--- /dev/null
+From 7ba75db79ce55a075f0741ff01b605a7ad49b258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 13:25:33 +0100
+Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ]
+
+The ACPI specification states that when executing AML_FATAL_OP,
+the OS should log the fatal error event and shutdown in a timely
+fashion.
+
+Windows complies with this requirement by immediatly entering a
+Bso_d, effectively aborting the execution of the AML bytecode in
+question.
+
+ACPICA however might continue with the AML bytecode execution
+should acpi_os_signal() simply return AE_OK. This will cause issues
+because ACPI BIOS implementations might assume that the Fatal()
+operator does not return.
+
+Fix this by aborting the AML bytecode execution in such a case
+by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a
+local variable because of its small size (12 bytes) and to ensure
+that acpi_os_signal() always receives valid information about the
+fatal ACPI BIOS error.
+
+Link: https://github.com/acpica/acpica/commit/d516c7758ba6
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++---------------------
+ 1 file changed, 18 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
+index c8d0d75fc4505..962929d4abbfc 100644
+--- a/drivers/acpi/acpica/exoparg3.c
++++ b/drivers/acpi/acpica/exoparg3.c
+@@ -10,6 +10,7 @@
+ #include <acpi/acpi.h>
+ #include "accommon.h"
+ #include "acinterp.h"
++#include <acpi/acoutput.h>
+ #include "acparser.h"
+ #include "amlcode.h"
+
+@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3")
+ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ {
+ union acpi_operand_object **operand = &walk_state->operands[0];
+- struct acpi_signal_fatal_info *fatal;
+- acpi_status status = AE_OK;
++ struct acpi_signal_fatal_info fatal;
+
+ ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R,
+ acpi_ps_get_opcode_name(walk_state->opcode));
+@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ switch (walk_state->opcode) {
+ case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */
+
+- ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+- "FatalOp: Type %X Code %X Arg %X "
+- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
+- (u32)operand[0]->integer.value,
+- (u32)operand[1]->integer.value,
+- (u32)operand[2]->integer.value));
+-
+- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info));
+- if (fatal) {
+- fatal->type = (u32) operand[0]->integer.value;
+- fatal->code = (u32) operand[1]->integer.value;
+- fatal->argument = (u32) operand[2]->integer.value;
+- }
++ fatal.type = (u32)operand[0]->integer.value;
++ fatal.code = (u32)operand[1]->integer.value;
++ fatal.argument = (u32)operand[2]->integer.value;
+
+- /* Always signal the OS! */
++ ACPI_BIOS_ERROR((AE_INFO,
++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n",
++ fatal.type, fatal.code, fatal.argument));
+
+- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal);
++ /* Always signal the OS! */
+
+- /* Might return while OS is shutting down, just continue */
++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal);
+
+- ACPI_FREE(fatal);
+- goto cleanup;
++ /*
++ * Might return while OS is shutting down, so abort the AML execution
++ * by returning an error.
++ */
++ return_ACPI_STATUS(AE_ERROR);
+
+ case AML_EXTERNAL_OP:
+ /*
+@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ * wrong if an external opcode ever gets here.
+ */
+ ACPI_ERROR((AE_INFO, "Executed External Op"));
+- status = AE_OK;
+- goto cleanup;
++
++ return_ACPI_STATUS(AE_OK);
+
+ default:
+
+ ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X",
+ walk_state->opcode));
+
+- status = AE_AML_BAD_OPCODE;
+- goto cleanup;
++ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
+ }
+-
+-cleanup:
+-
+- return_ACPI_STATUS(status);
+ }
+
+ /*******************************************************************************
+--
+2.51.0
+
--- /dev/null
+From 48873f584fa5d9d56ca6dee1f3cadf2ec0e1bb3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:05 +0100
+Subject: APEI/GHES: ensure that won't go past CPER allocated record
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ]
+
+The logic at ghes_new() prevents allocating too large records, by
+checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
+Yet, the allocation is done with the actual number of pages from the
+CPER bios table location, which can be smaller.
+
+Yet, a bad firmware could send data with a different size, which might
+be bigger than the allocated memory, causing an OOPS:
+
+ Unable to handle kernel paging request at virtual address fff00000f9b40000
+ Mem abort info:
+ ESR = 0x0000000096000007
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x07: level 3 translation fault
+ Data abort info:
+ ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+ swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
+ [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
+ Internal error: Oops: 0000000096000007 [#1] SMP
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
+ Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+ Workqueue: kacpi_notify acpi_os_execute_deferred
+ pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+ pc : hex_dump_to_buffer+0x30c/0x4a0
+ lr : hex_dump_to_buffer+0x328/0x4a0
+ sp : ffff800080e13880
+ x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
+ x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
+ x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
+ x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
+ x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
+ x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
+ x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
+ x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
+ x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
+ x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
+ Call trace:
+ hex_dump_to_buffer+0x30c/0x4a0 (P)
+ print_hex_dump+0xac/0x170
+ cper_estatus_print_section+0x90c/0x968
+ cper_estatus_print+0xf0/0x158
+ __ghes_print_estatus+0xa0/0x148
+ ghes_proc+0x1bc/0x220
+ ghes_notify_hed+0x5c/0xb8
+ notifier_call_chain+0x78/0x148
+ blocking_notifier_call_chain+0x4c/0x80
+ acpi_hed_notify+0x28/0x40
+ acpi_ev_notify_dispatch+0x50/0x80
+ acpi_os_execute_deferred+0x24/0x48
+ process_one_work+0x15c/0x3b0
+ worker_thread+0x2d0/0x400
+ kthread+0x148/0x228
+ ret_from_fork+0x10/0x20
+ Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
+ ---[ end trace 0000000000000000 ]---
+
+Prevent that by taking the actual allocated are into account when
+checking for CPER length.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 6 +++++-
+ include/acpi/ghes.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index bdb23ca251e23..28651f9e6d60f 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -28,6 +28,7 @@
+ #include <linux/timer.h>
+ #include <linux/cper.h>
+ #include <linux/platform_device.h>
++#include <linux/minmax.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+ #include <linux/vmalloc.h>
+@@ -262,6 +263,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
+ error_block_length = GHES_ESTATUS_MAX_SIZE;
+ }
+ ghes->estatus = kmalloc(error_block_length, GFP_KERNEL);
++ ghes->estatus_length = error_block_length;
+ if (!ghes->estatus) {
+ rc = -ENOMEM;
+ goto err_unmap_status_addr;
+@@ -333,13 +335,15 @@ static int __ghes_check_estatus(struct ghes *ghes,
+ struct acpi_hest_generic_status *estatus)
+ {
+ u32 len = cper_estatus_len(estatus);
++ u32 max_len = min(ghes->generic->error_block_length,
++ ghes->estatus_length);
+
+ if (len < sizeof(*estatus)) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n");
+ return -EIO;
+ }
+
+- if (len > ghes->generic->error_block_length) {
++ if (!len || len > max_len) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n");
+ return -EIO;
+ }
+diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
+index 292a5c40bd0c6..259ae345849f0 100644
+--- a/include/acpi/ghes.h
++++ b/include/acpi/ghes.h
+@@ -21,6 +21,7 @@ struct ghes {
+ struct acpi_hest_generic_v2 *generic_v2;
+ };
+ struct acpi_hest_generic_status *estatus;
++ unsigned int estatus_length;
+ unsigned long flags;
+ union {
+ struct list_head list;
+--
+2.51.0
+
--- /dev/null
+From 359cf09f70da4d0bfb61d8d2eb538b81541b850c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 10:56:33 +0100
+Subject: ARM: 9467/1: mm: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weissschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ]
+
+Restricted pointers ("%pK") were never meant to be used
+through printk(). They can acquire sleeping locks in atomic contexts.
+
+Switch to %px over the more secure %p as this usage is a debugging aid,
+gated behind CONFIG_DEBUG_VIRTUAL and used by WARN().
+
+Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/physaddr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c
+index cf75819e4c137..4ae327bf7aa29 100644
+--- a/arch/arm/mm/physaddr.c
++++ b/arch/arm/mm/physaddr.c
+@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x)
+ phys_addr_t __virt_to_phys(unsigned long x)
+ {
+ WARN(!__virt_addr_valid(x),
+- "virt_to_phys used for non-linear address: %pK (%pS)\n",
++ "virt_to_phys used for non-linear address: %px (%pS)\n",
+ (void *)x, (void *)x);
+
+ return __virt_to_phys_nodebug(x);
+--
+2.51.0
+
--- /dev/null
+From b2bcb49694adbfd2d205e834059814901422b4fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 17:24:48 +0800
+Subject: arm64: Add support for TSV110 Spectre-BHB mitigation
+
+From: Jinqian Yang <yangjinqian1@huawei.com>
+
+[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ]
+
+The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
+Buffer) attack, which can be exploited to leak information through
+branch prediction side channels. This commit adds the MIDR of TSV110
+to the list for software mitigation.
+
+Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
+Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/proton-pack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
+index 2773bf189a3f1..94db6dcc5c8a2 100644
+--- a/arch/arm64/kernel/proton-pack.c
++++ b/arch/arm64/kernel/proton-pack.c
+@@ -904,6 +904,7 @@ static u8 spectre_bhb_loop_affected(void)
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ {},
+ };
+ static const struct midr_range spectre_bhb_k24_list[] = {
+--
+2.51.0
+
--- /dev/null
+From 8abd89dec7755f6aa2e73ebc5024bdc7546c5215 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 21:27:21 +0000
+Subject: arm64: tegra: smaug: Add usb-role-switch support
+
+From: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+
+[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ]
+
+The USB2 port on Smaug is configured for OTG operation but lacked the
+required 'usb-role-switch' property, leading to a failed probe and a
+non-functioning USB port. Add the property along with setting the default
+role to host.
+
+Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+index bd78378248a68..0c2cf358dcc35 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+@@ -1687,6 +1687,8 @@ usb2-0 {
+ status = "okay";
+ vbus-supply = <&usbc_vbus>;
+ mode = "otg";
++ usb-role-switch;
++ role-switch-default-mode = "host";
+ };
+
+ usb3-0 {
+--
+2.51.0
+
--- /dev/null
+From eac3359fde76bdc0a653715fe59a574f1cfc342f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jan 2026 00:00:17 +0800
+Subject: ASoC: es8328: Add error unwind in resume
+
+From: Hsieh Hung-En <hungen3108@gmail.com>
+
+[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ]
+
+Handle failures in the resume path by unwinding previously enabled
+resources.
+
+If enabling regulators or syncing the regcache fails, disable regulators
+and unprepare the clock to avoid leaking resources and leaving the device
+in a partially resumed state.
+
+Signed-off-by: Hsieh Hung-En <hungen3108@gmail.com>
+Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index 60ad9f3683fe9..b169af20cd61c 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -750,17 +750,23 @@ static int es8328_resume(struct snd_soc_component *component)
+ es8328->supplies);
+ if (ret) {
+ dev_err(component->dev, "unable to enable regulators\n");
+- return ret;
++ goto err_clk;
+ }
+
+ regcache_mark_dirty(regmap);
+ ret = regcache_sync(regmap);
+ if (ret) {
+ dev_err(component->dev, "unable to sync regcache\n");
+- return ret;
++ goto err_regulators;
+ }
+
+ return 0;
++
++err_regulators:
++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies);
++err_clk:
++ clk_disable_unprepare(es8328->clk);
++ return ret;
+ }
+
+ static int es8328_component_probe(struct snd_soc_component *component)
+--
+2.51.0
+
--- /dev/null
+From 6705a07e69d5f66d42cc70f9cd0f83db37f4ccbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:08 +0100
+Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ]
+
+This bit is handled by a separate control.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 272932e200d87..ec214b06f5648 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18),
+
+
+ SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0),
+-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA),
++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX),
+
+ SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0),
+ SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA),
+--
+2.51.0
+
--- /dev/null
+From 15f54890982f9706c22e560ae89b31c9c2bb8e16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:10 +0100
+Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on
+ plug
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ]
+
+This usually means that a TRS plug with no microphone pin has been plugged
+into a TRRS socket. Cases where a user is plugging in a microphone while
+pressing a button will be handled via incoming interrupt after the user
+releases the button, so the microphone will still be detected once it
+becomes usable.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index ec214b06f5648..24e6d731942c5 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -67,6 +67,8 @@ struct wm8962_priv {
+ struct mutex dsp2_ena_lock;
+ u16 dsp2_ena;
+
++ int mic_status;
++
+ struct delayed_work mic_work;
+ struct snd_soc_jack *jack;
+
+@@ -3058,8 +3060,16 @@ static void wm8962_mic_work(struct work_struct *work)
+ if (reg & WM8962_MICSHORT_STS) {
+ status |= SND_JACK_BTN_0;
+ irq_pol |= WM8962_MICSCD_IRQ_POL;
++
++ /* Don't report a microphone if it's shorted right after
++ * plugging in, as this may be a TRS plug in a TRRS socket.
++ */
++ if (!(wm8962->mic_status & WM8962_MICDET_STS))
++ status = 0;
+ }
+
++ wm8962->mic_status = status;
++
+ snd_soc_jack_report(wm8962->jack, status,
+ SND_JACK_MICROPHONE | SND_JACK_BTN_0);
+
+--
+2.51.0
+
--- /dev/null
+From 75437aef2b2080ffae39ad81892d9af001fc15bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 20:49:30 +0100
+Subject: audit: add fchmodat2() to change attributes class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ]
+
+fchmodat2(), introduced in version 6.6 is currently not in the change
+attribute class of audit. Calling fchmodat2() to change a file
+attribute in the same fashion than chmod() or fchmodat() will bypass
+audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds fchmodat2() to the change attributes class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_change_attr.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h
+index 331670807cf01..6c311d4d37f4e 100644
+--- a/include/asm-generic/audit_change_attr.h
++++ b/include/asm-generic/audit_change_attr.h
+@@ -20,6 +20,9 @@ __NR_fremovexattr,
+ __NR_fchownat,
+ __NR_fchmodat,
+ #endif
++#ifdef __NR_fchmodat2
++__NR_fchmodat2,
++#endif
+ #ifdef __NR_chown32
+ __NR_chown32,
+ __NR_fchown32,
+--
+2.51.0
+
--- /dev/null
+From 0292a3aa978968ede70a2ce5ed5086fca81dcfbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 09:39:24 +0100
+Subject: audit: add missing syscalls to read class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ]
+
+The "at" variant of getxattr() and listxattr() are missing from the
+audit read class. Calling getxattrat() or listxattrat() on a file to
+read its extended attributes will bypass audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds missing syscalls to the audit read class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_read.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h
+index 7bb7b5a83ae2e..fb9991f53fb6f 100644
+--- a/include/asm-generic/audit_read.h
++++ b/include/asm-generic/audit_read.h
+@@ -4,9 +4,15 @@ __NR_readlink,
+ #endif
+ __NR_quotactl,
+ __NR_listxattr,
++#ifdef __NR_listxattrat
++__NR_listxattrat,
++#endif
+ __NR_llistxattr,
+ __NR_flistxattr,
+ __NR_getxattr,
++#ifdef __NR_getxattrat
++__NR_getxattrat,
++#endif
+ __NR_lgetxattr,
+ __NR_fgetxattr,
+ #ifdef __NR_readlinkat
+--
+2.51.0
+
--- /dev/null
+From 011794bbd615a622fa9fa4733f76641c18c2be7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 15:29:50 +0100
+Subject: binder: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log. Since commit ad67b74d2469 ("printk: hash
+addresses printed with %p") the regular %p has been improved to avoid
+this issue. Furthermore, restricted pointers ("%pK") were never meant
+to be used through printk(). They can still unintentionally leak raw
+pointers or acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+There are still a few users of %pK left, but these use it through
+seq_file, for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Carlos Llamas <cmllamas@google.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binder.c | 2 +-
+ drivers/android/binder_alloc.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index f75bbe7a4273c..9577193e72e64 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4355,7 +4355,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ }
+ }
+ binder_debug(BINDER_DEBUG_DEAD_BINDER,
+- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+ proc->pid, thread->pid, (u64)cookie,
+ death);
+ if (death == NULL) {
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index b655bc3956c79..bacccfd0fb74c 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc,
+ new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: add free buffer, size %zd, at %pK\n",
++ "%d: add free buffer, size %zd, at %p\n",
+ alloc->pid, new_buffer_size, new_buffer);
+
+ while (*p) {
+@@ -482,7 +482,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
+ }
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
+ alloc->pid, size, buffer, buffer_size);
+
+ has_page_addr = (void __user *)
+@@ -651,7 +651,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
+ ALIGN(buffer->extra_buffers_size, sizeof(void *));
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
++ "%d: binder_free_buf %p size %zd buffer_size %zd\n",
+ alloc->pid, buffer, size, buffer_size);
+
+ BUG_ON(buffer->free);
+--
+2.51.0
+
--- /dev/null
+From aa9b3ef112ae61e50c3754a5d9890cf2d356a7d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 16:05:22 +0800
+Subject: blk-mq-debugfs: add missing debugfs_mutex in
+ blk_mq_debugfs_register_hctxs()
+
+From: Yu Kuai <yukuai@fnnas.com>
+
+[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ]
+
+In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while
+creating debugfs entries for hctxs. Hence add debugfs_mutex there,
+it's safe because queue is not frozen.
+
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index 212e1e7954696..4179b9ccfa9e8 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -905,8 +905,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ int i;
+
++ mutex_lock(&q->debugfs_mutex);
+ queue_for_each_hw_ctx(q, hctx, i)
+ blk_mq_debugfs_register_hctx(q, hctx);
++ mutex_unlock(&q->debugfs_mutex);
+ }
+
+ void blk_mq_debugfs_unregister_hctxs(struct request_queue *q)
+--
+2.51.0
+
--- /dev/null
+From 768df0cddc9e00b0fae300992456b137b72a39a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:13:04 +0100
+Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU
+
+From: Jacopo Scannella <code@charlie.cat>
+
+[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ]
+
+Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek
+RTL8761BU Bluetooth adapter.
+
+Reference:
+https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth
+
+Signed-off-by: Jacopo Scannella <code@charlie.cat>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c5e4f675270c2..3010044f0810b 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -475,6 +475,7 @@ static const struct usb_device_id blacklist_table[] = {
+
+ /* Additional Realtek 8723BU Bluetooth devices */
+ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK },
+
+ /* Additional Realtek 8723DE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
+--
+2.51.0
+
--- /dev/null
+From b56f646246c444fb493bd5bfedb66ee853c2a0f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:09 +0100
+Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ]
+
+hci_conn_enter_active_mode() uses queue_delayed_work() with the
+intention that the work will run after the given timeout. However,
+queue_delayed_work() does nothing if the work is already queued, so
+depending on the link policy we may end up putting the connection
+into idle mode every hdev->idle_timeout ms.
+
+Use mod_delayed_work() instead so the work is queued if not already
+queued, and the timeout is updated otherwise.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 52e512f41da3c..eb70a4f44c7d1 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1553,8 +1553,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
+
+ timer:
+ if (hdev->idle_timeout > 0)
+- queue_delayed_work(hdev->workqueue, &conn->idle_work,
+- msecs_to_jiffies(hdev->idle_timeout));
++ mod_delayed_work(hdev->workqueue, &conn->idle_work,
++ msecs_to_jiffies(hdev->idle_timeout));
+ }
+
+ /* Drop all connection on the device */
+--
+2.51.0
+
--- /dev/null
+From b03b2f64602e2c37a1609ce81f45ac12e5d77b5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 18:02:19 +0000
+Subject: bpf: verifier improvement in 32bit shift sign extension pattern
+
+From: Cupertino Miranda <cupertino.miranda@oracle.com>
+
+[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ]
+
+This patch improves the verifier to correctly compute bounds for
+sign extension compiler pattern composed of left shift by 32bits
+followed by a sign right shift by 32bits. Pattern in the verifier was
+limitted to positive value bounds and would reset bound computation for
+negative values. New code allows both positive and negative values for
+sign extension without compromising bound computation and verifier to
+pass.
+
+This change is required by GCC which generate such pattern, and was
+detected in the context of systemd, as described in the following GCC
+bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731
+
+Three new tests were added in verifier_subreg.c.
+
+Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com>
+Signed-off-by: Andrew Pinski <andrew.pinski@oss.qualcomm.com>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Cc: David Faust <david.faust@oracle.com>
+Cc: Jose Marchesi <jose.marchesi@oracle.com>
+Cc: Elena Zannoni <elena.zannoni@oracle.com>
+Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 75251870430e4..150aa47b4a9ad 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6870,21 +6870,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg,
+ u64 umin_val, u64 umax_val)
+ {
+ /* Special case <<32 because it is a common compiler pattern to sign
+- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are
+- * positive we know this shift will also be positive so we can track
+- * bounds correctly. Otherwise we lose all sign bit information except
+- * what we can pick up from var_off. Perhaps we can generalize this
+- * later to shifts of any length.
++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct
++ * because s32 bounds don't flip sign when shifting to the left by
++ * 32bits.
+ */
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0)
++ if (umin_val == 32 && umax_val == 32) {
+ dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32;
+- else
+- dst_reg->smax_value = S64_MAX;
+-
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0)
+ dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32;
+- else
++ } else {
++ dst_reg->smax_value = S64_MAX;
+ dst_reg->smin_value = S64_MIN;
++ }
+
+ /* If we might shift our top bit out, then we know nothing */
+ if (dst_reg->umax_value > 1ULL << (63 - umax_val)) {
+--
+2.51.0
+
--- /dev/null
+From 0cb7154a19d2dac7b70d58d757540e55ff2c02bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 14:46:28 -0500
+Subject: clk: microchip: core: correct return value on *_get_parent()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ]
+
+roclk_get_parent() and sclk_get_parent() has the possibility of
+returning -EINVAL, however the framework expects this call to always
+succeed since the return value is unsigned.
+
+If there is no parent map defined, then the current value programmed in
+the hardware is used. Let's use that same value in the case where
+-EINVAL is currently returned.
+
+This index is only used by clk_core_get_parent_by_index(), and it
+validates that it doesn't overflow the number of available parents.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/microchip/clk-core.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c
+index 1b4f023cdc8be..71fbaf8318f22 100644
+--- a/drivers/clk/microchip/clk-core.c
++++ b/drivers/clk/microchip/clk-core.c
+@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK;
+
+- if (!refo->parent_map)
+- return v;
+-
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (refo->parent_map[i] == v)
+- return i;
++ if (refo->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (refo->parent_map[i] == v)
++ return i;
++ }
+
+- return -EINVAL;
++ return v;
+ }
+
+ static unsigned long roclk_calc_rate(unsigned long parent_rate,
+@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK;
+
+- if (!sclk->parent_map)
+- return v;
++ if (sclk->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (sclk->parent_map[i] == v)
++ return i;
++ }
+
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (sclk->parent_map[i] == v)
+- return i;
+- return -EINVAL;
++ return v;
+ }
+
+ static int sclk_set_parent(struct clk_hw *hw, u8 index)
+--
+2.51.0
+
--- /dev/null
+From 93fb1731d96d475771e342b33f28bdb7a472186b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 23:13:41 +0100
+Subject: clocksource/drivers/sh_tmu: Always leave device running after probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ]
+
+The TMU device can be used as both a clocksource and a clockevent
+provider. The driver tries to be smart and power itself on and off, as
+well as enabling and disabling its clock when it's not in operation.
+This behavior is slightly altered if the TMU is used as an early
+platform device in which case the device is left powered on after probe,
+but the clock is still enabled and disabled at runtime.
+
+This has worked for a long time, but recent improvements in PREEMPT_RT
+and PROVE_LOCKING have highlighted an issue. As the TMU registers itself
+as a clockevent provider, clockevents_register_device(), it needs to use
+raw spinlocks internally as this is the context of which the clockevent
+framework interacts with the TMU driver. However in the context of
+holding a raw spinlock the TMU driver can't really manage its power
+state or clock with calls to pm_runtime_*() and clk_*() as these calls
+end up in other platform drivers using regular spinlocks to control
+power and clocks.
+
+This mix of spinlock contexts trips a lockdep warning.
+
+ =============================
+ [ BUG: Invalid wait context ]
+ 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted
+ -----------------------------
+ swapper/0/0 is trying to lock:
+ ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88
+ other info that might help us debug this:
+ context-{5:5}
+ 1 lock held by swapper/0/0:
+ ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0
+ #0: ffff8000817ec298
+ ccree e6601000.crypto: ARM ccree device initialized
+ (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT
+ Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
+ Call trace:
+ show_stack+0x14/0x1c (C)
+ dump_stack_lvl+0x6c/0x90
+ dump_stack+0x14/0x1c
+ __lock_acquire+0x904/0x1584
+ lock_acquire+0x220/0x34c
+ _raw_spin_lock_irqsave+0x58/0x80
+ __pm_runtime_resume+0x38/0x88
+ sh_tmu_clock_event_set_oneshot+0x84/0xd4
+ clockevents_switch_state+0xfc/0x13c
+ tick_broadcast_set_event+0x30/0xa4
+ __tick_broadcast_oneshot_control+0x1e0/0x3a8
+ tick_broadcast_oneshot_control+0x30/0x40
+ cpuidle_enter_state+0x40c/0x680
+ cpuidle_enter+0x30/0x40
+ do_idle+0x1f4/0x280
+ cpu_startup_entry+0x34/0x40
+ kernel_init+0x0/0x130
+ do_one_initcall+0x0/0x230
+ __primary_switched+0x88/0x90
+
+For non-PREEMPT_RT builds this is not really an issue, but for
+PREEMPT_RT builds where normal spinlocks can sleep this might be an
+issue. Be cautious and always leave the power and clock running after
+probe.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/sh_tmu.c | 18 ------------------
+ 1 file changed, 18 deletions(-)
+
+diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
+index d41df9ba3725d..0e429d28cdd4f 100644
+--- a/drivers/clocksource/sh_tmu.c
++++ b/drivers/clocksource/sh_tmu.c
+@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start)
+
+ static int __sh_tmu_enable(struct sh_tmu_channel *ch)
+ {
+- int ret;
+-
+- /* enable clock */
+- ret = clk_enable(ch->tmu->clk);
+- if (ret) {
+- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n",
+- ch->index);
+- return ret;
+- }
+-
+ /* make sure channel is disabled */
+ sh_tmu_start_stop_ch(ch, 0);
+
+@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch)
+ if (ch->enable_count++ > 0)
+ return 0;
+
+- pm_runtime_get_sync(&ch->tmu->pdev->dev);
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, true);
+
+ return __sh_tmu_enable(ch);
+@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch)
+
+ /* disable interrupts in TMU block */
+ sh_tmu_write(ch, TCR, TCR_TPSC_CLK4);
+-
+- /* stop clock */
+- clk_disable(ch->tmu->clk);
+ }
+
+ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+ __sh_tmu_disable(ch);
+
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, false);
+- pm_runtime_put(&ch->tmu->pdev->dev);
+ }
+
+ static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta,
+@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
+ goto err_clk_unprepare;
+
+ tmu->rate = clk_get_rate(tmu->clk) / 4;
+- clk_disable(tmu->clk);
+
+ /* Map the memory resource. */
+ ret = sh_tmu_map_memory(tmu);
+@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev)
+ out:
+ if (tmu->has_clockevent || tmu->has_clocksource)
+ pm_runtime_irq_safe(&pdev->dev);
+- else
+- pm_runtime_idle(&pdev->dev);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 82c5487f266b2dabe16541bb37312b5816b300b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 12:17:23 +0100
+Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig
+ dependency on OF
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ]
+
+This driver accesses the of_aliases global variable declared in
+linux/of.h and defined in drivers/base/of.c. It requires OF support or
+will cause a link failure. Add the missing Kconfig dependency.
+
+Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index a0c6e88bebe08..6d46d44921a61 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -240,6 +240,7 @@ config KEYSTONE_TIMER
+
+ config INTEGRATOR_AP_TIMER
+ bool "Integrator-AP timer driver" if COMPILE_TEST
++ depends on OF
+ select CLKSRC_MMIO
+ help
+ Enables support for the Integrator-AP timer.
+--
+2.51.0
+
--- /dev/null
+From 5b7a12aafedc04b545d0412b5c7e19ab6a10341d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 20:03:50 +0800
+Subject: dm: remove fake timeout to avoid leak request
+
+From: Ding Hui <dinghui@sangfor.com.cn>
+
+[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ]
+
+Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
+blk_mq_complete_request"), drivers are responsible for calling
+blk_should_fake_timeout() at appropriate code paths and opportunities.
+
+However, the dm driver does not implement its own timeout handler and
+relies on the timeout handling of its slave devices.
+
+If an io-timeout-fail error is injected to a dm device, the request
+will be leaked and never completed, causing tasks to hang indefinitely.
+
+Reproduce:
+1. prepare dm which has iscsi slave device
+2. inject io-timeout-fail to dm
+ echo 1 >/sys/class/block/dm-0/io-timeout-fail
+ echo 100 >/sys/kernel/debug/fail_io_timeout/probability
+ echo 10 >/sys/kernel/debug/fail_io_timeout/times
+3. read/write dm
+4. iscsiadm -m node -u
+
+Result: hang task like below
+[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
+[ 862.244133] Tainted: G E 6.19.0-rc1+ #51
+[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000
+[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
+[ 862.245264] Call Trace:
+[ 862.245587] <TASK>
+[ 862.245814] __schedule+0x810/0x15c0
+[ 862.246557] schedule+0x69/0x180
+[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120
+[ 862.247688] elevator_change+0x16d/0x460
+[ 862.247893] elevator_set_none+0x87/0xf0
+[ 862.248798] blk_unregister_queue+0x12e/0x2a0
+[ 862.248995] __del_gendisk+0x231/0x7e0
+[ 862.250143] del_gendisk+0x12f/0x1d0
+[ 862.250339] sd_remove+0x85/0x130 [sd_mod]
+[ 862.250650] device_release_driver_internal+0x36d/0x530
+[ 862.250849] bus_remove_device+0x1dd/0x3f0
+[ 862.251042] device_del+0x38a/0x930
+[ 862.252095] __scsi_remove_device+0x293/0x360
+[ 862.252291] scsi_remove_target+0x486/0x760
+[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
+[ 862.252886] process_one_work+0x633/0xe50
+[ 862.253101] worker_thread+0x6df/0xf10
+[ 862.253647] kthread+0x36d/0x720
+[ 862.254533] ret_from_fork+0x2a6/0x470
+[ 862.255852] ret_from_fork_asm+0x1a/0x30
+[ 862.256037] </TASK>
+
+Remove the blk_should_fake_timeout() check from dm, as dm has no
+native timeout handling and should not attempt to fake timeouts.
+
+Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index a6ea77432e34c..29a09452abc4a 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -281,8 +281,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error)
+ struct dm_rq_target_io *tio = tio_from_request(rq);
+
+ tio->error = error;
+- if (likely(!blk_should_fake_timeout(rq->q)))
+- blk_mq_complete_request(rq);
++ blk_mq_complete_request(rq);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 335329fb545e58abf534524faca01b206fe4bc42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 08:22:26 -0500
+Subject: drm: Account property blob allocations to memcg
+
+From: Xiao Kan <814091656@qq.com>
+
+[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ]
+
+DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
+property blobs backed by kernel memory.
+
+Currently, the blob data allocation is not accounted to the allocating
+process's memory cgroup, allowing unprivileged users to trigger unbounded
+kernel memory consumption and potentially cause system-wide OOM.
+
+Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
+is properly charged to the caller's memcg. This ensures existing cgroup
+memory limits apply and prevents uncontrolled kernel memory growth without
+introducing additional policy or per-file limits.
+
+Signed-off-by: Xiao Kan <814091656@qq.com>
+Signed-off-by: Xiao Kan <xiao.kan@samsung.com>
+Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
+index 6ee04803c3620..92ecda176c7bf 100644
+--- a/drivers/gpu/drm/drm_property.c
++++ b/drivers/gpu/drm/drm_property.c
+@@ -564,7 +564,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
+ if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
+ return ERR_PTR(-EINVAL);
+
+- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT);
+ if (!blob)
+ return ERR_PTR(-ENOMEM);
+
+--
+2.51.0
+
--- /dev/null
+From b3a84160ae97bb9d7d8e1e4e3a4d5f6902daf042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 14:47:01 +0800
+Subject: drm/amd/display: Avoid updating surface with the same surface under
+ MPO
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ]
+
+[Why & How]
+Although it's dummy updates of surface update for committing stream
+updates, we should not have dummy_updates[j].surface all indicating
+to the same surface under multiple surfaces case. Otherwise,
+copy_surface_update_to_plane() in update_planes_and_stream_state()
+will update to the same surface only.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 0aa681939b7e7..c22783b882067 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -7958,7 +7958,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
+ * To fix this, DC should permit updating only stream properties.
+ */
+ for (j = 0; j < status->plane_count; j++)
+- dummy_updates[j].surface = status->plane_states[0];
++ dummy_updates[j].surface = status->plane_states[j];
+
+
+ mutex_lock(&dm->dc_lock);
+--
+2.51.0
+
--- /dev/null
+From 8e129e94befbdd3c4c682171ba6aaed1535b967f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:24:01 +0000
+Subject: drm/amdgpu: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for amdgpu.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
+index ece892b16d9a7..47d18f129cac8 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
+@@ -3426,6 +3426,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((adev->pdev->device == 0x666f) &&
++ (adev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (adev->asic_type == CHIP_OLAND) {
+ if ((adev->pdev->revision == 0xC7) ||
+ (adev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From 5ea02807d017141613cd24dfaa5d4e5fe8d5d9a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:52 +0200
+Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state
+ callback
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ]
+
+After several commits, the slab memory increases. Some drm_crtc_commit
+objects are not freed. The atomic_destroy_state callback only put the
+framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
+to put all the objects that are no longer needed.
+
+It has been seen after hours of usage of a graphics application or using
+kmemleak:
+
+unreferenced object 0xc63a6580 (size 64):
+ comm "egt_basic", pid 171, jiffies 4294940784
+ hex dump (first 32 bytes):
+ 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.
+ 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.
+ backtrace (crc c25aa925):
+ kmemleak_alloc+0x34/0x3c
+ __kmalloc_cache_noprof+0x150/0x1a4
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 40800ec5700a8..9a33e1d83834f 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -929,8 +929,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
+ state->dscrs[i]->self);
+ }
+
+- if (s->fb)
+- drm_framebuffer_put(s->fb);
++ __drm_atomic_helper_plane_destroy_state(s);
+
+ kfree(state);
+ }
+--
+2.51.0
+
--- /dev/null
+From 9e408b978aa1051658acd34e099c099c94fa1461 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:53 +0200
+Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ]
+
+The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
+the atmel_hlcdc_plane state structure without properly duplicating the
+drm_plane_state. In particular, state->commit remained set to the old
+state commit, which can lead to a use-after-free in the next
+drm_atomic_commit() call.
+
+Fix this by calling
+__drm_atomic_helper_duplicate_plane_state(), which correctly clones
+the base drm_plane_state (including the ->commit pointer).
+
+It has been seen when closing and re-opening the device node while
+another DRM client (e.g. fbdev) is still attached:
+
+=============================================================================
+BUG kmalloc-64 (Not tainted): Poison overwritten
+-----------------------------------------------------------------------------
+
+0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b
+FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b
+Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0
+pid=29
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_framebuffer_remove+0x4cc/0x5a8
+ drm_mode_rmfb_work_fn+0x6c/0x80
+ process_one_work+0x12c/0x2cc
+ worker_thread+0x2a8/0x400
+ kthread+0xc0/0xdc
+ ret_from_fork+0x14/0x28
+Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0
+pid=169
+ drm_atomic_helper_commit_hw_done+0x100/0x150
+ drm_atomic_helper_commit_tail+0x64/0x8c
+ commit_tail+0x168/0x18c
+ drm_atomic_helper_commit+0x138/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0
+flags=0x200(workingset|zone=0)
+Object 0xc611b340 @offset=832 fp=0xc611b7c0
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 9a33e1d83834f..49eaaf4031f55 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -910,8 +910,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
+ return NULL;
+ }
+
+- if (copy->base.fb)
+- drm_framebuffer_get(copy->base.fb);
++ __drm_atomic_helper_plane_duplicate_state(p, ©->base);
+
+ return ©->base;
+ }
+--
+2.51.0
+
--- /dev/null
+From 996a4690b53759f76be769196cbc6c84bf384918 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:26:00 +0000
+Subject: drm/radeon: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for radeon.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index a84df439deb2f..88ec2550ef672 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2972,6 +2972,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((rdev->pdev->device == 0x666f) &&
++ (rdev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (rdev->family == CHIP_OLAND) {
+ if ((rdev->pdev->revision == 0xC7) ||
+ (rdev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From b8406ba30a05f87e85b6b473af12346eae5acfb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:06 +0100
+Subject: EFI/CPER: don't dump the entire memory region
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ]
+
+The current logic at cper_print_fw_err() doesn't check if the
+error record length is big enough to handle offset. On a bad firmware,
+if the ofset is above the actual record, length -= offset will
+underflow, making it dump the entire memory.
+
+The end result can be:
+
+ - the logic taking a lot of time dumping large regions of memory;
+ - data disclosure due to the memory dumps;
+ - an OOPS, if it tries to dump an unmapped memory region.
+
+Fix it by checking if the section length is too small before doing
+a hex dump.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 8e24c36d7b633..2418401b2d816 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -524,6 +524,11 @@ static void cper_print_fw_err(const char *pfx,
+ } else {
+ offset = sizeof(*fw_err);
+ }
++ if (offset > length) {
++ printk("%s""error section length is too small: offset=%d, length=%d\n",
++ pfx, offset, length);
++ return;
++ }
+
+ buf += offset;
+ length -= offset;
+--
+2.51.0
+
--- /dev/null
+From 480ef95761c6220b2085ae17a4ab6cf47614c059 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:04 +0100
+Subject: EFI/CPER: don't go past the ARM processor CPER record buffer
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ]
+
+There's a logic inside GHES/CPER to detect if the section_length
+is too small, but it doesn't detect if it is too big.
+
+Currently, if the firmware receives an ARM processor CPER record
+stating that a section length is big, kernel will blindly trust
+section_length, producing a very long dump. For instance, a 67
+bytes record with ERR_INFO_NUM set 46198 and section length
+set to 854918320 would dump a lot of data going a way past the
+firmware memory-mapped area.
+
+Fix it by adding a logic to prevent it to go past the buffer
+if ERR_INFO_NUM is too big, making it report instead:
+
+ [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+ [Hardware Error]: event severity: recoverable
+ [Hardware Error]: Error 0, type: recoverable
+ [Hardware Error]: section_type: ARM processor error
+ [Hardware Error]: MIDR: 0xff304b2f8476870a
+ [Hardware Error]: section length: 854918320, CPER size: 67
+ [Hardware Error]: section length is too big
+ [Hardware Error]: firmware-generated error record is incorrect
+ [Hardware Error]: ERR_INFO_NUM is 46198
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject and changelog tweaks ]
+Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper-arm.c | 12 ++++++++----
+ drivers/firmware/efi/cper.c | 3 ++-
+ include/linux/cper.h | 3 ++-
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
+index ea43589944ba5..26a12f8076359 100644
+--- a/drivers/firmware/efi/cper-arm.c
++++ b/drivers/firmware/efi/cper-arm.c
+@@ -227,7 +227,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
+ }
+
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc)
++ const struct cper_sec_proc_arm *proc,
++ u32 length)
+ {
+ int i, len, max_ctx_type;
+ struct cper_arm_err_info *err_info;
+@@ -239,9 +240,12 @@ void cper_print_proc_arm(const char *pfx,
+
+ len = proc->section_length - (sizeof(*proc) +
+ proc->err_info_num * (sizeof(*err_info)));
+- if (len < 0) {
+- printk("%ssection length: %d\n", pfx, proc->section_length);
+- printk("%ssection length is too small\n", pfx);
++
++ if (len < 0 || proc->section_length > length) {
++ printk("%ssection length: %d, CPER size: %d\n",
++ pfx, proc->section_length, length);
++ printk("%ssection length is too %s\n", pfx,
++ (len < 0) ? "small" : "big");
+ printk("%sfirmware-generated error record is incorrect\n", pfx);
+ printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num);
+ return;
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 2418401b2d816..2a51a072e6700 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -609,7 +609,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata
+
+ printk("%ssection_type: ARM processor error\n", newpfx);
+ if (gdata->error_data_length >= sizeof(*arm_err))
+- cper_print_proc_arm(newpfx, arm_err);
++ cper_print_proc_arm(newpfx, arm_err,
++ gdata->error_data_length);
+ else
+ goto err_section_too_small;
+ #endif
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index a31e22cc839eb..b3079f687c5c6 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -567,7 +567,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *,
+ const char *cper_mem_err_unpack(struct trace_seq *,
+ struct cper_mem_err_compact *);
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc);
++ const struct cper_sec_proc_arm *proc,
++ u32 length);
+ void cper_print_proc_ia(const char *pfx,
+ const struct cper_sec_proc_ia *proc);
+
+--
+2.51.0
+
--- /dev/null
+From ec71318072fd03adea95270ded12e9f54fa7f90d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 13:11:24 +0100
+Subject: fix it87_wdt early reboot by reporting running timer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ]
+
+Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87
+wdt enabled by the firmware and a broken BIOS option that does not
+allow to change the time or turn it off. As this makes installing
+Linux rather difficult, change the it87_wdt to report it running to
+the watchdog core.
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/it87_wdt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
+index da9e24e4a8b60..1d41b9fdcedc4 100644
+--- a/drivers/watchdog/it87_wdt.c
++++ b/drivers/watchdog/it87_wdt.c
+@@ -191,6 +191,12 @@ static void _wdt_update_timeout(unsigned int t)
+ superio_outb(t >> 8, WDTVALMSB);
+ }
+
++/* Internal function, should be called after superio_select(GPIO) */
++static bool _wdt_running(void)
++{
++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB));
++}
++
+ static int wdt_update_timeout(unsigned int t)
+ {
+ int ret;
+@@ -373,6 +379,12 @@ static int __init it87_wdt_init(void)
+ }
+ }
+
++ /* wdt already left running by firmware? */
++ if (_wdt_running()) {
++ pr_info("Left running by firmware.\n");
++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status);
++ }
++
+ superio_exit();
+
+ if (timeout < 1 || timeout > max_units * 60) {
+--
+2.51.0
+
--- /dev/null
+From 3b7878f2590b8c51f29774ddd8aadfad3d3bf7c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:26:26 +0800
+Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ]
+
+Use module_platform_driver() to replace module_platform_driver_probe().
+The former utilizes platform_driver_register(), which allows the driver to
+defer probing when it doesn't acquire the necessary resources due to probe
+order. In contrast, the latter uses __platform_driver_probe(), which
+includes the comment "Note that this is incompatible with deferred
+probing." Since our SGPIO driver requires access to the clock resource, the
+former is more suitable.
+
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed-sgpio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
+index 64e54f8c30d2d..2ac1140725927 100644
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -474,7 +474,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = {
+
+ MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table);
+
+-static int __init aspeed_sgpio_probe(struct platform_device *pdev)
++static int aspeed_sgpio_probe(struct platform_device *pdev)
+ {
+ struct aspeed_sgpio *gpio;
+ u32 nr_gpios, sgpio_freq, sgpio_clk_div;
+@@ -562,12 +562,13 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ }
+
+ static struct platform_driver aspeed_sgpio_driver = {
++ .probe = aspeed_sgpio_probe,
+ .driver = {
+ .name = KBUILD_MODNAME,
+ .of_match_table = aspeed_sgpio_of_table,
+ },
+ };
+
+-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe);
++module_platform_driver(aspeed_sgpio_driver);
+ MODULE_DESCRIPTION("Aspeed Serial GPIO Driver");
+ MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From d9ec66459d3a92063e0fb1b4079d941ed187ee03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Dec 2025 19:58:22 -0800
+Subject: hfsplus: fix volume corruption issue for generic/498
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ]
+
+The xfstests' test-case generic/498 leaves HFS+ volume
+in corrupted state:
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
+(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details)
+
+Ran: generic/498
+Failures: generic/498
+Failed 1 of 1 tests
+
+sudo fsck.hfsplus -d /dev/loop51
+** /dev/loop51
+Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+Executing fsck_hfs (version 540.1-Linux).
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+Invalid leaf record count
+(It should be 16 instead of 2)
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
+CBTStat = 0x8000 CatStat = 0x00000000
+** Repairing volume.
+** Rechecking volume.
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled was repaired successfully.
+
+The generic/498 test executes such steps on final phase:
+
+mkdir $SCRATCH_MNT/A
+mkdir $SCRATCH_MNT/B
+mkdir $SCRATCH_MNT/A/C
+touch $SCRATCH_MNT/B/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo
+
+ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A
+
+"Simulate a power failure and mount the filesystem
+to check that what we explicitly fsync'ed exists."
+
+_flakey_drop_and_remount
+
+The FSCK tool complains about "Invalid leaf record count".
+HFS+ b-tree header contains leaf_count field is updated
+by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert()
+is involved into hard link creation process. However,
+modified in-core leaf_count field is stored into HFS+
+b-tree header by hfs_btree_write() method. But,
+unfortunately, hfs_btree_write() hasn't been called
+by hfsplus_cat_write_inode() and hfsplus_file_fsync()
+stores not fully consistent state of the Catalog File's
+b-tree.
+
+This patch adds calling hfs_btree_write() method in
+the hfsplus_cat_write_inode() with the goal of
+storing consistent state of Catalog File's b-tree.
+Finally, it makes FSCK tool happy.
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 33s ... 31s
+Ran: generic/498
+Passed all 1 tests
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/inode.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 0ba324ee7dffb..57123b206877c 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -587,6 +587,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ int hfsplus_cat_write_inode(struct inode *inode)
+ {
+ struct inode *main_inode = inode;
++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree;
+ struct hfs_find_data fd;
+ hfsplus_cat_entry entry;
+ int res = 0;
+@@ -597,7 +598,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ if (!main_inode->i_nlink)
+ return 0;
+
+- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd))
++ if (hfs_find_init(tree, &fd))
+ /* panic? */
+ return -EIO;
+
+@@ -662,5 +663,14 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags);
+ out:
+ hfs_find_exit(&fd);
++
++ if (!res) {
++ res = hfs_btree_write(tree);
++ if (res) {
++ pr_err("b-tree write err: %d, ino %lu\n",
++ res, inode->i_ino);
++ }
++ }
++
+ return res;
+ }
+--
+2.51.0
+
--- /dev/null
+From f8d157caeb60fea2b8a43bdfadf2baae4b9c0cae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 18:39:33 +0900
+Subject: hfsplus: pretend special inodes as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index 9f8945042faa8..ff9998be089a8 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode)
+ return -EIO;
+ }
+
++ /*
++ * Assign a dummy file type, for may_open() requires that
++ * an inode has a valid file type.
++ */
++ inode->i_mode = S_IFREG;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From db55041546804d137456cebc20a643183ef46bee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 09:57:05 +0100
+Subject: HID: multitouch: add eGalaxTouch EXC3188 support
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ]
+
+Add support for the for the EXC3188 touchscreen from eGalaxy.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 174090489072d..4b07b8be5c43e 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -395,6 +395,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
+
+ #define USB_VENDOR_ID_EDIFIER 0x2d99
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 1f1e4a383a85a..227cf3f6ca227 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1901,6 +1901,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
++ { .driver_data = MT_CLS_EGALAX_SERIAL,
++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) },
+ { .driver_data = MT_CLS_EGALAX,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
+--
+2.51.0
+
--- /dev/null
+From b3ae0d58a0db4cfe1d9a38864db4bc6e8b971ec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:44 +0100
+Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ]
+
+The unpacked union within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value'
+ is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)'
+ and is usually due to 'struct hv_kvp_exchg_msg_value' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 361 | union {
+ | ^
+
+With the recent changes to compile-test the UAPI headers in more cases,
+this warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warning.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/hyperv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h
+index 6135d92e0d47b..a9f05c61b37e7 100644
+--- a/include/uapi/linux/hyperv.h
++++ b/include/uapi/linux/hyperv.h
+@@ -351,7 +351,7 @@ struct hv_kvp_exchg_msg_value {
+ __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE];
+ __u32 value_u32;
+ __u64 value_u64;
+- };
++ } __attribute__((packed));
+ } __attribute__((packed));
+
+ struct hv_kvp_msg_enumerate {
+--
+2.51.0
+
--- /dev/null
+From f18f2853abeaf0760d10483463a07e5b415651c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:38 +0100
+Subject: iio: magnetometer: Remove IRQF_ONESHOT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+The force-threading functionality is required on PREEMPT_RT because the
+handler is using locks with can sleep on PREEMPT_RT.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index fd3a6cd16bcf1..a248a8270cb1d 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -511,7 +511,7 @@ static int ak8975_setup_irq(struct ak8975_data *data)
+ irq = gpiod_to_irq(data->eoc_gpiod);
+
+ rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ dev_name(&client->dev), data);
+ if (rc < 0) {
+ dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc);
+--
+2.51.0
+
--- /dev/null
+From 50f0e861b98f0879f65cfa6cfbaf7b68b994af80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 15:54:06 +0100
+Subject: include: uapi: netfilter_bridge.h: Cover for musl libc
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ]
+
+Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
+zero. To avoid struct redefinition errors, user space is therefore
+supposed to include netinet/if_ether.h before (or instead of)
+linux/if_ether.h. To relieve them from this burden, include the libc
+header here if not building for kernel space.
+
+Reported-by: Alyssa Ross <hi@alyssa.is>
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter_bridge.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 1610fdbab98df..ad520d3e9df8f 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -5,6 +5,10 @@
+ /* bridge-specific defines for netfilter.
+ */
+
++#ifndef __KERNEL__
++#include <netinet/if_ether.h> /* for __UAPI_DEF_ETHHDR if defined */
++#endif
++
+ #include <linux/in.h>
+ #include <linux/netfilter.h>
+ #include <linux/if_ether.h>
+--
+2.51.0
+
--- /dev/null
+From ab4c58fab2b2639c0429b9f567fd1677b710427d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 13:28:57 -0800
+Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
+
+From: Alexander Grest <Alexander.Grest@microsoft.com>
+
+[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ]
+
+The SMMU CMDQ lock is highly contentious when there are multiple CPUs
+issuing commands and the queue is nearly full.
+
+The lock has the following states:
+ - 0: Unlocked
+ - >0: Shared lock held with count
+ - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters
+ - INT_MIN: Exclusive lock held, no shared waiters
+
+When multiple CPUs are polling for space in the queue, they attempt to
+grab the exclusive lock to update the cons pointer from the hardware. If
+they fail to get the lock, they will spin until either the cons pointer
+is updated by another CPU.
+
+The current code allows the possibility of shared lock starvation
+if there is a constant stream of CPUs trying to grab the exclusive lock.
+This leads to severe latency issues and soft lockups.
+
+Consider the following scenario where CPU1's attempt to acquire the
+shared lock is starved by CPU2 and CPU0 contending for the exclusive
+lock.
+
+CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock`
+--------------------------------------------------------------------------
+trylock() //takes | | | 0
+ | shared_lock() | | INT_MIN
+ | fetch_inc() | | INT_MIN
+ | no return | | INT_MIN + 1
+ | spins // VAL >= 0 | | INT_MIN + 1
+unlock() | spins... | | INT_MIN + 1
+set_release(0) | spins... | | 0 see[NOTE]
+(done) | (sees 0) | trylock() // takes | 0
+ | *exits loop* | cmpxchg(0, INT_MIN) | 0
+ | | *cuts in* | INT_MIN
+ | cmpxchg(0, 1) | | INT_MIN
+ | fails // != 0 | | INT_MIN
+ | spins // VAL >= 0 | | INT_MIN
+ | *starved* | | INT_MIN
+
+[NOTE] The current code resets the exclusive lock to 0 regardless of the
+state of the lock. This causes two problems:
+1. It opens the possibility of back-to-back exclusive locks and the
+ downstream effect of starving shared lock.
+2. The count of shared lock waiters are lost.
+
+To mitigate this, we release the exclusive lock by only clearing the sign
+bit while retaining the shared lock waiter count as a way to avoid
+starving the shared lock waiters.
+
+Also deleted cmpxchg loop while trying to acquire the shared lock as it
+is not needed. The waiters can see the positive lock count and proceed
+immediately after the exclusive lock is released.
+
+Exclusive lock is not starved in that submitters will try exclusive lock
+first when new spaces become available.
+
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Alexander Grest <Alexander.Grest@microsoft.com>
+Signed-off-by: Jacob Pan <jacob.pan@linux.microsoft.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++-------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+index 9ac7b37290eb0..8ee0446c358d6 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+@@ -438,20 +438,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
+ */
+ static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq)
+ {
+- int val;
+-
+ /*
+- * We can try to avoid the cmpxchg() loop by simply incrementing the
+- * lock counter. When held in exclusive state, the lock counter is set
+- * to INT_MIN so these increments won't hurt as the value will remain
+- * negative.
++ * When held in exclusive state, the lock counter is set to INT_MIN
++ * so these increments won't hurt as the value will remain negative.
++ * The increment will also signal the exclusive locker that there are
++ * shared waiters.
+ */
+ if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0)
+ return;
+
+- do {
+- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0);
+- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val);
++ /*
++ * Someone else is holding the lock in exclusive state, so wait
++ * for them to finish. Since we already incremented the lock counter,
++ * no exclusive lock can be acquired until we finish. We don't need
++ * the return value since we only care that the exclusive lock is
++ * released (i.e. the lock counter is non-negative).
++ * Once the exclusive locker releases the lock, the sign bit will
++ * be cleared and our increment will make the lock counter positive,
++ * allowing us to proceed.
++ */
++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0);
+ }
+
+ static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq)
+@@ -478,9 +484,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq)
+ __ret; \
+ })
+
++/*
++ * Only clear the sign bit when releasing the exclusive lock this will
++ * allow any shared_lock() waiters to proceed without the possibility
++ * of entering the exclusive lock in a tight loop.
++ */
+ #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \
+ ({ \
+- atomic_set_release(&cmdq->lock, 0); \
++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \
+ local_irq_restore(flags); \
+ })
+
+--
+2.51.0
+
--- /dev/null
+From 756cd81535e3640723094bd28cd2c14a69cdcd6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 04:35:24 +0000
+Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ]
+
+syzbot reported that struct fib_alias.fa_state can be
+modified locklessly by RCU readers. [0]
+
+Let's use READ_ONCE()/WRITE_ONCE() properly.
+
+[0]:
+BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup
+
+write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0:
+ fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline]
+ fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1:
+ fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline]
+ fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+value changed: 0x00 -> 0x01
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
+
+Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/fib_lookup.h | 6 ++++--
+ net/ipv4/fib_trie.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
+index 818916b2a04d6..f8fe0da3d9af6 100644
+--- a/net/ipv4/fib_lookup.h
++++ b/net/ipv4/fib_lookup.h
+@@ -27,8 +27,10 @@ struct fib_alias {
+ /* Dont write on fa_state unless needed, to keep it shared on all cpus */
+ static inline void fib_alias_accessed(struct fib_alias *fa)
+ {
+- if (!(fa->fa_state & FA_S_ACCESSED))
+- fa->fa_state |= FA_S_ACCESSED;
++ u8 fa_state = READ_ONCE(fa->fa_state);
++
++ if (!(fa_state & FA_S_ACCESSED))
++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED);
+ }
+
+ /* Exported by fib_semantics.c */
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 671178ed41d0d..5c75591bcce00 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1237,7 +1237,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
+ new_fa->fa_tos = fa->fa_tos;
+ new_fa->fa_info = fi;
+ new_fa->fa_type = cfg->fc_type;
+- state = fa->fa_state;
++ state = READ_ONCE(fa->fa_state);
+ new_fa->fa_state = state & ~FA_S_ACCESSED;
+ new_fa->fa_slen = fa->fa_slen;
+ new_fa->tb_id = tb->tb_id;
+@@ -1697,7 +1697,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb,
+
+ fib_remove_alias(t, tp, l, fa_to_delete);
+
+- if (fa_to_delete->fa_state & FA_S_ACCESSED)
++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED)
+ rt_cache_flush(cfg->fc_nlinfo.nl_net);
+
+ fib_release_info(fa_to_delete->fa_info);
+--
+2.51.0
+
--- /dev/null
+From 459512f6d2be8274fc791afa3e21cc008553315c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 19:38:01 +0800
+Subject: jfs: Add missing set_freezable() for freezable kthread
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ]
+
+The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(),
+causing it to remain non-freezable by default. This prevents proper
+freezing during system suspend.
+
+Add set_freezable() to make the thread freezable as intended.
+
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_logmgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
+index 78fd136ac13b9..d02bca48bc7b0 100644
+--- a/fs/jfs/jfs_logmgr.c
++++ b/fs/jfs/jfs_logmgr.c
+@@ -2322,6 +2322,7 @@ int jfsIOWait(void *arg)
+ {
+ struct lbuf *bp;
+
++ set_freezable();
+ do {
+ spin_lock_irq(&log_redrive_lock);
+ while ((bp = log_redrive_list)) {
+--
+2.51.0
+
--- /dev/null
+From 862efaed62a4e035b3a7753d055353dac6600943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 13:22:12 +0100
+Subject: jfs: nlink overflow in jfs_rename
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ]
+
+If nlink is maximal for a directory (-1) and inside that directory you
+perform a rename for some child directory (not moving from the parent),
+then the nlink of the first directory is first incremented and later
+decremented. Normally this is fine, but when nlink = -1 this causes a
+wrap around to 0, and then drop_nlink issues a warning.
+
+After applying the patch syzbot no longer issues any warnings. I also
+ran some basic fs tests to look for any regressions.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
+Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/namei.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
+index f155ad6650bd4..e72c48f457d86 100644
+--- a/fs/jfs/namei.c
++++ b/fs/jfs/namei.c
+@@ -1226,7 +1226,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ jfs_err("jfs_rename: dtInsert returned -EIO");
+ goto out_tx;
+ }
+- if (S_ISDIR(old_ip->i_mode))
++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
+ inc_nlink(new_dir);
+ }
+ /*
+@@ -1242,7 +1242,9 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ goto out_tx;
+ }
+ if (S_ISDIR(old_ip->i_mode)) {
+- drop_nlink(old_dir);
++ if (new_ip || old_dir != new_dir)
++ drop_nlink(old_dir);
++
+ if (old_dir != new_dir) {
+ /*
+ * Change inode number of parent for moved directory
+--
+2.51.0
+
--- /dev/null
+From 74cf5851efa314b7fd6243f4f53a9313cb4c0ef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Dec 2025 21:04:01 +0900
+Subject: m68k: nommu: fix memmove() with differently aligned src and dest for
+ 68000
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ]
+
+68000 has different alignment needs to 68020+.
+memcpy() checks if the destination is aligned and does a smaller copy
+to fix the alignment and then critically for 68000 it checks if the
+source is still unaligned and if it is reverts to smaller copies.
+
+memmove() does not currently do the second part and malfunctions if
+one of the pointers is aligned and the other isn't.
+
+This is apparently getting triggered by printk. If I put breakpoints
+into the new checks added by this commit the first hit looks like this:
+
+memmove (n=205, src=0x2f3971 <printk_shared_pbufs+205>, dest=0x2f3980 <printk_shared_pbufs+220>) at arch/m68k/lib/memmove.c:82
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Signed-off-by: Greg Ungerer <gerg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/lib/memmove.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c
+index 6519f7f349f66..e33f00b02e4c0 100644
+--- a/arch/m68k/lib/memmove.c
++++ b/arch/m68k/lib/memmove.c
+@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *cdest++ = *csrc++;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *--cdest = *--csrc;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+--
+2.51.0
+
--- /dev/null
+From 331cf79cf18d5e4bf08c05571df5b41386249ae3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:24 +0100
+Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ]
+
+request_threaded_irq() is invoked with a primary and a secondary handler
+and no flags are passed. The primary handler is the same as
+irq_default_primary_handler() so there is no need to have an identical
+copy.
+
+The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt
+source is not masked while the threaded handler is active. This means,
+especially on LEVEL typed interrupt lines, the interrupt can fire again
+before the threaded handler had a chance to run.
+
+Use the default primary interrupt handler by specifying NULL and set
+IRQF_ONESHOT so the interrupt source is masked until the secondary handler
+is done.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index e913ed1e34c63..5348ccba13079 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1183,14 +1183,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset)
+
+ /* ====== FlexRM interrupt handler ===== */
+
+-static irqreturn_t flexrm_irq_event(int irq, void *dev_id)
+-{
+- /* We only have MSI for completions so just wakeup IRQ thread */
+- /* Ring related errors will be informed via completion descriptors */
+-
+- return IRQ_WAKE_THREAD;
+-}
+-
+ static irqreturn_t flexrm_irq_thread(int irq, void *dev_id)
+ {
+ flexrm_process_completions(dev_id);
+@@ -1281,10 +1273,8 @@ static int flexrm_startup(struct mbox_chan *chan)
+ ret = -ENODEV;
+ goto fail_free_cmpl_memory;
+ }
+- ret = request_threaded_irq(ring->irq,
+- flexrm_irq_event,
+- flexrm_irq_thread,
+- 0, dev_name(ring->mbox->dev), ring);
++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread,
++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring);
+ if (ret) {
+ dev_err(ring->mbox->dev,
+ "failed to request ring%d IRQ\n", ring->num);
+--
+2.51.0
+
--- /dev/null
+From 09c3000992e101305e38c0f7232348dc3b80032d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:36 +0100
+Subject: mailbox: sprd: clear delivery flag before handling TX done
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ]
+
+If there are any pending messages in the mailbox queue, they are sent
+as soon as a TX done event arrives from the driver. This may trigger a
+new delivery interrupt while the previous one is still being handled.
+If the delivery status is cleared after this, the interrupt is lost.
+To prevent this from happening, clear the delivery status immediately
+after checking it and before any new messages are sent.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index 94d9067dc8d09..96b7fc706bb9f 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -149,6 +149,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ return IRQ_NONE;
+ }
+
++ /* Clear FIFO delivery and overflow status first */
++ writel(fifo_sts &
++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
++ priv->inbox_base + SPRD_MBOX_FIFO_RST);
++
+ while (send_sts) {
+ id = __ffs(send_sts);
+ send_sts &= (send_sts - 1);
+@@ -164,11 +169,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ mbox_chan_txdone(chan, 0);
+ }
+
+- /* Clear FIFO delivery and overflow status */
+- writel(fifo_sts &
+- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
+- priv->inbox_base + SPRD_MBOX_FIFO_RST);
+-
+ /* Clear irq status */
+ writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS);
+
+--
+2.51.0
+
--- /dev/null
+From faeddfdd9e531c2c5b1905b448df037c5737b153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 15:29:57 +0100
+Subject: media: adv7180: fix frame interval in progressive mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ]
+
+The ADV7280-M may internally convert interlaced video input to
+progressive video. If this mode is enabled, the ADV7280-M delivers
+progressive video frames at the field rate of 50 fields per second (PAL)
+or 60 fields per second (NTSC).
+
+Fix the reported frame interval if progressive video is enabled.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 4498d14d34291..2d689357f156c 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -468,6 +468,13 @@ static int adv7180_g_frame_interval(struct v4l2_subdev *sd,
+ fi->interval.denominator = 25;
+ }
+
++ /*
++ * If the de-interlacer is active, the chip produces full video frames
++ * at the field rate.
++ */
++ if (state->field == V4L2_FIELD_NONE)
++ fi->interval.denominator *= 2;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9b62f853cec64cf8b7e1743c3caae4f8cac535fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 15:46:47 +0800
+Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ]
+
+Add release_mem_region() if ioremap() fails to release the memory
+region obtained by cx25821_get_resources().
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index a3d45287a5343..5b823124ff28b 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -915,6 +915,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
+
+ if (!dev->lmmio) {
+ CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n");
++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0));
+ cx25821_iounmap(dev);
+ return -ENOMEM;
+ }
+--
+2.51.0
+
--- /dev/null
+From 78acb4b22eb85582cfd9f6a0fd0dff799a629c08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 08:57:35 +0200
+Subject: media: dvb-core: dmxdevfilter must always flush bufs
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ]
+
+Currently the buffers are being filled until full, which works fine
+for the transport stream, but not when reading sections, those have
+to be returned to userspace immediately, otherwise dvbv5-scan will
+just wait forever.
+
+Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether
+the buffer must be flushed or wait until it is full.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dmxdev.c | 8 ++++----
+ drivers/media/dvb-core/dvb_vb2.c | 5 +++--
+ include/media/dvb_vb2.h | 6 ++++--
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index 12b7f698f5623..71651086bc4d8 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -406,11 +406,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
+ if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) {
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, true);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, true);
+ } else {
+ ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer,
+ buffer1, buffer1_len);
+@@ -461,10 +461,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
+
+ if (dvb_vb2_is_streaming(ctx)) {
+ ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, false);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, false);
+ } else {
+ if (buffer->error) {
+ spin_unlock(&dmxdevfilter->dev->lock);
+diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c
+index 1331f2c2237e6..c1aaa0b46c37e 100644
+--- a/drivers/media/dvb-core/dvb_vb2.c
++++ b/drivers/media/dvb-core/dvb_vb2.c
+@@ -256,7 +256,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx)
+
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags)
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush)
+ {
+ unsigned long flags = 0;
+ void *vbuf = NULL;
+@@ -313,7 +314,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ }
+ }
+
+- if (ctx->nonblocking && ctx->buf) {
++ if (flush && ctx->buf) {
+ vb2_set_plane_payload(&ctx->buf->vb, 0, ll);
+ vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE);
+ list_del(&ctx->buf->list);
+diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h
+index 8cb88452cd6c2..0fbbfc65157e6 100644
+--- a/include/media/dvb_vb2.h
++++ b/include/media/dvb_vb2.h
+@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx)
+ return 0;
+ };
+ #define dvb_vb2_is_streaming(ctx) (0)
+-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0)
++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0)
+
+ static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx,
+ struct file *file,
+@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx);
+ * @buffer_flags:
+ * pointer to buffer flags as defined by &enum dmx_buffer_flags.
+ * can be NULL.
++ * @flush: flush the buffer, even if it isn't full.
+ */
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags);
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush);
+
+ /**
+ * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV
+--
+2.51.0
+
--- /dev/null
+From 7438439ce5805119d37bbd0aabc680bc4fb78d33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 15:26:40 +0200
+Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ]
+
+The isp_video_mbus_to_pix/pix_to_mbus functions did not take
+the last empty entry { 0, } of the formats array into account.
+
+As a result, isp_video_mbus_to_pix would accept code 0 and
+isp_video_pix_to_mbus would select code 0 if no match was found.
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/ispvideo.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c
+index 8811d6dd4ee74..f7e1ef11cdc4a 100644
+--- a/drivers/media/platform/omap3isp/ispvideo.c
++++ b/drivers/media/platform/omap3isp/ispvideo.c
+@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video,
+ pix->width = mbus->width;
+ pix->height = mbus->height;
+
+- for (i = 0; i < ARRAY_SIZE(formats); ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
+ if (formats[i].code == mbus->code)
+ break;
+ }
+
+- if (WARN_ON(i == ARRAY_SIZE(formats)))
++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1))
+ return 0;
+
+ min_bpl = pix->width * formats[i].bpp;
+@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix,
+ /* Skip the last format in the loop so that it will be selected if no
+ * match is found.
+ */
+- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) {
+ if (formats[i].pixelformat == pix->pixelformat)
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 72f263d6b6efcb1a4c87070b0494eb0f2511a5e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 17:09:18 +0200
+Subject: media: omap3isp: isppreview: always clamp in preview_try_format()
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ]
+
+If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't
+clamped. Just always clamp.
+
+This fixes a v4l2-compliance error:
+
+ fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
+ fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
+test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/isppreview.c | 21 ++++++++------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c
+index 607b7685c982f..64c7553bef2f9 100644
+--- a/drivers/media/platform/omap3isp/isppreview.c
++++ b/drivers/media/platform/omap3isp/isppreview.c
+@@ -1739,22 +1739,17 @@ static void preview_try_format(struct isp_prev_device *prev,
+
+ switch (pad) {
+ case PREV_PAD_SINK:
+- /* When reading data from the CCDC, the input size has already
+- * been mangled by the CCDC output pad so it can be accepted
+- * as-is.
+- *
+- * When reading data from memory, clamp the requested width and
+- * height. The TRM doesn't specify a minimum input height, make
++ /*
++ * Clamp the requested width and height.
++ * The TRM doesn't specify a minimum input height, make
+ * sure we got enough lines to enable the noise filter and color
+ * filter array interpolation.
+ */
+- if (prev->input == PREVIEW_INPUT_MEMORY) {
+- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
+- preview_max_out_width(prev));
+- fmt->height = clamp_t(u32, fmt->height,
+- PREV_MIN_IN_HEIGHT,
+- PREV_MAX_IN_HEIGHT);
+- }
++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
++ preview_max_out_width(prev));
++ fmt->height = clamp_t(u32, fmt->height,
++ PREV_MIN_IN_HEIGHT,
++ PREV_MAX_IN_HEIGHT);
+
+ fmt->colorspace = V4L2_COLORSPACE_SRGB;
+
+--
+2.51.0
+
--- /dev/null
+From 5048683b3eccf890f74f60e4be0e5889f0d63e2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 09:21:53 +0200
+Subject: media: omap3isp: set initial format
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ]
+
+Initialize the v4l2_format to a default. Empty formats are
+not allowed in V4L2, so this fixes v4l2-compliance issues:
+
+ fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height
+test VIDIOC_G_FMT: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/ispvideo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c
+index f7e1ef11cdc4a..3304457716450 100644
+--- a/drivers/media/platform/omap3isp/ispvideo.c
++++ b/drivers/media/platform/omap3isp/ispvideo.c
+@@ -1293,6 +1293,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = {
+ static int isp_video_open(struct file *file)
+ {
+ struct isp_video *video = video_drvdata(file);
++ struct v4l2_mbus_framefmt fmt;
+ struct isp_video_fh *handle;
+ struct vb2_queue *queue;
+ int ret = 0;
+@@ -1334,6 +1335,13 @@ static int isp_video_open(struct file *file)
+
+ memset(&handle->format, 0, sizeof(handle->format));
+ handle->format.type = video->type;
++ handle->format.fmt.pix.width = 720;
++ handle->format.fmt.pix.height = 480;
++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY;
++ handle->format.fmt.pix.field = V4L2_FIELD_NONE;
++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt);
++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix);
+ handle->timeperframe.denominator = 1;
+
+ handle->video = video;
+--
+2.51.0
+
--- /dev/null
+From 98a85f66a3cbb52e101d08090727d5e1861a3ff3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 19:24:19 +0100
+Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex
+
+From: Szymon Wilczek <szymonwilczek@gmx.com>
+
+[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ]
+
+When pvr2_send_request_ex() submits a write URB successfully but fails to
+submit the read URB (e.g. returns -ENOMEM), it returns immediately without
+waiting for the write URB to complete. Since the driver reuses the same
+URB structure, a subsequent call to pvr2_send_request_ex() attempts to
+submit the still-active write URB, triggering a 'URB submitted while
+active' warning in usb_submit_urb().
+
+Fix this by ensuring the write URB is unlinked and waited upon if the read
+URB submission fails.
+
+Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
+Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com>
+Acked-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 10c21580a827b..fc7eb59aa2c80 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -3704,6 +3704,11 @@ status);
+ "Failed to submit read-control URB status=%d",
+ status);
+ hdw->ctl_read_pend_flag = 0;
++ if (hdw->ctl_write_pend_flag) {
++ usb_unlink_urb(hdw->ctl_write_urb);
++ while (hdw->ctl_write_pend_flag)
++ wait_for_completion(&hdw->ctl_done);
++ }
+ goto done;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From f49957ffeb36468762e282f26b3e3652f9390c38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:00:35 -0800
+Subject: media: solo6x10: Check for out of bounds chip_id
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ]
+
+Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
+(literal "1" is an "int") could end up being shifted beyond 32 bits,
+so instrumentation was added (and due to the double is_tw286x() call
+seen via inlining), Clang decides the second one must now be undefined
+behavior and elides the rest of the function[1]. This is a known problem
+with Clang (that is still being worked on), but we can avoid the entire
+problem by actually checking the existing max chip ID, and now there is
+no runtime instrumentation added at all since everything is known to be
+within bounds.
+
+Additionally use an unsigned value for the shift to remove the
+instrumentation even without the explicit bounds checking.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
+Suggested-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: fix checkpatch warning for is_tw286x]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+index 1b7c22a9bc94f..8f53946c67928 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c
++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = {
+ 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0,
+ };
+
+-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id)))
++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id))))
+
+ static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off,
+ u8 tw_off)
+@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ if (val > 255 || val < 0)
+ return -ERANGE;
+
+@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ switch (ctrl) {
+ case V4L2_CID_SHARPNESS:
+ /* Only 286x has sharpness */
+--
+2.51.0
+
--- /dev/null
+From 4890b94166b5d800baba31343051a46c73b35134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 16:39:47 +0100
+Subject: minix: Add required sanity checking to minix_check_superblock()
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ]
+
+The fs/minix implementation of the minix filesystem does not currently
+support any other value for s_log_zone_size than 0. This is also the
+only value supported in util-linux; see mkfs.minix.c line 511. In
+addition, this patch adds some sanity checking for the other minix
+superblock fields, and moves the minix_blocks_needed() checks for the
+zmap and imap also to minix_check_super_block().
+
+This also closes a related syzbot bug report.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/inode.c | 50 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 29 insertions(+), 21 deletions(-)
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 7636e789eb49b..5b2056d00121f 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -153,10 +153,38 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)
+ static bool minix_check_superblock(struct super_block *sb)
+ {
+ struct minix_sb_info *sbi = minix_sb(sb);
++ unsigned long block;
+
+- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
++ if (sbi->s_log_zone_size != 0) {
++ printk("minix-fs error: zone size must equal block size. "
++ "s_log_zone_size > 0 is not supported.\n");
++ return false;
++ }
++
++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
++ sbi->s_firstdatazone >= sbi->s_nzones)
+ return false;
+
++ /* Apparently minix can create filesystems that allocate more blocks for
++ * the bitmaps than needed. We simply ignore that, but verify it didn't
++ * create one with not enough blocks and bail out if so.
++ */
++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize);
++ if (sbi->s_imap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "imap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
++ block = minix_blocks_needed(
++ (sbi->s_nzones - sbi->s_firstdatazone + 1),
++ sb->s_blocksize);
++ if (sbi->s_zmap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "zmap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
+ /*
+ * s_max_size must not exceed the block mapping limitation. This check
+ * is only needed for V1 filesystems, since V2/V3 support an extra level
+@@ -275,26 +303,6 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ minix_set_bit(0,sbi->s_imap[0]->b_data);
+ minix_set_bit(0,sbi->s_zmap[0]->b_data);
+
+- /* Apparently minix can create filesystems that allocate more blocks for
+- * the bitmaps than needed. We simply ignore that, but verify it didn't
+- * create one with not enough blocks and bail out if so.
+- */
+- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
+- if (sbi->s_imap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "imap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+- block = minix_blocks_needed(
+- (sbi->s_nzones - sbi->s_firstdatazone + 1),
+- s->s_blocksize);
+- if (sbi->s_zmap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "zmap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+ /* set up enough so that it can read an inode */
+ s->s_op = &minix_sops;
+ s->s_time_min = 0;
+--
+2.51.0
+
--- /dev/null
+From 8f46db843b5b21ff68ba5f2187a469d3f29377fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 09:40:06 +0000
+Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ]
+
+The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which
+is a valid index - so add a check for this.
+
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mach-loongson64/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h
+index 3414a1fd17835..89bb4deab98a6 100644
+--- a/arch/mips/include/asm/mach-loongson64/topology.h
++++ b/arch/mips/include/asm/mach-loongson64/topology.h
+@@ -7,7 +7,7 @@
+ #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2)
+
+ extern cpumask_t __node_cpumask[];
+-#define cpumask_of_node(node) (&__node_cpumask[node])
++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node])
+
+ struct pci_bus;
+ extern int pcibus_to_node(struct pci_bus *);
+--
+2.51.0
+
--- /dev/null
+From 5197468aa5ef4d2d003e434c2821d5d3bd4c95a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 13:13:30 +0100
+Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ]
+
+Building a size optimized ppc64 kernel (-Os), gcc emits more FP
+save/restore symbols, that the linker generates on demand into the
+.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c,
+too. They are needed for the amdgpu in-kernel floating point support.
+
+MODPOST Module.symvers
+ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many)
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index fd77ac48dcc17..379d03d0c5e6d 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -668,6 +668,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
+ /* Special register function linked on all modules during final link of .ko */
+ if (strstarts(symname, "_restgpr0_") ||
+ strstarts(symname, "_savegpr0_") ||
++ strstarts(symname, "_restgpr1_") ||
++ strstarts(symname, "_savegpr1_") ||
++ strstarts(symname, "_restfpr_") ||
++ strstarts(symname, "_savefpr_") ||
+ strstarts(symname, "_restvr_") ||
+ strstarts(symname, "_savevr_") ||
+ strcmp(symname, ".TOC.") == 0)
+--
+2.51.0
+
--- /dev/null
+From b2bc7815774ecddf7efe95caebef3c6a0eb222b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 17:28:09 +0100
+Subject: myri10ge: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ]
+
+While compile testing on less common architectures, I noticed that gcc-10 on
+s390 finds a bug that all other configurations seem to miss:
+
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized]
+ 391 | buf->data0 = htonl(data->data0);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+ | ^~~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized]
+ 393 | buf->data2 = htonl(data->data2);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+
+It would be nice to understand how to make other compilers catch this as
+well, but for the moment I'll just shut up the warning by fixing the
+undefined behavior in this driver.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index 5a1ed4818baac..28857053f7514 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
+
+ /* probe for IPv6 TSO support */
+ mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE,
+ &cmd, 0);
+ if (status == 0) {
+@@ -805,6 +808,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp, u8 * addr)
+ | (addr[2] << 8) | addr[3]);
+
+ cmd.data1 = ((addr[4] << 8) | (addr[5]));
++ cmd.data2 = 0;
+
+ status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0);
+ return status;
+@@ -816,6 +820,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause)
+ int status, ctl;
+
+ ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, 0);
+
+ if (status) {
+@@ -833,6 +840,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic)
+ int status, ctl;
+
+ ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC;
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic);
+ if (status)
+ netdev_err(mgp->dev, "Failed to set promisc mode\n");
+@@ -1938,6 +1948,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss)
+ /* get ring sizes */
+ slice = ss - mgp->ss;
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
+ tx_ring_size = cmd.data0;
+ cmd.data0 = slice;
+@@ -2230,12 +2242,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice)
+ status = 0;
+ if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) {
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET,
+ &cmd, 0);
+ ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *)
+ (mgp->sram + cmd.data0);
+ }
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET,
+ &cmd, 0);
+ ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *)
+@@ -2304,6 +2320,7 @@ static int myri10ge_open(struct net_device *dev)
+ if (mgp->num_slices > 1) {
+ cmd.data0 = mgp->num_slices;
+ cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE;
++ cmd.data2 = 0;
+ if (mgp->dev->real_num_tx_queues > 1)
+ cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES,
+@@ -2406,6 +2423,8 @@ static int myri10ge_open(struct net_device *dev)
+
+ /* now give firmware buffers sizes, and MTU */
+ cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0);
+ cmd.data0 = mgp->small_bytes;
+ status |=
+@@ -2464,7 +2483,6 @@ static int myri10ge_open(struct net_device *dev)
+ static int myri10ge_close(struct net_device *dev)
+ {
+ struct myri10ge_priv *mgp = netdev_priv(dev);
+- struct myri10ge_cmd cmd;
+ int status, old_down_cnt;
+ int i;
+
+@@ -2483,8 +2501,13 @@ static int myri10ge_close(struct net_device *dev)
+
+ netif_tx_stop_all_queues(dev);
+ if (mgp->rebooted == 0) {
++ struct myri10ge_cmd cmd;
++
+ old_down_cnt = mgp->down_cnt;
+ mb();
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status =
+ myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0);
+ if (status)
+@@ -2948,6 +2971,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev)
+
+ /* Disable multicast filtering */
+
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1);
+ if (err != 0) {
+ netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n",
+--
+2.51.0
+
--- /dev/null
+From c7e18dacaa034f7dff05a30c067117dfa938f617 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:57:20 -0700
+Subject: net/rds: Clear reconnect pending bit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ]
+
+When canceling the reconnect worker, care must be taken to reset the
+reconnect-pending bit. If the reconnect worker has not yet been
+scheduled before it is canceled, the reconnect-pending bit will stay
+on forever.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 00bda534b9ce2..98c0d5ff9de9c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ * to the conn hash, so we never trigger a reconnect on this
+ * conn - the reconnect is always triggered by the active peer. */
+ cancel_delayed_work_sync(&cp->cp_conn_w);
++
++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags);
+ rcu_read_lock();
+ if (!hlist_unhashed(&conn->c_hash_node)) {
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From 43a19868dffba07f7abbc2908b5d335d2633fd2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 22:52:12 -0700
+Subject: net/rds: No shortcut out of RDS_CONN_ERROR
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ]
+
+RDS connections carry a state "rds_conn_path::cp_state"
+and transitions from one state to another and are conditional
+upon an expected state: "rds_conn_path_transition."
+
+There is one exception to this conditionality, which is
+"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"
+regardless of what state the condition is currently in.
+
+But as soon as a connection enters state "RDS_CONN_ERROR",
+the connection handling code expects it to go through the
+shutdown-path.
+
+The RDS/TCP multipath changes added a shortcut out of
+"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"
+via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").
+
+A subsequent "rds_tcp_reset_callbacks" can then transition
+the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.
+
+That'll trip up "rds_conn_init_shutdown", which was
+never adjusted to handle "RDS_CONN_RESETTING" and subsequently
+drops the connection with the dreaded "DR_INV_CONN_STATE",
+which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever.
+
+So we do two things here:
+
+a) Don't shortcut "RDS_CONN_ERROR", but take the longer
+ path through the shutdown code.
+
+b) Add "RDS_CONN_RESETTING" to the expected states in
+ "rds_conn_init_shutdown" so that we won't error out
+ and get stuck, if we ever hit weird state transitions
+ like this again."
+
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ net/rds/tcp_listen.c | 5 -----
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index b4cc699c5fad3..00bda534b9ce2 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ if (!rds_conn_path_transition(cp, RDS_CONN_UP,
+ RDS_CONN_DISCONNECTING) &&
+ !rds_conn_path_transition(cp, RDS_CONN_ERROR,
++ RDS_CONN_DISCONNECTING) &&
++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING,
+ RDS_CONN_DISCONNECTING)) {
+ rds_conn_path_error(cp,
+ "shutdown called in state %d\n",
+diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
+index 3994eeef95a3c..7b6d0088ae33e 100644
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -58,9 +58,6 @@ void rds_tcp_keepalive(struct socket *sock)
+ * socket and force a reconneect from smaller -> larger ip addr. The reason
+ * we special case cp_index 0 is to allow the rds probe ping itself to itself
+ * get through efficiently.
+- * Since reconnects are only initiated from the node with the numerically
+- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side
+- * by moving them to CONNECTING in this function.
+ */
+ static
+ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+@@ -85,8 +82,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+ struct rds_conn_path *cp = &conn->c_path[i];
+
+ if (rds_conn_path_transition(cp, RDS_CONN_DOWN,
+- RDS_CONN_CONNECTING) ||
+- rds_conn_path_transition(cp, RDS_CONN_ERROR,
+ RDS_CONN_CONNECTING)) {
+ return cp->cp_transport_data;
+ }
+--
+2.51.0
+
--- /dev/null
+From fd6db3a351e90e6484e53cba58795b590d702310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 09:59:49 +0800
+Subject: net: usb: r8152: fix transmit queue timeout
+
+From: Mingj Ye <insyelu@gmail.com>
+
+[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ]
+
+When the TX queue length reaches the threshold, the netdev watchdog
+immediately detects a TX queue timeout.
+
+This patch updates the trans_start timestamp of the transmit queue
+on every asynchronous USB URB submission along the transmit path,
+ensuring that the network watchdog accurately reflects ongoing
+transmission activity.
+
+Signed-off-by: Mingj Ye <insyelu@gmail.com>
+Reviewed-by: Hayes Wang <hayeswang@realtek.com>
+Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 57565fb2c0a11..2a8fa331a9452 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -2152,6 +2152,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
+ ret = usb_submit_urb(agg->urb, GFP_ATOMIC);
+ if (ret < 0)
+ usb_autopm_put_interface_async(tp->intf);
++ else
++ netif_trans_update(tp->netdev);
+
+ out_tx_fill:
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 41c339eeb130cc3965e899bd043b92323af95fba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:39:09 -0800
+Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter
+
+From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+
+[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ]
+
+Several registers referenced in this driver's source code do not
+actually exist (they are not writable and read as zero in my testing).
+They exist in this driver because it originated as a copy of the dm9601
+driver. Notably, these include the multicast filter registers - this
+causes the driver to not support multicast packets correctly. Remove
+the multicast filter code and register definitions. Instead, set the
+chip to receive all multicast filter packets when any multicast
+addresses are in the list.
+
+Reviewed-by: Simon Horman <horms@kernel.org> (from v1)
+Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/Kconfig | 1 -
+ drivers/net/usb/sr9700.c | 25 ++++---------------------
+ drivers/net/usb/sr9700.h | 7 +------
+ 3 files changed, 5 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index 867ff2ee8ecf3..e1ec0c6b33429 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -318,7 +318,6 @@ config USB_NET_DM9601
+ config USB_NET_SR9700
+ tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
+ depends on USB_USBNET
+- select CRC32
+ help
+ This option adds support for CoreChip-sz SR9700 based USB 1.1
+ 10/100 Ethernet adapters.
+diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
+index 4d860d5bbcd73..9dbce3232d7c2 100644
+--- a/drivers/net/usb/sr9700.c
++++ b/drivers/net/usb/sr9700.c
+@@ -18,7 +18,6 @@
+ #include <linux/ethtool.h>
+ #include <linux/mii.h>
+ #include <linux/usb.h>
+-#include <linux/crc32.h>
+ #include <linux/usb/usbnet.h>
+
+ #include "sr9700.h"
+@@ -264,31 +263,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = {
+ static void sr9700_set_multicast(struct net_device *netdev)
+ {
+ struct usbnet *dev = netdev_priv(netdev);
+- /* We use the 20 byte dev->data for our 8 byte filter buffer
+- * to avoid allocating memory that is tricky to free later
+- */
+- u8 *hashes = (u8 *)&dev->data;
+ /* rx_ctl setting : enable, disable_long, disable_crc */
+ u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG;
+
+- memset(hashes, 0x00, SR_MCAST_SIZE);
+- /* broadcast address */
+- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG;
+- if (netdev->flags & IFF_PROMISC) {
++ if (netdev->flags & IFF_PROMISC)
+ rx_ctl |= RCR_PRMSC;
+- } else if (netdev->flags & IFF_ALLMULTI ||
+- netdev_mc_count(netdev) > SR_MCAST_MAX) {
+- rx_ctl |= RCR_RUNT;
+- } else if (!netdev_mc_empty(netdev)) {
+- struct netdev_hw_addr *ha;
+-
+- netdev_for_each_mc_addr(ha, netdev) {
+- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26;
+- hashes[crc >> 3] |= 1 << (crc & 0x7);
+- }
+- }
++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev))
++ /* The chip has no multicast filter */
++ rx_ctl |= RCR_ALL;
+
+- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes);
+ sr_write_reg_async(dev, SR_RCR, rx_ctl);
+ }
+
+diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
+index ea2b4de621c86..c479908f7d823 100644
+--- a/drivers/net/usb/sr9700.h
++++ b/drivers/net/usb/sr9700.h
+@@ -104,9 +104,7 @@
+ #define WCR_LINKEN (1 << 5)
+ /* Physical Address Reg */
+ #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */
+-/* Multicast Address Reg */
+-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */
+-/* 0x1e unused */
++/* 0x16 --> 0x1E unused */
+ /* Phy Reset Reg */
+ #define SR_PRR 0x1F
+ #define PRR_PHY_RST (1 << 0)
+@@ -161,9 +159,6 @@
+ /* parameters */
+ #define SR_SHARE_TIMEOUT 1000
+ #define SR_EEPROM_LEN 256
+-#define SR_MCAST_SIZE 8
+-#define SR_MCAST_ADDR_FLAG 0x80
+-#define SR_MCAST_MAX 64
+ #define SR_TX_OVERHEAD 2 /* 2bytes header */
+ #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */
+
+--
+2.51.0
+
--- /dev/null
+From ca4a4352a966fbc43dc6ac19f4f858e7746d5a7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Dec 2025 20:53:51 +0900
+Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler
+
+From: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+
+[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ]
+
+The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
+ ("netfilter: conntrack: introduce clash resolution on insertion race"),
+sets allow_clash=true in the UDP/UDPLITE protocol handler
+but does not set it in the generic protocol handler.
+
+As a result, packets composed of connectionless protocols at each layer,
+such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
+
+To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.
+
+Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_generic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
+index e831637bc8ca8..cb260eb3d012c 100644
+--- a/net/netfilter/nf_conntrack_proto_generic.c
++++ b/net/netfilter/nf_conntrack_proto_generic.c
+@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net)
+ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
+ {
+ .l4proto = 255,
++ .allow_clash = true,
+ #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ .ctnl_timeout = {
+ .nlattr_to_obj = generic_timeout_nlattr_to_obj,
+--
+2.51.0
+
--- /dev/null
+From c5cc037cecc3372f710b9d98fb31c523f48564c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 12:30:42 +0100
+Subject: netfilter: xt_tcpmss: check remaining length before reading optlen
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ]
+
+Quoting reporter:
+ In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
+ op[i+1] directly without validating the remaining option length.
+
+ If the last byte of the option field is not EOL/NOP (0/1), the code attempts
+ to index op[i+1]. In the case where i + 1 == optlen, this causes an
+ out-of-bounds read, accessing memory past the optlen boundary
+ (either reading beyond the stack buffer _opt or the
+ following payload).
+
+Reported-by: sungzii <sungzii@pm.me>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_tcpmss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
+index 37704ab017992..0d32d4841cb32 100644
+--- a/net/netfilter/xt_tcpmss.c
++++ b/net/netfilter/xt_tcpmss.c
+@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ return (mssval >= info->mss_min &&
+ mssval <= info->mss_max) ^ info->invert;
+ }
+- if (op[i] < 2)
++ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i+1] ? : 1;
+--
+2.51.0
+
--- /dev/null
+From 8a156264dadd433c0b833be5ef2b373cabf17134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 19:11:39 +0800
+Subject: nfc: nxp-nci: remove interrupt trigger type
+
+From: Carl Lee <carl.lee@amd.com>
+
+[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ]
+
+For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and
+active high, not edge-triggered.
+
+Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail
+to trigger correctly.
+
+Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured
+via Device Tree.
+
+Signed-off-by: Carl Lee <carl.lee@amd.com>
+Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index f426dcdfcdd6a..78320d7bd2a16 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -306,7 +306,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client,
+
+ r = request_threaded_irq(client->irq, NULL,
+ nxp_nci_i2c_irq_thread_fn,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_ONESHOT,
+ NXP_NCI_I2C_DRIVER_NAME, phy);
+ if (r < 0)
+ nfc_err(&client->dev, "Unable to register IRQ handler\n");
+--
+2.51.0
+
--- /dev/null
+From 1c7a27ca5e78e09bc7d9f2c17ea7595a3b9639fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:18 -0800
+Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]
+
+Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
+This patch protects against invalid index out of bounds access to mw_sizes
+When invalid access print message to user that configuration is not valid.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index c5c1963c699d9..199ca06277ac1 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1316,6 +1316,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev)
+ for (i = 0; i < sndev->nr_lut_mw; i++) {
+ int idx = sndev->nr_direct_mw + i;
+
++ if (idx >= MAX_MWS) {
++ dev_err(&sndev->stdev->dev,
++ "Total number of MW cannot be bigger than %d", MAX_MWS);
++ break;
++ }
++
+ sndev->self_shared->mw_sizes[idx] = LUT_SIZE;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From fbb9f0f61dfd335f81872fc76827058837e56614 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:17 -0800
+Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]
+
+Number of MW LUTs depends on NTB configuration and can be set to zero,
+in such scenario rounddown_pow_of_two will cause undefined behaviour and
+should not be performed.
+This patch ensures that rounddown_pow_of_two is called on valid value.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index 199ca06277ac1..a912ffa2289ac 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1204,7 +1204,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+ sndev->mmio_self_ctrl);
+
+ sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries);
+- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
++ if (sndev->nr_lut_mw)
++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n",
+ sndev->nr_direct_mw, sndev->nr_lut_mw);
+@@ -1214,7 +1215,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+
+ sndev->peer_nr_lut_mw =
+ ioread16(&sndev->mmio_peer_ctrl->lut_table_entries);
+- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
++ if (sndev->peer_nr_lut_mw)
++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n",
+ sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw);
+--
+2.51.0
+
--- /dev/null
+From aa12ed5b03d48443b6bf3cc8efbeab9a442d6745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 18:21:47 +0530
+Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ]
+
+NIX SQ manager sticky mode is known to cause stalls when multiple SQs
+share an SMQ and transmit concurrently. Additionally, PSE may deadlock
+on transitions between sticky and non-sticky transmissions. There is
+also a credit drop issue observed when certain condition clocks are
+gated.
+
+work around these hardware errata by:
+- Disabling SQM sticky operation:
+ - Clear TM6 (bit 15)
+ - Clear TM11 (bit 14)
+- Disabling sticky → non-sticky transition path that can deadlock PSE:
+ - Clear TM5 (bit 23)
+- Preventing credit drops by keeping the control-flow clock enabled:
+ - Set TM9 (bit 21)
+
+These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this
+configuration the SQM/PSE maintain forward progress under load without
+credit loss, at the cost of disabling sticky optimizations.
+
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index 0a69d326f618c..971e0ae917f41 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -3155,12 +3155,18 @@ int rvu_nix_init(struct rvu *rvu)
+ /* Set chan/link to backpressure TL3 instead of TL2 */
+ rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
+
+- /* Disable SQ manager's sticky mode operation (set TM6 = 0)
++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0)
+ * This sticky mode is known to cause SQ stalls when multiple
+- * SQs are mapped to same SMQ and transmitting pkts at a time.
++ * SQs are mapped to same SMQ and transmitting pkts simultaneously.
++ * NIX PSE may deadlock when there are any sticky to non-sticky
++ * transmission. Hence disable it (TM5 = 0).
+ */
+ cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
+- cfg &= ~BIT_ULL(15);
++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23));
++ /* NIX may drop credits when condition clocks are turned off.
++ * Hence enable control flow clk (set TM9 = 1).
++ */
++ cfg |= BIT_ULL(21);
+ rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
+
+ ltdefs = rvu->kpu.lt_def;
+--
+2.51.0
+
--- /dev/null
+From e9a4fa0d346428b58ebc92862e43445228df89b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 12:07:23 -0500
+Subject: openrisc: define arch-specific version of nop()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ]
+
+When compiling a driver written for MIPS on OpenRISC that uses the nop()
+function, it fails due to the following error:
+
+ drivers/watchdog/pic32-wdt.c: Assembler messages:
+ drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop'
+
+The driver currently uses the generic version of nop() from
+include/asm-generic/barrier.h:
+
+ #ifndef nop
+ #define nop() asm volatile ("nop")
+ #endif
+
+Let's fix this on OpenRISC by defining an architecture-specific version
+of nop().
+
+This was tested by performing an allmodconfig openrisc cross compile on
+an aarch64 host.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/barrier.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+index 7538294721bed..8e592c9909023 100644
+--- a/arch/openrisc/include/asm/barrier.h
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -4,6 +4,8 @@
+
+ #define mb() asm volatile ("l.msync" ::: "memory")
+
++#define nop() asm volatile ("l.nop")
++
+ #include <asm-generic/barrier.h>
+
+ #endif /* __ASM_BARRIER_H */
+--
+2.51.0
+
--- /dev/null
+From 84d3620445669b2d5cc6e4a8719ba9e6a2e1fb8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 17:58:55 +0100
+Subject: parisc: Prevent interrupts during reboot
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/process.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index c14ee40302d85..afe17c3ca0bfc 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -85,6 +85,9 @@ void machine_restart(char *cmd)
+ #endif
+ /* set up a new led state on systems shipped with a LED State panel */
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN);
++
++ /* prevent interrupts during reboot */
++ set_eiem(0);
+
+ /* "Normal" system reset */
+ pdc_do_reset();
+--
+2.51.0
+
--- /dev/null
+From c0dbef4090863c789fa9bf287ce8598d6f591d29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:53:32 +0530
+Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
+
+From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+
+[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ]
+
+The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability,
+but they do provide ACS-like features to disable peer transactions and
+validate bus numbers in requests.
+
+Add an ACS quirk for Hamoa & Glymur.
+
+Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index cd2968da288f4..564575affe130 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4950,6 +4950,10 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
+ /* QCOM SA8775P root port */
+ { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },
++ /* QCOM Hamoa root port */
++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs },
++ /* QCOM Glymur root port */
++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs },
+ /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */
+ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs },
+ /* Intel PCH root ports */
+--
+2.51.0
+
--- /dev/null
+From c1f836ab0eae9a737eebcd78abc4542b2eea1dae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 21:04:47 +0530
+Subject: PCI: Enable ACS after configuring IOMMU for OF platforms
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ]
+
+Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets
+'pci_acs_enable' to request that ACS be enabled for any devices enumerated
+in the future.
+
+OF platforms called pci_enable_acs() for the first device before
+of_iommu_configure() called pci_request_acs(), so ACS was never enabled for
+that device (typically a Root Port).
+
+Call pci_enable_acs() later, from pci_dma_configure(), after
+of_dma_configure() has had a chance to call pci_request_acs().
+
+Here's the call path, showing the move of pci_enable_acs() from
+pci_acs_init() to pci_dma_configure(), where it always happens after
+pci_request_acs():
+
+ pci_device_add
+ pci_init_capabilities
+ pci_acs_init
+ - pci_enable_acs
+ - if (pci_acs_enable) <-- previous test
+ - ...
+ device_add
+ bus_notify(BUS_NOTIFY_ADD_DEVICE)
+ iommu_bus_notifier
+ iommu_probe_device
+ iommu_init_device
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ of_dma_configure
+ of_iommu_configure
+ pci_request_acs
+ pci_acs_enable = 1 <-- set
+ + pci_enable_acs
+ + if (pci_acs_enable) <-- new test
+ + ...
+ bus_probe_device
+ device_initial_probe
+ ...
+ really_probe
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ ...
+ pci_enable_acs
+
+Note that we will now call pci_enable_acs() twice for every device, first
+from the iommu_probe_device() path and again from the really_probe() path.
+Presumably that's not an issue since we also call dev->bus->dma_configure()
+twice.
+
+For the ACPI platforms, pci_request_acs() is called during ACPI
+initialization time itself, independent of the IOMMU framework.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 8 ++++++++
+ drivers/pci/pci.c | 10 +---------
+ drivers/pci/pci.h | 1 +
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index fe15e59e7c56e..de500afdcf97c 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1601,6 +1601,14 @@ static int pci_dma_configure(struct device *dev)
+ ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
+ }
+
++ /*
++ * Attempt to enable ACS regardless of capability because some Root
++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
++ * the standard ACS capability but still support ACS via those
++ * quirks.
++ */
++ pci_enable_acs(to_pci_dev(dev));
++
+ pci_put_host_bridge_device(bridge);
+ return ret;
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 92f4876c37f06..1663660661302 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -894,7 +894,7 @@ static void pci_std_enable_acs(struct pci_dev *dev)
+ * pci_enable_acs - enable ACS if hardware support it
+ * @dev: the PCI device
+ */
+-static void pci_enable_acs(struct pci_dev *dev)
++void pci_enable_acs(struct pci_dev *dev)
+ {
+ if (!pci_acs_enable)
+ goto disable_acs_redir;
+@@ -3548,14 +3548,6 @@ bool pci_acs_path_enabled(struct pci_dev *start,
+ void pci_acs_init(struct pci_dev *dev)
+ {
+ dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
+-
+- /*
+- * Attempt to enable ACS regardless of capability because some Root
+- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+- * the standard ACS capability but still support ACS via those
+- * quirks.
+- */
+- pci_enable_acs(dev);
+ }
+
+ /**
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index c2fd92a9ee1ad..5079800f56ceb 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -547,6 +547,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
+ }
+
+ void pci_acs_init(struct pci_dev *dev);
++void pci_enable_acs(struct pci_dev *dev);
+ #ifdef CONFIG_PCI_QUIRKS
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);
+--
+2.51.0
+
--- /dev/null
+From 409a9bb82b393cccb3f3eea59b76bf2212fcd1b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 08:59:51 -0800
+Subject: PCI: Fix pci_slot_lock () device locking
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ]
+
+Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to
+prevent warnings like:
+
+ pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0
+
+Take and release the lock for the bridge providing the slot for the
+lock/trylock and unlock routines.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 15618b87bc4b9..92f4876c37f06 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5318,10 +5318,9 @@ static int pci_bus_trylock(struct pci_bus *bus)
+ /* Do any devices on or below this slot prevent a bus reset? */
+ static bool pci_slot_resetable(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+- if (slot->bus->self &&
+- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
+ return false;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+@@ -5338,7 +5337,10 @@ static bool pci_slot_resetable(struct pci_slot *slot)
+ /* Lock devices from the top of the tree down */
+ static void pci_slot_lock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge)
++ pci_dev_lock(bridge);
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5353,7 +5355,7 @@ static void pci_slot_lock(struct pci_slot *slot)
+ /* Unlock devices from the bottom of the tree up */
+ static void pci_slot_unlock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5363,12 +5365,18 @@ static void pci_slot_unlock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ }
+
+ /* Return 1 on successful lock, 0 on contention */
+ static int pci_slot_trylock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge && !pci_dev_trylock(bridge))
++ return 0;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5393,6 +5401,9 @@ static int pci_slot_trylock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 24acb237c91d8c0f835695b904fa4e7f8599c811 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 17:02:08 -0700
+Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset
+
+From: Alex Williamson <alex.williamson@nvidia.com>
+
+[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ]
+
+User forums report issues when assigning ASM1164 SATA controllers to VMs,
+especially in configurations with multiple controllers. Logs show the
+device fails to retrain after bus reset. Reports suggest this is an issue
+across multiple platforms. The device indicates support for PM reset,
+therefore the device still has a viable function level reset mechanism.
+The reporting user confirms the device is well behaved in this use case
+with bus reset disabled.
+
+Reported-by: Patrick Bianchi <patrick.w.bianchi@gmail.com>
+Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
+Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index c925e0be5f476..cd2968da288f4 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3624,6 +3624,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset);
+ */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
+
++/*
++ * Reports from users making use of PCI device assignment with ASM1164
++ * controllers indicate an issue with bus reset where the device fails to
++ * retrain. The issue appears more common in configurations with multiple
++ * controllers. The device does indicate PM reset support (NoSoftRst-),
++ * therefore this still leaves a viable reset method.
++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset);
++
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
+ /*
+--
+2.51.0
+
--- /dev/null
+From 9729423cf794d729429056ce30c7d115e45b593c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 16:44:06 +0800
+Subject: PCI: Mark Nvidia GB10 to avoid bus reset
+
+From: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+
+[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ]
+
+After asserting Secondary Bus Reset to downstream devices via a GB10 Root
+Port, the link may not retrain correctly, e.g., the link may retrain with a
+lower lane count or config accesses to downstream devices may fail.
+
+Prevent use of Secondary Bus Reset for devices below GB10.
+
+Signed-off-by: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+[bhelgaas: drop pci_ids.h update (only used once), update commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 564575affe130..0319aca1f762b 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3581,6 +3581,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+ }
+
++/*
++ * After asserting Secondary Bus Reset to downstream devices via a GB10
++ * Root Port, the link may not retrain correctly.
++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset);
++
+ /*
+ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
+ * prevented for those affected devices.
+--
+2.51.0
+
--- /dev/null
+From a10f4c49fb9e580391fea45078bc2c56aaebdf6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:36 -0800
+Subject: perf callchain: Fix srcline printing with inlines
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ]
+
+sample__fprintf_callchain() was using map__fprintf_srcline() which won't
+report inline line numbers.
+
+Fix by using the srcline from the callchain and falling back to the map
+variant.
+
+Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel_fprintf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
+index fb498a723a006..3aedff5e6fa4d 100644
+--- a/tools/perf/util/evsel_fprintf.c
++++ b/tools/perf/util/evsel_fprintf.c
+@@ -170,8 +170,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
+ printed += fprintf(fp, ")");
+ }
+
+- if (print_srcline)
+- printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ if (print_srcline) {
++ if (node->srcline)
++ printed += fprintf(fp, "\n %s", node->srcline);
++ else
++ printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ }
+
+ if (sym && sym->inlined)
+ printed += fprintf(fp, " (inlined)");
+--
+2.51.0
+
--- /dev/null
+From dcf976a22543f7fac5279826438cfabfd8d1e88c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 19:17:12 +0800
+Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ]
+
+Disabling PHYs in runtime usually causes the client with external abort
+exception or similar issue due to lack of API to notify clients about PHY
+removal. This patch removes the possibility to unbind i.MX PHY drivers in
+runtime.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+index 62d6d6849ad60..4328396cd13de 100644
+--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+@@ -194,6 +194,7 @@ static struct platform_driver imx8mq_usb_phy_driver = {
+ .driver = {
+ .name = "imx8mq-usb-phy",
+ .of_match_table = imx8mq_usb_phy_of_match,
++ .suppress_bind_attrs = true,
+ }
+ };
+ module_platform_driver(imx8mq_usb_phy_driver);
+--
+2.51.0
+
--- /dev/null
+From 1f4e19c8b2ca8a0a1277ca3a96349f10b4379ebe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 10:03:58 +0800
+Subject: pstore: ram_core: fix incorrect success return when vmap() fails
+
+From: Ruipeng Qi <ruipengqi3@gmail.com>
+
+[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ]
+
+In persistent_ram_vmap(), vmap() may return NULL on failure.
+
+If offset is non-zero, adding offset_in_page(start) causes the function
+to return a non-NULL pointer even though the mapping failed.
+persistent_ram_buffer_map() therefore incorrectly returns success.
+
+Subsequent access to prz->buffer may dereference an invalid address
+and cause crashes.
+
+Add proper NULL checking for vmap() failures.
+
+Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
+Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 97ec9041b9b98..ccaa138a57b7c 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -443,6 +443,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot);
+ kfree(pages);
+
++ /*
++ * vmap() may fail and return NULL. Do not add the offset in this
++ * case, otherwise a NULL mapping would appear successful.
++ */
++ if (!vaddr)
++ return NULL;
++
+ /*
+ * Since vmap() uses page granularity, we must add the offset
+ * into the page here, to get the byte granularity address
+--
+2.51.0
+
--- /dev/null
+From c66ef24e1be3ad159ee87392462a830d68227006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 17:16:51 +0100
+Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask"
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ]
+
+This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed.
+
+Almost every register in this chip can be customized via OTP
+memory. Somehow the value for R19, which decide if the flag is set
+on read or write operation, seems to have been overwritten for the chip
+the original patch were written for.
+
+Revert the change to follow the default behavior.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9052-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c
+index 06c500bf4d57e..5faf3766a5e20 100644
+--- a/drivers/mfd/da9052-spi.c
++++ b/drivers/mfd/da9052-spi.c
+@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)
+ spi_set_drvdata(spi, da9052);
+
+ config = da9052_regmap_config;
+- config.write_flag_mask = 1;
++ config.read_flag_mask = 1;
+ config.reg_bits = 7;
+ config.pad_bits = 1;
+ config.val_bits = 8;
+--
+2.51.0
+
--- /dev/null
+From 1eed435c3c9dbf30b1815a51b97a246905de7df6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 13:47:33 +0100
+Subject: rnbd-srv: Zero the rsp buffer before using it
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ]
+
+Before using the data buffer to send back the response message, zero it
+completely. This prevents any stray bytes to be picked up by the client
+side when there the message is exchanged between different protocol
+versions.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-srv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
+index 9c5d52335e17c..6bec309719066 100644
+--- a/drivers/block/rnbd/rnbd-srv.c
++++ b/drivers/block/rnbd/rnbd-srv.c
+@@ -535,6 +535,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp,
+ {
+ struct rnbd_dev *rnbd_dev = sess_dev->rnbd_dev;
+
++ memset(rsp, 0, sizeof(*rsp));
++
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP);
+ rsp->device_id =
+ cpu_to_le32(sess_dev->device_id);
+@@ -649,6 +651,7 @@ static int process_msg_sess_info(struct rtrs_srv *rtrs,
+ srv_sess->sessname, srv_sess->ver,
+ sess_info_msg->ver, RNBD_PROTO_VER_MAJOR);
+
++ memset(rsp, 0, sizeof(*rsp));
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP);
+ rsp->ver = srv_sess->ver;
+
+--
+2.51.0
+
--- /dev/null
+From a15f032a136b37616a0de2575f96453ec9602cab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 17:35:19 +0000
+Subject: rtc: interface: Alarm race handling should not discard preceding
+ error
+
+From: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+
+[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ]
+
+Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting
+alarm") should not discard any errors from the preceding validations.
+
+Prior to that commit, if the alarm feature was disabled, or the
+set_alarm failed, a meaningful error code would be returned to the
+caller for further action.
+
+After, more often than not, the __rtc_read_time will cause a success
+return code instead, misleading the caller.
+
+An example of this is when timer_enqueue is called for a rtc-abx080x
+device. Since that driver does not clear the alarm feature bit, but
+instead relies on the set_alarm operation to return invalid, the discard
+of the return code causes very different behaviour; i.e.
+ hwclock: select() to /dev/rtc0 to wait for clock tick timed out
+
+Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm")
+Signed-off-by: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+Reviewed-by: Esben Haabendal <esben@geanix.com>
+Tested-by: Nick Bowler <nbowler@draconx.ca>
+Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 9d2a2637246eb..7c9487050b25b 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -456,7 +456,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ * are in, we can return -ETIME to signal that the timer has already
+ * expired, which is true in both cases.
+ */
+- if ((scheduled - now) <= 1) {
++ if (!err && (scheduled - now) <= 1) {
+ err = __rtc_read_time(rtc, &tm);
+ if (err)
+ return err;
+--
+2.51.0
+
--- /dev/null
+From 5590e0c140cd2dc868deba9ebcf247430b90f5e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 10:14:12 +0100
+Subject: s390/perf: Disable register readout on sampling events
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ]
+
+Running commands
+ # ./perf record -IR0,R1 -a sleep 1
+extracts and displays register value of general purpose register r1 and r0.
+However the value displayed of any register is random and does not
+reflect the register value recorded at the time of the sample interrupt.
+
+The sampling device driver on s390 creates a very large buffer
+for the hardware to store the samples. Only when that large buffer
+gets full an interrupt is generated and many hundreds of sample
+entries are processed and copied to the kernel ring buffer and
+eventually get copied to the perf tool. It is during the copy
+to the kernel ring buffer that each sample is processed (on s390)
+and at that time the register values are extracted.
+This is not the original goal, the register values should be read
+when the samples are created not when the samples are copied to the
+kernel ring buffer.
+
+Prevent this event from being installed in the first place and
+return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index fc45f123f3bdc..0c60252a757d2 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -887,7 +887,7 @@ static bool is_callchain_event(struct perf_event *event)
+ u64 sample_type = event->attr.sample_type;
+
+ return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER |
+- PERF_SAMPLE_STACK_USER);
++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER);
+ }
+
+ static int cpumsf_pmu_event_init(struct perf_event *event)
+--
+2.51.0
+
--- /dev/null
+From e288a57ab3133ce7d6d9a9d935e2fd1311e5c0d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 16:47:07 +0100
+Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ]
+
+Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
+to scripts/Makefile.extrawarn, since clang generates warnings for the
+dummy variable in typecheck():
+
+ CC arch/s390/purgatory/purgatory.o
+ arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
+ 221 | return psw_bits(regs->psw).pstate;
+ | ^
+ arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
+ 98 | typecheck(psw_t, __psw); \
+ | ^
+ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
+ 11 | typeof(x) __dummy2; \
+ | ^
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/purgatory/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
+index e03f234fcfbef..efbbdc7f6e9d7 100644
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -28,6 +28,7 @@ KBUILD_CFLAGS += -fno-stack-protector
+ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+ KBUILD_CFLAGS += $(CLANG_FLAGS)
+ KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
+ KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS))
+
+ # Since we link purgatory with -r unresolved symbols are not checked, so we
+--
+2.51.0
+
--- /dev/null
+From 4a4b1bb1971ab79f76ecd8760da2cf10effbdb77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:29 +0530
+Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
+ termination is done
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ]
+
+Clear rx_running flag only after DMA teardown polling completes. In the
+previous implementation the flag was being cleared while hardware teardown
+was still in progress, creating a mismatch between software state
+(flag = 0, "ready") and hardware state (still terminating).
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 98df9d4ceaecd..e4e2bf9cd4716 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -854,7 +854,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+
+ cookie = dma->rx_cookie;
+- dma->rx_running = 0;
+
+ /* Re-enable RX FIFO interrupt now that transfer is complete */
+ if (priv->habit & UART_HAS_RHR_IT_DIS) {
+@@ -888,6 +887,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+ ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+
++ dma->rx_running = 0;
+ p->port.icount.rx += ret;
+ p->port.icount.buf_overrun += count - ret;
+ out:
+--
+2.51.0
+
--- /dev/null
+From 908f47126b1be47ea0d80b4dc6cfb62e64c6c492 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 17:54:25 +0300
+Subject: serial: 8250_dw: handle clock enable errors in runtime_resume
+
+From: Artem Shimko <a.shimko.dev@gmail.com>
+
+[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ]
+
+Add error checking for clk_prepare_enable() calls in
+dw8250_runtime_resume(). Currently if either clock fails to enable,
+the function returns success while leaving clocks in inconsistent state.
+
+This change implements comprehensive error handling by checking the return
+values of both clk_prepare_enable() calls. If the second clock enable
+operation fails after the first clock has already been successfully
+enabled, the code now properly cleans up by disabling and unpreparing
+the first clock before returning. The error code is then propagated to
+the caller, ensuring that clock enable failures are properly reported
+rather than being silently ignored.
+
+Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
+Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index bcf770f344dac..211dc88ce4e2c 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -684,11 +684,18 @@ static int dw8250_runtime_suspend(struct device *dev)
+
+ static int dw8250_runtime_resume(struct device *dev)
+ {
++ int ret;
+ struct dw8250_data *data = dev_get_drvdata(dev);
+
+- clk_prepare_enable(data->pclk);
++ ret = clk_prepare_enable(data->pclk);
++ if (ret)
++ return ret;
+
+- clk_prepare_enable(data->clk);
++ ret = clk_prepare_enable(data->clk);
++ if (ret) {
++ clk_disable_unprepare(data->pclk);
++ return ret;
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
ata-pata_ftide010-fix-some-dma-timings.patch
sunrpc-auth_gss-fix-memory-leaks-in-xdr-decoding-error-paths.patch
sunrpc-fix-gss_auth-kref-leak-in-gss_alloc_msg-error-path.patch
+perf-callchain-fix-srcline-printing-with-inlines.patch
+rtc-interface-alarm-race-handling-should-not-discard.patch
+audit-add-fchmodat2-to-change-attributes-class.patch
+hfsplus-fix-volume-corruption-issue-for-generic-498.patch
+audit-add-missing-syscalls-to-read-class.patch
+hfsplus-pretend-special-inodes-as-regular-files.patch
+minix-add-required-sanity-checking-to-minix_check_su.patch
+tools-power-cpupower-reset-errno-before-strtoull.patch
+s390-purgatory-add-wno-default-const-init-unsafe-to-.patch
+arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch
+rnbd-srv-zero-the-rsp-buffer-before-using-it.patch
+x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch
+efi-cper-don-t-dump-the-entire-memory-region.patch
+apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch
+efi-cper-don-t-go-past-the-arm-processor-cper-record.patch
+acpica-abort-aml-bytecode-execution-when-executing-a.patch
+s390-perf-disable-register-readout-on-sampling-event.patch
+xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch
+blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch
+sparc-synchronize-user-stack-on-fork-and-clone.patch
+sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch
+bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch
+clocksource-drivers-sh_tmu-always-leave-device-runni.patch
+clocksource-drivers-timer-integrator-ap-add-missing-.patch
+mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch
+pstore-ram_core-fix-incorrect-success-return-when-vm.patch
+arm64-tegra-smaug-add-usb-role-switch-support.patch
+parisc-prevent-interrupts-during-reboot.patch
+media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch
+media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch
+media-omap3isp-isppreview-always-clamp-in-preview_tr.patch
+media-omap3isp-set-initial-format.patch
+asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch
+asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch
+media-adv7180-fix-frame-interval-in-progressive-mode.patch
+media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch
+media-solo6x10-check-for-out-of-bounds-chip_id.patch
+media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch
+drm-account-property-blob-allocations-to-memcg.patch
+hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch
+virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch
+drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch
+drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch
+hid-multitouch-add-egalaxtouch-exc3188-support.patch
+gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch
+spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch
+asoc-es8328-add-error-unwind-in-resume.patch
+modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch
+jfs-add-missing-set_freezable-for-freezable-kthread.patch
+jfs-nlink-overflow-in-jfs_rename.patch
+dm-remove-fake-timeout-to-avoid-leak-request.patch
+iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch
+wifi-libertas-fix-warning-in-usb_tx_block.patch
+netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch
+netfilter-xt_tcpmss-check-remaining-length-before-re.patch
+openrisc-define-arch-specific-version-of-nop.patch
+net-usb-r8152-fix-transmit-queue-timeout.patch
+net-rds-no-shortcut-out-of-rds_conn_error.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch
+ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch
+bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch
+bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch
+octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch
+wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch
+net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch
+vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch
+net-rds-clear-reconnect-pending-bit.patch
+pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch
+pci-fix-pci_slot_lock-device-locking.patch
+pci-enable-acs-after-configuring-iommu-for-of-platfo.patch
+pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch
+pci-mark-nvidia-gb10-to-avoid-bus-reset.patch
+myri10ge-avoid-uninitialized-variable-use.patch
+nfc-nxp-nci-remove-interrupt-trigger-type.patch
+mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch
+clk-microchip-core-correct-return-value-on-_get_pare.patch
+m68k-nommu-fix-memmove-with-differently-aligned-src-.patch
+serial-8250_dw-handle-clock-enable-errors-in-runtime.patch
+serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch
+fix-it87_wdt-early-reboot-by-reporting-running-timer.patch
+binder-don-t-use-pk-through-printk.patch
+phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch
+revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch
+iio-magnetometer-remove-irqf_oneshot.patch
+mips-loongson-make-cpumask_of_node-robust-against-nu.patch
+include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch
+arm-9467-1-mm-don-t-use-pk-through-printk.patch
+drm-amd-display-avoid-updating-surface-with-the-same.patch
+drm-amdgpu-add-hainan-clock-adjustment.patch
+drm-radeon-add-hainan-clock-adjustment.patch
+ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch
+ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch
--- /dev/null
+From 1e103f91110ed08d0d145e338efd2d4d7015580c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 13:40:29 +0000
+Subject: sparc: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ]
+
+Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros").
+
+glibc-2.42 drops the legacy termio struct, but the ioctls.h header still
+defines some TC* constants in terms of termio (via sizeof). Hardcode the
+values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h
+index 7fd2f5873c9e7..a8bbdf9877a41 100644
+--- a/arch/sparc/include/uapi/asm/ioctls.h
++++ b/arch/sparc/include/uapi/asm/ioctls.h
+@@ -5,10 +5,10 @@
+ #include <asm/ioctl.h>
+
+ /* Big T */
+-#define TCGETA _IOR('T', 1, struct termio)
+-#define TCSETA _IOW('T', 2, struct termio)
+-#define TCSETAW _IOW('T', 3, struct termio)
+-#define TCSETAF _IOW('T', 4, struct termio)
++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */
++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */
++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */
++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */
+ #define TCSBRK _IO('T', 5)
+ #define TCXONC _IO('T', 6)
+ #define TCFLSH _IO('T', 7)
+--
+2.51.0
+
--- /dev/null
+From 7b2ce60e39b6a4141464d72ae46f407c4cabe928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:47:52 +0100
+Subject: sparc: Synchronize user stack on fork and clone
+
+From: Andreas Larsson <andreas@gaisler.com>
+
+[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ]
+
+Flush all uncommitted user windows before calling the generic syscall
+handlers for clone, fork, and vfork.
+
+Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the
+arch-specific syscall wrappers for these syscalls will attempt to flush
+all windows (including user windows).
+
+In the window overflow trap handlers on both SPARC{32|64},
+if the window can't be stored (i.e due to MMU related faults) the routine
+backups the user window and increments a thread counter (wsaved).
+
+By adding a synchronization point after the flush attempt, when fault
+handling is enabled, any uncommitted user windows will be flushed.
+
+Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394
+Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++--------------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
+index 0442ab00518d3..7d69877511fac 100644
+--- a/arch/sparc/kernel/process.c
++++ b/arch/sparc/kernel/process.c
+@@ -17,14 +17,18 @@
+
+ asmlinkage long sparc_fork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+ struct kernel_clone_args args = {
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs)
+
+ asmlinkage long sparc_vfork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+-
+ struct kernel_clone_args args = {
+ .flags = CLONE_VFORK | CLONE_VM,
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs)
+
+ asmlinkage long sparc_clone(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
+- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ unsigned long orig_i1;
++ unsigned int flags;
+ long ret;
++ struct kernel_clone_args args = {0};
+
+- struct kernel_clone_args args = {
+- .flags = (flags & ~CSIGNAL),
+- .exit_signal = (flags & CSIGNAL),
+- .tls = regs->u_regs[UREG_I3],
+- };
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ args.flags = (flags & ~CSIGNAL);
++ args.exit_signal = (flags & CSIGNAL);
++ args.tls = regs->u_regs[UREG_I3];
+
+ #ifdef CONFIG_COMPAT
+ if (test_thread_flag(TIF_32BIT)) {
+--
+2.51.0
+
--- /dev/null
+From 600b78cf1ea0004a39b82df55840290a0d073c19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 20:30:04 +0800
+Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
+
+From: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+
+[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ]
+
+spi_mem_dirmap_create() may reconfigure controller-wide settings,
+which can interfere with concurrent transfers to other devices
+sharing the same SPI controller but using different chip selects.
+
+Wrap the ->dirmap_create() callback with spi_mem_access_start() and
+spi_mem_access_end() to serialize access and prevent cross-CS
+interference during dirmap creation.
+
+This patch has been verified on a setup where a SPI TPM is connected
+to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1
+of the same controller. Without this patch, spi_mem_dirmap_create()
+for the SPI NOR flash interferes with ongoing SPI TPM data transfers,
+resulting in failure to create the TPM device. This was tested on an
+ASPEED AST2700 EVB.
+
+Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 4682f49dc7330..5260923b6a3d6 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -522,9 +522,18 @@ spi_mem_dirmap_create(struct spi_mem *mem,
+
+ desc->mem = mem;
+ desc->info = *info;
+- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create)
++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) {
++ ret = spi_mem_access_start(mem);
++ if (ret) {
++ kfree(desc);
++ return ERR_PTR(ret);
++ }
++
+ ret = ctlr->mem_ops->dirmap_create(desc);
+
++ spi_mem_access_end(mem);
++ }
++
+ if (ret) {
+ desc->nodirmap = true;
+ if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
+--
+2.51.0
+
--- /dev/null
+From 897b427622ad43045dffbcf3f116418f9f79912e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:47:45 +0530
+Subject: tools/power cpupower: Reset errno before strtoull()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ]
+
+cpuidle_state_get_one_value() never cleared errno before calling
+strtoull(), so a prior ERANGE caused every cpuidle counter read to
+return zero. Reset errno to 0 before the conversion so each sysfs read
+is evaluated independently.
+
+Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index c15d0de12357f..e7b8c56638370 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -148,6 +148,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu,
+ if (len == 0)
+ return 0;
+
++ errno = 0;
+ value = strtoull(linebuf, &endp, 0);
+
+ if (endp == linebuf || errno == ERANGE)
+--
+2.51.0
+
--- /dev/null
+From 0000c9cf3ec10ace3b99e83c94ac2a606f41ad3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:45 +0100
+Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ]
+
+The unpacked unions within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)'
+ and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 239 | } u;
+ | ^
+
+./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+
+With the recent changes to compile-test the UAPI headers in more cases,
+these warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warnings.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/vbox_vmmdev_types.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
+index f8a8d6b3c5219..436678d4fb24f 100644
+--- a/include/uapi/linux/vbox_vmmdev_types.h
++++ b/include/uapi/linux/vbox_vmmdev_types.h
+@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 {
+ /** Relative to the request header. */
+ __u32 offset;
+ } page_list;
+- } u;
++ } __packed u;
+ } __packed;
+ VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
+
+@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 {
+ union {
+ __u64 phys_addr;
+ __u64 linear_addr;
+- } u;
++ } __packed u;
+ } __packed pointer;
+ struct {
+ /** Size of the buffer described by the page list. */
+--
+2.51.0
+
--- /dev/null
+From 680779835d455df662aa333c6abb2390e52ecbb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:34:00 +0100
+Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ]
+
+The gcc-16.0.1 snapshot produces a false-positive warning that turns
+into a build failure with CONFIG_WERROR:
+
+In file included from arch/x86/include/asm/string.h:6,
+ from net/vmw_vsock/vmci_transport.c:10:
+In function 'vmci_transport_packet_init',
+ inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2:
+arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull]
+ 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy'
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+
+This seems relatively harmless, and it so far the only instance of this
+warning I have found. The __vmci_transport_send_control_pkt function
+is called either with wait=NULL or with one of the type values that
+pass 'wait' into memcpy() here, but not from the same caller.
+
+Replacing the memcpy with a struct assignment is otherwise the same
+but avoids the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Bryan Tan <bryan-bt.tan@broadcom.com>
+Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 912bafcf825b2..5a85e1ce2aa48 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt,
+
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
+- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
++ pkt->u.wait = *wait;
+ break;
+
+ case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
+--
+2.51.0
+
--- /dev/null
+From 5b3865817c00c70301aa2ea539357c3fd296fa70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:56:11 +0000
+Subject: wifi: ath10k: fix lock protection in
+ ath10k_wmi_event_peer_sta_ps_state_chg()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ]
+
+ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to
+assert that ar->data_lock should be held by the caller, but neither
+ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock
+before calling this function.
+
+The field arsta->peer_ps_state is documented as protected by
+ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable,
+ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock.
+
+Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update,
+and remove the lockdep_assert_held() to be aligned with new locking,
+following the pattern used by other WMI event handlers in the driver.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu
+[removed excess blank line]
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 6293dbc32bde4..2852d31cedd6d 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5282,8 +5282,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ struct ath10k_sta *arsta;
+ u8 peer_addr[ETH_ALEN];
+
+- lockdep_assert_held(&ar->data_lock);
+-
+ ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data;
+ ether_addr_copy(peer_addr, ev->peer_macaddr.addr);
+
+@@ -5298,7 +5296,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ }
+
+ arsta = (struct ath10k_sta *)sta->drv_priv;
++ spin_lock_bh(&ar->data_lock);
+ arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state);
++ spin_unlock_bh(&ar->data_lock);
+
+ exit:
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From 1a08c9ae0520b6416b1e7903ede90b546735d7e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:30:05 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il3945_store_measurement()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ]
+
+il3945_store_measurement() calls il3945_get_measurement() which internally
+calls il_send_cmd_sync() without holding il->mutex. However,
+il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that
+callers must hold this lock.
+
+Other sysfs store functions in the same file properly acquire the mutex:
+- il3945_store_flags() acquires mutex at 3945-mac.c:3110
+- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144
+
+Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call
+in the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 55c00a07bc4d3..a9d06dd5e19ef 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3270,7 +3270,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
+
+ D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n",
+ type, params.channel, buf);
++ mutex_lock(&il->mutex);
+ il3945_get_measurement(il, ¶ms, type);
++ mutex_unlock(&il->mutex);
+
+ return count;
+ }
+--
+2.51.0
+
--- /dev/null
+From 26056c83b099718ad14ff611b5b7d5cffef69240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:40:39 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il4965_store_tx_power()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ]
+
+il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex.
+However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating
+that callers must hold this lock.
+
+All other callers of il_set_tx_power() properly acquire the mutex:
+- il_bg_scan_completed() acquires mutex at common.c:1683
+- il_mac_config() acquires mutex at common.c:5006
+- il3945_commit_rxon() and il4965_commit_rxon() are called via work
+ queues that hold the mutex (like il4965_bg_alive_start)
+
+Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in
+the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 6e5decf79a06b..7ef27f95c5265 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4613,7 +4613,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr,
+ if (ret)
+ IL_INFO("%s is not in decimal form.\n", buf);
+ else {
++ mutex_lock(&il->mutex);
+ ret = il_set_tx_power(il, val, false);
++ mutex_unlock(&il->mutex);
+ if (ret)
+ IL_ERR("failed setting tx power (0x%08x).\n", ret);
+ else
+--
+2.51.0
+
--- /dev/null
+From ae5de5e2112656d1809f5974491b194ac51e4d20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:58:06 +0100
+Subject: wifi: libertas: fix WARNING in usb_tx_block
+
+From: Szymon Wilczek <swilczek.lx@gmail.com>
+
+[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ]
+
+The function usb_tx_block() submits cardp->tx_urb without ensuring that
+any previous transmission on this URB has completed. If a second call
+occurs while the URB is still active (e.g. during rapid firmware loading),
+usb_submit_urb() detects the active state and triggers a warning:
+'URB submitted while active'.
+
+Fix this by enforcing serialization: call usb_kill_urb() before
+submitting the new request. This ensures the URB is idle and safe to reuse.
+
+Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
+Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
+Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index 2240b4db8c036..d98c81539ba53 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb
+ goto tx_ret;
+ }
+
++ usb_kill_urb(cardp->tx_urb);
++
+ usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
+ usb_sndbulkpipe(cardp->udev,
+ cardp->ep_out),
+--
+2.51.0
+
--- /dev/null
+From 7f6b5377fc41cb5b0e3c80e8deb4b0cf8163396a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 12:00:08 +0800
+Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when
+ CONFIG_X86_PAE is set
+
+From: Hou Wenlong <houwenlong.hwl@antgroup.com>
+
+[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ]
+
+The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests
+do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds
+different pagetables depending on whether CONFIG_X86_PAE is set.
+Therefore, enabling PAE mode for 32-bit KVM guests without
+CONFIG_X86_PAE being set would result in a boot failure during CR3
+loading.
+
+Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <d09ce9a134eb9cbc16928a5b316969f8ba606b81.1768017442.git.houwenlong.hwl@antgroup.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/pvh/head.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
+index bfd4e63a90cbe..f7713d5d07f9f 100644
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -69,10 +69,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
+
+ mov $_pa(early_stack_end), %esp
+
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ /* Enable PAE mode. */
+ mov %cr4, %eax
+ orl $X86_CR4_PAE, %eax
+ mov %eax, %cr4
++#endif
+
+ #ifdef CONFIG_X86_64
+ /* Enable Long mode. */
+--
+2.51.0
+
--- /dev/null
+From 14deb1d3d439bb8f1e67d58bd230d30d77acd0f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 17:47:29 -0500
+Subject: xenbus: Use .freeze/.thaw to handle xenbus devices
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ]
+
+The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming
+from s3 or s2idle disconnects its PV devices during resume. The
+backends are not expecting this and do not reconnect.
+
+b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/
+resume/chkpt") changed xen_suspend()/do_suspend() from
+PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the
+suspend/resume callbacks remained.
+
+.freeze/restore are used with hiberation where Linux restarts in a new
+place in the future. .suspend/resume are useful for runtime power
+management for the duration of a boot.
+
+The current behavior of the callbacks works for an xl save/restore or
+live migration where the domain is restored/migrated to a new location
+and connecting to a not-already-connected backend.
+
+Change xenbus_pm_ops to use .freeze/thaw/restore and drop the
+.suspend/resume hook. This matches the use in drivers/xen/manage.c for
+save/restore and live migration. With .suspend/resume empty, PV devices
+are left connected during s2idle and s3, so PV devices are not changed
+and work after resume.
+
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Acked-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index 480944606a3c9..73cf4810715e4 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev)
+ }
+
+ static const struct dev_pm_ops xenbus_pm_ops = {
+- .suspend = xenbus_dev_suspend,
+- .resume = xenbus_frontend_dev_resume,
+ .freeze = xenbus_dev_suspend,
+ .thaw = xenbus_dev_cancel,
+- .restore = xenbus_dev_resume,
++ .restore = xenbus_frontend_dev_resume,
+ };
+
+ static struct xen_bus_type xenbus_frontend = {
+--
+2.51.0
+
--- /dev/null
+From b804d52b7167d0396205da1643b85049d3fbc0ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 00:32:14 +0800
+Subject: ACPI: processor: Fix NULL-pointer dereference in
+ acpi_processor_errata_piix4()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ]
+
+In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
+device and then reassigned an ISA device:
+
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
+
+If the first lookup succeeds but the second fails, dev becomes NULL. This
+leads to a potential null-pointer dereference when dev_dbg() is called:
+
+ if (errata.piix4.bmisx)
+ dev_dbg(&dev->dev, ...);
+
+To prevent this, use two temporary pointers and retrieve each device
+independently, avoiding overwriting dev with a possible NULL value.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+[ rjw: Subject adjustment, added an empty code line ]
+Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_processor.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index cfa75b14caa2b..669398045c0fd 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -33,6 +33,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ {
+ u8 value1 = 0;
+ u8 value2 = 0;
++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL;
+
+
+ if (!dev)
+@@ -90,12 +91,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * each IDE controller's DMA status to make sure we catch all
+ * DMA activity.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- errata.piix4.bmisx = pci_resource_start(dev, 4);
+- pci_dev_put(dev);
++ if (ide_dev) {
++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
++ pci_dev_put(ide_dev);
+ }
+
+ /*
+@@ -107,24 +108,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * disable C3 support if this is enabled, as some legacy
+ * devices won't operate well if fast DMA is disabled.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB_0,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- pci_read_config_byte(dev, 0x76, &value1);
+- pci_read_config_byte(dev, 0x77, &value2);
++ if (isa_dev) {
++ pci_read_config_byte(isa_dev, 0x76, &value1);
++ pci_read_config_byte(isa_dev, 0x77, &value2);
+ if ((value1 & 0x80) || (value2 & 0x80))
+ errata.piix4.fdma = 1;
+- pci_dev_put(dev);
++ pci_dev_put(isa_dev);
+ }
+
+ break;
+ }
+
+- if (errata.piix4.bmisx)
+- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
+- if (errata.piix4.fdma)
+- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
++ if (ide_dev)
++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
++
++ if (isa_dev)
++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From bdd4befd3e0afc5abcef0db009741a47e1bc2c0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 13:25:33 +0100
+Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ]
+
+The ACPI specification states that when executing AML_FATAL_OP,
+the OS should log the fatal error event and shutdown in a timely
+fashion.
+
+Windows complies with this requirement by immediatly entering a
+Bso_d, effectively aborting the execution of the AML bytecode in
+question.
+
+ACPICA however might continue with the AML bytecode execution
+should acpi_os_signal() simply return AE_OK. This will cause issues
+because ACPI BIOS implementations might assume that the Fatal()
+operator does not return.
+
+Fix this by aborting the AML bytecode execution in such a case
+by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a
+local variable because of its small size (12 bytes) and to ensure
+that acpi_os_signal() always receives valid information about the
+fatal ACPI BIOS error.
+
+Link: https://github.com/acpica/acpica/commit/d516c7758ba6
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++---------------------
+ 1 file changed, 18 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
+index 140aae0096904..109abf3e12fce 100644
+--- a/drivers/acpi/acpica/exoparg3.c
++++ b/drivers/acpi/acpica/exoparg3.c
+@@ -10,6 +10,7 @@
+ #include <acpi/acpi.h>
+ #include "accommon.h"
+ #include "acinterp.h"
++#include <acpi/acoutput.h>
+ #include "acparser.h"
+ #include "amlcode.h"
+
+@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3")
+ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ {
+ union acpi_operand_object **operand = &walk_state->operands[0];
+- struct acpi_signal_fatal_info *fatal;
+- acpi_status status = AE_OK;
++ struct acpi_signal_fatal_info fatal;
+
+ ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R,
+ acpi_ps_get_opcode_name(walk_state->opcode));
+@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ switch (walk_state->opcode) {
+ case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */
+
+- ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+- "FatalOp: Type %X Code %X Arg %X "
+- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
+- (u32)operand[0]->integer.value,
+- (u32)operand[1]->integer.value,
+- (u32)operand[2]->integer.value));
+-
+- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info));
+- if (fatal) {
+- fatal->type = (u32) operand[0]->integer.value;
+- fatal->code = (u32) operand[1]->integer.value;
+- fatal->argument = (u32) operand[2]->integer.value;
+- }
++ fatal.type = (u32)operand[0]->integer.value;
++ fatal.code = (u32)operand[1]->integer.value;
++ fatal.argument = (u32)operand[2]->integer.value;
+
+- /* Always signal the OS! */
++ ACPI_BIOS_ERROR((AE_INFO,
++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n",
++ fatal.type, fatal.code, fatal.argument));
+
+- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal);
++ /* Always signal the OS! */
+
+- /* Might return while OS is shutting down, just continue */
++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal);
+
+- ACPI_FREE(fatal);
+- goto cleanup;
++ /*
++ * Might return while OS is shutting down, so abort the AML execution
++ * by returning an error.
++ */
++ return_ACPI_STATUS(AE_ERROR);
+
+ case AML_EXTERNAL_OP:
+ /*
+@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ * wrong if an external opcode ever gets here.
+ */
+ ACPI_ERROR((AE_INFO, "Executed External Op"));
+- status = AE_OK;
+- goto cleanup;
++
++ return_ACPI_STATUS(AE_OK);
+
+ default:
+
+ ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X",
+ walk_state->opcode));
+
+- status = AE_AML_BAD_OPCODE;
+- goto cleanup;
++ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
+ }
+-
+-cleanup:
+-
+- return_ACPI_STATUS(status);
+ }
+
+ /*******************************************************************************
+--
+2.51.0
+
--- /dev/null
+From 28ab4cc1a3fcd03802d7dcd3fef5b742bfaea4b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 08:38:29 +0000
+Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
+
+From: Lianqin Hu <hulianqin@vivo.com>
+
+[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ]
+
+Setting up the interface when suspended/resumeing fail on this card.
+Adding a reset and delay quirk will eliminate this problem.
+
+usb 1-1: New USB device found, idVendor=001f, idProduct=0b21
+usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+usb 1-1: Product: AB13X USB Audio
+usb 1-1: Manufacturer: Generic
+usb 1-1: SerialNumber: 20210926172016
+
+Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
+Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index f24a334316a29..778304f349699 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1768,6 +1768,8 @@ struct usb_audio_quirk_flags_table {
+
+ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ /* Device matches */
++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */
++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
+ DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
+ QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
+--
+2.51.0
+
--- /dev/null
+From 3795363b160300eaba7dcdf62963a92ab1c50ece Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:07 +0100
+Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ]
+
+At silencing the playback URB packets in the implicit fb mode before
+the actual playback, we blindly assume that the received packets fit
+with the buffer size. But when the setup in the capture stream
+differs from the playback stream (e.g. due to the USB core limitation
+of max packet size), such an inconsistency may lead to OOB writes to
+the buffer, resulting in a crash.
+
+For addressing it, add a sanity check of the transfer buffer size at
+prepare_silent_urb(), and stop the data copy if the received data
+overflows. Also, report back the transfer error properly from there,
+too.
+
+Note that this doesn't fix the root cause of the playback error
+itself, but this merely covers the kernel Oops.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
+Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 39 ++++++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 17 deletions(-)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index f7cad63ae43f0..e442a4fcead9b 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -277,8 +277,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip)
+ return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH;
+ }
+
+-static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+- struct snd_urb_ctx *ctx)
++static int prepare_silent_urb(struct snd_usb_endpoint *ep,
++ struct snd_urb_ctx *ctx)
+ {
+ struct urb *urb = ctx->urb;
+ unsigned int offs = 0;
+@@ -291,28 +291,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+ extra = sizeof(packet_length);
+
+ for (i = 0; i < ctx->packets; ++i) {
+- unsigned int offset;
+- unsigned int length;
+- int counts;
+-
+- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
+- length = counts * ep->stride; /* number of silent bytes */
+- offset = offs * ep->stride + extra * i;
+- urb->iso_frame_desc[i].offset = offset;
++ int length;
++
++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
++ if (length < 0)
++ return length;
++ length *= ep->stride; /* number of silent bytes */
++ if (offs + length + extra > ctx->buffer_size)
++ break;
++ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = length + extra;
+ if (extra) {
+ packet_length = cpu_to_le32(length);
+- memcpy(urb->transfer_buffer + offset,
++ memcpy(urb->transfer_buffer + offs,
+ &packet_length, sizeof(packet_length));
++ offs += extra;
+ }
+- memset(urb->transfer_buffer + offset + extra,
++ memset(urb->transfer_buffer + offs,
+ ep->silence_value, length);
+- offs += counts;
++ offs += length;
+ }
+
+- urb->number_of_packets = ctx->packets;
+- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra;
++ if (!offs)
++ return -EPIPE;
++
++ urb->number_of_packets = i;
++ urb->transfer_buffer_length = offs;
+ ctx->queued = 0;
++ return 0;
+ }
+
+ /*
+@@ -334,8 +340,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep,
+ if (data_subs && ep->prepare_data_urb)
+ return ep->prepare_data_urb(data_subs, urb, in_stream_lock);
+ /* no data provider, so send silence */
+- prepare_silent_urb(ep, ctx);
+- break;
++ return prepare_silent_urb(ep, ctx);
+
+ case SND_USB_ENDPOINT_TYPE_SYNC:
+ if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) {
+--
+2.51.0
+
--- /dev/null
+From c45d1df84e0d075c83415c87d3f8e259b56c68d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:05 +0100
+Subject: ALSA: usb-audio: Update the number of packets properly at receiving
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ]
+
+At receiving the packets from the implicit feedback source, we didn't
+update ctx->packets field but only the ctx->packet_size[] data.
+In exceptional cases, this might lead to unexpectedly superfluous data
+transfer (although this won't happen usually due to the nature of USB
+isochronous transfer). Fix it to update the field properly.
+
+Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 40c5825fa41e5..f7cad63ae43f0 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -488,6 +488,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+
+ /* copy over the length information */
+ if (implicit_fb) {
++ ctx->packets = packet->packets;
+ for (i = 0; i < packet->packets; i++)
+ ctx->packet_size[i] = packet->packet_size[i];
+ }
+--
+2.51.0
+
--- /dev/null
+From b1269a5881ce3ff3dbda6859762a38064e659ba3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:05 +0100
+Subject: APEI/GHES: ensure that won't go past CPER allocated record
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ]
+
+The logic at ghes_new() prevents allocating too large records, by
+checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
+Yet, the allocation is done with the actual number of pages from the
+CPER bios table location, which can be smaller.
+
+Yet, a bad firmware could send data with a different size, which might
+be bigger than the allocated memory, causing an OOPS:
+
+ Unable to handle kernel paging request at virtual address fff00000f9b40000
+ Mem abort info:
+ ESR = 0x0000000096000007
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x07: level 3 translation fault
+ Data abort info:
+ ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+ swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
+ [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
+ Internal error: Oops: 0000000096000007 [#1] SMP
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
+ Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+ Workqueue: kacpi_notify acpi_os_execute_deferred
+ pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+ pc : hex_dump_to_buffer+0x30c/0x4a0
+ lr : hex_dump_to_buffer+0x328/0x4a0
+ sp : ffff800080e13880
+ x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
+ x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
+ x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
+ x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
+ x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
+ x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
+ x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
+ x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
+ x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
+ x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
+ Call trace:
+ hex_dump_to_buffer+0x30c/0x4a0 (P)
+ print_hex_dump+0xac/0x170
+ cper_estatus_print_section+0x90c/0x968
+ cper_estatus_print+0xf0/0x158
+ __ghes_print_estatus+0xa0/0x148
+ ghes_proc+0x1bc/0x220
+ ghes_notify_hed+0x5c/0xb8
+ notifier_call_chain+0x78/0x148
+ blocking_notifier_call_chain+0x4c/0x80
+ acpi_hed_notify+0x28/0x40
+ acpi_ev_notify_dispatch+0x50/0x80
+ acpi_os_execute_deferred+0x24/0x48
+ process_one_work+0x15c/0x3b0
+ worker_thread+0x2d0/0x400
+ kthread+0x148/0x228
+ ret_from_fork+0x10/0x20
+ Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
+ ---[ end trace 0000000000000000 ]---
+
+Prevent that by taking the actual allocated are into account when
+checking for CPER length.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 6 +++++-
+ include/acpi/ghes.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index bdb23ca251e23..28651f9e6d60f 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -28,6 +28,7 @@
+ #include <linux/timer.h>
+ #include <linux/cper.h>
+ #include <linux/platform_device.h>
++#include <linux/minmax.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+ #include <linux/vmalloc.h>
+@@ -262,6 +263,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
+ error_block_length = GHES_ESTATUS_MAX_SIZE;
+ }
+ ghes->estatus = kmalloc(error_block_length, GFP_KERNEL);
++ ghes->estatus_length = error_block_length;
+ if (!ghes->estatus) {
+ rc = -ENOMEM;
+ goto err_unmap_status_addr;
+@@ -333,13 +335,15 @@ static int __ghes_check_estatus(struct ghes *ghes,
+ struct acpi_hest_generic_status *estatus)
+ {
+ u32 len = cper_estatus_len(estatus);
++ u32 max_len = min(ghes->generic->error_block_length,
++ ghes->estatus_length);
+
+ if (len < sizeof(*estatus)) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n");
+ return -EIO;
+ }
+
+- if (len > ghes->generic->error_block_length) {
++ if (!len || len > max_len) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n");
+ return -EIO;
+ }
+diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
+index 292a5c40bd0c6..259ae345849f0 100644
+--- a/include/acpi/ghes.h
++++ b/include/acpi/ghes.h
+@@ -21,6 +21,7 @@ struct ghes {
+ struct acpi_hest_generic_v2 *generic_v2;
+ };
+ struct acpi_hest_generic_status *estatus;
++ unsigned int estatus_length;
+ unsigned long flags;
+ union {
+ struct list_head list;
+--
+2.51.0
+
--- /dev/null
+From 4f7a5343c2ae0d26c0416149b3877dca8078d1a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 10:56:33 +0100
+Subject: ARM: 9467/1: mm: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weissschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ]
+
+Restricted pointers ("%pK") were never meant to be used
+through printk(). They can acquire sleeping locks in atomic contexts.
+
+Switch to %px over the more secure %p as this usage is a debugging aid,
+gated behind CONFIG_DEBUG_VIRTUAL and used by WARN().
+
+Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/physaddr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c
+index cf75819e4c137..4ae327bf7aa29 100644
+--- a/arch/arm/mm/physaddr.c
++++ b/arch/arm/mm/physaddr.c
+@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x)
+ phys_addr_t __virt_to_phys(unsigned long x)
+ {
+ WARN(!__virt_addr_valid(x),
+- "virt_to_phys used for non-linear address: %pK (%pS)\n",
++ "virt_to_phys used for non-linear address: %px (%pS)\n",
+ (void *)x, (void *)x);
+
+ return __virt_to_phys_nodebug(x);
+--
+2.51.0
+
--- /dev/null
+From aeaa0ca0adca6d60460b0eaf7d3b9e36fb079f4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 17:24:48 +0800
+Subject: arm64: Add support for TSV110 Spectre-BHB mitigation
+
+From: Jinqian Yang <yangjinqian1@huawei.com>
+
+[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ]
+
+The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
+Buffer) attack, which can be exploited to leak information through
+branch prediction side channels. This commit adds the MIDR of TSV110
+to the list for software mitigation.
+
+Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
+Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/proton-pack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
+index 42359eaba2dba..6fd2caa968fbe 100644
+--- a/arch/arm64/kernel/proton-pack.c
++++ b/arch/arm64/kernel/proton-pack.c
+@@ -896,6 +896,7 @@ static u8 spectre_bhb_loop_affected(void)
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ {},
+ };
+ static const struct midr_range spectre_bhb_k24_list[] = {
+--
+2.51.0
+
--- /dev/null
+From 140d0b7689b43dc8f5c67092577229081ef0a8f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 21:27:21 +0000
+Subject: arm64: tegra: smaug: Add usb-role-switch support
+
+From: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+
+[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ]
+
+The USB2 port on Smaug is configured for OTG operation but lacked the
+required 'usb-role-switch' property, leading to a failed probe and a
+non-functioning USB port. Add the property along with setting the default
+role to host.
+
+Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+index 131c064d69919..5fae86c1e4f10 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+@@ -1687,6 +1687,8 @@ usb2-0 {
+ status = "okay";
+ vbus-supply = <&usbc_vbus>;
+ mode = "otg";
++ usb-role-switch;
++ role-switch-default-mode = "host";
+ };
+
+ usb3-0 {
+--
+2.51.0
+
--- /dev/null
+From 31496fbeec6d849beba92f50f7e5551dea060551 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jan 2026 00:00:17 +0800
+Subject: ASoC: es8328: Add error unwind in resume
+
+From: Hsieh Hung-En <hungen3108@gmail.com>
+
+[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ]
+
+Handle failures in the resume path by unwinding previously enabled
+resources.
+
+If enabling regulators or syncing the regcache fails, disable regulators
+and unprepare the clock to avoid leaking resources and leaving the device
+in a partially resumed state.
+
+Signed-off-by: Hsieh Hung-En <hungen3108@gmail.com>
+Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index fe4763805df94..0e4951c4febbd 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -750,17 +750,23 @@ static int es8328_resume(struct snd_soc_component *component)
+ es8328->supplies);
+ if (ret) {
+ dev_err(component->dev, "unable to enable regulators\n");
+- return ret;
++ goto err_clk;
+ }
+
+ regcache_mark_dirty(regmap);
+ ret = regcache_sync(regmap);
+ if (ret) {
+ dev_err(component->dev, "unable to sync regcache\n");
+- return ret;
++ goto err_regulators;
+ }
+
+ return 0;
++
++err_regulators:
++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies);
++err_clk:
++ clk_disable_unprepare(es8328->clk);
++ return ret;
+ }
+
+ static int es8328_component_probe(struct snd_soc_component *component)
+--
+2.51.0
+
--- /dev/null
+From 0d309828969dd169e1f946a38836f4fa15d5f577 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:08 +0100
+Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ]
+
+This bit is handled by a separate control.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index b5a35999d8dfa..a22a95fb4fd1d 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18),
+
+
+ SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0),
+-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA),
++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX),
+
+ SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0),
+ SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA),
+--
+2.51.0
+
--- /dev/null
+From 35dffb465787b15870fe925ed930f8bb0606038d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:10 +0100
+Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on
+ plug
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ]
+
+This usually means that a TRS plug with no microphone pin has been plugged
+into a TRRS socket. Cases where a user is plugging in a microphone while
+pressing a button will be handled via incoming interrupt after the user
+releases the button, so the microphone will still be detected once it
+becomes usable.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index a22a95fb4fd1d..d8497b06c0638 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -67,6 +67,8 @@ struct wm8962_priv {
+ struct mutex dsp2_ena_lock;
+ u16 dsp2_ena;
+
++ int mic_status;
++
+ struct delayed_work mic_work;
+ struct snd_soc_jack *jack;
+
+@@ -3061,8 +3063,16 @@ static void wm8962_mic_work(struct work_struct *work)
+ if (reg & WM8962_MICSHORT_STS) {
+ status |= SND_JACK_BTN_0;
+ irq_pol |= WM8962_MICSCD_IRQ_POL;
++
++ /* Don't report a microphone if it's shorted right after
++ * plugging in, as this may be a TRS plug in a TRRS socket.
++ */
++ if (!(wm8962->mic_status & WM8962_MICDET_STS))
++ status = 0;
+ }
+
++ wm8962->mic_status = status;
++
+ snd_soc_jack_report(wm8962->jack, status,
+ SND_JACK_MICROPHONE | SND_JACK_BTN_0);
+
+--
+2.51.0
+
--- /dev/null
+From 55f32e5d8b58a04423766a357675e2cc98b7336d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 20:49:30 +0100
+Subject: audit: add fchmodat2() to change attributes class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ]
+
+fchmodat2(), introduced in version 6.6 is currently not in the change
+attribute class of audit. Calling fchmodat2() to change a file
+attribute in the same fashion than chmod() or fchmodat() will bypass
+audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds fchmodat2() to the change attributes class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_change_attr.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h
+index 331670807cf01..6c311d4d37f4e 100644
+--- a/include/asm-generic/audit_change_attr.h
++++ b/include/asm-generic/audit_change_attr.h
+@@ -20,6 +20,9 @@ __NR_fremovexattr,
+ __NR_fchownat,
+ __NR_fchmodat,
+ #endif
++#ifdef __NR_fchmodat2
++__NR_fchmodat2,
++#endif
+ #ifdef __NR_chown32
+ __NR_chown32,
+ __NR_fchown32,
+--
+2.51.0
+
--- /dev/null
+From 227a7e62b1daba8b92d1fad8c43f28ed7022b2ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 09:39:24 +0100
+Subject: audit: add missing syscalls to read class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ]
+
+The "at" variant of getxattr() and listxattr() are missing from the
+audit read class. Calling getxattrat() or listxattrat() on a file to
+read its extended attributes will bypass audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds missing syscalls to the audit read class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_read.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h
+index 7bb7b5a83ae2e..fb9991f53fb6f 100644
+--- a/include/asm-generic/audit_read.h
++++ b/include/asm-generic/audit_read.h
+@@ -4,9 +4,15 @@ __NR_readlink,
+ #endif
+ __NR_quotactl,
+ __NR_listxattr,
++#ifdef __NR_listxattrat
++__NR_listxattrat,
++#endif
+ __NR_llistxattr,
+ __NR_flistxattr,
+ __NR_getxattr,
++#ifdef __NR_getxattrat
++__NR_getxattrat,
++#endif
+ __NR_lgetxattr,
+ __NR_fgetxattr,
+ #ifdef __NR_readlinkat
+--
+2.51.0
+
--- /dev/null
+From 018765b3861aecb1992e559bbe9601a069798ff0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 15:29:50 +0100
+Subject: binder: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log. Since commit ad67b74d2469 ("printk: hash
+addresses printed with %p") the regular %p has been improved to avoid
+this issue. Furthermore, restricted pointers ("%pK") were never meant
+to be used through printk(). They can still unintentionally leak raw
+pointers or acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+There are still a few users of %pK left, but these use it through
+seq_file, for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Carlos Llamas <cmllamas@google.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binder.c | 2 +-
+ drivers/android/binder_alloc.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 73fd95bc70c03..24906f085b940 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4008,7 +4008,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ }
+ }
+ binder_debug(BINDER_DEBUG_DEAD_BINDER,
+- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+ proc->pid, thread->pid, (u64)cookie,
+ death);
+ if (death == NULL) {
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 813894ba5da6b..cb46d36e219a0 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc,
+ new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: add free buffer, size %zd, at %pK\n",
++ "%d: add free buffer, size %zd, at %p\n",
+ alloc->pid, new_buffer_size, new_buffer);
+
+ while (*p) {
+@@ -474,7 +474,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
+ }
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
+ alloc->pid, size, buffer, buffer_size);
+
+ has_page_addr = (void __user *)
+@@ -646,7 +646,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
+ ALIGN(buffer->extra_buffers_size, sizeof(void *));
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
++ "%d: binder_free_buf %p size %zd buffer_size %zd\n",
+ alloc->pid, buffer, size, buffer_size);
+
+ BUG_ON(buffer->free);
+--
+2.51.0
+
--- /dev/null
+From 3ac21c6936d23c967daebf7081da108ff1aed625 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 16:05:22 +0800
+Subject: blk-mq-debugfs: add missing debugfs_mutex in
+ blk_mq_debugfs_register_hctxs()
+
+From: Yu Kuai <yukuai@fnnas.com>
+
+[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ]
+
+In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while
+creating debugfs entries for hctxs. Hence add debugfs_mutex there,
+it's safe because queue is not frozen.
+
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index 7023257a133df..8ae3115666e70 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -903,8 +903,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ int i;
+
++ mutex_lock(&q->debugfs_mutex);
+ queue_for_each_hw_ctx(q, hctx, i)
+ blk_mq_debugfs_register_hctx(q, hctx);
++ mutex_unlock(&q->debugfs_mutex);
+ }
+
+ void blk_mq_debugfs_unregister_hctxs(struct request_queue *q)
+--
+2.51.0
+
--- /dev/null
+From 40c15c6cab9698eecdc6c9b7f22909bcd3609a50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:13:04 +0100
+Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU
+
+From: Jacopo Scannella <code@charlie.cat>
+
+[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ]
+
+Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek
+RTL8761BU Bluetooth adapter.
+
+Reference:
+https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth
+
+Signed-off-by: Jacopo Scannella <code@charlie.cat>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c447e2e9417b3..a79fd106fad7a 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -512,6 +512,7 @@ static const struct usb_device_id blacklist_table[] = {
+
+ /* Additional Realtek 8723BU Bluetooth devices */
+ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK },
+
+ /* Additional Realtek 8723DE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
+--
+2.51.0
+
--- /dev/null
+From 36bcbe12fc7a2bd8c43f6254a691f6bf64046855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:09 +0100
+Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ]
+
+hci_conn_enter_active_mode() uses queue_delayed_work() with the
+intention that the work will run after the given timeout. However,
+queue_delayed_work() does nothing if the work is already queued, so
+depending on the link policy we may end up putting the connection
+into idle mode every hdev->idle_timeout ms.
+
+Use mod_delayed_work() instead so the work is queued if not already
+queued, and the timeout is updated otherwise.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 700920aea39ef..a9ba288afe0ee 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1604,8 +1604,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
+
+ timer:
+ if (hdev->idle_timeout > 0)
+- queue_delayed_work(hdev->workqueue, &conn->idle_work,
+- msecs_to_jiffies(hdev->idle_timeout));
++ mod_delayed_work(hdev->workqueue, &conn->idle_work,
++ msecs_to_jiffies(hdev->idle_timeout));
+ }
+
+ /* Drop all connection on the device */
+--
+2.51.0
+
--- /dev/null
+From 291c5a41d328edd2a2b947025d08316ace654154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 18:02:19 +0000
+Subject: bpf: verifier improvement in 32bit shift sign extension pattern
+
+From: Cupertino Miranda <cupertino.miranda@oracle.com>
+
+[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ]
+
+This patch improves the verifier to correctly compute bounds for
+sign extension compiler pattern composed of left shift by 32bits
+followed by a sign right shift by 32bits. Pattern in the verifier was
+limitted to positive value bounds and would reset bound computation for
+negative values. New code allows both positive and negative values for
+sign extension without compromising bound computation and verifier to
+pass.
+
+This change is required by GCC which generate such pattern, and was
+detected in the context of systemd, as described in the following GCC
+bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731
+
+Three new tests were added in verifier_subreg.c.
+
+Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com>
+Signed-off-by: Andrew Pinski <andrew.pinski@oss.qualcomm.com>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Cc: David Faust <david.faust@oracle.com>
+Cc: Jose Marchesi <jose.marchesi@oracle.com>
+Cc: Elena Zannoni <elena.zannoni@oracle.com>
+Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 4b7c9a60a7352..48776d23b44e2 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -7953,21 +7953,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg,
+ u64 umin_val, u64 umax_val)
+ {
+ /* Special case <<32 because it is a common compiler pattern to sign
+- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are
+- * positive we know this shift will also be positive so we can track
+- * bounds correctly. Otherwise we lose all sign bit information except
+- * what we can pick up from var_off. Perhaps we can generalize this
+- * later to shifts of any length.
++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct
++ * because s32 bounds don't flip sign when shifting to the left by
++ * 32bits.
+ */
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0)
++ if (umin_val == 32 && umax_val == 32) {
+ dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32;
+- else
+- dst_reg->smax_value = S64_MAX;
+-
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0)
+ dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32;
+- else
++ } else {
++ dst_reg->smax_value = S64_MAX;
+ dst_reg->smin_value = S64_MIN;
++ }
+
+ /* If we might shift our top bit out, then we know nothing */
+ if (dst_reg->umax_value > 1ULL << (63 - umax_val)) {
+--
+2.51.0
+
--- /dev/null
+From b4617fca0748fc59537c39c70299415e013cb176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 22:53:57 +0530
+Subject: btrfs: replace BUG() with error handling in __btrfs_balance()
+
+From: Adarsh Das <adarshdas950@gmail.com>
+
+[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ]
+
+We search with offset (u64)-1 which should never match exactly.
+Previously this was handled with BUG(). Now logs an error
+and return -EUCLEAN.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index c18918ce8edde..839ee01827b26 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -3992,8 +3992,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info)
+ * this shouldn't happen, it means the last relocate
+ * failed
+ */
+- if (ret == 0)
+- BUG(); /* FIXME break ? */
++ if (unlikely(ret == 0)) {
++ btrfs_err(fs_info,
++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx",
++ key.offset);
++ mutex_unlock(&fs_info->reclaim_bgs_lock);
++ ret = -EUCLEAN;
++ goto error;
++ }
+
+ ret = btrfs_previous_item(chunk_root, path, 0,
+ BTRFS_CHUNK_ITEM_KEY);
+--
+2.51.0
+
--- /dev/null
+From 20ed5b052a988e606937406454c7118b03d25f5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:29 +0100
+Subject: char: tpm: cr50: Remove IRQF_ONESHOT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+
+The flag also prevents force-threading of the primary handler and the
+irq-core will warn about this.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +--
+ drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+index e2ab6a329732b..beb338722d20c 100644
+--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c
++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+@@ -699,8 +699,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client)
+
+ if (client->irq > 0) {
+ rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler,
+- IRQF_TRIGGER_FALLING | IRQF_ONESHOT |
+- IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
+ dev->driver->name, chip);
+ if (rc < 0) {
+ dev_err(dev, "Failed to probe IRQ %d\n", client->irq);
+diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c
+index ea759af256345..c1188a6368288 100644
+--- a/drivers/char/tpm/tpm_tis_spi_cr50.c
++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c
+@@ -273,7 +273,7 @@ int cr50_spi_probe(struct spi_device *spi)
+ if (spi->irq > 0) {
+ ret = devm_request_irq(&spi->dev, spi->irq,
+ cr50_spi_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ "cr50_spi", cr50_phy);
+ if (ret < 0) {
+ if (ret == -EPROBE_DEFER)
+--
+2.51.0
+
--- /dev/null
+From ba60295e1b90288ffb65c0a2e66872ac60ef9f41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 14:46:28 -0500
+Subject: clk: microchip: core: correct return value on *_get_parent()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ]
+
+roclk_get_parent() and sclk_get_parent() has the possibility of
+returning -EINVAL, however the framework expects this call to always
+succeed since the return value is unsigned.
+
+If there is no parent map defined, then the current value programmed in
+the hardware is used. Let's use that same value in the case where
+-EINVAL is currently returned.
+
+This index is only used by clk_core_get_parent_by_index(), and it
+validates that it doesn't overflow the number of available parents.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/microchip/clk-core.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c
+index 1b4f023cdc8be..71fbaf8318f22 100644
+--- a/drivers/clk/microchip/clk-core.c
++++ b/drivers/clk/microchip/clk-core.c
+@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK;
+
+- if (!refo->parent_map)
+- return v;
+-
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (refo->parent_map[i] == v)
+- return i;
++ if (refo->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (refo->parent_map[i] == v)
++ return i;
++ }
+
+- return -EINVAL;
++ return v;
+ }
+
+ static unsigned long roclk_calc_rate(unsigned long parent_rate,
+@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK;
+
+- if (!sclk->parent_map)
+- return v;
++ if (sclk->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (sclk->parent_map[i] == v)
++ return i;
++ }
+
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (sclk->parent_map[i] == v)
+- return i;
+- return -EINVAL;
++ return v;
+ }
+
+ static int sclk_set_parent(struct clk_hw *hw, u8 index)
+--
+2.51.0
+
--- /dev/null
+From f37833a37b8e061add99587afeb35bf93661e1fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 23:13:41 +0100
+Subject: clocksource/drivers/sh_tmu: Always leave device running after probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ]
+
+The TMU device can be used as both a clocksource and a clockevent
+provider. The driver tries to be smart and power itself on and off, as
+well as enabling and disabling its clock when it's not in operation.
+This behavior is slightly altered if the TMU is used as an early
+platform device in which case the device is left powered on after probe,
+but the clock is still enabled and disabled at runtime.
+
+This has worked for a long time, but recent improvements in PREEMPT_RT
+and PROVE_LOCKING have highlighted an issue. As the TMU registers itself
+as a clockevent provider, clockevents_register_device(), it needs to use
+raw spinlocks internally as this is the context of which the clockevent
+framework interacts with the TMU driver. However in the context of
+holding a raw spinlock the TMU driver can't really manage its power
+state or clock with calls to pm_runtime_*() and clk_*() as these calls
+end up in other platform drivers using regular spinlocks to control
+power and clocks.
+
+This mix of spinlock contexts trips a lockdep warning.
+
+ =============================
+ [ BUG: Invalid wait context ]
+ 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted
+ -----------------------------
+ swapper/0/0 is trying to lock:
+ ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88
+ other info that might help us debug this:
+ context-{5:5}
+ 1 lock held by swapper/0/0:
+ ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0
+ #0: ffff8000817ec298
+ ccree e6601000.crypto: ARM ccree device initialized
+ (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT
+ Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
+ Call trace:
+ show_stack+0x14/0x1c (C)
+ dump_stack_lvl+0x6c/0x90
+ dump_stack+0x14/0x1c
+ __lock_acquire+0x904/0x1584
+ lock_acquire+0x220/0x34c
+ _raw_spin_lock_irqsave+0x58/0x80
+ __pm_runtime_resume+0x38/0x88
+ sh_tmu_clock_event_set_oneshot+0x84/0xd4
+ clockevents_switch_state+0xfc/0x13c
+ tick_broadcast_set_event+0x30/0xa4
+ __tick_broadcast_oneshot_control+0x1e0/0x3a8
+ tick_broadcast_oneshot_control+0x30/0x40
+ cpuidle_enter_state+0x40c/0x680
+ cpuidle_enter+0x30/0x40
+ do_idle+0x1f4/0x280
+ cpu_startup_entry+0x34/0x40
+ kernel_init+0x0/0x130
+ do_one_initcall+0x0/0x230
+ __primary_switched+0x88/0x90
+
+For non-PREEMPT_RT builds this is not really an issue, but for
+PREEMPT_RT builds where normal spinlocks can sleep this might be an
+issue. Be cautious and always leave the power and clock running after
+probe.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/sh_tmu.c | 18 ------------------
+ 1 file changed, 18 deletions(-)
+
+diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
+index b00dec0655cb2..2e35bb39ef42f 100644
+--- a/drivers/clocksource/sh_tmu.c
++++ b/drivers/clocksource/sh_tmu.c
+@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start)
+
+ static int __sh_tmu_enable(struct sh_tmu_channel *ch)
+ {
+- int ret;
+-
+- /* enable clock */
+- ret = clk_enable(ch->tmu->clk);
+- if (ret) {
+- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n",
+- ch->index);
+- return ret;
+- }
+-
+ /* make sure channel is disabled */
+ sh_tmu_start_stop_ch(ch, 0);
+
+@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch)
+ if (ch->enable_count++ > 0)
+ return 0;
+
+- pm_runtime_get_sync(&ch->tmu->pdev->dev);
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, true);
+
+ return __sh_tmu_enable(ch);
+@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch)
+
+ /* disable interrupts in TMU block */
+ sh_tmu_write(ch, TCR, TCR_TPSC_CLK4);
+-
+- /* stop clock */
+- clk_disable(ch->tmu->clk);
+ }
+
+ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+ __sh_tmu_disable(ch);
+
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, false);
+- pm_runtime_put(&ch->tmu->pdev->dev);
+ }
+
+ static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta,
+@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
+ goto err_clk_unprepare;
+
+ tmu->rate = clk_get_rate(tmu->clk) / 4;
+- clk_disable(tmu->clk);
+
+ /* Map the memory resource. */
+ ret = sh_tmu_map_memory(tmu);
+@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev)
+ out:
+ if (tmu->has_clockevent || tmu->has_clocksource)
+ pm_runtime_irq_safe(&pdev->dev);
+- else
+- pm_runtime_idle(&pdev->dev);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 236eddaab66e225b1535fee4e43d982cfc0b5c77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 12:17:23 +0100
+Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig
+ dependency on OF
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ]
+
+This driver accesses the of_aliases global variable declared in
+linux/of.h and defined in drivers/base/of.c. It requires OF support or
+will cause a link failure. Add the missing Kconfig dependency.
+
+Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index 6382dad202207..133ee5c3c0bf8 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -221,6 +221,7 @@ config KEYSTONE_TIMER
+
+ config INTEGRATOR_AP_TIMER
+ bool "Integrator-AP timer driver" if COMPILE_TEST
++ depends on OF
+ select CLKSRC_MMIO
+ help
+ Enables support for the Integrator-AP timer.
+--
+2.51.0
+
--- /dev/null
+From a45ac40a6c719005616413332f07f82c203270e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 20:03:50 +0800
+Subject: dm: remove fake timeout to avoid leak request
+
+From: Ding Hui <dinghui@sangfor.com.cn>
+
+[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ]
+
+Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
+blk_mq_complete_request"), drivers are responsible for calling
+blk_should_fake_timeout() at appropriate code paths and opportunities.
+
+However, the dm driver does not implement its own timeout handler and
+relies on the timeout handling of its slave devices.
+
+If an io-timeout-fail error is injected to a dm device, the request
+will be leaked and never completed, causing tasks to hang indefinitely.
+
+Reproduce:
+1. prepare dm which has iscsi slave device
+2. inject io-timeout-fail to dm
+ echo 1 >/sys/class/block/dm-0/io-timeout-fail
+ echo 100 >/sys/kernel/debug/fail_io_timeout/probability
+ echo 10 >/sys/kernel/debug/fail_io_timeout/times
+3. read/write dm
+4. iscsiadm -m node -u
+
+Result: hang task like below
+[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
+[ 862.244133] Tainted: G E 6.19.0-rc1+ #51
+[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000
+[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
+[ 862.245264] Call Trace:
+[ 862.245587] <TASK>
+[ 862.245814] __schedule+0x810/0x15c0
+[ 862.246557] schedule+0x69/0x180
+[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120
+[ 862.247688] elevator_change+0x16d/0x460
+[ 862.247893] elevator_set_none+0x87/0xf0
+[ 862.248798] blk_unregister_queue+0x12e/0x2a0
+[ 862.248995] __del_gendisk+0x231/0x7e0
+[ 862.250143] del_gendisk+0x12f/0x1d0
+[ 862.250339] sd_remove+0x85/0x130 [sd_mod]
+[ 862.250650] device_release_driver_internal+0x36d/0x530
+[ 862.250849] bus_remove_device+0x1dd/0x3f0
+[ 862.251042] device_del+0x38a/0x930
+[ 862.252095] __scsi_remove_device+0x293/0x360
+[ 862.252291] scsi_remove_target+0x486/0x760
+[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
+[ 862.252886] process_one_work+0x633/0xe50
+[ 862.253101] worker_thread+0x6df/0xf10
+[ 862.253647] kthread+0x36d/0x720
+[ 862.254533] ret_from_fork+0x2a6/0x470
+[ 862.255852] ret_from_fork_asm+0x1a/0x30
+[ 862.256037] </TASK>
+
+Remove the blk_should_fake_timeout() check from dm, as dm has no
+native timeout handling and should not attempt to fake timeouts.
+
+Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 7eedcd012f45f..bcbf5081887a9 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -281,8 +281,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error)
+ struct dm_rq_target_io *tio = tio_from_request(rq);
+
+ tio->error = error;
+- if (likely(!blk_should_fake_timeout(rq->q)))
+- blk_mq_complete_request(rq);
++ blk_mq_complete_request(rq);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 4956d3e0f0dc201852a3a1d3d2198458d5458a97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 08:22:26 -0500
+Subject: drm: Account property blob allocations to memcg
+
+From: Xiao Kan <814091656@qq.com>
+
+[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ]
+
+DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
+property blobs backed by kernel memory.
+
+Currently, the blob data allocation is not accounted to the allocating
+process's memory cgroup, allowing unprivileged users to trigger unbounded
+kernel memory consumption and potentially cause system-wide OOM.
+
+Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
+is properly charged to the caller's memcg. This ensures existing cgroup
+memory limits apply and prevents uncontrolled kernel memory growth without
+introducing additional policy or per-file limits.
+
+Signed-off-by: Xiao Kan <814091656@qq.com>
+Signed-off-by: Xiao Kan <xiao.kan@samsung.com>
+Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
+index 6c353c9dc772e..125a807e6e0ec 100644
+--- a/drivers/gpu/drm/drm_property.c
++++ b/drivers/gpu/drm/drm_property.c
+@@ -564,7 +564,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
+ if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
+ return ERR_PTR(-EINVAL);
+
+- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT);
+ if (!blob)
+ return ERR_PTR(-ENOMEM);
+
+--
+2.51.0
+
--- /dev/null
+From 16b7c441403ac38d5d779757846ca948a6ac8b38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 14:47:01 +0800
+Subject: drm/amd/display: Avoid updating surface with the same surface under
+ MPO
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ]
+
+[Why & How]
+Although it's dummy updates of surface update for committing stream
+updates, we should not have dummy_updates[j].surface all indicating
+to the same surface under multiple surfaces case. Otherwise,
+copy_surface_update_to_plane() in update_planes_and_stream_state()
+will update to the same surface only.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 5d22622f9c1a8..9a6c0b17745e5 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9875,7 +9875,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
+ * To fix this, DC should permit updating only stream properties.
+ */
+ for (j = 0; j < status->plane_count; j++)
+- dummy_updates[j].surface = status->plane_states[0];
++ dummy_updates[j].surface = status->plane_states[j];
+
+
+ mutex_lock(&dm->dc_lock);
+--
+2.51.0
+
--- /dev/null
+From 5297a3cbb43d574cf4dbf6fb2e8d42068101a9db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:24:01 +0000
+Subject: drm/amdgpu: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for amdgpu.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
+index a6ed28ab07083..35160f1f323be 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
+@@ -3426,6 +3426,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((adev->pdev->device == 0x666f) &&
++ (adev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (adev->asic_type == CHIP_OLAND) {
+ if ((adev->pdev->revision == 0xC7) ||
+ (adev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From 52c4247d8afac1da296a848c066fa65d3c9a7c48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 15:32:01 +0800
+Subject: drm/amdgpu: Adjust usleep_range in fence wait
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ]
+
+Tune the sleep interval in the PSP fence wait loop from 10-100us to
+60-100us.This adjustment results in an overall wait window of 1.2s
+(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations),
+which guarantees that we can retrieve the correct fence value
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 64bf24b64446b..7f84c202aeb7f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -488,7 +488,7 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ ras_intr = amdgpu_ras_intr_triggered();
+ if (ras_intr)
+ break;
+- usleep_range(10, 100);
++ usleep_range(60, 100);
+ amdgpu_device_invalidate_hdp(psp->adev, NULL);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 195fc7919a17d2bfd93ef363d720375b7668b437 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 19:36:56 +0530
+Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in
+ svm_migrate_gart_map()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ]
+
+In svm_migrate_gart_map(), while migrating GART mapping, the number of
+bytes copied for the GART table only accounts for CPU pages. On non-4K
+systems, each CPU page can contain multiple GPU pages, and the GART
+requires one 8-byte PTE per GPU page. As a result, an incorrect size was
+passed to the DMA, causing only a partial update of the GART table.
+
+Fix this function to work correctly on non-4K page-size systems by
+accounting for the number of GPU pages per CPU page when calculating the
+number of bytes to be copied.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index 013749cd3ae29..2396f79470d9b 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -57,7 +57,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, uint64_t npages,
+ *gart_addr = adev->gmc.gart_start;
+
+ num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8);
+- num_bytes = npages * 8;
++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE;
+
+ r = amdgpu_job_alloc_with_ib(adev, num_dw * 4 + num_bytes,
+ AMDGPU_IB_POOL_DELAYED, &job);
+--
+2.51.0
+
--- /dev/null
+From 1fcb858d02c2e8047e599f848776f70691c41005 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 11:38:25 +0100
+Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has
+ fractional parts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ]
+
+Don’t reject the commit when the source rectangle has fractional parts.
+This can occur due to scaling: drm_atomic_helper_check_plane_state() calls
+drm_rect_clip_scaled(), which may introduce fractional parts while
+computing the clipped source rectangle. This does not imply the commit is
+invalid, so we should accept it instead of discarding it.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 594999d67c808..79e04c53a642e 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -77,8 +77,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s)
+ return container_of(s, struct atmel_hlcdc_plane_state, base);
+ }
+
+-#define SUBPIXEL_MASK 0xffff
+-
+ static uint32_t rgb_formats[] = {
+ DRM_FORMAT_C8,
+ DRM_FORMAT_XRGB4444,
+@@ -618,24 +616,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p,
+ if (ret || !s->visible)
+ return ret;
+
+- hstate->src_x = s->src.x1;
+- hstate->src_y = s->src.y1;
+- hstate->src_w = drm_rect_width(&s->src);
+- hstate->src_h = drm_rect_height(&s->src);
++ hstate->src_x = s->src.x1 >> 16;
++ hstate->src_y = s->src.y1 >> 16;
++ hstate->src_w = drm_rect_width(&s->src) >> 16;
++ hstate->src_h = drm_rect_height(&s->src) >> 16;
+ hstate->crtc_x = s->dst.x1;
+ hstate->crtc_y = s->dst.y1;
+ hstate->crtc_w = drm_rect_width(&s->dst);
+ hstate->crtc_h = drm_rect_height(&s->dst);
+
+- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) &
+- SUBPIXEL_MASK)
+- return -EINVAL;
+-
+- hstate->src_x >>= 16;
+- hstate->src_y >>= 16;
+- hstate->src_w >>= 16;
+- hstate->src_h >>= 16;
+-
+ hstate->nplanes = fb->format->num_planes;
+ if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 60f4f03d7c32c36b4ab434a42d9eeaebc9ae0cd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:52 +0200
+Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state
+ callback
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ]
+
+After several commits, the slab memory increases. Some drm_crtc_commit
+objects are not freed. The atomic_destroy_state callback only put the
+framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
+to put all the objects that are no longer needed.
+
+It has been seen after hours of usage of a graphics application or using
+kmemleak:
+
+unreferenced object 0xc63a6580 (size 64):
+ comm "egt_basic", pid 171, jiffies 4294940784
+ hex dump (first 32 bytes):
+ 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.
+ 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.
+ backtrace (crc c25aa925):
+ kmemleak_alloc+0x34/0x3c
+ __kmalloc_cache_noprof+0x150/0x1a4
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index a077d93c78d7b..594999d67c808 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -933,8 +933,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
+ state->dscrs[i]->self);
+ }
+
+- if (s->fb)
+- drm_framebuffer_put(s->fb);
++ __drm_atomic_helper_plane_destroy_state(s);
+
+ kfree(state);
+ }
+--
+2.51.0
+
--- /dev/null
+From 544c46c4bb7823483bf775d02d5b5d3880ac27ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:53 +0200
+Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ]
+
+The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
+the atmel_hlcdc_plane state structure without properly duplicating the
+drm_plane_state. In particular, state->commit remained set to the old
+state commit, which can lead to a use-after-free in the next
+drm_atomic_commit() call.
+
+Fix this by calling
+__drm_atomic_helper_duplicate_plane_state(), which correctly clones
+the base drm_plane_state (including the ->commit pointer).
+
+It has been seen when closing and re-opening the device node while
+another DRM client (e.g. fbdev) is still attached:
+
+=============================================================================
+BUG kmalloc-64 (Not tainted): Poison overwritten
+-----------------------------------------------------------------------------
+
+0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b
+FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b
+Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0
+pid=29
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_framebuffer_remove+0x4cc/0x5a8
+ drm_mode_rmfb_work_fn+0x6c/0x80
+ process_one_work+0x12c/0x2cc
+ worker_thread+0x2a8/0x400
+ kthread+0xc0/0xdc
+ ret_from_fork+0x14/0x28
+Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0
+pid=169
+ drm_atomic_helper_commit_hw_done+0x100/0x150
+ drm_atomic_helper_commit_tail+0x64/0x8c
+ commit_tail+0x168/0x18c
+ drm_atomic_helper_commit+0x138/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0
+flags=0x200(workingset|zone=0)
+Object 0xc611b340 @offset=832 fp=0xc611b7c0
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 79e04c53a642e..fba7e4b52e978 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -903,8 +903,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
+ return NULL;
+ }
+
+- if (copy->base.fb)
+- drm_framebuffer_get(copy->base.fb);
++ __drm_atomic_helper_plane_duplicate_state(p, ©->base);
+
+ return ©->base;
+ }
+--
+2.51.0
+
--- /dev/null
+From 18ac0f9baa7bac3df3436bd8af251a279ca38f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:26:00 +0000
+Subject: drm/radeon: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for radeon.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 3add39c1a6897..82a93f7aeafb4 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2969,6 +2969,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((rdev->pdev->device == 0x666f) &&
++ (rdev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (rdev->family == CHIP_OLAND) {
+ if ((rdev->pdev->revision == 0xC7) ||
+ (rdev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From 1ef1337339bcf847b54c949e962001d82635cdc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 21:03:23 +0800
+Subject: drm/v3d: Set DMA segment size to avoid debug warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ]
+
+When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
+kernel occasionally reports a segment size mismatch. This is because
+'max_seg_size' is not set. The kernel defaults to 64K. setting
+'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
+from complaining about the over-mapping of the V3D segment length.
+
+DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device
+ claims to support [len=8290304] [max=65536]
+WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388
+CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1
+Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : debug_dma_map_sg+0x330/0x388
+lr : debug_dma_map_sg+0x330/0x388
+sp : ffff8000829a3ac0
+x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000
+x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000
+x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002
+x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff
+x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573
+x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000
+x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c
+x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001
+x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280
+Call trace:
+ debug_dma_map_sg+0x330/0x388
+ __dma_map_sg_attrs+0xc0/0x278
+ dma_map_sgtable+0x30/0x58
+ drm_gem_shmem_get_pages_sgt+0xb4/0x140
+ v3d_bo_create_finish+0x28/0x130 [v3d]
+ v3d_create_bo_ioctl+0x54/0x180 [v3d]
+ drm_ioctl_kernel+0xc8/0x140
+ drm_ioctl+0x2d4/0x4d8
+
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
+index 6407a006d6ec4..692131c7fa36d 100644
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -246,6 +246,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
++ dma_set_max_seg_size(&pdev->dev, UINT_MAX);
++
+ v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH);
+
+ ident1 = V3D_READ(V3D_HUB_IDENT1);
+--
+2.51.0
+
--- /dev/null
+From bb4636e71ecf636e53ab55ed52b36353cf28ebdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:06 +0100
+Subject: EFI/CPER: don't dump the entire memory region
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ]
+
+The current logic at cper_print_fw_err() doesn't check if the
+error record length is big enough to handle offset. On a bad firmware,
+if the ofset is above the actual record, length -= offset will
+underflow, making it dump the entire memory.
+
+The end result can be:
+
+ - the logic taking a lot of time dumping large regions of memory;
+ - data disclosure due to the memory dumps;
+ - an OOPS, if it tries to dump an unmapped memory region.
+
+Fix it by checking if the section length is too small before doing
+a hex dump.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index f00ee3eef71b8..22cc0fc35b417 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -523,6 +523,11 @@ static void cper_print_fw_err(const char *pfx,
+ } else {
+ offset = sizeof(*fw_err);
+ }
++ if (offset > length) {
++ printk("%s""error section length is too small: offset=%d, length=%d\n",
++ pfx, offset, length);
++ return;
++ }
+
+ buf += offset;
+ length -= offset;
+--
+2.51.0
+
--- /dev/null
+From 527360d45cbdd020e5215d057bbabf50841e4a25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:04 +0100
+Subject: EFI/CPER: don't go past the ARM processor CPER record buffer
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ]
+
+There's a logic inside GHES/CPER to detect if the section_length
+is too small, but it doesn't detect if it is too big.
+
+Currently, if the firmware receives an ARM processor CPER record
+stating that a section length is big, kernel will blindly trust
+section_length, producing a very long dump. For instance, a 67
+bytes record with ERR_INFO_NUM set 46198 and section length
+set to 854918320 would dump a lot of data going a way past the
+firmware memory-mapped area.
+
+Fix it by adding a logic to prevent it to go past the buffer
+if ERR_INFO_NUM is too big, making it report instead:
+
+ [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+ [Hardware Error]: event severity: recoverable
+ [Hardware Error]: Error 0, type: recoverable
+ [Hardware Error]: section_type: ARM processor error
+ [Hardware Error]: MIDR: 0xff304b2f8476870a
+ [Hardware Error]: section length: 854918320, CPER size: 67
+ [Hardware Error]: section length is too big
+ [Hardware Error]: firmware-generated error record is incorrect
+ [Hardware Error]: ERR_INFO_NUM is 46198
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject and changelog tweaks ]
+Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper-arm.c | 12 ++++++++----
+ drivers/firmware/efi/cper.c | 3 ++-
+ include/linux/cper.h | 3 ++-
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
+index ea43589944ba5..26a12f8076359 100644
+--- a/drivers/firmware/efi/cper-arm.c
++++ b/drivers/firmware/efi/cper-arm.c
+@@ -227,7 +227,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
+ }
+
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc)
++ const struct cper_sec_proc_arm *proc,
++ u32 length)
+ {
+ int i, len, max_ctx_type;
+ struct cper_arm_err_info *err_info;
+@@ -239,9 +240,12 @@ void cper_print_proc_arm(const char *pfx,
+
+ len = proc->section_length - (sizeof(*proc) +
+ proc->err_info_num * (sizeof(*err_info)));
+- if (len < 0) {
+- printk("%ssection length: %d\n", pfx, proc->section_length);
+- printk("%ssection length is too small\n", pfx);
++
++ if (len < 0 || proc->section_length > length) {
++ printk("%ssection length: %d, CPER size: %d\n",
++ pfx, proc->section_length, length);
++ printk("%ssection length is too %s\n", pfx,
++ (len < 0) ? "small" : "big");
+ printk("%sfirmware-generated error record is incorrect\n", pfx);
+ printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num);
+ return;
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 22cc0fc35b417..d45f653502206 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -608,7 +608,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata
+
+ printk("%ssection_type: ARM processor error\n", newpfx);
+ if (gdata->error_data_length >= sizeof(*arm_err))
+- cper_print_proc_arm(newpfx, arm_err);
++ cper_print_proc_arm(newpfx, arm_err,
++ gdata->error_data_length);
+ else
+ goto err_section_too_small;
+ #endif
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index a31e22cc839eb..b3079f687c5c6 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -567,7 +567,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *,
+ const char *cper_mem_err_unpack(struct trace_seq *,
+ struct cper_mem_err_compact *);
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc);
++ const struct cper_sec_proc_arm *proc,
++ u32 length);
+ void cper_print_proc_ia(const char *pfx,
+ const struct cper_sec_proc_ia *proc);
+
+--
+2.51.0
+
--- /dev/null
+From f49738670540424f4c22c79e71df79560aeed664 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:41 +0800
+Subject: ext4: mark group add fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ]
+
+Fast commits only log operations that have dedicated replay support.
+Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group
+descriptor metadata without going through the fast commit tracking
+paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+ext4_ioctl_group_add() adds new block groups.
+This forces those transactions to fall back to a full commit,
+ensuring that the filesystem geometry updates are captured by the
+normal journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_ADD safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted
+ filesystem and checked the resize ineligible reason:
+ ./group_add_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows "Resize": > 0.
+3. Fsynced a file on the resized filesystem and verified that the fast
+ commit stats report at least one ineligible commit:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+ shows fc stats ineligible > 0.
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index bd90b454c6213..889eadb87520e 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -709,6 +709,7 @@ static long ext4_ioctl_group_add(struct file *file,
+
+ err = ext4_group_add(sb, input);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From 9e67f66ba4201b156fe72707df4c34b9d536e736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:42 +0800
+Subject: ext4: mark group extend fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ]
+
+Fast commits only log operations that have dedicated replay support.
+EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last
+block group and updates the same on-disk metadata without going
+through the fast commit tracking paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+EXT4_IOC_GROUP_EXTEND grows the filesystem.
+This forces those transactions to fall back to a full commit,
+ensuring that the group extension changes are captured by the normal
+journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_EXTEND safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Extended the filesystem to the end of the last block group using a
+ helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem
+ and checked fc_info:
+ ./group_extend_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows the "Resize" ineligible reason increased.
+3. Fsynced a file on the resized filesystem and confirmed that the fast
+ commit ineligible counter incremented for the resize transaction:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 889eadb87520e..4d1e5d8055231 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -937,6 +937,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+
+ err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE,
++ NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From bfd08d39485f3f98a30ad06f88f1de25b4ab9d57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 13:11:24 +0100
+Subject: fix it87_wdt early reboot by reporting running timer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ]
+
+Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87
+wdt enabled by the firmware and a broken BIOS option that does not
+allow to change the time or turn it off. As this makes installing
+Linux rather difficult, change the it87_wdt to report it running to
+the watchdog core.
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/it87_wdt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
+index 239947df613db..1392e557fa371 100644
+--- a/drivers/watchdog/it87_wdt.c
++++ b/drivers/watchdog/it87_wdt.c
+@@ -183,6 +183,12 @@ static void _wdt_update_timeout(unsigned int t)
+ superio_outb(t >> 8, WDTVALMSB);
+ }
+
++/* Internal function, should be called after superio_select(GPIO) */
++static bool _wdt_running(void)
++{
++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB));
++}
++
+ static int wdt_update_timeout(unsigned int t)
+ {
+ int ret;
+@@ -365,6 +371,12 @@ static int __init it87_wdt_init(void)
+ }
+ }
+
++ /* wdt already left running by firmware? */
++ if (_wdt_running()) {
++ pr_info("Left running by firmware.\n");
++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status);
++ }
++
+ superio_exit();
+
+ if (timeout < 1 || timeout > max_units * 60) {
+--
+2.51.0
+
--- /dev/null
+From 0b9fd1c4375d90e69347e110d76f0ee58f804c45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 16:07:32 +0100
+Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in
+ ntfs_read_run_nb_ra()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ]
+
+When ntfs_read_run_nb_ra() is invoked with run == NULL the code later
+assumes run is valid and may call run_get_entry(NULL, ...), and also
+uses clen/idx without initializing them. Smatch reported uninitialized
+variable warnings and this can lead to undefined behaviour. This patch
+fixes it.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fsntfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index 7dc2ae7dec591..566dd9083b8ff 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -1249,6 +1249,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run,
+
+ } while (len32);
+
++ if (!run) {
++ err = -EINVAL;
++ goto out;
++ }
++
++ /* Get next fragment to read. */
+ vcn_next = vcn + clen;
+ if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) ||
+ vcn != vcn_next) {
+--
+2.51.0
+
--- /dev/null
+From 21230cafe02631de06dc81727f18a90be0582331 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 19:59:59 +0900
+Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed dentry in the ntfs3 filesystem can cause the kernel to hang
+during the lookup operations. By setting the HAS_SUB_NODE flag in an
+INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the
+VCN pointer, an attacker can cause the indx_find() function to repeatedly
+read the same block, allocating 4 KB of memory each time. The kernel lacks
+VCN loop detection and depth limits, causing memory exhaustion and an OOM
+crash.
+
+This patch adds a return value check for fnd_push() to prevent a memory
+exhaustion vulnerability caused by infinite loops. When the index exceeds the
+size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()
+function checks this return value and stops processing, preventing further
+memory allocation.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 0fe1b5696e855..b0aa5cc63b507 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1197,7 +1197,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni,
+ goto out;
+ }
+
+- fnd_push(fnd, node, e);
++ err = fnd_push(fnd, node, e);
++
++ if (err) {
++ put_indx_node(node);
++ return err;
++ }
+ }
+
+ out:
+--
+2.51.0
+
--- /dev/null
+From c3b51225566a45c6fbe6734ddd06eb9678b7b13d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:09 +0900
+Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
+ metadata
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an attribute header
+indicates an empty run list, while directory entries reference it as
+containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way
+to represent an empty run list, and run_unpack() correctly handles this by
+checking if evcn + 1 equals svcn and returning early without parsing any run
+data. However, this creates a problem when there is metadata inconsistency,
+where the attribute header claims to be empty (evcn=-1) but the caller
+expects to read actual data. When run_unpack() immediately returns success
+upon seeing this condition, it leaves the runs_tree uninitialized with
+run->runs as a NULL. The calling function attr_load_runs_range() assumes
+that a successful return means that the runs were loaded and sets clen to 0,
+expecting the next run_lookup_entry() call to succeed. Because runs_tree
+remains uninitialized, run_lookup_entry() continues to fail, and the loop
+increments vcn by zero (vcn += 0), leading to an infinite loop.
+
+This patch adds a retry counter to detect when run_lookup_entry() fails
+consecutively after attr_load_runs_vcn(). If the run is still not found on
+the second attempt, it indicates corrupted metadata and returns -EINVAL,
+preventing the Denial-of-Service (DoS) vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index 83c15c70f5945..872586e9598a7 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -1192,19 +1192,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type,
+ CLST vcn = from >> cluster_bits;
+ CLST vcn_last = (to - 1) >> cluster_bits;
+ CLST lcn, clen;
+- int err;
++ int err = 0;
++ int retry = 0;
+
+ for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) {
+ if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) {
++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */
++ err = -EINVAL;
++ break;
++ }
+ err = attr_load_runs_vcn(ni, type, name, name_len, run,
+ vcn);
+ if (err)
+- return err;
++ break;
++
+ clen = 0; /* Next run_lookup_entry(vcn) must be success. */
++ retry++;
+ }
++ else
++ retry = 0;
+ }
+
+- return 0;
++ return err;
+ }
+
+ #ifdef CONFIG_NTFS3_LZX_XPRESS
+--
+2.51.0
+
--- /dev/null
+From 2f83ccf0f5283179e8a35e4a58672d4330e34533 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:46 +0900
+Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
+indicates a zero data size while the driver allocates memory for it.
+
+When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
+to zero, it still allocates memory because of al_aligned(0). This creates an
+inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
+non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
+list exists and enumerates only the primary MFT record. When it finds
+ATTR_LIST, the code reloads it and restarts the enumeration, repeating
+indefinitely. The mount operation never completes, hanging the kernel thread.
+
+This patch adds validation to ensure that data_size is non-zero before memory
+allocation. When a zero-sized ATTR_LIST is detected, the function returns
+-EINVAL, preventing a DoS vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrlist.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
+index 82bd9b5d9bd80..64da2196711ed 100644
+--- a/fs/ntfs3/attrlist.c
++++ b/fs/ntfs3/attrlist.c
+@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+
+ if (!attr->non_res) {
+ lsize = le32_to_cpu(attr->res.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ /* attr is resident: lsize < record_size (1K or 4K) */
+ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+ u16 run_off = le16_to_cpu(attr->nres.run_off);
+
+ lsize = le64_to_cpu(attr->nres.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
+
+ run_init(&ni->attr_list.run);
+
+--
+2.51.0
+
--- /dev/null
+From 124ecccfe1a97703ef8b1cad0398b9b4dae0a603 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 15:52:57 +0100
+Subject: gfs2: fiemap page fault fix
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ]
+
+In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode
+glock. This can lead to recursive glock taking if the fiemap buffer is
+memory mapped to the same inode and accessing it triggers a page fault.
+
+Fix by disabling page faults for iomap_fiemap() and faulting in the
+buffer by hand if necessary.
+
+Fixes xfstest generic/742.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/inode.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index a7af9904e3edb..061372f84a64c 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -2076,6 +2076,14 @@ static int gfs2_getattr(struct user_namespace *mnt_userns,
+ return 0;
+ }
+
++static bool fault_in_fiemap(struct fiemap_extent_info *fi)
++{
++ struct fiemap_extent __user *dest = fi->fi_extents_start;
++ size_t size = sizeof(*dest) * fi->fi_extents_max;
++
++ return fault_in_safe_writeable((char __user *)dest, size) == 0;
++}
++
+ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ u64 start, u64 len)
+ {
+@@ -2085,14 +2093,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+
+ inode_lock_shared(inode);
+
++retry:
+ ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh);
+ if (ret)
+ goto out;
+
++ pagefault_disable();
+ ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops);
++ pagefault_enable();
+
+ gfs2_glock_dq_uninit(&gh);
+
++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) {
++ fieinfo->fi_extents_mapped = 0;
++ goto retry;
++ }
++
+ out:
+ inode_unlock_shared(inode);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 81e572e42730d9562e6644dace15590da99a22ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:26:26 +0800
+Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ]
+
+Use module_platform_driver() to replace module_platform_driver_probe().
+The former utilizes platform_driver_register(), which allows the driver to
+defer probing when it doesn't acquire the necessary resources due to probe
+order. In contrast, the latter uses __platform_driver_probe(), which
+includes the comment "Note that this is incompatible with deferred
+probing." Since our SGPIO driver requires access to the clock resource, the
+former is more suitable.
+
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed-sgpio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
+index 454cefbeecf0e..e523a539410a8 100644
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -508,7 +508,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = {
+
+ MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table);
+
+-static int __init aspeed_sgpio_probe(struct platform_device *pdev)
++static int aspeed_sgpio_probe(struct platform_device *pdev)
+ {
+ u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask;
+ const struct aspeed_sgpio_pdata *pdata;
+@@ -601,12 +601,13 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ }
+
+ static struct platform_driver aspeed_sgpio_driver = {
++ .probe = aspeed_sgpio_probe,
+ .driver = {
+ .name = KBUILD_MODNAME,
+ .of_match_table = aspeed_sgpio_of_table,
+ },
+ };
+
+-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe);
++module_platform_driver(aspeed_sgpio_driver);
+ MODULE_DESCRIPTION("Aspeed Serial GPIO Driver");
+ MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From 593c66839963f17413eca90aa0e8aa63795cc7b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Dec 2025 19:58:22 -0800
+Subject: hfsplus: fix volume corruption issue for generic/498
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ]
+
+The xfstests' test-case generic/498 leaves HFS+ volume
+in corrupted state:
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
+(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details)
+
+Ran: generic/498
+Failures: generic/498
+Failed 1 of 1 tests
+
+sudo fsck.hfsplus -d /dev/loop51
+** /dev/loop51
+Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+Executing fsck_hfs (version 540.1-Linux).
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+Invalid leaf record count
+(It should be 16 instead of 2)
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
+CBTStat = 0x8000 CatStat = 0x00000000
+** Repairing volume.
+** Rechecking volume.
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled was repaired successfully.
+
+The generic/498 test executes such steps on final phase:
+
+mkdir $SCRATCH_MNT/A
+mkdir $SCRATCH_MNT/B
+mkdir $SCRATCH_MNT/A/C
+touch $SCRATCH_MNT/B/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo
+
+ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A
+
+"Simulate a power failure and mount the filesystem
+to check that what we explicitly fsync'ed exists."
+
+_flakey_drop_and_remount
+
+The FSCK tool complains about "Invalid leaf record count".
+HFS+ b-tree header contains leaf_count field is updated
+by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert()
+is involved into hard link creation process. However,
+modified in-core leaf_count field is stored into HFS+
+b-tree header by hfs_btree_write() method. But,
+unfortunately, hfs_btree_write() hasn't been called
+by hfsplus_cat_write_inode() and hfsplus_file_fsync()
+stores not fully consistent state of the Catalog File's
+b-tree.
+
+This patch adds calling hfs_btree_write() method in
+the hfsplus_cat_write_inode() with the goal of
+storing consistent state of Catalog File's b-tree.
+Finally, it makes FSCK tool happy.
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 33s ... 31s
+Ran: generic/498
+Passed all 1 tests
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/inode.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 98a80ec5faa91..4310b9105d0fa 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -599,6 +599,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ int hfsplus_cat_write_inode(struct inode *inode)
+ {
+ struct inode *main_inode = inode;
++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree;
+ struct hfs_find_data fd;
+ hfsplus_cat_entry entry;
+ int res = 0;
+@@ -609,7 +610,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ if (!main_inode->i_nlink)
+ return 0;
+
+- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd))
++ if (hfs_find_init(tree, &fd))
+ /* panic? */
+ return -EIO;
+
+@@ -674,6 +675,15 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags);
+ out:
+ hfs_find_exit(&fd);
++
++ if (!res) {
++ res = hfs_btree_write(tree);
++ if (res) {
++ pr_err("b-tree write err: %d, ino %lu\n",
++ res, inode->i_ino);
++ }
++ }
++
+ return res;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6097a0a15b05889506162ae5ebf35361c57c96b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 18:39:33 +0900
+Subject: hfsplus: pretend special inodes as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index cb703b3e99fc2..8d2155ef7e811 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode)
+ return -EIO;
+ }
+
++ /*
++ * Assign a dummy file type, for may_open() requires that
++ * an inode has a valid file type.
++ */
++ inode->i_mode = S_IFREG;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c0e244c564291b63da7ede5b8f54e93e41f92e04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 12:56:09 +0900
+Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
+
+From: David Phillips <david@profile.sh>
+
+[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ]
+
+New model in the ELECOM HUGE trackball line that has 8 buttons but the
+report descriptor specifies only 5. The HUGE Plus supports connecting via
+Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable.
+Each connection type reports a different device id, 01AA for cable,
+01AB for USB dongle, and 01AC for Bluetooth.
+
+This patch adds these device IDs and applies the fixups similar to the
+other ELECOM devices to get all 8 buttons working for all 3 connection
+types.
+
+For reference, the usbhid-dump output:
+001:013:001:DESCRIPTOR 1769085639.598405
+ 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01
+ 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01
+ 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10
+ 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06
+ 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0
+ C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01
+ 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01
+ 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03
+ 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00
+ A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81
+ 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26
+ FF 00 75 08 95 07 B1 02 C0
+
+Signed-off-by: David Phillips <david@profile.sh>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-elecom.c | 16 ++++++++++++++++
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 3 +++
+ 4 files changed, 23 insertions(+)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 9235ab7161e3a..e1bd249666a2b 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -337,6 +337,7 @@ config HID_ELECOM
+ - EX-G Trackballs (M-XT3DRBK, M-XT3URBK)
+ - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ - HUGE Plus Trackball (M-HT1MRBK)
+
+ config HID_ELO
+ tristate "ELO USB 4000/4500 touchscreen"
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index f76fec79e8903..9aeb2d2b43a43 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -5,6 +5,7 @@
+ * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK)
+ * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ * - HUGE Plus Trackball (M-HT1MRBK)
+ *
+ * Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
+ * Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
+@@ -111,12 +112,25 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
+ break;
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC:
++ /*
++ * Report descriptor format:
++ * 24: button bit count
++ * 28: padding bit count
++ * 22: button report size
++ * 16: button usage maximum
++ */
++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8);
++ break;
+ }
+ return rdesc;
+ }
+
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+@@ -127,6 +141,8 @@ static const struct hid_device_id elecom_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, elecom_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index caa2a5a122c7f..37beb969268c3 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -429,6 +429,9 @@
+ #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac
+
+ #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34
+ #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index b4f4f6823c5f6..2a07db02ad932 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -392,6 +392,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+@@ -401,6 +402,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_ELO)
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
+--
+2.51.0
+
--- /dev/null
+From b14411b305528461f6e0cf3327ba62e79b8ec0a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 09:57:05 +0100
+Subject: HID: multitouch: add eGalaxTouch EXC3188 support
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ]
+
+Add support for the for the EXC3188 touchscreen from eGalaxy.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 1dc28cabd71d5..caa2a5a122c7f 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -399,6 +399,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
+
+ #define USB_VENDOR_ID_EDIFIER 0x2d99
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 5c40790b977ee..30769b37aabe7 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2017,6 +2017,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
++ { .driver_data = MT_CLS_EGALAX_SERIAL,
++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) },
+ { .driver_data = MT_CLS_EGALAX,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
+--
+2.51.0
+
--- /dev/null
+From cb2a3bfb3c9c7442b3b147d28c6c3ab11df3e4bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:44 +0100
+Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ]
+
+The unpacked union within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value'
+ is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)'
+ and is usually due to 'struct hv_kvp_exchg_msg_value' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 361 | union {
+ | ^
+
+With the recent changes to compile-test the UAPI headers in more cases,
+this warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warning.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/hyperv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h
+index daf82a230c0e7..15f3415415d2c 100644
+--- a/include/uapi/linux/hyperv.h
++++ b/include/uapi/linux/hyperv.h
+@@ -351,7 +351,7 @@ struct hv_kvp_exchg_msg_value {
+ __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE];
+ __u32 value_u32;
+ __u64 value_u64;
+- };
++ } __attribute__((packed));
+ } __attribute__((packed));
+
+ struct hv_kvp_msg_enumerate {
+--
+2.51.0
+
--- /dev/null
+From 671e862c2611edbc5cd1f89bf9d2cfc1f62f4e39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:08:51 -0500
+Subject: i3c: master: svc: Initialize 'dev' to NULL in
+ svc_i3c_master_ibi_isr()
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ]
+
+Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add
+a NULL check in the error path.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index d12b4ff2a4495..c1aa01d8b162e 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -357,8 +357,8 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ {
+ struct svc_i3c_master *master = container_of(work, struct svc_i3c_master, ibi_work);
+ struct svc_i3c_i2c_dev_data *data;
++ struct i3c_dev_desc *dev = NULL;
+ unsigned int ibitype, ibiaddr;
+- struct i3c_dev_desc *dev;
+ u32 status, val;
+ int ret;
+
+@@ -419,7 +419,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ * for the slave to interrupt again.
+ */
+ if (svc_i3c_master_error(master)) {
+- if (master->ibi.tbq_slot) {
++ if (master->ibi.tbq_slot && dev) {
+ data = i3c_dev_get_master_data(dev);
+ i3c_generic_ibi_recycle_slot(data->ibi_pool,
+ master->ibi.tbq_slot);
+--
+2.51.0
+
--- /dev/null
+From 8ffa52d51dbe75bc0a6eb007f8905c21c510fbd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:38 +0100
+Subject: iio: magnetometer: Remove IRQF_ONESHOT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+The force-threading functionality is required on PREEMPT_RT because the
+handler is using locks with can sleep on PREEMPT_RT.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index c12bcee912424..565f64e1cb17a 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -511,7 +511,7 @@ static int ak8975_setup_irq(struct ak8975_data *data)
+ irq = gpiod_to_irq(data->eoc_gpiod);
+
+ rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ dev_name(&client->dev), data);
+ if (rc < 0) {
+ dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc);
+--
+2.51.0
+
--- /dev/null
+From 7e9731b3a86e4bfc8df1ba962a89f6b86d88f325 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:36 +0100
+Subject: iio: Use IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ]
+
+The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke
+other interrupt handler and this supposed to happen from within the
+hardirq.
+
+Use IRQF_NO_THREAD to forbid forced-threading.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/bma180.c | 5 +++--
+ drivers/iio/adc/ad7766.c | 2 +-
+ drivers/iio/gyro/itg3200_buffer.c | 8 +++-----
+ drivers/iio/light/si1145.c | 2 +-
+ 4 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
+index 3a1f47c7288ff..ea453087b8ed5 100644
+--- a/drivers/iio/accel/bma180.c
++++ b/drivers/iio/accel/bma180.c
+@@ -997,8 +997,9 @@ static int bma180_probe(struct i2c_client *client,
+ }
+
+ ret = devm_request_irq(dev, client->irq,
+- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING,
+- "bma180_event", data->trig);
++ iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "bma180_event", data->trig);
+ if (ret) {
+ dev_err(dev, "unable to request IRQ\n");
+ goto err_trigger_free;
+diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c
+index 51ee9482e0df9..cd4283c32349b 100644
+--- a/drivers/iio/adc/ad7766.c
++++ b/drivers/iio/adc/ad7766.c
+@@ -262,7 +262,7 @@ static int ad7766_probe(struct spi_device *spi)
+ * don't enable the interrupt to avoid extra load on the system
+ */
+ ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq,
+- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD,
+ dev_name(&spi->dev),
+ ad7766->trig);
+ if (ret < 0)
+diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
+index 4cfa0d4395605..d1c125a77308a 100644
+--- a/drivers/iio/gyro/itg3200_buffer.c
++++ b/drivers/iio/gyro/itg3200_buffer.c
+@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev)
+ if (!st->trig)
+ return -ENOMEM;
+
+- ret = request_irq(st->i2c->irq,
+- &iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_RISING,
+- "itg3200_data_rdy",
+- st->trig);
++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "itg3200_data_rdy", st->trig);
+ if (ret)
+ goto error_free_trig;
+
+diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c
+index e8f6cdf26f22a..50b424b4f23b9 100644
+--- a/drivers/iio/light/si1145.c
++++ b/drivers/iio/light/si1145.c
+@@ -1251,7 +1251,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev)
+
+ ret = devm_request_irq(&client->dev, client->irq,
+ iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_FALLING,
++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD,
+ "si1145_irq",
+ trig);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From 44403dbb8229d0944572bf1fd08b12412de9f493 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 15:54:06 +0100
+Subject: include: uapi: netfilter_bridge.h: Cover for musl libc
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ]
+
+Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
+zero. To avoid struct redefinition errors, user space is therefore
+supposed to include netinet/if_ether.h before (or instead of)
+linux/if_ether.h. To relieve them from this burden, include the libc
+header here if not building for kernel space.
+
+Reported-by: Alyssa Ross <hi@alyssa.is>
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter_bridge.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 1610fdbab98df..ad520d3e9df8f 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -5,6 +5,10 @@
+ /* bridge-specific defines for netfilter.
+ */
+
++#ifndef __KERNEL__
++#include <netinet/if_ether.h> /* for __UAPI_DEF_ETHHDR if defined */
++#endif
++
+ #include <linux/in.h>
+ #include <linux/netfilter.h>
+ #include <linux/if_ether.h>
+--
+2.51.0
+
--- /dev/null
+From 4a20d909eec4cf919ccdc28132d2f544db282a1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 13:28:57 -0800
+Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
+
+From: Alexander Grest <Alexander.Grest@microsoft.com>
+
+[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ]
+
+The SMMU CMDQ lock is highly contentious when there are multiple CPUs
+issuing commands and the queue is nearly full.
+
+The lock has the following states:
+ - 0: Unlocked
+ - >0: Shared lock held with count
+ - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters
+ - INT_MIN: Exclusive lock held, no shared waiters
+
+When multiple CPUs are polling for space in the queue, they attempt to
+grab the exclusive lock to update the cons pointer from the hardware. If
+they fail to get the lock, they will spin until either the cons pointer
+is updated by another CPU.
+
+The current code allows the possibility of shared lock starvation
+if there is a constant stream of CPUs trying to grab the exclusive lock.
+This leads to severe latency issues and soft lockups.
+
+Consider the following scenario where CPU1's attempt to acquire the
+shared lock is starved by CPU2 and CPU0 contending for the exclusive
+lock.
+
+CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock`
+--------------------------------------------------------------------------
+trylock() //takes | | | 0
+ | shared_lock() | | INT_MIN
+ | fetch_inc() | | INT_MIN
+ | no return | | INT_MIN + 1
+ | spins // VAL >= 0 | | INT_MIN + 1
+unlock() | spins... | | INT_MIN + 1
+set_release(0) | spins... | | 0 see[NOTE]
+(done) | (sees 0) | trylock() // takes | 0
+ | *exits loop* | cmpxchg(0, INT_MIN) | 0
+ | | *cuts in* | INT_MIN
+ | cmpxchg(0, 1) | | INT_MIN
+ | fails // != 0 | | INT_MIN
+ | spins // VAL >= 0 | | INT_MIN
+ | *starved* | | INT_MIN
+
+[NOTE] The current code resets the exclusive lock to 0 regardless of the
+state of the lock. This causes two problems:
+1. It opens the possibility of back-to-back exclusive locks and the
+ downstream effect of starving shared lock.
+2. The count of shared lock waiters are lost.
+
+To mitigate this, we release the exclusive lock by only clearing the sign
+bit while retaining the shared lock waiter count as a way to avoid
+starving the shared lock waiters.
+
+Also deleted cmpxchg loop while trying to acquire the shared lock as it
+is not needed. The waiters can see the positive lock count and proceed
+immediately after the exclusive lock is released.
+
+Exclusive lock is not starved in that submitters will try exclusive lock
+first when new spaces become available.
+
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Alexander Grest <Alexander.Grest@microsoft.com>
+Signed-off-by: Jacob Pan <jacob.pan@linux.microsoft.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++-------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+index bc65e7b4f0045..b12e23800844a 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+@@ -448,20 +448,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
+ */
+ static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq)
+ {
+- int val;
+-
+ /*
+- * We can try to avoid the cmpxchg() loop by simply incrementing the
+- * lock counter. When held in exclusive state, the lock counter is set
+- * to INT_MIN so these increments won't hurt as the value will remain
+- * negative.
++ * When held in exclusive state, the lock counter is set to INT_MIN
++ * so these increments won't hurt as the value will remain negative.
++ * The increment will also signal the exclusive locker that there are
++ * shared waiters.
+ */
+ if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0)
+ return;
+
+- do {
+- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0);
+- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val);
++ /*
++ * Someone else is holding the lock in exclusive state, so wait
++ * for them to finish. Since we already incremented the lock counter,
++ * no exclusive lock can be acquired until we finish. We don't need
++ * the return value since we only care that the exclusive lock is
++ * released (i.e. the lock counter is non-negative).
++ * Once the exclusive locker releases the lock, the sign bit will
++ * be cleared and our increment will make the lock counter positive,
++ * allowing us to proceed.
++ */
++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0);
+ }
+
+ static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq)
+@@ -488,9 +494,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq)
+ __ret; \
+ })
+
++/*
++ * Only clear the sign bit when releasing the exclusive lock this will
++ * allow any shared_lock() waiters to proceed without the possibility
++ * of entering the exclusive lock in a tight loop.
++ */
+ #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \
+ ({ \
+- atomic_set_release(&cmdq->lock, 0); \
++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \
+ local_irq_restore(flags); \
+ })
+
+--
+2.51.0
+
--- /dev/null
+From f3cba7ba2f7119e4634cd4cb5ec6f32bc96fcc4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 04:35:24 +0000
+Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ]
+
+syzbot reported that struct fib_alias.fa_state can be
+modified locklessly by RCU readers. [0]
+
+Let's use READ_ONCE()/WRITE_ONCE() properly.
+
+[0]:
+BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup
+
+write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0:
+ fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline]
+ fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1:
+ fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline]
+ fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+value changed: 0x00 -> 0x01
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
+
+Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/fib_lookup.h | 6 ++++--
+ net/ipv4/fib_trie.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
+index 78e40ea42e58d..82e77516ca8d2 100644
+--- a/net/ipv4/fib_lookup.h
++++ b/net/ipv4/fib_lookup.h
+@@ -27,8 +27,10 @@ struct fib_alias {
+ /* Don't write on fa_state unless needed, to keep it shared on all cpus */
+ static inline void fib_alias_accessed(struct fib_alias *fa)
+ {
+- if (!(fa->fa_state & FA_S_ACCESSED))
+- fa->fa_state |= FA_S_ACCESSED;
++ u8 fa_state = READ_ONCE(fa->fa_state);
++
++ if (!(fa_state & FA_S_ACCESSED))
++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED);
+ }
+
+ /* Exported by fib_semantics.c */
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 2cec18cb5c488..3f43851f87e39 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1279,7 +1279,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
+ new_fa->fa_tos = fa->fa_tos;
+ new_fa->fa_info = fi;
+ new_fa->fa_type = cfg->fc_type;
+- state = fa->fa_state;
++ state = READ_ONCE(fa->fa_state);
+ new_fa->fa_state = state & ~FA_S_ACCESSED;
+ new_fa->fa_slen = fa->fa_slen;
+ new_fa->tb_id = tb->tb_id;
+@@ -1741,7 +1741,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb,
+
+ fib_remove_alias(t, tp, l, fa_to_delete);
+
+- if (fa_to_delete->fa_state & FA_S_ACCESSED)
++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED)
+ rt_cache_flush(cfg->fc_nlinfo.nl_net);
+
+ fib_release_info(fa_to_delete->fa_info);
+--
+2.51.0
+
--- /dev/null
+From 4649d69f120a12d16dc70f16b4b7804a55ad1e0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:37 +0000
+Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ]
+
+Add missing READ_ONCE() when reading sysctl values.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ipv6.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index dcae37154d3c2..0a1c9366cc81e 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -923,11 +923,11 @@ static inline int ip6_default_np_autolabel(struct net *net)
+ #if IS_ENABLED(CONFIG_IPV6)
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_policy;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy);
+ }
+ static inline u32 ip6_multipath_hash_fields(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_fields;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields);
+ }
+ #else
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+--
+2.51.0
+
--- /dev/null
+From c40c0b5ee2f0fbc35be0778a6ee4591523ab441d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:40 +0000
+Subject: ipv6: exthdrs: annotate data-race over multiple sysctl
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ]
+
+Following four sysctls can change under us, add missing READ_ONCE().
+
+- ipv6.sysctl.max_dst_opts_len
+- ipv6.sysctl.max_dst_opts_cnt
+- ipv6.sysctl.max_hbh_opts_len
+- ipv6.sysctl.max_hbh_opts_cnt
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/exthdrs.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index d273f6fe19c20..7907056db1008 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -308,7 +308,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_dst_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len))
+ goto fail_and_free;
+
+ opt->lastopt = opt->dst1 = skb_network_header_len(skb);
+@@ -316,7 +316,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ dstbuf = opt->dst1;
+ #endif
+
+- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) {
++ if (ip6_parse_tlv(false, skb,
++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ #if IS_ENABLED(CONFIG_IPV6_MIP6)
+@@ -1073,11 +1074,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len))
+ goto fail_and_free;
+
+ opt->flags |= IP6SKB_HOPBYHOP;
+- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) {
++ if (ip6_parse_tlv(true, skb,
++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ opt->nhoff = sizeof(struct ipv6hdr);
+--
+2.51.0
+
--- /dev/null
+From bac45156db39836a2e3576d9b204891867ddb86a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 19:38:01 +0800
+Subject: jfs: Add missing set_freezable() for freezable kthread
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ]
+
+The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(),
+causing it to remain non-freezable by default. This prevents proper
+freezing during system suspend.
+
+Add set_freezable() to make the thread freezable as intended.
+
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_logmgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
+index 78fd136ac13b9..d02bca48bc7b0 100644
+--- a/fs/jfs/jfs_logmgr.c
++++ b/fs/jfs/jfs_logmgr.c
+@@ -2322,6 +2322,7 @@ int jfsIOWait(void *arg)
+ {
+ struct lbuf *bp;
+
++ set_freezable();
+ do {
+ spin_lock_irq(&log_redrive_lock);
+ while ((bp = log_redrive_list)) {
+--
+2.51.0
+
--- /dev/null
+From 244a6992d2effa4fd236de8cf1d39e4d43257e69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 13:22:12 +0100
+Subject: jfs: nlink overflow in jfs_rename
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ]
+
+If nlink is maximal for a directory (-1) and inside that directory you
+perform a rename for some child directory (not moving from the parent),
+then the nlink of the first directory is first incremented and later
+decremented. Normally this is fine, but when nlink = -1 this causes a
+wrap around to 0, and then drop_nlink issues a warning.
+
+After applying the patch syzbot no longer issues any warnings. I also
+ran some basic fs tests to look for any regressions.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
+Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/namei.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
+index b3a0fe0649c49..df6bde0206bb4 100644
+--- a/fs/jfs/namei.c
++++ b/fs/jfs/namei.c
+@@ -1227,7 +1227,7 @@ static int jfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
+ jfs_err("jfs_rename: dtInsert returned -EIO");
+ goto out_tx;
+ }
+- if (S_ISDIR(old_ip->i_mode))
++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
+ inc_nlink(new_dir);
+ }
+ /*
+@@ -1243,7 +1243,9 @@ static int jfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
+ goto out_tx;
+ }
+ if (S_ISDIR(old_ip->i_mode)) {
+- drop_nlink(old_dir);
++ if (new_ip || old_dir != new_dir)
++ drop_nlink(old_dir);
++
+ if (old_dir != new_dir) {
+ /*
+ * Change inode number of parent for moved directory
+--
+2.51.0
+
--- /dev/null
+From b5ad91fca4a15feac4dc5eab0b3e794a6cc365c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 16:30:50 +0200
+Subject: libceph: define and enforce CEPH_MAX_KEY_LEN
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ]
+
+When decoding the key, verify that the key material would fit into
+a fixed-size buffer in process_auth_done() and generally has a sane
+length.
+
+The new CEPH_MAX_KEY_LEN check replaces the existing check for a key
+with no key material which is a) not universal since CEPH_CRYPTO_NONE
+has to be excluded and b) doesn't provide much value since a smaller
+than needed key is just as invalid as no key -- this has to be handled
+elsewhere anyway.
+
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/crypto.c | 8 +++++---
+ net/ceph/crypto.h | 2 +-
+ net/ceph/messenger_v2.c | 2 +-
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
+index 92d89b3316459..4c6cc4e855d36 100644
+--- a/net/ceph/crypto.c
++++ b/net/ceph/crypto.c
+@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf)
+ return -ENOTSUPP;
+ }
+
+- if (!key->len)
+- return -EINVAL;
+-
+ key->key = kmemdup(buf, key->len, GFP_NOIO);
+ if (!key->key) {
+ ret = -ENOMEM;
+@@ -95,6 +92,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
+ ceph_decode_copy(p, &key->created, sizeof(key->created));
+ key->len = ceph_decode_16(p);
+ ceph_decode_need(p, end, key->len, bad);
++ if (key->len > CEPH_MAX_KEY_LEN) {
++ pr_err("secret too big %d\n", key->len);
++ return -EINVAL;
++ }
++
+ ret = set_secret(key, *p);
+ memzero_explicit(*p, key->len);
+ *p += key->len;
+diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h
+index 13bd526349fa1..0d32f1649f3d0 100644
+--- a/net/ceph/crypto.h
++++ b/net/ceph/crypto.h
+@@ -5,7 +5,7 @@
+ #include <linux/ceph/types.h>
+ #include <linux/ceph/buffer.h>
+
+-#define CEPH_KEY_LEN 16
++#define CEPH_MAX_KEY_LEN 16
+ #define CEPH_MAX_CON_SECRET_LEN 64
+
+ /*
+diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
+index d7c61058fa0f8..a35ff372d4230 100644
+--- a/net/ceph/messenger_v2.c
++++ b/net/ceph/messenger_v2.c
+@@ -2052,7 +2052,7 @@ static int process_auth_reply_more(struct ceph_connection *con,
+ */
+ static int process_auth_done(struct ceph_connection *con, void *p, void *end)
+ {
+- u8 session_key_buf[CEPH_KEY_LEN + 16];
++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16];
+ u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16];
+ u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16);
+ u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16);
+--
+2.51.0
+
--- /dev/null
+From f7fc393c70a3b18d7417481b78082c2c5937b7aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:09:18 -0800
+Subject: libperf build: Always place libperf includes first
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ]
+
+When building tools/perf the CFLAGS can contain a directory for the
+installed headers.
+
+As the headers may be being installed while building libperf.a this can
+cause headers to be partially installed and found in the include path
+while building an object file for libperf.a.
+
+The installed header may reference other installed headers that are
+missing given the partial nature of the install and then the build fails
+with a missing header file.
+
+Avoid this by ensuring the libperf source headers are always first in
+the CFLAGS.
+
+Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index 143d566cc6a56..c8d5a434c2ab9 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -63,9 +63,9 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
++override CFLAGS := $(INCLUDES) $(CFLAGS)
+ override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+-override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += $(EXTRA_CFLAGS)
+--
+2.51.0
+
--- /dev/null
+From 721a16abbfad5b2c7f34d507044782448605bdfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 11:40:09 +0000
+Subject: libperf: Don't remove -g when EXTRA_CFLAGS are used
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit f5b07010c13c77541e8ade167d05bef3b8a63739 ]
+
+When using EXTRA_CFLAGS, for example "EXTRA_CFLAGS=-DREFCNT_CHECKING=1",
+this construct stops setting -g which you'd expect would not be affected
+by adding extra flags. Additionally, EXTRA_CFLAGS should be the last
+thing to be appended so that it can be used to undo any defaults. And no
+condition is required, just += appends to any existing CFLAGS and also
+appends or doesn't append EXTRA_CFLAGS if they are or aren't set.
+
+It's not clear why DEBUG=1 is required for -g in Perf when in libperf
+it's always on, but I don't think we need to change that behavior now
+because someone may be depending on it.
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250319114009.417865-1-james.clark@linaro.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 8c5b40678c63 ("libperf build: Always place libperf includes first")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index 08fe6e3c4089f..143d566cc6a56 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -54,13 +54,6 @@ endif
+
+ TEST_ARGS := $(if $(V),-v)
+
+-# Set compile option CFLAGS
+-ifdef EXTRA_CFLAGS
+- CFLAGS := $(EXTRA_CFLAGS)
+-else
+- CFLAGS := -g -Wall
+-endif
+-
+ INCLUDES = \
+ -I$(srctree)/tools/lib/perf/include \
+ -I$(srctree)/tools/lib/ \
+@@ -70,11 +63,12 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
+-override CFLAGS += $(EXTRA_WARNINGS)
+-override CFLAGS += -Werror -Wall
++override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+ override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
++override CFLAGS += $(EXTRA_WARNINGS)
++override CFLAGS += $(EXTRA_CFLAGS)
+
+ all:
+
+--
+2.51.0
+
--- /dev/null
+From 0d2168ae1fa20174c864c0030cb30993aaa810d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Dec 2025 21:04:01 +0900
+Subject: m68k: nommu: fix memmove() with differently aligned src and dest for
+ 68000
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ]
+
+68000 has different alignment needs to 68020+.
+memcpy() checks if the destination is aligned and does a smaller copy
+to fix the alignment and then critically for 68000 it checks if the
+source is still unaligned and if it is reverts to smaller copies.
+
+memmove() does not currently do the second part and malfunctions if
+one of the pointers is aligned and the other isn't.
+
+This is apparently getting triggered by printk. If I put breakpoints
+into the new checks added by this commit the first hit looks like this:
+
+memmove (n=205, src=0x2f3971 <printk_shared_pbufs+205>, dest=0x2f3980 <printk_shared_pbufs+220>) at arch/m68k/lib/memmove.c:82
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Signed-off-by: Greg Ungerer <gerg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/lib/memmove.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c
+index 6519f7f349f66..e33f00b02e4c0 100644
+--- a/arch/m68k/lib/memmove.c
++++ b/arch/m68k/lib/memmove.c
+@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *cdest++ = *csrc++;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *--cdest = *--csrc;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+--
+2.51.0
+
--- /dev/null
+From 3bf18c2d7af21a902718a1489326c94e642396fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:24 +0100
+Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ]
+
+request_threaded_irq() is invoked with a primary and a secondary handler
+and no flags are passed. The primary handler is the same as
+irq_default_primary_handler() so there is no need to have an identical
+copy.
+
+The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt
+source is not masked while the threaded handler is active. This means,
+especially on LEVEL typed interrupt lines, the interrupt can fire again
+before the threaded handler had a chance to run.
+
+Use the default primary interrupt handler by specifying NULL and set
+IRQF_ONESHOT so the interrupt source is masked until the secondary handler
+is done.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index b7e9fd53d47db..08870ed12a271 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1183,14 +1183,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset)
+
+ /* ====== FlexRM interrupt handler ===== */
+
+-static irqreturn_t flexrm_irq_event(int irq, void *dev_id)
+-{
+- /* We only have MSI for completions so just wakeup IRQ thread */
+- /* Ring related errors will be informed via completion descriptors */
+-
+- return IRQ_WAKE_THREAD;
+-}
+-
+ static irqreturn_t flexrm_irq_thread(int irq, void *dev_id)
+ {
+ flexrm_process_completions(dev_id);
+@@ -1281,10 +1273,8 @@ static int flexrm_startup(struct mbox_chan *chan)
+ ret = -ENODEV;
+ goto fail_free_cmpl_memory;
+ }
+- ret = request_threaded_irq(ring->irq,
+- flexrm_irq_event,
+- flexrm_irq_thread,
+- 0, dev_name(ring->mbox->dev), ring);
++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread,
++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring);
+ if (ret) {
+ dev_err(ring->mbox->dev,
+ "failed to request ring%d IRQ\n", ring->num);
+--
+2.51.0
+
--- /dev/null
+From 4176b8150cf44ab0185ea7830d6fb2f4fe359d0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:36 +0100
+Subject: mailbox: sprd: clear delivery flag before handling TX done
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ]
+
+If there are any pending messages in the mailbox queue, they are sent
+as soon as a TX done event arrives from the driver. This may trigger a
+new delivery interrupt while the previous one is still being handled.
+If the delivery status is cleared after this, the interrupt is lost.
+To prevent this from happening, clear the delivery status immediately
+after checking it and before any new messages are sent.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index 0dc609592c46a..2a43fb375bcb9 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -167,6 +167,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ return IRQ_NONE;
+ }
+
++ /* Clear FIFO delivery and overflow status first */
++ writel(fifo_sts &
++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
++ priv->inbox_base + SPRD_MBOX_FIFO_RST);
++
+ while (send_sts) {
+ id = __ffs(send_sts);
+ send_sts &= (send_sts - 1);
+@@ -182,11 +187,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ mbox_chan_txdone(chan, 0);
+ }
+
+- /* Clear FIFO delivery and overflow status */
+- writel(fifo_sts &
+- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
+- priv->inbox_base + SPRD_MBOX_FIFO_RST);
+-
+ /* Clear irq status */
+ writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS);
+
+--
+2.51.0
+
--- /dev/null
+From 39ac475ad8926a46de37bc97f1c241d95bd4c982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:38 +0100
+Subject: mailbox: sprd: mask interrupts that are not handled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ]
+
+To reduce the amount of spurious interrupts, disable the interrupts that
+are not handled in this driver.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index e3c899abeed8b..0dc609592c46a 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -244,21 +244,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan)
+ /* Select outbox FIFO mode and reset the outbox FIFO status */
+ writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST);
+
+- /* Enable inbox FIFO overflow and delivery interrupt */
+- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ);
++ /* Enable inbox FIFO delivery interrupt */
++ val = SPRD_INBOX_FIFO_IRQ_MASK;
++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ;
+ writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable outbox FIFO not empty interrupt */
+- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ val = SPRD_OUTBOX_FIFO_IRQ_MASK;
+ val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable supplementary outbox as the fundamental one */
+ if (priv->supp_base) {
+ writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST);
+- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 794c46cbfdaea7cdbb5a0ae8815c9f6afddf2d51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 15:29:57 +0100
+Subject: media: adv7180: fix frame interval in progressive mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ]
+
+The ADV7280-M may internally convert interlaced video input to
+progressive video. If this mode is enabled, the ADV7280-M delivers
+progressive video frames at the field rate of 50 fields per second (PAL)
+or 60 fields per second (NTSC).
+
+Fix the reported frame interval if progressive video is enabled.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index d9a99fcfacb17..930ab969cc742 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -471,6 +471,13 @@ static int adv7180_g_frame_interval(struct v4l2_subdev *sd,
+ fi->interval.denominator = 25;
+ }
+
++ /*
++ * If the de-interlacer is active, the chip produces full video frames
++ * at the field rate.
++ */
++ if (state->field == V4L2_FIELD_NONE)
++ fi->interval.denominator *= 2;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ce17b418524313ef2522d3eb62476fc33c401a4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 15:46:47 +0800
+Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ]
+
+Add release_mem_region() if ioremap() fails to release the memory
+region obtained by cx25821_get_resources().
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index a4192e80e9a07..bce4fe15dce57 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -915,6 +915,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
+
+ if (!dev->lmmio) {
+ CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n");
++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0));
+ cx25821_iounmap(dev);
+ return -ENOMEM;
+ }
+--
+2.51.0
+
--- /dev/null
+From a7db05c2a035e1dea955bf0c0c447dafbca61302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 08:57:35 +0200
+Subject: media: dvb-core: dmxdevfilter must always flush bufs
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ]
+
+Currently the buffers are being filled until full, which works fine
+for the transport stream, but not when reading sections, those have
+to be returned to userspace immediately, otherwise dvbv5-scan will
+just wait forever.
+
+Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether
+the buffer must be flushed or wait until it is full.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dmxdev.c | 8 ++++----
+ drivers/media/dvb-core/dvb_vb2.c | 5 +++--
+ include/media/dvb_vb2.h | 6 ++++--
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index 8abf7f44d96bc..4989ffe2477ea 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -406,11 +406,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
+ if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) {
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, true);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, true);
+ } else {
+ ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer,
+ buffer1, buffer1_len);
+@@ -461,10 +461,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
+
+ if (dvb_vb2_is_streaming(ctx)) {
+ ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, false);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, false);
+ } else {
+ if (buffer->error) {
+ spin_unlock(&dmxdevfilter->dev->lock);
+diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c
+index 1331f2c2237e6..c1aaa0b46c37e 100644
+--- a/drivers/media/dvb-core/dvb_vb2.c
++++ b/drivers/media/dvb-core/dvb_vb2.c
+@@ -256,7 +256,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx)
+
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags)
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush)
+ {
+ unsigned long flags = 0;
+ void *vbuf = NULL;
+@@ -313,7 +314,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ }
+ }
+
+- if (ctx->nonblocking && ctx->buf) {
++ if (flush && ctx->buf) {
+ vb2_set_plane_payload(&ctx->buf->vb, 0, ll);
+ vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE);
+ list_del(&ctx->buf->list);
+diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h
+index 8cb88452cd6c2..0fbbfc65157e6 100644
+--- a/include/media/dvb_vb2.h
++++ b/include/media/dvb_vb2.h
+@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx)
+ return 0;
+ };
+ #define dvb_vb2_is_streaming(ctx) (0)
+-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0)
++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0)
+
+ static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx,
+ struct file *file,
+@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx);
+ * @buffer_flags:
+ * pointer to buffer flags as defined by &enum dmx_buffer_flags.
+ * can be NULL.
++ * @flush: flush the buffer, even if it isn't full.
+ */
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags);
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush);
+
+ /**
+ * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV
+--
+2.51.0
+
--- /dev/null
+From bee20913a36cbc056f651e10c0f4011d718cc5e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 15:26:40 +0200
+Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ]
+
+The isp_video_mbus_to_pix/pix_to_mbus functions did not take
+the last empty entry { 0, } of the formats array into account.
+
+As a result, isp_video_mbus_to_pix would accept code 0 and
+isp_video_pix_to_mbus would select code 0 if no match was found.
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/ispvideo.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c
+index 8811d6dd4ee74..f7e1ef11cdc4a 100644
+--- a/drivers/media/platform/omap3isp/ispvideo.c
++++ b/drivers/media/platform/omap3isp/ispvideo.c
+@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video,
+ pix->width = mbus->width;
+ pix->height = mbus->height;
+
+- for (i = 0; i < ARRAY_SIZE(formats); ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
+ if (formats[i].code == mbus->code)
+ break;
+ }
+
+- if (WARN_ON(i == ARRAY_SIZE(formats)))
++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1))
+ return 0;
+
+ min_bpl = pix->width * formats[i].bpp;
+@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix,
+ /* Skip the last format in the loop so that it will be selected if no
+ * match is found.
+ */
+- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) {
+ if (formats[i].pixelformat == pix->pixelformat)
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From f8791547ae10aeb1eb257da1888ee8c530adf1e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 17:09:18 +0200
+Subject: media: omap3isp: isppreview: always clamp in preview_try_format()
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ]
+
+If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't
+clamped. Just always clamp.
+
+This fixes a v4l2-compliance error:
+
+ fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
+ fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
+test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/isppreview.c | 21 ++++++++------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c
+index 53aedec7990da..32e4348e6837a 100644
+--- a/drivers/media/platform/omap3isp/isppreview.c
++++ b/drivers/media/platform/omap3isp/isppreview.c
+@@ -1744,22 +1744,17 @@ static void preview_try_format(struct isp_prev_device *prev,
+
+ switch (pad) {
+ case PREV_PAD_SINK:
+- /* When reading data from the CCDC, the input size has already
+- * been mangled by the CCDC output pad so it can be accepted
+- * as-is.
+- *
+- * When reading data from memory, clamp the requested width and
+- * height. The TRM doesn't specify a minimum input height, make
++ /*
++ * Clamp the requested width and height.
++ * The TRM doesn't specify a minimum input height, make
+ * sure we got enough lines to enable the noise filter and color
+ * filter array interpolation.
+ */
+- if (prev->input == PREVIEW_INPUT_MEMORY) {
+- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
+- preview_max_out_width(prev));
+- fmt->height = clamp_t(u32, fmt->height,
+- PREV_MIN_IN_HEIGHT,
+- PREV_MAX_IN_HEIGHT);
+- }
++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
++ preview_max_out_width(prev));
++ fmt->height = clamp_t(u32, fmt->height,
++ PREV_MIN_IN_HEIGHT,
++ PREV_MAX_IN_HEIGHT);
+
+ fmt->colorspace = V4L2_COLORSPACE_SRGB;
+
+--
+2.51.0
+
--- /dev/null
+From c137a1c9581e28d0979464ef09a05482786e9d13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 09:21:53 +0200
+Subject: media: omap3isp: set initial format
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ]
+
+Initialize the v4l2_format to a default. Empty formats are
+not allowed in V4L2, so this fixes v4l2-compliance issues:
+
+ fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height
+test VIDIOC_G_FMT: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/ispvideo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c
+index f7e1ef11cdc4a..3304457716450 100644
+--- a/drivers/media/platform/omap3isp/ispvideo.c
++++ b/drivers/media/platform/omap3isp/ispvideo.c
+@@ -1293,6 +1293,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = {
+ static int isp_video_open(struct file *file)
+ {
+ struct isp_video *video = video_drvdata(file);
++ struct v4l2_mbus_framefmt fmt;
+ struct isp_video_fh *handle;
+ struct vb2_queue *queue;
+ int ret = 0;
+@@ -1334,6 +1335,13 @@ static int isp_video_open(struct file *file)
+
+ memset(&handle->format, 0, sizeof(handle->format));
+ handle->format.type = video->type;
++ handle->format.fmt.pix.width = 720;
++ handle->format.fmt.pix.height = 480;
++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY;
++ handle->format.fmt.pix.field = V4L2_FIELD_NONE;
++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt);
++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix);
+ handle->timeperframe.denominator = 1;
+
+ handle->video = video;
+--
+2.51.0
+
--- /dev/null
+From 9e32e65e79437c17ae8da62a550629b2b3345fce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 19:24:19 +0100
+Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex
+
+From: Szymon Wilczek <szymonwilczek@gmx.com>
+
+[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ]
+
+When pvr2_send_request_ex() submits a write URB successfully but fails to
+submit the read URB (e.g. returns -ENOMEM), it returns immediately without
+waiting for the write URB to complete. Since the driver reuses the same
+URB structure, a subsequent call to pvr2_send_request_ex() attempts to
+submit the still-active write URB, triggering a 'URB submitted while
+active' warning in usb_submit_urb().
+
+Fix this by ensuring the write URB is unlinked and waited upon if the read
+URB submission fails.
+
+Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
+Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com>
+Acked-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 10c21580a827b..fc7eb59aa2c80 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -3704,6 +3704,11 @@ status);
+ "Failed to submit read-control URB status=%d",
+ status);
+ hdw->ctl_read_pend_flag = 0;
++ if (hdw->ctl_write_pend_flag) {
++ usb_unlink_urb(hdw->ctl_write_urb);
++ while (hdw->ctl_write_pend_flag)
++ wait_for_completion(&hdw->ctl_done);
++ }
+ goto done;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From b1160e8f81f598ab96216695a885c4735c4760fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:00:35 -0800
+Subject: media: solo6x10: Check for out of bounds chip_id
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ]
+
+Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
+(literal "1" is an "int") could end up being shifted beyond 32 bits,
+so instrumentation was added (and due to the double is_tw286x() call
+seen via inlining), Clang decides the second one must now be undefined
+behavior and elides the rest of the function[1]. This is a known problem
+with Clang (that is still being worked on), but we can avoid the entire
+problem by actually checking the existing max chip ID, and now there is
+no runtime instrumentation added at all since everything is known to be
+within bounds.
+
+Additionally use an unsigned value for the shift to remove the
+instrumentation even without the explicit bounds checking.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
+Suggested-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: fix checkpatch warning for is_tw286x]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+index 1b7c22a9bc94f..8f53946c67928 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c
++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = {
+ 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0,
+ };
+
+-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id)))
++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id))))
+
+ static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off,
+ u8 tw_off)
+@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ if (val > 255 || val < 0)
+ return -ERANGE;
+
+@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ switch (ctrl) {
+ case V4L2_CID_SHARPNESS:
+ /* Only 286x has sharpness */
+--
+2.51.0
+
--- /dev/null
+From c3055bc0715194c45d65c19f3cc389a867aa7089 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 16:39:47 +0100
+Subject: minix: Add required sanity checking to minix_check_superblock()
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ]
+
+The fs/minix implementation of the minix filesystem does not currently
+support any other value for s_log_zone_size than 0. This is also the
+only value supported in util-linux; see mkfs.minix.c line 511. In
+addition, this patch adds some sanity checking for the other minix
+superblock fields, and moves the minix_blocks_needed() checks for the
+zmap and imap also to minix_check_super_block().
+
+This also closes a related syzbot bug report.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/inode.c | 50 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 29 insertions(+), 21 deletions(-)
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 807ae40b64b06..95705305d358a 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -153,10 +153,38 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)
+ static bool minix_check_superblock(struct super_block *sb)
+ {
+ struct minix_sb_info *sbi = minix_sb(sb);
++ unsigned long block;
+
+- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
++ if (sbi->s_log_zone_size != 0) {
++ printk("minix-fs error: zone size must equal block size. "
++ "s_log_zone_size > 0 is not supported.\n");
++ return false;
++ }
++
++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
++ sbi->s_firstdatazone >= sbi->s_nzones)
+ return false;
+
++ /* Apparently minix can create filesystems that allocate more blocks for
++ * the bitmaps than needed. We simply ignore that, but verify it didn't
++ * create one with not enough blocks and bail out if so.
++ */
++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize);
++ if (sbi->s_imap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "imap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
++ block = minix_blocks_needed(
++ (sbi->s_nzones - sbi->s_firstdatazone + 1),
++ sb->s_blocksize);
++ if (sbi->s_zmap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "zmap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
+ /*
+ * s_max_size must not exceed the block mapping limitation. This check
+ * is only needed for V1 filesystems, since V2/V3 support an extra level
+@@ -275,26 +303,6 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ minix_set_bit(0,sbi->s_imap[0]->b_data);
+ minix_set_bit(0,sbi->s_zmap[0]->b_data);
+
+- /* Apparently minix can create filesystems that allocate more blocks for
+- * the bitmaps than needed. We simply ignore that, but verify it didn't
+- * create one with not enough blocks and bail out if so.
+- */
+- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
+- if (sbi->s_imap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "imap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+- block = minix_blocks_needed(
+- (sbi->s_nzones - sbi->s_firstdatazone + 1),
+- s->s_blocksize);
+- if (sbi->s_zmap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "zmap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+ /* set up enough so that it can read an inode */
+ s->s_op = &minix_sops;
+ s->s_time_min = 0;
+--
+2.51.0
+
--- /dev/null
+From 38923a7905ce3e1df82cdb8a416005d638942731 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 09:40:06 +0000
+Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ]
+
+The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which
+is a valid index - so add a check for this.
+
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mach-loongson64/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h
+index 3414a1fd17835..89bb4deab98a6 100644
+--- a/arch/mips/include/asm/mach-loongson64/topology.h
++++ b/arch/mips/include/asm/mach-loongson64/topology.h
+@@ -7,7 +7,7 @@
+ #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2)
+
+ extern cpumask_t __node_cpumask[];
+-#define cpumask_of_node(node) (&__node_cpumask[node])
++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node])
+
+ struct pci_bus;
+ extern int pcibus_to_node(struct pci_bus *);
+--
+2.51.0
+
--- /dev/null
+From 7f1b89da5d0048bf9444828cd00fb9e6ac42b9f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 11:48:24 +0100
+Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
+
+From: Markus Perkins <markus@notsyncing.net>
+
+[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ]
+
+commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66
+compatible strings") added support for 93xx56 and 93xx66 eeproms, but
+didn't take into account that the write enable/disable + erase all
+commands are hardcoded for the 6-bit address of the 93xx46.
+
+This commit fixes the command word generation by increasing the number
+of shifts as the address field grows, keeping the command intact.
+
+Also, the check for 8-bit or 16-bit mode is no longer required as this
+is already taken into account in the edev->addrlen field.
+
+Signed-off-by: Markus Perkins <markus@notsyncing.net>
+Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index 1f15399e5cb49..fb8c054321a38 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -23,6 +23,7 @@
+ #define OP_START 0x4
+ #define OP_WRITE (OP_START | 0x1)
+ #define OP_READ (OP_START | 0x2)
++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */
+ #define ADDR_EWDS 0x00
+ #define ADDR_ERAL 0x20
+ #define ADDR_EWEN 0x30
+@@ -173,10 +174,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1;
+- else
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS);
++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+@@ -320,10 +318,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= ADDR_ERAL << 1;
+- else
+- cmd_addr |= ADDR_ERAL;
++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+--
+2.51.0
+
--- /dev/null
+From b60b94455d11af0d6f4035e3a0978e7a5ac83d42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 13:13:30 +0100
+Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ]
+
+Building a size optimized ppc64 kernel (-Os), gcc emits more FP
+save/restore symbols, that the linker generates on demand into the
+.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c,
+too. They are needed for the amdgpu in-kernel floating point support.
+
+MODPOST Module.symvers
+ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many)
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index a663a0ea4066b..2fa333fca1f7b 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -654,6 +654,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
+ /* Special register function linked on all modules during final link of .ko */
+ if (strstarts(symname, "_restgpr0_") ||
+ strstarts(symname, "_savegpr0_") ||
++ strstarts(symname, "_restgpr1_") ||
++ strstarts(symname, "_savegpr1_") ||
++ strstarts(symname, "_restfpr_") ||
++ strstarts(symname, "_savefpr_") ||
+ strstarts(symname, "_restvr_") ||
+ strstarts(symname, "_savevr_") ||
+ strcmp(symname, ".TOC.") == 0)
+--
+2.51.0
+
--- /dev/null
+From b7039214d10137bb585d8ab3e14fa5ca0d393f4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 17:28:09 +0100
+Subject: myri10ge: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ]
+
+While compile testing on less common architectures, I noticed that gcc-10 on
+s390 finds a bug that all other configurations seem to miss:
+
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized]
+ 391 | buf->data0 = htonl(data->data0);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+ | ^~~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized]
+ 393 | buf->data2 = htonl(data->data2);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+
+It would be nice to understand how to make other compilers catch this as
+well, but for the moment I'll just shut up the warning by fixing the
+undefined behavior in this driver.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index e6f18e004036a..30a523e03c806 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
+
+ /* probe for IPv6 TSO support */
+ mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE,
+ &cmd, 0);
+ if (status == 0) {
+@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp,
+ | (addr[2] << 8) | addr[3]);
+
+ cmd.data1 = ((addr[4] << 8) | (addr[5]));
++ cmd.data2 = 0;
+
+ status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0);
+ return status;
+@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause)
+ int status, ctl;
+
+ ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, 0);
+
+ if (status) {
+@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic)
+ int status, ctl;
+
+ ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC;
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic);
+ if (status)
+ netdev_err(mgp->dev, "Failed to set promisc mode\n");
+@@ -1944,6 +1954,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss)
+ /* get ring sizes */
+ slice = ss - mgp->ss;
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
+ tx_ring_size = cmd.data0;
+ cmd.data0 = slice;
+@@ -2236,12 +2248,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice)
+ status = 0;
+ if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) {
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET,
+ &cmd, 0);
+ ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *)
+ (mgp->sram + cmd.data0);
+ }
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET,
+ &cmd, 0);
+ ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *)
+@@ -2310,6 +2326,7 @@ static int myri10ge_open(struct net_device *dev)
+ if (mgp->num_slices > 1) {
+ cmd.data0 = mgp->num_slices;
+ cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE;
++ cmd.data2 = 0;
+ if (mgp->dev->real_num_tx_queues > 1)
+ cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES,
+@@ -2412,6 +2429,8 @@ static int myri10ge_open(struct net_device *dev)
+
+ /* now give firmware buffers sizes, and MTU */
+ cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0);
+ cmd.data0 = mgp->small_bytes;
+ status |=
+@@ -2470,7 +2489,6 @@ static int myri10ge_open(struct net_device *dev)
+ static int myri10ge_close(struct net_device *dev)
+ {
+ struct myri10ge_priv *mgp = netdev_priv(dev);
+- struct myri10ge_cmd cmd;
+ int status, old_down_cnt;
+ int i;
+
+@@ -2489,8 +2507,13 @@ static int myri10ge_close(struct net_device *dev)
+
+ netif_tx_stop_all_queues(dev);
+ if (mgp->rebooted == 0) {
++ struct myri10ge_cmd cmd;
++
+ old_down_cnt = mgp->down_cnt;
+ mb();
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status =
+ myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0);
+ if (status)
+@@ -2954,6 +2977,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev)
+
+ /* Disable multicast filtering */
+
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1);
+ if (err != 0) {
+ netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n",
+--
+2.51.0
+
--- /dev/null
+From fcf61e38363309f6b16aa1de6e9e7fd5e0c463ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:47:55 +0800
+Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits
+
+From: Jijie Shao <shaojijie@huawei.com>
+
+[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ]
+
+Currently, HCLGE_FD_AD_QID has only 10 bits and supports a
+maximum of 1023 queues. However, there are actually scenarios
+where the queue_id exceeds 1023.
+
+This patch adds an additional bit to HCLGE_FD_AD_QID to ensure
+that queue_id greater than 1023 are supported.
+
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++--
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 7d96aa361f633..fb0dc5833af1a 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -1032,8 +1032,8 @@ struct hclge_fd_tcam_config_3_cmd {
+
+ #define HCLGE_FD_AD_DROP_B 0
+ #define HCLGE_FD_AD_DIRECT_QID_B 1
+-#define HCLGE_FD_AD_QID_S 2
+-#define HCLGE_FD_AD_QID_M GENMASK(11, 2)
++#define HCLGE_FD_AD_QID_L_S 2
++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2)
+ #define HCLGE_FD_AD_USE_COUNTER_B 12
+ #define HCLGE_FD_AD_COUNTER_NUM_S 13
+ #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)
+@@ -1046,6 +1046,7 @@ struct hclge_fd_tcam_config_3_cmd {
+ #define HCLGE_FD_AD_TC_OVRD_B 16
+ #define HCLGE_FD_AD_TC_SIZE_S 17
+ #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17)
++#define HCLGE_FD_AD_QID_H_B 21
+
+ struct hclge_fd_ad_config_cmd {
+ u8 stage;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 1dae7500fa57c..4fcb08684ee09 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5845,11 +5845,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc,
+ hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M,
+ HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size);
+ }
++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B,
++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0);
+ ad_data <<= 32;
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B,
+ action->forward_to_direct_queue);
+- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S,
++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S,
+ action->queue_id);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter);
+ hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M,
+--
+2.51.0
+
--- /dev/null
+From 9721572baa84813482a3c0c300797b2f4689f5af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:57:20 -0700
+Subject: net/rds: Clear reconnect pending bit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ]
+
+When canceling the reconnect worker, care must be taken to reset the
+reconnect-pending bit. If the reconnect worker has not yet been
+scheduled before it is canceled, the reconnect-pending bit will stay
+on forever.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 00bda534b9ce2..98c0d5ff9de9c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ * to the conn hash, so we never trigger a reconnect on this
+ * conn - the reconnect is always triggered by the active peer. */
+ cancel_delayed_work_sync(&cp->cp_conn_w);
++
++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags);
+ rcu_read_lock();
+ if (!hlist_unhashed(&conn->c_hash_node)) {
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From ab790526f993afc681a0b05109321f539e118166 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 22:52:12 -0700
+Subject: net/rds: No shortcut out of RDS_CONN_ERROR
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ]
+
+RDS connections carry a state "rds_conn_path::cp_state"
+and transitions from one state to another and are conditional
+upon an expected state: "rds_conn_path_transition."
+
+There is one exception to this conditionality, which is
+"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"
+regardless of what state the condition is currently in.
+
+But as soon as a connection enters state "RDS_CONN_ERROR",
+the connection handling code expects it to go through the
+shutdown-path.
+
+The RDS/TCP multipath changes added a shortcut out of
+"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"
+via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").
+
+A subsequent "rds_tcp_reset_callbacks" can then transition
+the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.
+
+That'll trip up "rds_conn_init_shutdown", which was
+never adjusted to handle "RDS_CONN_RESETTING" and subsequently
+drops the connection with the dreaded "DR_INV_CONN_STATE",
+which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever.
+
+So we do two things here:
+
+a) Don't shortcut "RDS_CONN_ERROR", but take the longer
+ path through the shutdown code.
+
+b) Add "RDS_CONN_RESETTING" to the expected states in
+ "rds_conn_init_shutdown" so that we won't error out
+ and get stuck, if we ever hit weird state transitions
+ like this again."
+
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ net/rds/tcp_listen.c | 5 -----
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index b4cc699c5fad3..00bda534b9ce2 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ if (!rds_conn_path_transition(cp, RDS_CONN_UP,
+ RDS_CONN_DISCONNECTING) &&
+ !rds_conn_path_transition(cp, RDS_CONN_ERROR,
++ RDS_CONN_DISCONNECTING) &&
++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING,
+ RDS_CONN_DISCONNECTING)) {
+ rds_conn_path_error(cp,
+ "shutdown called in state %d\n",
+diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
+index 3994eeef95a3c..7b6d0088ae33e 100644
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -58,9 +58,6 @@ void rds_tcp_keepalive(struct socket *sock)
+ * socket and force a reconneect from smaller -> larger ip addr. The reason
+ * we special case cp_index 0 is to allow the rds probe ping itself to itself
+ * get through efficiently.
+- * Since reconnects are only initiated from the node with the numerically
+- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side
+- * by moving them to CONNECTING in this function.
+ */
+ static
+ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+@@ -85,8 +82,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+ struct rds_conn_path *cp = &conn->c_path[i];
+
+ if (rds_conn_path_transition(cp, RDS_CONN_DOWN,
+- RDS_CONN_CONNECTING) ||
+- rds_conn_path_transition(cp, RDS_CONN_ERROR,
+ RDS_CONN_CONNECTING)) {
+ return cp->cp_transport_data;
+ }
+--
+2.51.0
+
--- /dev/null
+From 242bae2e542f420ed958d5220a65d0fd1cd77440 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 09:59:49 +0800
+Subject: net: usb: r8152: fix transmit queue timeout
+
+From: Mingj Ye <insyelu@gmail.com>
+
+[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ]
+
+When the TX queue length reaches the threshold, the netdev watchdog
+immediately detects a TX queue timeout.
+
+This patch updates the trans_start timestamp of the transmit queue
+on every asynchronous USB URB submission along the transmit path,
+ensuring that the network watchdog accurately reflects ongoing
+transmission activity.
+
+Signed-off-by: Mingj Ye <insyelu@gmail.com>
+Reviewed-by: Hayes Wang <hayeswang@realtek.com>
+Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 1bd18a6292803..e70f3cb8bad94 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -2339,6 +2339,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
+ ret = usb_submit_urb(agg->urb, GFP_ATOMIC);
+ if (ret < 0)
+ usb_autopm_put_interface_async(tp->intf);
++ else
++ netif_trans_update(tp->netdev);
+
+ out_tx_fill:
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From aa6363d6409eeacead6e0b627c5605c88f7d4dc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:39:09 -0800
+Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter
+
+From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+
+[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ]
+
+Several registers referenced in this driver's source code do not
+actually exist (they are not writable and read as zero in my testing).
+They exist in this driver because it originated as a copy of the dm9601
+driver. Notably, these include the multicast filter registers - this
+causes the driver to not support multicast packets correctly. Remove
+the multicast filter code and register definitions. Instead, set the
+chip to receive all multicast filter packets when any multicast
+addresses are in the list.
+
+Reviewed-by: Simon Horman <horms@kernel.org> (from v1)
+Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/Kconfig | 1 -
+ drivers/net/usb/sr9700.c | 25 ++++---------------------
+ drivers/net/usb/sr9700.h | 7 +------
+ 3 files changed, 5 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index 8939e5fbd50a8..4143714f2b7d5 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -320,7 +320,6 @@ config USB_NET_DM9601
+ config USB_NET_SR9700
+ tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
+ depends on USB_USBNET
+- select CRC32
+ help
+ This option adds support for CoreChip-sz SR9700 based USB 1.1
+ 10/100 Ethernet adapters.
+diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
+index 86d14fad318c3..07a018585b30f 100644
+--- a/drivers/net/usb/sr9700.c
++++ b/drivers/net/usb/sr9700.c
+@@ -18,7 +18,6 @@
+ #include <linux/ethtool.h>
+ #include <linux/mii.h>
+ #include <linux/usb.h>
+-#include <linux/crc32.h>
+ #include <linux/usb/usbnet.h>
+
+ #include "sr9700.h"
+@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = {
+ static void sr9700_set_multicast(struct net_device *netdev)
+ {
+ struct usbnet *dev = netdev_priv(netdev);
+- /* We use the 20 byte dev->data for our 8 byte filter buffer
+- * to avoid allocating memory that is tricky to free later
+- */
+- u8 *hashes = (u8 *)&dev->data;
+ /* rx_ctl setting : enable, disable_long, disable_crc */
+ u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG;
+
+- memset(hashes, 0x00, SR_MCAST_SIZE);
+- /* broadcast address */
+- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG;
+- if (netdev->flags & IFF_PROMISC) {
++ if (netdev->flags & IFF_PROMISC)
+ rx_ctl |= RCR_PRMSC;
+- } else if (netdev->flags & IFF_ALLMULTI ||
+- netdev_mc_count(netdev) > SR_MCAST_MAX) {
+- rx_ctl |= RCR_RUNT;
+- } else if (!netdev_mc_empty(netdev)) {
+- struct netdev_hw_addr *ha;
+-
+- netdev_for_each_mc_addr(ha, netdev) {
+- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26;
+- hashes[crc >> 3] |= 1 << (crc & 0x7);
+- }
+- }
++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev))
++ /* The chip has no multicast filter */
++ rx_ctl |= RCR_ALL;
+
+- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes);
+ sr_write_reg_async(dev, SR_RCR, rx_ctl);
+ }
+
+diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
+index ea2b4de621c86..c479908f7d823 100644
+--- a/drivers/net/usb/sr9700.h
++++ b/drivers/net/usb/sr9700.h
+@@ -104,9 +104,7 @@
+ #define WCR_LINKEN (1 << 5)
+ /* Physical Address Reg */
+ #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */
+-/* Multicast Address Reg */
+-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */
+-/* 0x1e unused */
++/* 0x16 --> 0x1E unused */
+ /* Phy Reset Reg */
+ #define SR_PRR 0x1F
+ #define PRR_PHY_RST (1 << 0)
+@@ -161,9 +159,6 @@
+ /* parameters */
+ #define SR_SHARE_TIMEOUT 1000
+ #define SR_EEPROM_LEN 256
+-#define SR_MCAST_SIZE 8
+-#define SR_MCAST_ADDR_FLAG 0x80
+-#define SR_MCAST_MAX 64
+ #define SR_TX_OVERHEAD 2 /* 2bytes header */
+ #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */
+
+--
+2.51.0
+
--- /dev/null
+From fd499ced0a32497e7e77b4ddbaf33f0277b8c2d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Dec 2025 20:53:51 +0900
+Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler
+
+From: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+
+[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ]
+
+The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
+ ("netfilter: conntrack: introduce clash resolution on insertion race"),
+sets allow_clash=true in the UDP/UDPLITE protocol handler
+but does not set it in the generic protocol handler.
+
+As a result, packets composed of connectionless protocols at each layer,
+such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
+
+To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.
+
+Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_generic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
+index e831637bc8ca8..cb260eb3d012c 100644
+--- a/net/netfilter/nf_conntrack_proto_generic.c
++++ b/net/netfilter/nf_conntrack_proto_generic.c
+@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net)
+ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
+ {
+ .l4proto = 255,
++ .allow_clash = true,
+ #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ .ctnl_timeout = {
+ .nlattr_to_obj = generic_timeout_nlattr_to_obj,
+--
+2.51.0
+
--- /dev/null
+From cef02aa5e7489575746a2a6ef14bf6cd80ea6245 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 12:30:42 +0100
+Subject: netfilter: xt_tcpmss: check remaining length before reading optlen
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ]
+
+Quoting reporter:
+ In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
+ op[i+1] directly without validating the remaining option length.
+
+ If the last byte of the option field is not EOL/NOP (0/1), the code attempts
+ to index op[i+1]. In the case where i + 1 == optlen, this causes an
+ out-of-bounds read, accessing memory past the optlen boundary
+ (either reading beyond the stack buffer _opt or the
+ following payload).
+
+Reported-by: sungzii <sungzii@pm.me>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_tcpmss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
+index 37704ab017992..0d32d4841cb32 100644
+--- a/net/netfilter/xt_tcpmss.c
++++ b/net/netfilter/xt_tcpmss.c
+@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ return (mssval >= info->mss_min &&
+ mssval <= info->mss_max) ^ info->invert;
+ }
+- if (op[i] < 2)
++ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i+1] ? : 1;
+--
+2.51.0
+
--- /dev/null
+From 11ce536a1c6298e37a9b268a4ffc450227f2e442 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 19:11:39 +0800
+Subject: nfc: nxp-nci: remove interrupt trigger type
+
+From: Carl Lee <carl.lee@amd.com>
+
+[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ]
+
+For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and
+active high, not edge-triggered.
+
+Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail
+to trigger correctly.
+
+Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured
+via Device Tree.
+
+Signed-off-by: Carl Lee <carl.lee@amd.com>
+Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index ae2ba08d8ac3f..152c9065e730d 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -306,7 +306,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client,
+
+ r = request_threaded_irq(client->irq, NULL,
+ nxp_nci_i2c_irq_thread_fn,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_ONESHOT,
+ NXP_NCI_I2C_DRIVER_NAME, phy);
+ if (r < 0)
+ nfc_err(&client->dev, "Unable to register IRQ handler\n");
+--
+2.51.0
+
--- /dev/null
+From 911b8701956da149096805fa7e28cad8d2250b89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:18 -0800
+Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]
+
+Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
+This patch protects against invalid index out of bounds access to mw_sizes
+When invalid access print message to user that configuration is not valid.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index c9351063aaf15..3fdde852c3b54 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev)
+ for (i = 0; i < sndev->nr_lut_mw; i++) {
+ int idx = sndev->nr_direct_mw + i;
+
++ if (idx >= MAX_MWS) {
++ dev_err(&sndev->stdev->dev,
++ "Total number of MW cannot be bigger than %d", MAX_MWS);
++ break;
++ }
++
+ sndev->self_shared->mw_sizes[idx] = LUT_SIZE;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 1a8619ea4950c457d283716b28c5467b72a2ef19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:17 -0800
+Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]
+
+Number of MW LUTs depends on NTB configuration and can be set to zero,
+in such scenario rounddown_pow_of_two will cause undefined behaviour and
+should not be performed.
+This patch ensures that rounddown_pow_of_two is called on valid value.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index 3fdde852c3b54..da1e32edadc8e 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+ sndev->mmio_self_ctrl);
+
+ sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries);
+- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
++ if (sndev->nr_lut_mw)
++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n",
+ sndev->nr_direct_mw, sndev->nr_lut_mw);
+@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+
+ sndev->peer_nr_lut_mw =
+ ioread16(&sndev->mmio_peer_ctrl->lut_table_entries);
+- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
++ if (sndev->peer_nr_lut_mw)
++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n",
+ sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw);
+--
+2.51.0
+
--- /dev/null
+From 12834979f1d1f912f260dc112a7caf3e8f2e13fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 18:21:47 +0530
+Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ]
+
+NIX SQ manager sticky mode is known to cause stalls when multiple SQs
+share an SMQ and transmit concurrently. Additionally, PSE may deadlock
+on transitions between sticky and non-sticky transmissions. There is
+also a credit drop issue observed when certain condition clocks are
+gated.
+
+work around these hardware errata by:
+- Disabling SQM sticky operation:
+ - Clear TM6 (bit 15)
+ - Clear TM11 (bit 14)
+- Disabling sticky → non-sticky transition path that can deadlock PSE:
+ - Clear TM5 (bit 23)
+- Preventing credit drops by keeping the control-flow clock enabled:
+ - Set TM9 (bit 21)
+
+These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this
+configuration the SQM/PSE maintain forward progress under load without
+credit loss, at the cost of disabling sticky optimizations.
+
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index 8bdde74b34b6d..e91b4d27ce759 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -4411,12 +4411,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw)
+ /* Set chan/link to backpressure TL3 instead of TL2 */
+ rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
+
+- /* Disable SQ manager's sticky mode operation (set TM6 = 0)
++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0)
+ * This sticky mode is known to cause SQ stalls when multiple
+- * SQs are mapped to same SMQ and transmitting pkts at a time.
++ * SQs are mapped to same SMQ and transmitting pkts simultaneously.
++ * NIX PSE may deadlock when there are any sticky to non-sticky
++ * transmission. Hence disable it (TM5 = 0).
+ */
+ cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
+- cfg &= ~BIT_ULL(15);
++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23));
++ /* NIX may drop credits when condition clocks are turned off.
++ * Hence enable control flow clk (set TM9 = 1).
++ */
++ cfg |= BIT_ULL(21);
+ rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
+
+ ltdefs = rvu->kpu.lt_def;
+--
+2.51.0
+
--- /dev/null
+From 15a5d8d0e5737aaa976cfa5d11035d486cc68867 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 12:07:23 -0500
+Subject: openrisc: define arch-specific version of nop()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ]
+
+When compiling a driver written for MIPS on OpenRISC that uses the nop()
+function, it fails due to the following error:
+
+ drivers/watchdog/pic32-wdt.c: Assembler messages:
+ drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop'
+
+The driver currently uses the generic version of nop() from
+include/asm-generic/barrier.h:
+
+ #ifndef nop
+ #define nop() asm volatile ("nop")
+ #endif
+
+Let's fix this on OpenRISC by defining an architecture-specific version
+of nop().
+
+This was tested by performing an allmodconfig openrisc cross compile on
+an aarch64 host.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/barrier.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+index 7538294721bed..8e592c9909023 100644
+--- a/arch/openrisc/include/asm/barrier.h
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -4,6 +4,8 @@
+
+ #define mb() asm volatile ("l.msync" ::: "memory")
+
++#define nop() asm volatile ("l.nop")
++
+ #include <asm-generic/barrier.h>
+
+ #endif /* __ASM_BARRIER_H */
+--
+2.51.0
+
--- /dev/null
+From bb9ca966d4551994a5832d7358a77439df2c40c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 17:58:55 +0100
+Subject: parisc: Prevent interrupts during reboot
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/process.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index f393d24e4b1c3..e5cbdd17cdd53 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -82,6 +82,9 @@ void machine_restart(char *cmd)
+ #endif
+ /* set up a new led state on systems shipped with a LED State panel */
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN);
++
++ /* prevent interrupts during reboot */
++ set_eiem(0);
+
+ /* "Normal" system reset */
+ pdc_do_reset();
+--
+2.51.0
+
--- /dev/null
+From 28030e6ad9ab665cb81a563e11d35dc58b1e5057 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:53:32 +0530
+Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
+
+From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+
+[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ]
+
+The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability,
+but they do provide ACS-like features to disable peer transactions and
+validate bus numbers in requests.
+
+Add an ACS quirk for Hamoa & Glymur.
+
+Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 8ea3d2c9676d5..7a94236f1c2c6 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4976,6 +4976,10 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
+ /* QCOM SA8775P root port */
+ { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },
++ /* QCOM Hamoa root port */
++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs },
++ /* QCOM Glymur root port */
++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs },
+ /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */
+ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs },
+ /* Intel PCH root ports */
+--
+2.51.0
+
--- /dev/null
+From f00601bfd418c766c98e8a7678189f70c04a372d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 10:25:51 +0100
+Subject: PCI/AER: Clear stale errors on reporting agents upon probe
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ]
+
+Correctable and Uncorrectable Error Status Registers on reporting agents
+are cleared upon PCI device enumeration in pci_aer_init() to flush past
+events. They're cleared again when an error is handled by the AER driver.
+
+If an agent reports a new error after pci_aer_init() and before the AER
+driver has probed on the corresponding Root Port or Root Complex Event
+Collector, that error is not handled by the AER driver: It clears the
+Root Error Status Register on probe, but neglects to re-clear the
+Correctable and Uncorrectable Error Status Registers on reporting agents.
+
+The error will eventually be reported when another error occurs. Which
+is irritating because to an end user it appears as if the earlier error
+has just happened.
+
+Amend the AER driver to clear stale errors on reporting agents upon probe.
+
+Skip reporting agents which have not invoked pci_aer_init() yet to avoid
+using an uninitialized pdev->aer_cap. They're recognizable by the error
+bits in the Device Control register still being clear.
+
+Reporting agents may execute pci_aer_init() after the AER driver has
+probed, particularly when devices are hotplugged or removed/rescanned via
+sysfs. For this reason, it continues to be necessary that pci_aer_init()
+clears Correctable and Uncorrectable Error Status Registers.
+
+Reported-by: Lucas Van <lucas.van@intel.com> # off-list
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Lucas Van <lucas.van@intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 81ea196ce843e..a8bec1c3c769a 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -1257,6 +1257,20 @@ static void set_downstream_devices_error_reporting(struct pci_dev *dev,
+
+ }
+
++static int clear_status_iter(struct pci_dev *dev, void *data)
++{
++ u16 devctl;
++
++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */
++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl);
++ if (!(devctl & PCI_EXP_AER_FLAGS))
++ return 0;
++
++ pci_aer_clear_status(dev);
++ pcie_clear_device_status(dev);
++ return 0;
++}
++
+ /**
+ * aer_enable_rootport - enable Root Port's interrupts when receiving messages
+ * @rpc: pointer to a Root Port data structure
+@@ -1278,9 +1292,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc)
+ pcie_capability_clear_word(pdev, PCI_EXP_RTCTL,
+ SYSTEM_ERROR_INTR_ON_MESG_MASK);
+
+- /* Clear error status */
++ /* Clear error status of this Root Port or RCEC */
+ pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32);
++
++ /* Clear error status of agents reporting to this Root Port or RCEC */
++ if (reg32 & AER_ERR_STATUS_MASK) {
++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC)
++ pcie_walk_rcec(pdev, clear_status_iter, NULL);
++ else if (pdev->subordinate)
++ pci_walk_bus(pdev->subordinate, clear_status_iter,
++ NULL);
++ }
++
+ pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32);
+ pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32);
+--
+2.51.0
+
--- /dev/null
+From df05713e38db3cea4779ac2ef586636cf320a938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 21:04:47 +0530
+Subject: PCI: Enable ACS after configuring IOMMU for OF platforms
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ]
+
+Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets
+'pci_acs_enable' to request that ACS be enabled for any devices enumerated
+in the future.
+
+OF platforms called pci_enable_acs() for the first device before
+of_iommu_configure() called pci_request_acs(), so ACS was never enabled for
+that device (typically a Root Port).
+
+Call pci_enable_acs() later, from pci_dma_configure(), after
+of_dma_configure() has had a chance to call pci_request_acs().
+
+Here's the call path, showing the move of pci_enable_acs() from
+pci_acs_init() to pci_dma_configure(), where it always happens after
+pci_request_acs():
+
+ pci_device_add
+ pci_init_capabilities
+ pci_acs_init
+ - pci_enable_acs
+ - if (pci_acs_enable) <-- previous test
+ - ...
+ device_add
+ bus_notify(BUS_NOTIFY_ADD_DEVICE)
+ iommu_bus_notifier
+ iommu_probe_device
+ iommu_init_device
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ of_dma_configure
+ of_iommu_configure
+ pci_request_acs
+ pci_acs_enable = 1 <-- set
+ + pci_enable_acs
+ + if (pci_acs_enable) <-- new test
+ + ...
+ bus_probe_device
+ device_initial_probe
+ ...
+ really_probe
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ ...
+ pci_enable_acs
+
+Note that we will now call pci_enable_acs() twice for every device, first
+from the iommu_probe_device() path and again from the really_probe() path.
+Presumably that's not an issue since we also call dev->bus->dma_configure()
+twice.
+
+For the ACPI platforms, pci_request_acs() is called during ACPI
+initialization time itself, independent of the IOMMU framework.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 8 ++++++++
+ drivers/pci/pci.c | 10 +---------
+ drivers/pci/pci.h | 1 +
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 08c985478b8ff..ecbe382b56be9 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1616,6 +1616,14 @@ static int pci_dma_configure(struct device *dev)
+ ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
+ }
+
++ /*
++ * Attempt to enable ACS regardless of capability because some Root
++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
++ * the standard ACS capability but still support ACS via those
++ * quirks.
++ */
++ pci_enable_acs(to_pci_dev(dev));
++
+ pci_put_host_bridge_device(bridge);
+ return ret;
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index b1690622f4235..220cef46989e8 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -936,7 +936,7 @@ static void pci_std_enable_acs(struct pci_dev *dev)
+ * pci_enable_acs - enable ACS if hardware support it
+ * @dev: the PCI device
+ */
+-static void pci_enable_acs(struct pci_dev *dev)
++void pci_enable_acs(struct pci_dev *dev)
+ {
+ if (!pci_acs_enable)
+ goto disable_acs_redir;
+@@ -3609,14 +3609,6 @@ bool pci_acs_path_enabled(struct pci_dev *start,
+ void pci_acs_init(struct pci_dev *dev)
+ {
+ dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
+-
+- /*
+- * Attempt to enable ACS regardless of capability because some Root
+- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+- * the standard ACS capability but still support ACS via those
+- * quirks.
+- */
+- pci_enable_acs(dev);
+ }
+
+ /**
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 4a8f499d278be..d9d7a79e3563e 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -562,6 +562,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
+ }
+
+ void pci_acs_init(struct pci_dev *dev);
++void pci_enable_acs(struct pci_dev *dev);
+ #ifdef CONFIG_PCI_QUIRKS
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);
+--
+2.51.0
+
--- /dev/null
+From a7b5b8c32dded84fef4ba55a08011c8f77225b71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 08:59:51 -0800
+Subject: PCI: Fix pci_slot_lock () device locking
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ]
+
+Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to
+prevent warnings like:
+
+ pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0
+
+Take and release the lock for the bridge providing the slot for the
+lock/trylock and unlock routines.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 9cf46bf7e1e7b..b1690622f4235 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5555,10 +5555,9 @@ static int pci_bus_trylock(struct pci_bus *bus)
+ /* Do any devices on or below this slot prevent a bus reset? */
+ static bool pci_slot_resetable(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+- if (slot->bus->self &&
+- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
+ return false;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+@@ -5575,7 +5574,10 @@ static bool pci_slot_resetable(struct pci_slot *slot)
+ /* Lock devices from the top of the tree down */
+ static void pci_slot_lock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge)
++ pci_dev_lock(bridge);
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5590,7 +5592,7 @@ static void pci_slot_lock(struct pci_slot *slot)
+ /* Unlock devices from the bottom of the tree up */
+ static void pci_slot_unlock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5600,12 +5602,18 @@ static void pci_slot_unlock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ }
+
+ /* Return 1 on successful lock, 0 on contention */
+ static int pci_slot_trylock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge && !pci_dev_trylock(bridge))
++ return 0;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5630,6 +5638,9 @@ static int pci_slot_trylock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 42b2a8df3dbbbb89e4307977a964218202809ed5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 17:02:08 -0700
+Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset
+
+From: Alex Williamson <alex.williamson@nvidia.com>
+
+[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ]
+
+User forums report issues when assigning ASM1164 SATA controllers to VMs,
+especially in configurations with multiple controllers. Logs show the
+device fails to retrain after bus reset. Reports suggest this is an issue
+across multiple platforms. The device indicates support for PM reset,
+therefore the device still has a viable function level reset mechanism.
+The reporting user confirms the device is well behaved in this use case
+with bus reset disabled.
+
+Reported-by: Patrick Bianchi <patrick.w.bianchi@gmail.com>
+Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
+Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 88922e21d440a..8ea3d2c9676d5 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3652,6 +3652,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset);
+ */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
+
++/*
++ * Reports from users making use of PCI device assignment with ASM1164
++ * controllers indicate an issue with bus reset where the device fails to
++ * retrain. The issue appears more common in configurations with multiple
++ * controllers. The device does indicate PM reset support (NoSoftRst-),
++ * therefore this still leaves a viable reset method.
++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset);
++
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
+ /*
+--
+2.51.0
+
--- /dev/null
+From 6c1bdb63f6af8aba786aa833435e06efe29f3954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 16:44:06 +0800
+Subject: PCI: Mark Nvidia GB10 to avoid bus reset
+
+From: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+
+[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ]
+
+After asserting Secondary Bus Reset to downstream devices via a GB10 Root
+Port, the link may not retrain correctly, e.g., the link may retrain with a
+lower lane count or config accesses to downstream devices may fail.
+
+Prevent use of Secondary Bus Reset for devices below GB10.
+
+Signed-off-by: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+[bhelgaas: drop pci_ids.h update (only used once), update commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7a94236f1c2c6..d4a300766cbc3 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3609,6 +3609,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+ }
+
++/*
++ * After asserting Secondary Bus Reset to downstream devices via a GB10
++ * Root Port, the link may not retrain correctly.
++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset);
++
+ /*
+ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
+ * prevented for those affected devices.
+--
+2.51.0
+
--- /dev/null
+From d0f7af75154e8a9c410eb585126fb3022ee62c50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:36 -0800
+Subject: perf callchain: Fix srcline printing with inlines
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ]
+
+sample__fprintf_callchain() was using map__fprintf_srcline() which won't
+report inline line numbers.
+
+Fix by using the srcline from the callchain and falling back to the map
+variant.
+
+Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel_fprintf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
+index bfedd7b235211..2ef8e7cb0c86c 100644
+--- a/tools/perf/util/evsel_fprintf.c
++++ b/tools/perf/util/evsel_fprintf.c
+@@ -171,8 +171,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
+ printed += fprintf(fp, ")");
+ }
+
+- if (print_srcline)
+- printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ if (print_srcline) {
++ if (node->srcline)
++ printed += fprintf(fp, "\n %s", node->srcline);
++ else
++ printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ }
+
+ if (sym && sym->inlined)
+ printed += fprintf(fp, " (inlined)");
+--
+2.51.0
+
--- /dev/null
+From 1a54ef9d860aa62fe93b7329afbf87e14f24bc89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 19:17:12 +0800
+Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ]
+
+Disabling PHYs in runtime usually causes the client with external abort
+exception or similar issue due to lack of API to notify clients about PHY
+removal. This patch removes the possibility to unbind i.MX PHY drivers in
+runtime.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+index a29b4a6f7c249..c2a6e70493ff7 100644
+--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+@@ -192,6 +192,7 @@ static struct platform_driver imx8mq_usb_phy_driver = {
+ .driver = {
+ .name = "imx8mq-usb-phy",
+ .of_match_table = imx8mq_usb_phy_of_match,
++ .suppress_bind_attrs = true,
+ }
+ };
+ module_platform_driver(imx8mq_usb_phy_driver);
+--
+2.51.0
+
--- /dev/null
+From 27446a91d60c6a885ecda0dcf7eeafe98396755a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 15:06:43 +0000
+Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts
+
+From: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+
+[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ]
+
+The problem with the current implementation is that it does not consider
+that the USB controller can have multiple PHY handles with different
+arguments count, as for example we have in our cn9131 based platform:
+"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;".
+
+In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells)
+leads to not proper phy detection, taking the "marvell,cp110-utmi-phy"
+dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0
+(#phy-cells = <0>) and safely look for that phy.
+
+Signed-off-by: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+index 08d178a4dc13f..d5761681a253f 100644
+--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+@@ -326,7 +326,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
+- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1);
++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0);
+ if ((port->dr_mode != USB_DR_MODE_HOST) &&
+ (port->dr_mode != USB_DR_MODE_PERIPHERAL)) {
+ dev_err(&pdev->dev,
+--
+2.51.0
+
--- /dev/null
+From 18ef846a00d1b49ffa16480b21f12171c5a0c831 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 10:03:58 +0800
+Subject: pstore: ram_core: fix incorrect success return when vmap() fails
+
+From: Ruipeng Qi <ruipengqi3@gmail.com>
+
+[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ]
+
+In persistent_ram_vmap(), vmap() may return NULL on failure.
+
+If offset is non-zero, adding offset_in_page(start) causes the function
+to return a non-NULL pointer even though the mapping failed.
+persistent_ram_buffer_map() therefore incorrectly returns success.
+
+Subsequent access to prz->buffer may dereference an invalid address
+and cause crashes.
+
+Add proper NULL checking for vmap() failures.
+
+Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
+Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 8eb4bea7295b4..c0b3b9c6892d1 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot);
+ kfree(pages);
+
++ /*
++ * vmap() may fail and return NULL. Do not add the offset in this
++ * case, otherwise a NULL mapping would appear successful.
++ */
++ if (!vaddr)
++ return NULL;
++
+ /*
+ * Since vmap() uses page granularity, we must add the offset
+ * into the page here, to get the byte granularity address
+--
+2.51.0
+
--- /dev/null
+From b8a78bba356a7a20889438086d5309b080f9bb4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:15:16 +0100
+Subject: RDMA/rtrs-clt: For conn rejection use actual err number
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ]
+
+When the connection establishment request is rejected from the server
+side, then the actual error number sent back should be used.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com
+Reviewed-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index cda7849e2133c..dbd51e5be3a6b 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1911,7 +1911,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ struct rtrs_path *s = con->c.path;
+ const struct rtrs_msg_conn_rsp *msg;
+ const char *rej_msg;
+- int status, errno;
++ int status, errno = -ECONNRESET;
+ u8 data_len;
+
+ status = ev->status;
+@@ -1933,7 +1933,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ status, rej_msg);
+ }
+
+- return -ECONNRESET;
++ return errno;
+ }
+
+ void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait)
+--
+2.51.0
+
--- /dev/null
+From 9cd2b20052283b2fe1953f46ee78eaba6a15805f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 11:07:55 +0000
+Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock`
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ]
+
+A potential circular locking dependency (ABBA deadlock) exists between
+`ec_dev->lock` and the clock framework's `prepare_lock`.
+
+The first order (A -> B) occurs when scp_ipi_send() is called while
+`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()):
+1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send().
+2. scp_ipi_send() calls clk_prepare_enable(), which acquires
+ `prepare_lock`.
+See #0 in the following example calling trace.
+(Lock Order: `ec_dev->lock` -> `prepare_lock`)
+
+The reverse order (B -> A) is more complex and has been observed
+(learned) by lockdep. It involves the clock prepare operation
+triggering power domain changes, which then propagates through sysfs
+and power supply uevents, eventually calling back into the ChromeOS EC
+driver and attempting to acquire `ec_dev->lock`:
+1. Something calls clk_prepare(), which acquires `prepare_lock`. It
+ then triggers genpd operations like genpd_runtime_resume(), which
+ takes `&genpd->mlock`.
+2. Power domain changes can trigger regulator changes; regulator
+ changes can then trigger device link changes; device link changes
+ can then trigger sysfs changes. Eventually, power_supply_uevent()
+ is called.
+3. This leads to calls like cros_usbpd_charger_get_prop(), which calls
+ cros_ec_cmd_xfer_status(), which then attempts to acquire
+ `ec_dev->lock`.
+See #1 ~ #6 in the following example calling trace.
+(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`)
+
+Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the
+remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock`
+is only acquired in prepare()/unprepare() callbacks. Since
+`ec_dev->lock` is not involved in the callbacks, the dependency loop is
+broken.
+
+This means the clock is always "prepared" when the SCP is running. The
+prolonged "prepared time" for the clock should be acceptable as SCP is
+designed to be a very power efficient processor. The power consumption
+impact can be negligible.
+
+A simplified calling trace reported by lockdep:
+> -> #6 (&ec_dev->lock)
+> cros_ec_cmd_xfer
+> cros_ec_cmd_xfer_status
+> cros_usbpd_charger_get_port_status
+> cros_usbpd_charger_get_prop
+> power_supply_get_property
+> power_supply_show_property
+> power_supply_uevent
+> dev_uevent
+> uevent_show
+> dev_attr_show
+> sysfs_kf_seq_show
+> kernfs_seq_show
+> -> #5 (kn->active#2)
+> kernfs_drain
+> __kernfs_remove
+> kernfs_remove_by_name_ns
+> sysfs_remove_file_ns
+> device_del
+> __device_link_del
+> device_links_driver_bound
+> -> #4 (device_links_lock)
+> device_link_remove
+> _regulator_put
+> regulator_put
+> -> #3 (regulator_list_mutex)
+> regulator_lock_dependent
+> regulator_disable
+> scpsys_power_off
+> _genpd_power_off
+> genpd_power_off
+> -> #2 (&genpd->mlock/1)
+> genpd_add_subdomain
+> pm_genpd_add_subdomain
+> scpsys_add_subdomain
+> scpsys_probe
+> -> #1 (&genpd->mlock)
+> genpd_runtime_resume
+> __rpm_callback
+> rpm_callback
+> rpm_resume
+> __pm_runtime_resume
+> clk_core_prepare
+> clk_prepare
+> -> #0 (prepare_lock)
+> clk_prepare
+> scp_ipi_send
+> scp_send_ipi
+> mtk_rpmsg_send
+> rpmsg_send
+> cros_ec_pkt_xfer_rpmsg
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++---------
+ drivers/remoteproc/mtk_scp_ipi.c | 4 ++--
+ 2 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
+index 211c7e3b848e4..bf9228bd5090f 100644
+--- a/drivers/remoteproc/mtk_scp.c
++++ b/drivers/remoteproc/mtk_scp.c
+@@ -225,7 +225,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+ struct mtk_scp *scp = priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return IRQ_NONE;
+@@ -233,7 +233,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+
+ scp->data->scp_irq_handler(scp);
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return IRQ_HANDLED;
+ }
+@@ -391,7 +391,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -406,7 +406,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+
+ ret = scp_elf_load_segments(rproc, fw);
+ leave:
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+@@ -417,14 +417,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+ }
+
+ ret = scp_ipi_init(scp, fw);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -435,7 +435,7 @@ static int scp_start(struct rproc *rproc)
+ struct scp_run *run = &scp->run;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -460,14 +460,14 @@ static int scp_start(struct rproc *rproc)
+ goto stop;
+ }
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver);
+
+ return 0;
+
+ stop:
+ scp->data->scp_reset_assert(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -548,7 +548,7 @@ static int scp_stop(struct rproc *rproc)
+ struct mtk_scp *scp = (struct mtk_scp *)rproc->priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return ret;
+@@ -556,12 +556,29 @@ static int scp_stop(struct rproc *rproc)
+
+ scp->data->scp_reset_assert(scp);
+ scp->data->scp_stop(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return 0;
+ }
+
++static int scp_prepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ return clk_prepare(scp->clk);
++}
++
++static int scp_unprepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ clk_unprepare(scp->clk);
++ return 0;
++}
++
+ static const struct rproc_ops scp_ops = {
++ .prepare = scp_prepare,
++ .unprepare = scp_unprepare,
+ .start = scp_start,
+ .stop = scp_stop,
+ .load = scp_load,
+diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c
+index 968128b78e59c..3f657a662cc0e 100644
+--- a/drivers/remoteproc/mtk_scp_ipi.c
++++ b/drivers/remoteproc/mtk_scp_ipi.c
+@@ -164,7 +164,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+ WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf))
+ return -EINVAL;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clock\n");
+ return ret;
+@@ -207,7 +207,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+
+ unlock_mutex:
+ mutex_unlock(&scp->send_lock);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 008b07bfb17cb7afb93104c097dcb1a54a847f36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 17:16:51 +0100
+Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask"
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ]
+
+This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed.
+
+Almost every register in this chip can be customized via OTP
+memory. Somehow the value for R19, which decide if the flag is set
+on read or write operation, seems to have been overwritten for the chip
+the original patch were written for.
+
+Revert the change to follow the default behavior.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9052-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c
+index 06c500bf4d57e..5faf3766a5e20 100644
+--- a/drivers/mfd/da9052-spi.c
++++ b/drivers/mfd/da9052-spi.c
+@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)
+ spi_set_drvdata(spi, da9052);
+
+ config = da9052_regmap_config;
+- config.write_flag_mask = 1;
++ config.read_flag_mask = 1;
+ config.reg_bits = 7;
+ config.pad_bits = 1;
+ config.val_bits = 8;
+--
+2.51.0
+
--- /dev/null
+From 1713229227e906a052245bdeeabf9d49b68f05df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 13:47:33 +0100
+Subject: rnbd-srv: Zero the rsp buffer before using it
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ]
+
+Before using the data buffer to send back the response message, zero it
+completely. This prevents any stray bytes to be picked up by the client
+side when there the message is exchanged between different protocol
+versions.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-srv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
+index 86a6242d9c205..3af8c4e49fe4c 100644
+--- a/drivers/block/rnbd/rnbd-srv.c
++++ b/drivers/block/rnbd/rnbd-srv.c
+@@ -546,6 +546,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp,
+ struct rnbd_dev *rnbd_dev = sess_dev->rnbd_dev;
+ struct request_queue *q = bdev_get_queue(rnbd_dev->bdev);
+
++ memset(rsp, 0, sizeof(*rsp));
++
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP);
+ rsp->device_id =
+ cpu_to_le32(sess_dev->device_id);
+@@ -663,6 +665,7 @@ static int process_msg_sess_info(struct rnbd_srv_session *srv_sess,
+ srv_sess->sessname, srv_sess->ver,
+ sess_info_msg->ver, RNBD_PROTO_VER_MAJOR);
+
++ memset(rsp, 0, sizeof(*rsp));
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP);
+ rsp->ver = srv_sess->ver;
+
+--
+2.51.0
+
--- /dev/null
+From 16c7a73b9f4222a8b5e8f8421e5083b3e3dea7bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 17:35:19 +0000
+Subject: rtc: interface: Alarm race handling should not discard preceding
+ error
+
+From: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+
+[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ]
+
+Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting
+alarm") should not discard any errors from the preceding validations.
+
+Prior to that commit, if the alarm feature was disabled, or the
+set_alarm failed, a meaningful error code would be returned to the
+caller for further action.
+
+After, more often than not, the __rtc_read_time will cause a success
+return code instead, misleading the caller.
+
+An example of this is when timer_enqueue is called for a rtc-abx080x
+device. Since that driver does not clear the alarm feature bit, but
+instead relies on the set_alarm operation to return invalid, the discard
+of the return code causes very different behaviour; i.e.
+ hwclock: select() to /dev/rtc0 to wait for clock tick timed out
+
+Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm")
+Signed-off-by: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+Reviewed-by: Esben Haabendal <esben@geanix.com>
+Tested-by: Nick Bowler <nbowler@draconx.ca>
+Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index e91ab1df4c6b8..5a3e0f3fcd8d7 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -456,7 +456,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ * are in, we can return -ETIME to signal that the timer has already
+ * expired, which is true in both cases.
+ */
+- if ((scheduled - now) <= 1) {
++ if (!err && (scheduled - now) <= 1) {
+ err = __rtc_read_time(rtc, &tm);
+ if (err)
+ return err;
+--
+2.51.0
+
--- /dev/null
+From a69e977bd6b096422063874c5ce7d55da7a9442c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 10:14:12 +0100
+Subject: s390/perf: Disable register readout on sampling events
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ]
+
+Running commands
+ # ./perf record -IR0,R1 -a sleep 1
+extracts and displays register value of general purpose register r1 and r0.
+However the value displayed of any register is random and does not
+reflect the register value recorded at the time of the sample interrupt.
+
+The sampling device driver on s390 creates a very large buffer
+for the hardware to store the samples. Only when that large buffer
+gets full an interrupt is generated and many hundreds of sample
+entries are processed and copied to the kernel ring buffer and
+eventually get copied to the perf tool. It is during the copy
+to the kernel ring buffer that each sample is processed (on s390)
+and at that time the register values are extracted.
+This is not the original goal, the register values should be read
+when the samples are created not when the samples are copied to the
+kernel ring buffer.
+
+Prevent this event from being installed in the first place and
+return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 22893bf86f650..b7606b80388bc 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -887,7 +887,7 @@ static bool is_callchain_event(struct perf_event *event)
+ u64 sample_type = event->attr.sample_type;
+
+ return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER |
+- PERF_SAMPLE_STACK_USER);
++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER);
+ }
+
+ static int cpumsf_pmu_event_init(struct perf_event *event)
+--
+2.51.0
+
--- /dev/null
+From 3929b439716804ceba487013a59ffe7933228082 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 16:47:07 +0100
+Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ]
+
+Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
+to scripts/Makefile.extrawarn, since clang generates warnings for the
+dummy variable in typecheck():
+
+ CC arch/s390/purgatory/purgatory.o
+ arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
+ 221 | return psw_bits(regs->psw).pstate;
+ | ^
+ arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
+ 98 | typecheck(psw_t, __psw); \
+ | ^
+ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
+ 11 | typeof(x) __dummy2; \
+ | ^
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/purgatory/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
+index 414ba87e038b6..c5e4a1ed820df 100644
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -29,6 +29,7 @@ KBUILD_CFLAGS += -fno-stack-protector
+ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+ KBUILD_CFLAGS += $(CLANG_FLAGS)
+ KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
+ KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS))
+
+ # Since we link purgatory with -r unresolved symbols are not checked, so we
+--
+2.51.0
+
--- /dev/null
+From ac4f3e71049e780654a494f0b5aa4974d308033d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:33:15 +0100
+Subject: scsi: buslogic: Reduce stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ]
+
+Some randconfig builds run into excessive stack usage with gcc-14 or
+higher, which use __attribute__((cold)) where earlier versions did not do
+that:
+
+drivers/scsi/BusLogic.c: In function 'blogic_init':
+drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
+
+The problem is that a lot of code gets inlined into blogic_init() here. Two
+functions stick out, but they are a bit different:
+
+ - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel
+ stack, which is a problem in combination with other functions that also
+ do. Marking this one as noinline means that the stack slots get get
+ reused between function calls
+
+ - blogic_reportconfig() has a few large variables, but whenever it is not
+ inlined into its caller, the compiler is actually smart enough to reuse
+ stack slots for these automatically, so marking it as noinline saves
+ most of the stack space by itself.
+
+The combination of both of these should avoid the problem entirely.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/BusLogic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index 40088dcb98cd8..ee90509b5c760 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -919,7 +919,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter)
+ a particular probe order.
+ */
+
+-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter)
++static noinline_for_stack void __init
++blogic_init_probeinfo_list(struct blogic_adapter *adapter)
+ {
+ /*
+ If a PCI BIOS is present, interrogate it for MultiMaster and
+@@ -1689,7 +1690,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter)
+ blogic_reportconfig reports the configuration of Host Adapter.
+ */
+
+-static bool __init blogic_reportconfig(struct blogic_adapter *adapter)
++static noinline_for_stack bool __init
++blogic_reportconfig(struct blogic_adapter *adapter)
+ {
+ unsigned short alltgt_mask = (1 << adapter->maxdev) - 1;
+ unsigned short sync_ok, fast_ok;
+--
+2.51.0
+
--- /dev/null
+From e8906219d62caa77af4fea960fbbac24cc534e5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:29 +0530
+Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
+ termination is done
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ]
+
+Clear rx_running flag only after DMA teardown polling completes. In the
+previous implementation the flag was being cleared while hardware teardown
+was still in progress, creating a mismatch between software state
+(flag = 0, "ready") and hardware state (still terminating).
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 3baa37d26bc64..0d9fd4837ce96 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -849,7 +849,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+
+ cookie = dma->rx_cookie;
+- dma->rx_running = 0;
+
+ /* Re-enable RX FIFO interrupt now that transfer is complete */
+ if (priv->habit & UART_HAS_RHR_IT_DIS) {
+@@ -883,6 +882,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+ ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+
++ dma->rx_running = 0;
+ p->port.icount.rx += ret;
+ p->port.icount.buf_overrun += count - ret;
+ out:
+--
+2.51.0
+
--- /dev/null
+From 3d7faf36fb83fe75b1d6ca3395a7f3ffee430e46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 17:54:25 +0300
+Subject: serial: 8250_dw: handle clock enable errors in runtime_resume
+
+From: Artem Shimko <a.shimko.dev@gmail.com>
+
+[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ]
+
+Add error checking for clk_prepare_enable() calls in
+dw8250_runtime_resume(). Currently if either clock fails to enable,
+the function returns success while leaving clocks in inconsistent state.
+
+This change implements comprehensive error handling by checking the return
+values of both clk_prepare_enable() calls. If the second clock enable
+operation fails after the first clock has already been successfully
+enabled, the code now properly cleans up by disabling and unpreparing
+the first clock before returning. The error code is then propagated to
+the caller, ensuring that clock enable failures are properly reported
+rather than being silently ignored.
+
+Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
+Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index bcf770f344dac..211dc88ce4e2c 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -684,11 +684,18 @@ static int dw8250_runtime_suspend(struct device *dev)
+
+ static int dw8250_runtime_resume(struct device *dev)
+ {
++ int ret;
+ struct dw8250_data *data = dev_get_drvdata(dev);
+
+- clk_prepare_enable(data->pclk);
++ ret = clk_prepare_enable(data->pclk);
++ if (ret)
++ return ret;
+
+- clk_prepare_enable(data->clk);
++ ret = clk_prepare_enable(data->clk);
++ if (ret) {
++ clk_disable_unprepare(data->pclk);
++ return ret;
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
ata-pata_ftide010-fix-some-dma-timings.patch
sunrpc-auth_gss-fix-memory-leaks-in-xdr-decoding-error-paths.patch
sunrpc-fix-gss_auth-kref-leak-in-gss_alloc_msg-error-path.patch
+perf-callchain-fix-srcline-printing-with-inlines.patch
+libperf-don-t-remove-g-when-extra_cflags-are-used.patch
+libperf-build-always-place-libperf-includes-first.patch
+rtc-interface-alarm-race-handling-should-not-discard.patch
+audit-add-fchmodat2-to-change-attributes-class.patch
+hfsplus-fix-volume-corruption-issue-for-generic-498.patch
+audit-add-missing-syscalls-to-read-class.patch
+hfsplus-pretend-special-inodes-as-regular-files.patch
+i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch
+minix-add-required-sanity-checking-to-minix_check_su.patch
+gfs2-fiemap-page-fault-fix.patch
+tools-power-cpupower-reset-errno-before-strtoull.patch
+s390-purgatory-add-wno-default-const-init-unsafe-to-.patch
+arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch
+rnbd-srv-zero-the-rsp-buffer-before-using-it.patch
+x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch
+efi-cper-don-t-dump-the-entire-memory-region.patch
+apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch
+efi-cper-don-t-go-past-the-arm-processor-cper-record.patch
+acpi-processor-fix-null-pointer-dereference-in-acpi_.patch
+acpica-abort-aml-bytecode-execution-when-executing-a.patch
+s390-perf-disable-register-readout-on-sampling-event.patch
+xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch
+blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch
+sparc-synchronize-user-stack-on-fork-and-clone.patch
+sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch
+bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch
+clocksource-drivers-sh_tmu-always-leave-device-runni.patch
+clocksource-drivers-timer-integrator-ap-add-missing-.patch
+mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch
+char-tpm-cr50-remove-irqf_oneshot.patch
+pstore-ram_core-fix-incorrect-success-return-when-vm.patch
+arm64-tegra-smaug-add-usb-role-switch-support.patch
+parisc-prevent-interrupts-during-reboot.patch
+media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch
+spi-stm32-fix-overrun-issue-at-8bpw.patch
+drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch
+media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch
+media-omap3isp-isppreview-always-clamp-in-preview_tr.patch
+media-omap3isp-set-initial-format.patch
+asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch
+asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch
+media-adv7180-fix-frame-interval-in-progressive-mode.patch
+media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch
+media-solo6x10-check-for-out-of-bounds-chip_id.patch
+media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch
+drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch
+drm-account-property-blob-allocations-to-memcg.patch
+hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch
+virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch
+drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch
+drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch
+drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch
+hid-multitouch-add-egalaxtouch-exc3188-support.patch
+hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch
+gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch
+spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch
+asoc-es8328-add-error-unwind-in-resume.patch
+modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch
+alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch
+jfs-add-missing-set_freezable-for-freezable-kthread.patch
+jfs-nlink-overflow-in-jfs_rename.patch
+dm-remove-fake-timeout-to-avoid-leak-request.patch
+iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch
+wifi-libertas-fix-warning-in-usb_tx_block.patch
+ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch
+ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch
+ext4-mark-group-add-fast-commit-ineligible.patch
+ext4-mark-group-extend-fast-commit-ineligible.patch
+netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch
+netfilter-xt_tcpmss-check-remaining-length-before-re.patch
+openrisc-define-arch-specific-version-of-nop.patch
+net-usb-r8152-fix-transmit-queue-timeout.patch
+net-rds-no-shortcut-out-of-rds_conn_error.patch
+net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch
+ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch
+bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch
+bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch
+octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch
+wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch
+net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch
+vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch
+net-rds-clear-reconnect-pending-bit.patch
+pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch
+pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch
+pci-fix-pci_slot_lock-device-locking.patch
+pci-enable-acs-after-configuring-iommu-for-of-platfo.patch
+pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch
+pci-mark-nvidia-gb10-to-avoid-bus-reset.patch
+myri10ge-avoid-uninitialized-variable-use.patch
+nfc-nxp-nci-remove-interrupt-trigger-type.patch
+rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch
+scsi-buslogic-reduce-stack-usage.patch
+tracing-fix-false-sharing-in-hwlat-get_sample.patch
+mailbox-sprd-mask-interrupts-that-are-not-handled.patch
+remoteproc-mediatek-break-lock-dependency-to-prepare.patch
+mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch
+clk-microchip-core-correct-return-value-on-_get_pare.patch
+m68k-nommu-fix-memmove-with-differently-aligned-src-.patch
+staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch
+serial-8250_dw-handle-clock-enable-errors-in-runtime.patch
+misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch
+staging-rtl8723bs-fix-memory-leak-on-failure-path.patch
+serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch
+fix-it87_wdt-early-reboot-by-reporting-running-timer.patch
+binder-don-t-use-pk-through-printk.patch
+phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch
+phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch
+revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch
+iio-use-irqf_no_thread.patch
+iio-magnetometer-remove-irqf_oneshot.patch
+mips-loongson-make-cpumask_of_node-robust-against-nu.patch
+fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch
+fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch
+fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch
+fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch
+libceph-define-and-enforce-ceph_max_key_len.patch
+include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch
+arm-9467-1-mm-don-t-use-pk-through-printk.patch
+drm-amd-display-avoid-updating-surface-with-the-same.patch
+drm-amdgpu-adjust-usleep_range-in-fence-wait.patch
+alsa-usb-audio-update-the-number-of-packets-properly.patch
+drm-amdgpu-add-hainan-clock-adjustment.patch
+drm-radeon-add-hainan-clock-adjustment.patch
+alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch
+btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch
+ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch
+ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch
--- /dev/null
+From cce34539e29c56a7d6cb30545a274640e2beab56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 13:40:29 +0000
+Subject: sparc: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ]
+
+Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros").
+
+glibc-2.42 drops the legacy termio struct, but the ioctls.h header still
+defines some TC* constants in terms of termio (via sizeof). Hardcode the
+values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h
+index 7fd2f5873c9e7..a8bbdf9877a41 100644
+--- a/arch/sparc/include/uapi/asm/ioctls.h
++++ b/arch/sparc/include/uapi/asm/ioctls.h
+@@ -5,10 +5,10 @@
+ #include <asm/ioctl.h>
+
+ /* Big T */
+-#define TCGETA _IOR('T', 1, struct termio)
+-#define TCSETA _IOW('T', 2, struct termio)
+-#define TCSETAW _IOW('T', 3, struct termio)
+-#define TCSETAF _IOW('T', 4, struct termio)
++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */
++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */
++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */
++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */
+ #define TCSBRK _IO('T', 5)
+ #define TCXONC _IO('T', 6)
+ #define TCFLSH _IO('T', 7)
+--
+2.51.0
+
--- /dev/null
+From 8e29f0a07c5241b552e0c1c549dcb17fed80e0eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:47:52 +0100
+Subject: sparc: Synchronize user stack on fork and clone
+
+From: Andreas Larsson <andreas@gaisler.com>
+
+[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ]
+
+Flush all uncommitted user windows before calling the generic syscall
+handlers for clone, fork, and vfork.
+
+Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the
+arch-specific syscall wrappers for these syscalls will attempt to flush
+all windows (including user windows).
+
+In the window overflow trap handlers on both SPARC{32|64},
+if the window can't be stored (i.e due to MMU related faults) the routine
+backups the user window and increments a thread counter (wsaved).
+
+By adding a synchronization point after the flush attempt, when fault
+handling is enabled, any uncommitted user windows will be flushed.
+
+Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394
+Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++--------------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
+index 0442ab00518d3..7d69877511fac 100644
+--- a/arch/sparc/kernel/process.c
++++ b/arch/sparc/kernel/process.c
+@@ -17,14 +17,18 @@
+
+ asmlinkage long sparc_fork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+ struct kernel_clone_args args = {
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs)
+
+ asmlinkage long sparc_vfork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+-
+ struct kernel_clone_args args = {
+ .flags = CLONE_VFORK | CLONE_VM,
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs)
+
+ asmlinkage long sparc_clone(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
+- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ unsigned long orig_i1;
++ unsigned int flags;
+ long ret;
++ struct kernel_clone_args args = {0};
+
+- struct kernel_clone_args args = {
+- .flags = (flags & ~CSIGNAL),
+- .exit_signal = (flags & CSIGNAL),
+- .tls = regs->u_regs[UREG_I3],
+- };
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ args.flags = (flags & ~CSIGNAL);
++ args.exit_signal = (flags & CSIGNAL);
++ args.tls = regs->u_regs[UREG_I3];
+
+ #ifdef CONFIG_COMPAT
+ if (test_thread_flag(TIF_32BIT)) {
+--
+2.51.0
+
--- /dev/null
+From 484ddfaeec55ce95440c17ecd874722658e304de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 20:30:04 +0800
+Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
+
+From: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+
+[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ]
+
+spi_mem_dirmap_create() may reconfigure controller-wide settings,
+which can interfere with concurrent transfers to other devices
+sharing the same SPI controller but using different chip selects.
+
+Wrap the ->dirmap_create() callback with spi_mem_access_start() and
+spi_mem_access_end() to serialize access and prevent cross-CS
+interference during dirmap creation.
+
+This patch has been verified on a setup where a SPI TPM is connected
+to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1
+of the same controller. Without this patch, spi_mem_dirmap_create()
+for the SPI NOR flash interferes with ongoing SPI TPM data transfers,
+resulting in failure to create the TPM device. This was tested on an
+ASPEED AST2700 EVB.
+
+Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 37f4443ce9a09..fa1cd68625553 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -540,9 +540,18 @@ spi_mem_dirmap_create(struct spi_mem *mem,
+
+ desc->mem = mem;
+ desc->info = *info;
+- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create)
++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) {
++ ret = spi_mem_access_start(mem);
++ if (ret) {
++ kfree(desc);
++ return ERR_PTR(ret);
++ }
++
+ ret = ctlr->mem_ops->dirmap_create(desc);
+
++ spi_mem_access_end(mem);
++ }
++
+ if (ret) {
+ desc->nodirmap = true;
+ if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
+--
+2.51.0
+
--- /dev/null
+From 619d66e6841a985fc5eb204e1a1180ab0cff97fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 11:48:28 +0100
+Subject: spi: stm32: fix Overrun issue at < 8bpw
+
+From: Deepak Kumar <deepak.kumar01@st.com>
+
+[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ]
+
+When SPI communication is suspended by hardware automatically, it could
+happen that few bits of next frame are already clocked out due to
+internal synchronization delay.
+
+To achieve a safe suspension, we need to ensure that each word must be
+at least 8 SPI clock cycles long. That's why, if bpw is less than 8
+bits, we need to use midi to reach 8 SPI clock cycles at least.
+
+This will ensure that each word achieve safe suspension and prevent
+overrun condition.
+
+Signed-off-by: Deepak Kumar <deepak.kumar01@st.com>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index e8d21c93ed7ef..4500c4a4aed0c 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1486,11 +1486,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, u32 len)
+ cfg2_clrb |= STM32H7_SPI_CFG2_MIDI;
+ if ((len > 1) && (spi->cur_midi > 0)) {
+ u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed);
+- u32 midi = min_t(u32,
+- DIV_ROUND_UP(spi->cur_midi, sck_period_ns),
+- FIELD_GET(STM32H7_SPI_CFG2_MIDI,
+- STM32H7_SPI_CFG2_MIDI));
++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns);
+
++ if ((spi->cur_bpw + midi) < 8)
++ midi = 8 - spi->cur_bpw;
++
++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI));
+
+ dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n",
+ sck_period_ns, midi, midi * sck_period_ns);
+--
+2.51.0
+
--- /dev/null
+From fdd48a9e4b3cf0c725bf3c56bff796d8214a62f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:47:12 +0530
+Subject: staging: rtl8723bs: fix memory leak on failure path
+
+From: Diksha Kumari <dikshakdevgan@gmail.com>
+
+[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ]
+
+cfg80211_inform_bss_frame() may return NULL on failure. In that case,
+the allocated buffer 'buf' is not freed and the function returns early,
+leading to potential memory leak.
+Fix this by ensuring that 'buf' is freed on both success and failure paths.
+
+Signed-off-by: Diksha Kumari <dikshakdevgan@gmail.com>
+Reviewed-by: Mukesh Kumar Chaurasiya <mkchauras@linux.ibm.com>
+Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+index b33424a9e83b7..6ac79b430acc9 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -318,9 +318,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl
+ len, notify_signal, GFP_ATOMIC);
+
+ if (unlikely(!bss))
+- goto exit;
++ goto free_buf;
+
+ cfg80211_put_bss(wiphy, bss);
++free_buf:
+ kfree(buf);
+
+ exit:
+--
+2.51.0
+
--- /dev/null
+From 63453f14006d9f64223ef68037d4a8ff5d3bb9d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:27:28 +0800
+Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq()
+ failure
+
+From: Liang Jie <liangjie@lixiang.com>
+
+[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ]
+
+The return value of sdio_alloc_irq() was not stored in status.
+If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds,
+status remains _SUCCESS and the error path skips resource cleanup,
+while rtw_drv_init() still returns success.
+
+Store the return value of sdio_alloc_irq() in status and reuse the
+existing error handling which relies on status.
+
+Reviewed-by: fanggeng <fanggeng@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+index 4904314845242..335e6002df70f 100644
+--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+@@ -380,7 +380,8 @@ static int rtw_drv_init(
+ if (status != _SUCCESS)
+ goto free_if1;
+
+- if (sdio_alloc_irq(dvobj) != _SUCCESS)
++ status = sdio_alloc_irq(dvobj);
++ if (status != _SUCCESS)
+ goto free_if1;
+
+ rtw_ndev_notifier_register();
+--
+2.51.0
+
--- /dev/null
+From 3f96d910faad2ab252085913f72b20a618d20363 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:47:45 +0530
+Subject: tools/power cpupower: Reset errno before strtoull()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ]
+
+cpuidle_state_get_one_value() never cleared errno before calling
+strtoull(), so a prior ERANGE caused every cpuidle counter read to
+return zero. Reset errno to 0 before the conversion so each sysfs read
+is evaluated independently.
+
+Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index c15d0de12357f..e7b8c56638370 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -148,6 +148,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu,
+ if (len == 0)
+ return 0;
+
++ errno = 0;
+ value = strtoull(linebuf, &endp, 0);
+
+ if (endp == linebuf || errno == ERANGE)
+--
+2.51.0
+
--- /dev/null
+From d42f32ead499c3a996d0edbd0836ef9775b1b1e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 23:48:10 -0800
+Subject: tracing: Fix false sharing in hwlat get_sample()
+
+From: Colin Lord <clord@mykolab.com>
+
+[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ]
+
+The get_sample() function in the hwlat tracer assumes the caller holds
+hwlat_data.lock, but this is not actually happening. The result is
+unprotected data access to hwlat_data, and in per-cpu mode can result in
+false sharing which may show up as false positive latency events.
+
+The specific case of false sharing observed was primarily between
+hwlat_data.sample_width and hwlat_data.count. These are separated by
+just 8B and are therefore likely to share a cache line. When one thread
+modifies count, the cache line is in a modified state so when other
+threads read sample_width in the main latency detection loop, they fetch
+the modified cache line. On some systems, the fetch itself may be slow
+enough to count as a latency event, which could set up a self
+reinforcing cycle of latency events as each event increments count which
+then causes more latency events, continuing the cycle.
+
+The other result of the unprotected data access is that hwlat_data.count
+can end up with duplicate or missed values, which was observed on some
+systems in testing.
+
+Convert hwlat_data.count to atomic64_t so it can be safely modified
+without locking, and prevent false sharing by pulling sample_width into
+a local variable.
+
+One system this was tested on was a dual socket server with 32 CPUs on
+each numa node. With settings of 1us threshold, 1000us width, and
+2000us window, this change reduced the number of latency events from
+500 per second down to approximately 1 event per minute. Some machines
+tested did not exhibit measurable latency from the false sharing.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com
+Signed-off-by: Colin Lord <clord@mykolab.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_hwlat.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
+index 77a5a05544fce..31ce3d137307e 100644
+--- a/kernel/trace/trace_hwlat.c
++++ b/kernel/trace/trace_hwlat.c
+@@ -102,9 +102,9 @@ struct hwlat_sample {
+ /* keep the global state somewhere. */
+ static struct hwlat_data {
+
+- struct mutex lock; /* protect changes */
++ struct mutex lock; /* protect changes */
+
+- u64 count; /* total since reset */
++ atomic64_t count; /* total since reset */
+
+ u64 sample_window; /* total sampling window (on+off) */
+ u64 sample_width; /* active sampling portion of window */
+@@ -195,8 +195,7 @@ void trace_hwlat_callback(bool enter)
+ * get_sample - sample the CPU TSC and look for likely hardware latencies
+ *
+ * Used to repeatedly capture the CPU TSC (or similar), looking for potential
+- * hardware-induced latency. Called with interrupts disabled and with
+- * hwlat_data.lock held.
++ * hardware-induced latency. Called with interrupts disabled.
+ */
+ static int get_sample(void)
+ {
+@@ -206,6 +205,7 @@ static int get_sample(void)
+ time_type start, t1, t2, last_t2;
+ s64 diff, outer_diff, total, last_total = 0;
+ u64 sample = 0;
++ u64 sample_width = READ_ONCE(hwlat_data.sample_width);
+ u64 thresh = tracing_thresh;
+ u64 outer_sample = 0;
+ int ret = -1;
+@@ -269,7 +269,7 @@ static int get_sample(void)
+ if (diff > sample)
+ sample = diff; /* only want highest value */
+
+- } while (total <= hwlat_data.sample_width);
++ } while (total <= sample_width);
+
+ barrier(); /* finish the above in the view for NMIs */
+ trace_hwlat_callback_enabled = false;
+@@ -287,8 +287,7 @@ static int get_sample(void)
+ if (kdata->nmi_total_ts)
+ do_div(kdata->nmi_total_ts, NSEC_PER_USEC);
+
+- hwlat_data.count++;
+- s.seqnum = hwlat_data.count;
++ s.seqnum = atomic64_inc_return(&hwlat_data.count);
+ s.duration = sample;
+ s.outer_duration = outer_sample;
+ s.nmi_total_ts = kdata->nmi_total_ts;
+@@ -837,7 +836,7 @@ static int hwlat_tracer_init(struct trace_array *tr)
+
+ hwlat_trace = tr;
+
+- hwlat_data.count = 0;
++ atomic64_set(&hwlat_data.count, 0);
+ tr->max_latency = 0;
+ save_tracing_thresh = tracing_thresh;
+
+--
+2.51.0
+
--- /dev/null
+From ebe545d4d3b8cbb3d883b12b22eab61b900b6238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:45 +0100
+Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ]
+
+The unpacked unions within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)'
+ and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 239 | } u;
+ | ^
+
+./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+
+With the recent changes to compile-test the UAPI headers in more cases,
+these warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warnings.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/vbox_vmmdev_types.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
+index f8a8d6b3c5219..436678d4fb24f 100644
+--- a/include/uapi/linux/vbox_vmmdev_types.h
++++ b/include/uapi/linux/vbox_vmmdev_types.h
+@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 {
+ /** Relative to the request header. */
+ __u32 offset;
+ } page_list;
+- } u;
++ } __packed u;
+ } __packed;
+ VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
+
+@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 {
+ union {
+ __u64 phys_addr;
+ __u64 linear_addr;
+- } u;
++ } __packed u;
+ } __packed pointer;
+ struct {
+ /** Size of the buffer described by the page list. */
+--
+2.51.0
+
--- /dev/null
+From c21b821b3c904a0bde549d2c5b74acf097c47e01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:34:00 +0100
+Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ]
+
+The gcc-16.0.1 snapshot produces a false-positive warning that turns
+into a build failure with CONFIG_WERROR:
+
+In file included from arch/x86/include/asm/string.h:6,
+ from net/vmw_vsock/vmci_transport.c:10:
+In function 'vmci_transport_packet_init',
+ inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2:
+arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull]
+ 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy'
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+
+This seems relatively harmless, and it so far the only instance of this
+warning I have found. The __vmci_transport_send_control_pkt function
+is called either with wait=NULL or with one of the type values that
+pass 'wait' into memcpy() here, but not from the same caller.
+
+Replacing the memcpy with a struct assignment is otherwise the same
+but avoids the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Bryan Tan <bryan-bt.tan@broadcom.com>
+Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 6910b5ce9a183..35585e9f1af4c 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt,
+
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
+- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
++ pkt->u.wait = *wait;
+ break;
+
+ case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
+--
+2.51.0
+
--- /dev/null
+From fcad7ef366f0288432546ee309f99e910ff68614 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:56:11 +0000
+Subject: wifi: ath10k: fix lock protection in
+ ath10k_wmi_event_peer_sta_ps_state_chg()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ]
+
+ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to
+assert that ar->data_lock should be held by the caller, but neither
+ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock
+before calling this function.
+
+The field arsta->peer_ps_state is documented as protected by
+ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable,
+ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock.
+
+Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update,
+and remove the lockdep_assert_held() to be aligned with new locking,
+following the pattern used by other WMI event handlers in the driver.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu
+[removed excess blank line]
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index e018f732fa267..e3d4505d7615e 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5282,8 +5282,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ struct ath10k_sta *arsta;
+ u8 peer_addr[ETH_ALEN];
+
+- lockdep_assert_held(&ar->data_lock);
+-
+ ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data;
+ ether_addr_copy(peer_addr, ev->peer_macaddr.addr);
+
+@@ -5298,7 +5296,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ }
+
+ arsta = (struct ath10k_sta *)sta->drv_priv;
++ spin_lock_bh(&ar->data_lock);
+ arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state);
++ spin_unlock_bh(&ar->data_lock);
+
+ exit:
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From bd5cd2076f3160f2b811fd0a750832e2700f4f16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:30:05 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il3945_store_measurement()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ]
+
+il3945_store_measurement() calls il3945_get_measurement() which internally
+calls il_send_cmd_sync() without holding il->mutex. However,
+il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that
+callers must hold this lock.
+
+Other sysfs store functions in the same file properly acquire the mutex:
+- il3945_store_flags() acquires mutex at 3945-mac.c:3110
+- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144
+
+Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call
+in the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index dea0012fcdc79..1f2d089e1fdf8 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3268,7 +3268,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
+
+ D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n",
+ type, params.channel, buf);
++ mutex_lock(&il->mutex);
+ il3945_get_measurement(il, ¶ms, type);
++ mutex_unlock(&il->mutex);
+
+ return count;
+ }
+--
+2.51.0
+
--- /dev/null
+From a14a9d55aa22a74e7a4910ccb1254cc13f022056 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:40:39 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il4965_store_tx_power()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ]
+
+il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex.
+However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating
+that callers must hold this lock.
+
+All other callers of il_set_tx_power() properly acquire the mutex:
+- il_bg_scan_completed() acquires mutex at common.c:1683
+- il_mac_config() acquires mutex at common.c:5006
+- il3945_commit_rxon() and il4965_commit_rxon() are called via work
+ queues that hold the mutex (like il4965_bg_alive_start)
+
+Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in
+the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index df9d139a008eb..7bf2e3a35cd8c 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4612,7 +4612,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr,
+ if (ret)
+ IL_INFO("%s is not in decimal form.\n", buf);
+ else {
++ mutex_lock(&il->mutex);
+ ret = il_set_tx_power(il, val, false);
++ mutex_unlock(&il->mutex);
+ if (ret)
+ IL_ERR("failed setting tx power (0x%08x).\n", ret);
+ else
+--
+2.51.0
+
--- /dev/null
+From 5c71408ce41b2b8540fecbdbc94e8cae6965dc83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:58:06 +0100
+Subject: wifi: libertas: fix WARNING in usb_tx_block
+
+From: Szymon Wilczek <swilczek.lx@gmail.com>
+
+[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ]
+
+The function usb_tx_block() submits cardp->tx_urb without ensuring that
+any previous transmission on this URB has completed. If a second call
+occurs while the URB is still active (e.g. during rapid firmware loading),
+usb_submit_urb() detects the active state and triggers a warning:
+'URB submitted while active'.
+
+Fix this by enforcing serialization: call usb_kill_urb() before
+submitting the new request. This ensures the URB is idle and safe to reuse.
+
+Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
+Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
+Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index 2240b4db8c036..d98c81539ba53 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb
+ goto tx_ret;
+ }
+
++ usb_kill_urb(cardp->tx_urb);
++
+ usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
+ usb_sndbulkpipe(cardp->udev,
+ cardp->ep_out),
+--
+2.51.0
+
--- /dev/null
+From 17a17d0ebc8fc50e4a0f9bfd0dae8bfa7d7e81a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 12:00:08 +0800
+Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when
+ CONFIG_X86_PAE is set
+
+From: Hou Wenlong <houwenlong.hwl@antgroup.com>
+
+[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ]
+
+The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests
+do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds
+different pagetables depending on whether CONFIG_X86_PAE is set.
+Therefore, enabling PAE mode for 32-bit KVM guests without
+CONFIG_X86_PAE being set would result in a boot failure during CR3
+loading.
+
+Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <d09ce9a134eb9cbc16928a5b316969f8ba606b81.1768017442.git.houwenlong.hwl@antgroup.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/pvh/head.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
+index b3e3f64d436d8..56376fb4b3ae8 100644
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -69,10 +69,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
+
+ mov $_pa(early_stack_end), %esp
+
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ /* Enable PAE mode. */
+ mov %cr4, %eax
+ orl $X86_CR4_PAE, %eax
+ mov %eax, %cr4
++#endif
+
+ #ifdef CONFIG_X86_64
+ /* Enable Long mode. */
+--
+2.51.0
+
--- /dev/null
+From 42c73481bf13491cb072b1e17a167cb9c2fd1e6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 17:47:29 -0500
+Subject: xenbus: Use .freeze/.thaw to handle xenbus devices
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ]
+
+The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming
+from s3 or s2idle disconnects its PV devices during resume. The
+backends are not expecting this and do not reconnect.
+
+b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/
+resume/chkpt") changed xen_suspend()/do_suspend() from
+PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the
+suspend/resume callbacks remained.
+
+.freeze/restore are used with hiberation where Linux restarts in a new
+place in the future. .suspend/resume are useful for runtime power
+management for the duration of a boot.
+
+The current behavior of the callbacks works for an xl save/restore or
+live migration where the domain is restored/migrated to a new location
+and connecting to a not-already-connected backend.
+
+Change xenbus_pm_ops to use .freeze/thaw/restore and drop the
+.suspend/resume hook. This matches the use in drivers/xen/manage.c for
+save/restore and live migration. With .suspend/resume empty, PV devices
+are left connected during s2idle and s3, so PV devices are not changed
+and work after resume.
+
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Acked-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index 480944606a3c9..73cf4810715e4 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev)
+ }
+
+ static const struct dev_pm_ops xenbus_pm_ops = {
+- .suspend = xenbus_dev_suspend,
+- .resume = xenbus_frontend_dev_resume,
+ .freeze = xenbus_dev_suspend,
+ .thaw = xenbus_dev_cancel,
+- .restore = xenbus_dev_resume,
++ .restore = xenbus_frontend_dev_resume,
+ };
+
+ static struct xen_bus_type xenbus_frontend = {
+--
+2.51.0
+
--- /dev/null
+From 7270aae67b839766005aed7e81e5d421d5c74d91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 00:32:14 +0800
+Subject: ACPI: processor: Fix NULL-pointer dereference in
+ acpi_processor_errata_piix4()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ]
+
+In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
+device and then reassigned an ISA device:
+
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
+
+If the first lookup succeeds but the second fails, dev becomes NULL. This
+leads to a potential null-pointer dereference when dev_dbg() is called:
+
+ if (errata.piix4.bmisx)
+ dev_dbg(&dev->dev, ...);
+
+To prevent this, use two temporary pointers and retrieve each device
+independently, avoiding overwriting dev with a possible NULL value.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+[ rjw: Subject adjustment, added an empty code line ]
+Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_processor.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index cfa75b14caa2b..669398045c0fd 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -33,6 +33,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ {
+ u8 value1 = 0;
+ u8 value2 = 0;
++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL;
+
+
+ if (!dev)
+@@ -90,12 +91,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * each IDE controller's DMA status to make sure we catch all
+ * DMA activity.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- errata.piix4.bmisx = pci_resource_start(dev, 4);
+- pci_dev_put(dev);
++ if (ide_dev) {
++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
++ pci_dev_put(ide_dev);
+ }
+
+ /*
+@@ -107,24 +108,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * disable C3 support if this is enabled, as some legacy
+ * devices won't operate well if fast DMA is disabled.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB_0,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- pci_read_config_byte(dev, 0x76, &value1);
+- pci_read_config_byte(dev, 0x77, &value2);
++ if (isa_dev) {
++ pci_read_config_byte(isa_dev, 0x76, &value1);
++ pci_read_config_byte(isa_dev, 0x77, &value2);
+ if ((value1 & 0x80) || (value2 & 0x80))
+ errata.piix4.fdma = 1;
+- pci_dev_put(dev);
++ pci_dev_put(isa_dev);
+ }
+
+ break;
+ }
+
+- if (errata.piix4.bmisx)
+- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
+- if (errata.piix4.fdma)
+- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
++ if (ide_dev)
++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
++
++ if (isa_dev)
++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 32db5ad7bcd2783092cf5c6cf020ed5724b2abdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 13:25:33 +0100
+Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ]
+
+The ACPI specification states that when executing AML_FATAL_OP,
+the OS should log the fatal error event and shutdown in a timely
+fashion.
+
+Windows complies with this requirement by immediatly entering a
+Bso_d, effectively aborting the execution of the AML bytecode in
+question.
+
+ACPICA however might continue with the AML bytecode execution
+should acpi_os_signal() simply return AE_OK. This will cause issues
+because ACPI BIOS implementations might assume that the Fatal()
+operator does not return.
+
+Fix this by aborting the AML bytecode execution in such a case
+by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a
+local variable because of its small size (12 bytes) and to ensure
+that acpi_os_signal() always receives valid information about the
+fatal ACPI BIOS error.
+
+Link: https://github.com/acpica/acpica/commit/d516c7758ba6
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++---------------------
+ 1 file changed, 18 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
+index 4b069bd6bc71e..198da79c0cd48 100644
+--- a/drivers/acpi/acpica/exoparg3.c
++++ b/drivers/acpi/acpica/exoparg3.c
+@@ -10,6 +10,7 @@
+ #include <acpi/acpi.h>
+ #include "accommon.h"
+ #include "acinterp.h"
++#include <acpi/acoutput.h>
+ #include "acparser.h"
+ #include "amlcode.h"
+
+@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3")
+ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ {
+ union acpi_operand_object **operand = &walk_state->operands[0];
+- struct acpi_signal_fatal_info *fatal;
+- acpi_status status = AE_OK;
++ struct acpi_signal_fatal_info fatal;
+
+ ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R,
+ acpi_ps_get_opcode_name(walk_state->opcode));
+@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ switch (walk_state->opcode) {
+ case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */
+
+- ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+- "FatalOp: Type %X Code %X Arg %X "
+- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
+- (u32)operand[0]->integer.value,
+- (u32)operand[1]->integer.value,
+- (u32)operand[2]->integer.value));
+-
+- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info));
+- if (fatal) {
+- fatal->type = (u32) operand[0]->integer.value;
+- fatal->code = (u32) operand[1]->integer.value;
+- fatal->argument = (u32) operand[2]->integer.value;
+- }
++ fatal.type = (u32)operand[0]->integer.value;
++ fatal.code = (u32)operand[1]->integer.value;
++ fatal.argument = (u32)operand[2]->integer.value;
+
+- /* Always signal the OS! */
++ ACPI_BIOS_ERROR((AE_INFO,
++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n",
++ fatal.type, fatal.code, fatal.argument));
+
+- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal);
++ /* Always signal the OS! */
+
+- /* Might return while OS is shutting down, just continue */
++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal);
+
+- ACPI_FREE(fatal);
+- goto cleanup;
++ /*
++ * Might return while OS is shutting down, so abort the AML execution
++ * by returning an error.
++ */
++ return_ACPI_STATUS(AE_ERROR);
+
+ case AML_EXTERNAL_OP:
+ /*
+@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ * wrong if an external opcode ever gets here.
+ */
+ ACPI_ERROR((AE_INFO, "Executed External Op"));
+- status = AE_OK;
+- goto cleanup;
++
++ return_ACPI_STATUS(AE_OK);
+
+ default:
+
+ ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X",
+ walk_state->opcode));
+
+- status = AE_AML_BAD_OPCODE;
+- goto cleanup;
++ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
+ }
+-
+-cleanup:
+-
+- return_ACPI_STATUS(status);
+ }
+
+ /*******************************************************************************
+--
+2.51.0
+
--- /dev/null
+From 3d2e897483354908a35c3b703e78a877ac6ae9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 08:38:29 +0000
+Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
+
+From: Lianqin Hu <hulianqin@vivo.com>
+
+[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ]
+
+Setting up the interface when suspended/resumeing fail on this card.
+Adding a reset and delay quirk will eliminate this problem.
+
+usb 1-1: New USB device found, idVendor=001f, idProduct=0b21
+usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+usb 1-1: Product: AB13X USB Audio
+usb 1-1: Manufacturer: Generic
+usb 1-1: SerialNumber: 20210926172016
+
+Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
+Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 286ec4580718c..755ba2fe05b5a 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2045,6 +2045,8 @@ struct usb_audio_quirk_flags_table {
+
+ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ /* Device matches */
++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */
++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
+ DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
+ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
+ DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
+--
+2.51.0
+
--- /dev/null
+From 93235bc6944a417c3130ae62d7aaee56c1027838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:07 +0100
+Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ]
+
+At silencing the playback URB packets in the implicit fb mode before
+the actual playback, we blindly assume that the received packets fit
+with the buffer size. But when the setup in the capture stream
+differs from the playback stream (e.g. due to the USB core limitation
+of max packet size), such an inconsistency may lead to OOB writes to
+the buffer, resulting in a crash.
+
+For addressing it, add a sanity check of the transfer buffer size at
+prepare_silent_urb(), and stop the data copy if the received data
+overflows. Also, report back the transfer error properly from there,
+too.
+
+Note that this doesn't fix the root cause of the playback error
+itself, but this merely covers the kernel Oops.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
+Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 39 ++++++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 17 deletions(-)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index d0e07e7001632..86a8624e8781e 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -278,8 +278,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip)
+ return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH;
+ }
+
+-static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+- struct snd_urb_ctx *ctx)
++static int prepare_silent_urb(struct snd_usb_endpoint *ep,
++ struct snd_urb_ctx *ctx)
+ {
+ struct urb *urb = ctx->urb;
+ unsigned int offs = 0;
+@@ -292,28 +292,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+ extra = sizeof(packet_length);
+
+ for (i = 0; i < ctx->packets; ++i) {
+- unsigned int offset;
+- unsigned int length;
+- int counts;
+-
+- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
+- length = counts * ep->stride; /* number of silent bytes */
+- offset = offs * ep->stride + extra * i;
+- urb->iso_frame_desc[i].offset = offset;
++ int length;
++
++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
++ if (length < 0)
++ return length;
++ length *= ep->stride; /* number of silent bytes */
++ if (offs + length + extra > ctx->buffer_size)
++ break;
++ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = length + extra;
+ if (extra) {
+ packet_length = cpu_to_le32(length);
+- memcpy(urb->transfer_buffer + offset,
++ memcpy(urb->transfer_buffer + offs,
+ &packet_length, sizeof(packet_length));
++ offs += extra;
+ }
+- memset(urb->transfer_buffer + offset + extra,
++ memset(urb->transfer_buffer + offs,
+ ep->silence_value, length);
+- offs += counts;
++ offs += length;
+ }
+
+- urb->number_of_packets = ctx->packets;
+- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra;
++ if (!offs)
++ return -EPIPE;
++
++ urb->number_of_packets = i;
++ urb->transfer_buffer_length = offs;
+ ctx->queued = 0;
++ return 0;
+ }
+
+ /*
+@@ -335,8 +341,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep,
+ if (data_subs && ep->prepare_data_urb)
+ return ep->prepare_data_urb(data_subs, urb, in_stream_lock);
+ /* no data provider, so send silence */
+- prepare_silent_urb(ep, ctx);
+- break;
++ return prepare_silent_urb(ep, ctx);
+
+ case SND_USB_ENDPOINT_TYPE_SYNC:
+ if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) {
+--
+2.51.0
+
--- /dev/null
+From 4925070dbd4dcb9587dc44b2d6b1665a725f1068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:05 +0100
+Subject: ALSA: usb-audio: Update the number of packets properly at receiving
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ]
+
+At receiving the packets from the implicit feedback source, we didn't
+update ctx->packets field but only the ctx->packet_size[] data.
+In exceptional cases, this might lead to unexpectedly superfluous data
+transfer (although this won't happen usually due to the nature of USB
+isochronous transfer). Fix it to update the field properly.
+
+Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 4ac1af844b2b7..d0e07e7001632 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -489,6 +489,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+
+ /* copy over the length information */
+ if (implicit_fb) {
++ ctx->packets = packet->packets;
+ for (i = 0; i < packet->packets; i++)
+ ctx->packet_size[i] = packet->packet_size[i];
+ }
+--
+2.51.0
+
--- /dev/null
+From 958404d09c868f6bb3ac09d5a1a3e30d00aab70a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:05 +0100
+Subject: APEI/GHES: ensure that won't go past CPER allocated record
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ]
+
+The logic at ghes_new() prevents allocating too large records, by
+checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
+Yet, the allocation is done with the actual number of pages from the
+CPER bios table location, which can be smaller.
+
+Yet, a bad firmware could send data with a different size, which might
+be bigger than the allocated memory, causing an OOPS:
+
+ Unable to handle kernel paging request at virtual address fff00000f9b40000
+ Mem abort info:
+ ESR = 0x0000000096000007
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x07: level 3 translation fault
+ Data abort info:
+ ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+ swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
+ [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
+ Internal error: Oops: 0000000096000007 [#1] SMP
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
+ Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+ Workqueue: kacpi_notify acpi_os_execute_deferred
+ pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+ pc : hex_dump_to_buffer+0x30c/0x4a0
+ lr : hex_dump_to_buffer+0x328/0x4a0
+ sp : ffff800080e13880
+ x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
+ x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
+ x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
+ x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
+ x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
+ x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
+ x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
+ x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
+ x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
+ x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
+ Call trace:
+ hex_dump_to_buffer+0x30c/0x4a0 (P)
+ print_hex_dump+0xac/0x170
+ cper_estatus_print_section+0x90c/0x968
+ cper_estatus_print+0xf0/0x158
+ __ghes_print_estatus+0xa0/0x148
+ ghes_proc+0x1bc/0x220
+ ghes_notify_hed+0x5c/0xb8
+ notifier_call_chain+0x78/0x148
+ blocking_notifier_call_chain+0x4c/0x80
+ acpi_hed_notify+0x28/0x40
+ acpi_ev_notify_dispatch+0x50/0x80
+ acpi_os_execute_deferred+0x24/0x48
+ process_one_work+0x15c/0x3b0
+ worker_thread+0x2d0/0x400
+ kthread+0x148/0x228
+ ret_from_fork+0x10/0x20
+ Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
+ ---[ end trace 0000000000000000 ]---
+
+Prevent that by taking the actual allocated are into account when
+checking for CPER length.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 6 +++++-
+ include/acpi/ghes.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 9fb86d0c4ff05..3b7f348dc608a 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -28,6 +28,7 @@
+ #include <linux/timer.h>
+ #include <linux/cper.h>
+ #include <linux/platform_device.h>
++#include <linux/minmax.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+ #include <linux/vmalloc.h>
+@@ -262,6 +263,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
+ error_block_length = GHES_ESTATUS_MAX_SIZE;
+ }
+ ghes->estatus = kmalloc(error_block_length, GFP_KERNEL);
++ ghes->estatus_length = error_block_length;
+ if (!ghes->estatus) {
+ rc = -ENOMEM;
+ goto err_unmap_status_addr;
+@@ -333,13 +335,15 @@ static int __ghes_check_estatus(struct ghes *ghes,
+ struct acpi_hest_generic_status *estatus)
+ {
+ u32 len = cper_estatus_len(estatus);
++ u32 max_len = min(ghes->generic->error_block_length,
++ ghes->estatus_length);
+
+ if (len < sizeof(*estatus)) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n");
+ return -EIO;
+ }
+
+- if (len > ghes->generic->error_block_length) {
++ if (!len || len > max_len) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n");
+ return -EIO;
+ }
+diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
+index 292a5c40bd0c6..259ae345849f0 100644
+--- a/include/acpi/ghes.h
++++ b/include/acpi/ghes.h
+@@ -21,6 +21,7 @@ struct ghes {
+ struct acpi_hest_generic_v2 *generic_v2;
+ };
+ struct acpi_hest_generic_status *estatus;
++ unsigned int estatus_length;
+ unsigned long flags;
+ union {
+ struct list_head list;
+--
+2.51.0
+
--- /dev/null
+From 35b1569d28e0743b0809bd33622f5fd02b0d8f88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 10:56:33 +0100
+Subject: ARM: 9467/1: mm: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weissschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ]
+
+Restricted pointers ("%pK") were never meant to be used
+through printk(). They can acquire sleeping locks in atomic contexts.
+
+Switch to %px over the more secure %p as this usage is a debugging aid,
+gated behind CONFIG_DEBUG_VIRTUAL and used by WARN().
+
+Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/physaddr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c
+index cf75819e4c137..4ae327bf7aa29 100644
+--- a/arch/arm/mm/physaddr.c
++++ b/arch/arm/mm/physaddr.c
+@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x)
+ phys_addr_t __virt_to_phys(unsigned long x)
+ {
+ WARN(!__virt_addr_valid(x),
+- "virt_to_phys used for non-linear address: %pK (%pS)\n",
++ "virt_to_phys used for non-linear address: %px (%pS)\n",
+ (void *)x, (void *)x);
+
+ return __virt_to_phys_nodebug(x);
+--
+2.51.0
+
--- /dev/null
+From bcc77c47aebd7ebc8a60b4415433248ed6a020d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 17:24:48 +0800
+Subject: arm64: Add support for TSV110 Spectre-BHB mitigation
+
+From: Jinqian Yang <yangjinqian1@huawei.com>
+
+[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ]
+
+The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
+Buffer) attack, which can be exploited to leak information through
+branch prediction side channels. This commit adds the MIDR of TSV110
+to the list for software mitigation.
+
+Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
+Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/proton-pack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
+index 4978c466e325d..21105c725c34e 100644
+--- a/arch/arm64/kernel/proton-pack.c
++++ b/arch/arm64/kernel/proton-pack.c
+@@ -908,6 +908,7 @@ static u8 spectre_bhb_loop_affected(void)
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ {},
+ };
+ static const struct midr_range spectre_bhb_k24_list[] = {
+--
+2.51.0
+
--- /dev/null
+From f85145963feddb968d1238a5e05eb54ae6ee61f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 21:27:21 +0000
+Subject: arm64: tegra: smaug: Add usb-role-switch support
+
+From: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+
+[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ]
+
+The USB2 port on Smaug is configured for OTG operation but lacked the
+required 'usb-role-switch' property, leading to a failed probe and a
+non-functioning USB port. Add the property along with setting the default
+role to host.
+
+Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+index 2b4dbfac84a70..43b2409ad7e5f 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+@@ -1701,6 +1701,8 @@ usb2-0 {
+ status = "okay";
+ vbus-supply = <&usbc_vbus>;
+ mode = "otg";
++ usb-role-switch;
++ role-switch-default-mode = "host";
+ };
+
+ usb3-0 {
+--
+2.51.0
+
--- /dev/null
+From 2b88c5c88b948872e571222e2c2c53c1b5061eb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 17:19:04 +0800
+Subject: ASoC: codecs: max98390: Check return value of
+ devm_gpiod_get_optional() in max98390_i2c_probe()
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ]
+
+The devm_gpiod_get_optional() function may return an error pointer
+(ERR_PTR) in case of a genuine failure during GPIO acquisition,
+not just NULL which indicates the legitimate absence of an optional
+GPIO.
+
+Add an IS_ERR() check after the function call to catch such errors and
+propagate them to the probe function, ensuring the driver fails to load
+safely rather than proceeding with an invalid pointer.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98390.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c
+index 7a5260ff8d6b0..09fae6ee2b442 100644
+--- a/sound/soc/codecs/max98390.c
++++ b/sound/soc/codecs/max98390.c
+@@ -1076,6 +1076,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c)
+
+ reset_gpio = devm_gpiod_get_optional(&i2c->dev,
+ "reset", GPIOD_OUT_HIGH);
++ if (IS_ERR(reset_gpio))
++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio),
++ "Failed to get reset gpio\n");
+
+ /* Power on device */
+ if (reset_gpio) {
+--
+2.51.0
+
--- /dev/null
+From 60d0eafc2ce0c35619766a83dd3f394825340f75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jan 2026 00:00:17 +0800
+Subject: ASoC: es8328: Add error unwind in resume
+
+From: Hsieh Hung-En <hungen3108@gmail.com>
+
+[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ]
+
+Handle failures in the resume path by unwinding previously enabled
+resources.
+
+If enabling regulators or syncing the regcache fails, disable regulators
+and unprepare the clock to avoid leaking resources and leaving the device
+in a partially resumed state.
+
+Signed-off-by: Hsieh Hung-En <hungen3108@gmail.com>
+Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index 8182e9b37c03d..5c9ba2a0e759f 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -750,17 +750,23 @@ static int es8328_resume(struct snd_soc_component *component)
+ es8328->supplies);
+ if (ret) {
+ dev_err(component->dev, "unable to enable regulators\n");
+- return ret;
++ goto err_clk;
+ }
+
+ regcache_mark_dirty(regmap);
+ ret = regcache_sync(regmap);
+ if (ret) {
+ dev_err(component->dev, "unable to sync regcache\n");
+- return ret;
++ goto err_regulators;
+ }
+
+ return 0;
++
++err_regulators:
++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies);
++err_clk:
++ clk_disable_unprepare(es8328->clk);
++ return ret;
+ }
+
+ static int es8328_component_probe(struct snd_soc_component *component)
+--
+2.51.0
+
--- /dev/null
+From 0d6570d5c81ea60682719179925a4ddd958b65de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 11:32:50 +0800
+Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ]
+
+Add check for the return value of devm_regmap_init_mmio() and return the
+error if it fails in order to catch the error.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun50i-dmic.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c
+index 86cff5a5b1bd6..e2735bd4f369a 100644
+--- a/sound/soc/sunxi/sun50i-dmic.c
++++ b/sound/soc/sunxi/sun50i-dmic.c
+@@ -325,6 +325,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev)
+
+ host->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+ &sun50i_dmic_regmap_config);
++ if (IS_ERR(host->regmap))
++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap),
++ "failed to initialise regmap\n");
+
+ /* Clocks */
+ host->bus_clk = devm_clk_get(&pdev->dev, "bus");
+--
+2.51.0
+
--- /dev/null
+From 9101f3e31e279e3f7d5b8f0e5307f83f29e65935 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:08 +0100
+Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ]
+
+This bit is handled by a separate control.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index d215e58c4a7b3..dbab41fb22f5b 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18),
+
+
+ SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0),
+-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA),
++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX),
+
+ SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0),
+ SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA),
+--
+2.51.0
+
--- /dev/null
+From e58e43f2f6136432719c782a5810a132221c7ba4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:10 +0100
+Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on
+ plug
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ]
+
+This usually means that a TRS plug with no microphone pin has been plugged
+into a TRRS socket. Cases where a user is plugging in a microphone while
+pressing a button will be handled via incoming interrupt after the user
+releases the button, so the microphone will still be detected once it
+becomes usable.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index dbab41fb22f5b..a7cd6ee82d7a8 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -67,6 +67,8 @@ struct wm8962_priv {
+ struct mutex dsp2_ena_lock;
+ u16 dsp2_ena;
+
++ int mic_status;
++
+ struct delayed_work mic_work;
+ struct snd_soc_jack *jack;
+
+@@ -3073,8 +3075,16 @@ static void wm8962_mic_work(struct work_struct *work)
+ if (reg & WM8962_MICSHORT_STS) {
+ status |= SND_JACK_BTN_0;
+ irq_pol |= WM8962_MICSCD_IRQ_POL;
++
++ /* Don't report a microphone if it's shorted right after
++ * plugging in, as this may be a TRS plug in a TRRS socket.
++ */
++ if (!(wm8962->mic_status & WM8962_MICDET_STS))
++ status = 0;
+ }
+
++ wm8962->mic_status = status;
++
+ snd_soc_jack_report(wm8962->jack, status,
+ SND_JACK_MICROPHONE | SND_JACK_BTN_0);
+
+--
+2.51.0
+
--- /dev/null
+From 5bc886737004b0b1e4ec314823eaccf7e70ce8f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 20:49:30 +0100
+Subject: audit: add fchmodat2() to change attributes class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ]
+
+fchmodat2(), introduced in version 6.6 is currently not in the change
+attribute class of audit. Calling fchmodat2() to change a file
+attribute in the same fashion than chmod() or fchmodat() will bypass
+audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds fchmodat2() to the change attributes class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_change_attr.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h
+index 331670807cf01..6c311d4d37f4e 100644
+--- a/include/asm-generic/audit_change_attr.h
++++ b/include/asm-generic/audit_change_attr.h
+@@ -20,6 +20,9 @@ __NR_fremovexattr,
+ __NR_fchownat,
+ __NR_fchmodat,
+ #endif
++#ifdef __NR_fchmodat2
++__NR_fchmodat2,
++#endif
+ #ifdef __NR_chown32
+ __NR_chown32,
+ __NR_fchown32,
+--
+2.51.0
+
--- /dev/null
+From 0a644d8c4fd6871eba72d3717b38282b94cf4318 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 09:39:24 +0100
+Subject: audit: add missing syscalls to read class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ]
+
+The "at" variant of getxattr() and listxattr() are missing from the
+audit read class. Calling getxattrat() or listxattrat() on a file to
+read its extended attributes will bypass audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds missing syscalls to the audit read class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_read.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h
+index 7bb7b5a83ae2e..fb9991f53fb6f 100644
+--- a/include/asm-generic/audit_read.h
++++ b/include/asm-generic/audit_read.h
+@@ -4,9 +4,15 @@ __NR_readlink,
+ #endif
+ __NR_quotactl,
+ __NR_listxattr,
++#ifdef __NR_listxattrat
++__NR_listxattrat,
++#endif
+ __NR_llistxattr,
+ __NR_flistxattr,
+ __NR_getxattr,
++#ifdef __NR_getxattrat
++__NR_getxattrat,
++#endif
+ __NR_lgetxattr,
+ __NR_fgetxattr,
+ #ifdef __NR_readlinkat
+--
+2.51.0
+
--- /dev/null
+From 800dec1013e00be540a14c46864e2a0d96d5b106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 15:29:50 +0100
+Subject: binder: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log. Since commit ad67b74d2469 ("printk: hash
+addresses printed with %p") the regular %p has been improved to avoid
+this issue. Furthermore, restricted pointers ("%pK") were never meant
+to be used through printk(). They can still unintentionally leak raw
+pointers or acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+There are still a few users of %pK left, but these use it through
+seq_file, for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Carlos Llamas <cmllamas@google.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binder.c | 2 +-
+ drivers/android/binder_alloc.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 07ff4c1477f82..115791f3bb8c9 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4190,7 +4190,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ }
+ }
+ binder_debug(BINDER_DEBUG_DEAD_BINDER,
+- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+ proc->pid, thread->pid, (u64)cookie,
+ death);
+ if (death == NULL) {
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index fcbb750b1ccc3..f63a46626bab2 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc,
+ new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: add free buffer, size %zd, at %pK\n",
++ "%d: add free buffer, size %zd, at %p\n",
+ alloc->pid, new_buffer_size, new_buffer);
+
+ while (*p) {
+@@ -474,7 +474,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
+ }
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
+ alloc->pid, size, buffer, buffer_size);
+
+ has_page_addr = (void __user *)
+@@ -646,7 +646,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
+ ALIGN(buffer->extra_buffers_size, sizeof(void *));
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
++ "%d: binder_free_buf %p size %zd buffer_size %zd\n",
+ alloc->pid, buffer, size, buffer_size);
+
+ BUG_ON(buffer->free);
+--
+2.51.0
+
--- /dev/null
+From 847aafb092a34f8bd8db68b8f35d0809781846ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 16:05:22 +0800
+Subject: blk-mq-debugfs: add missing debugfs_mutex in
+ blk_mq_debugfs_register_hctxs()
+
+From: Yu Kuai <yukuai@fnnas.com>
+
+[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ]
+
+In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while
+creating debugfs entries for hctxs. Hence add debugfs_mutex there,
+it's safe because queue is not frozen.
+
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index 7675e663df365..7e149db646dc0 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -756,8 +756,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ unsigned long i;
+
++ mutex_lock(&q->debugfs_mutex);
+ queue_for_each_hw_ctx(q, hctx, i)
+ blk_mq_debugfs_register_hctx(q, hctx);
++ mutex_unlock(&q->debugfs_mutex);
+ }
+
+ void blk_mq_debugfs_unregister_hctxs(struct request_queue *q)
+--
+2.51.0
+
--- /dev/null
+From 64f9c09f89b2d82e1081b397273d67b738b9828a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:13:04 +0100
+Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU
+
+From: Jacopo Scannella <code@charlie.cat>
+
+[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ]
+
+Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek
+RTL8761BU Bluetooth adapter.
+
+Reference:
+https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth
+
+Signed-off-by: Jacopo Scannella <code@charlie.cat>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 2dc686ac3a15e..cc5ce7a984f6c 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -652,6 +652,7 @@ static const struct usb_device_id blacklist_table[] = {
+
+ /* Additional Realtek 8723BU Bluetooth devices */
+ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK },
+
+ /* Additional Realtek 8723DE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
+--
+2.51.0
+
--- /dev/null
+From bf48f510c56f047cc96ff823e32e7a42dd4a27ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 15:03:35 +1100
+Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE
+
+From: Shell Chen <w27@sorz.org>
+
+[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ]
+
+Add VID:PID 13d3:3612 to the quirks_table.
+
+This ID pair is found in the Realtek RTL8852CE PCIe module
+in an ASUS TUF A14 2025 (FA401KM) laptop.
+
+Tested on aforementioned laptop.
+
+The device info from /sys/kernel/debug/usb/devices is listed as below.
+
+T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3612 Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=Bluetooth Radio
+S: SerialNumber=00e04c000001
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+
+Signed-off-by: Shell Chen <w27@sorz.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c6ac351209c0e..2dc686ac3a15e 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -534,6 +534,8 @@ static const struct usb_device_id blacklist_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
+--
+2.51.0
+
--- /dev/null
+From 149302ad1c2e22cc586c047a205e97d312e287e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:09 +0100
+Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ]
+
+hci_conn_enter_active_mode() uses queue_delayed_work() with the
+intention that the work will run after the given timeout. However,
+queue_delayed_work() does nothing if the work is already queued, so
+depending on the link policy we may end up putting the connection
+into idle mode every hdev->idle_timeout ms.
+
+Use mod_delayed_work() instead so the work is queued if not already
+queued, and the timeout is updated otherwise.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 5f6785fd6af52..8d659aec172b3 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2486,8 +2486,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
+
+ timer:
+ if (hdev->idle_timeout > 0)
+- queue_delayed_work(hdev->workqueue, &conn->idle_work,
+- msecs_to_jiffies(hdev->idle_timeout));
++ mod_delayed_work(hdev->workqueue, &conn->idle_work,
++ msecs_to_jiffies(hdev->idle_timeout));
+ }
+
+ /* Drop all connection on the device */
+--
+2.51.0
+
--- /dev/null
+From eb5ecbb0e1bfce8e4bb5b9e2725150fdae87371c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 18:02:19 +0000
+Subject: bpf: verifier improvement in 32bit shift sign extension pattern
+
+From: Cupertino Miranda <cupertino.miranda@oracle.com>
+
+[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ]
+
+This patch improves the verifier to correctly compute bounds for
+sign extension compiler pattern composed of left shift by 32bits
+followed by a sign right shift by 32bits. Pattern in the verifier was
+limitted to positive value bounds and would reset bound computation for
+negative values. New code allows both positive and negative values for
+sign extension without compromising bound computation and verifier to
+pass.
+
+This change is required by GCC which generate such pattern, and was
+detected in the context of systemd, as described in the following GCC
+bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731
+
+Three new tests were added in verifier_subreg.c.
+
+Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com>
+Signed-off-by: Andrew Pinski <andrew.pinski@oss.qualcomm.com>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Cc: David Faust <david.faust@oracle.com>
+Cc: Jose Marchesi <jose.marchesi@oracle.com>
+Cc: Elena Zannoni <elena.zannoni@oracle.com>
+Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 276a0de9a1bb2..42bbc97fab71a 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -9059,21 +9059,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg,
+ u64 umin_val, u64 umax_val)
+ {
+ /* Special case <<32 because it is a common compiler pattern to sign
+- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are
+- * positive we know this shift will also be positive so we can track
+- * bounds correctly. Otherwise we lose all sign bit information except
+- * what we can pick up from var_off. Perhaps we can generalize this
+- * later to shifts of any length.
++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct
++ * because s32 bounds don't flip sign when shifting to the left by
++ * 32bits.
+ */
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0)
++ if (umin_val == 32 && umax_val == 32) {
+ dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32;
+- else
+- dst_reg->smax_value = S64_MAX;
+-
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0)
+ dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32;
+- else
++ } else {
++ dst_reg->smax_value = S64_MAX;
+ dst_reg->smin_value = S64_MIN;
++ }
+
+ /* If we might shift our top bit out, then we know nothing */
+ if (dst_reg->umax_value > 1ULL << (63 - umax_val)) {
+--
+2.51.0
+
--- /dev/null
+From 8f7e8df99257e000cff7134a23cba61f97499937 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 22:53:57 +0530
+Subject: btrfs: replace BUG() with error handling in __btrfs_balance()
+
+From: Adarsh Das <adarshdas950@gmail.com>
+
+[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ]
+
+We search with offset (u64)-1 which should never match exactly.
+Previously this was handled with BUG(). Now logs an error
+and return -EUCLEAN.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 366cf2e8c51cb..d06709ced0f36 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4011,8 +4011,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info)
+ * this shouldn't happen, it means the last relocate
+ * failed
+ */
+- if (ret == 0)
+- BUG(); /* FIXME break ? */
++ if (unlikely(ret == 0)) {
++ btrfs_err(fs_info,
++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx",
++ key.offset);
++ mutex_unlock(&fs_info->reclaim_bgs_lock);
++ ret = -EUCLEAN;
++ goto error;
++ }
+
+ ret = btrfs_previous_item(chunk_root, path, 0,
+ BTRFS_CHUNK_ITEM_KEY);
+--
+2.51.0
+
--- /dev/null
+From 8c54e7f908eea1454e95083ce07a6dfc5e790777 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 18:42:06 +0800
+Subject: ceph: supply snapshot context in ceph_uninline_data()
+
+From: ethanwu <ethanwu@synology.com>
+
+[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ]
+
+The ceph_uninline_data function was missing proper snapshot context
+handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and
+CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate
+snapshot context, which could lead to unnecessary object clone.
+
+Reproducer:
+../src/vstart.sh --new -x --localhost --bluestore
+// turn on cephfs inline data
+./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it
+// allow fs_a client to take snapshot
+./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a'
+// mount cephfs with fuse, since kernel cephfs doesn't support inline write
+ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/
+// bump snapshot seq
+mkdir /mnt/mycephfs/.snap/snap1
+echo "foo" > /mnt/mycephfs/test
+// umount and mount it again using kernel cephfs client
+umount /mnt/mycephfs
+mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf
+echo "bar" >> /mnt/mycephfs/test
+./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000
+
+will see this object does unnecessary clone
+1000000000a.00000000 (seq:2):
+cloneid snaps size overlap
+2 2 4 []
+head - 8
+
+but it's expected to see
+10000000000.00000000 (seq:2):
+cloneid snaps size overlap
+head - 8
+
+since there's no snapshot between these 2 writes
+
+clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't
+pass snap context so object is created with snap seq 0, but later data
+writeback is equipped with snapshot context.
+snap.seq(1) > object snap seq(0), so osd does object clone.
+
+This fix properly acquiring the snapshot context before performing
+write operations.
+
+Signed-off-by: ethanwu <ethanwu@synology.com>
+Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/addr.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index f92c7dc9d9bf1..b1d6ca50e1222 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -1704,6 +1704,7 @@ int ceph_uninline_data(struct file *file)
+ struct ceph_osd_request *req = NULL;
+ struct ceph_cap_flush *prealloc_cf = NULL;
+ struct folio *folio = NULL;
++ struct ceph_snap_context *snapc = NULL;
+ u64 inline_version = CEPH_INLINE_NONE;
+ struct page *pages[1];
+ int err = 0;
+@@ -1731,6 +1732,24 @@ int ceph_uninline_data(struct file *file)
+ if (inline_version == 1) /* initial version, no data */
+ goto out_uninline;
+
++ down_read(&fsc->mdsc->snap_rwsem);
++ spin_lock(&ci->i_ceph_lock);
++ if (__ceph_have_pending_cap_snap(ci)) {
++ struct ceph_cap_snap *capsnap =
++ list_last_entry(&ci->i_cap_snaps,
++ struct ceph_cap_snap,
++ ci_item);
++ snapc = ceph_get_snap_context(capsnap->context);
++ } else {
++ if (!ci->i_head_snapc) {
++ ci->i_head_snapc = ceph_get_snap_context(
++ ci->i_snap_realm->cached_context);
++ }
++ snapc = ceph_get_snap_context(ci->i_head_snapc);
++ }
++ spin_unlock(&ci->i_ceph_lock);
++ up_read(&fsc->mdsc->snap_rwsem);
++
+ folio = read_mapping_folio(inode->i_mapping, 0, file);
+ if (IS_ERR(folio)) {
+ err = PTR_ERR(folio);
+@@ -1746,7 +1765,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 0, 1,
+ CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE,
+- NULL, 0, 0, false);
++ snapc, 0, 0, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+ goto out_unlock;
+@@ -1762,7 +1781,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 1, 3,
+ CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE,
+- NULL, ci->i_truncate_seq,
++ snapc, ci->i_truncate_seq,
+ ci->i_truncate_size, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+@@ -1825,6 +1844,7 @@ int ceph_uninline_data(struct file *file)
+ folio_put(folio);
+ }
+ out:
++ ceph_put_snap_context(snapc);
+ ceph_free_cap_flush(prealloc_cf);
+ dout("uninline_data %p %llx.%llx inline_version %llu = %d\n",
+ inode, ceph_vinop(inode), inline_version, err);
+--
+2.51.0
+
--- /dev/null
+From 0d1017da273b867df94f4b030cc14735c12c7dbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:29 +0100
+Subject: char: tpm: cr50: Remove IRQF_ONESHOT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+
+The flag also prevents force-threading of the primary handler and the
+irq-core will warn about this.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +--
+ drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+index 77cea5b31c6e4..99e05c517673d 100644
+--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c
++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+@@ -714,8 +714,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client)
+
+ if (client->irq > 0) {
+ rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler,
+- IRQF_TRIGGER_FALLING | IRQF_ONESHOT |
+- IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
+ dev->driver->name, chip);
+ if (rc < 0) {
+ dev_err(dev, "Failed to probe IRQ %d\n", client->irq);
+diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c
+index f4937280e9406..32920b4cecfb4 100644
+--- a/drivers/char/tpm/tpm_tis_spi_cr50.c
++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c
+@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi)
+ if (spi->irq > 0) {
+ ret = devm_request_irq(&spi->dev, spi->irq,
+ cr50_spi_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ "cr50_spi", cr50_phy);
+ if (ret < 0) {
+ if (ret == -EPROBE_DEFER)
+--
+2.51.0
+
--- /dev/null
+From 89d8c23b86b2333b314914b83da4b0bac40f8acf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 14:46:28 -0500
+Subject: clk: microchip: core: correct return value on *_get_parent()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ]
+
+roclk_get_parent() and sclk_get_parent() has the possibility of
+returning -EINVAL, however the framework expects this call to always
+succeed since the return value is unsigned.
+
+If there is no parent map defined, then the current value programmed in
+the hardware is used. Let's use that same value in the case where
+-EINVAL is currently returned.
+
+This index is only used by clk_core_get_parent_by_index(), and it
+validates that it doesn't overflow the number of available parents.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/microchip/clk-core.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c
+index 1b4f023cdc8be..71fbaf8318f22 100644
+--- a/drivers/clk/microchip/clk-core.c
++++ b/drivers/clk/microchip/clk-core.c
+@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK;
+
+- if (!refo->parent_map)
+- return v;
+-
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (refo->parent_map[i] == v)
+- return i;
++ if (refo->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (refo->parent_map[i] == v)
++ return i;
++ }
+
+- return -EINVAL;
++ return v;
+ }
+
+ static unsigned long roclk_calc_rate(unsigned long parent_rate,
+@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK;
+
+- if (!sclk->parent_map)
+- return v;
++ if (sclk->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (sclk->parent_map[i] == v)
++ return i;
++ }
+
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (sclk->parent_map[i] == v)
+- return i;
+- return -EINVAL;
++ return v;
+ }
+
+ static int sclk_set_parent(struct clk_hw *hw, u8 index)
+--
+2.51.0
+
--- /dev/null
+From 309e247823a601a66470e743d4dbda277c01c76e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 23:13:41 +0100
+Subject: clocksource/drivers/sh_tmu: Always leave device running after probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ]
+
+The TMU device can be used as both a clocksource and a clockevent
+provider. The driver tries to be smart and power itself on and off, as
+well as enabling and disabling its clock when it's not in operation.
+This behavior is slightly altered if the TMU is used as an early
+platform device in which case the device is left powered on after probe,
+but the clock is still enabled and disabled at runtime.
+
+This has worked for a long time, but recent improvements in PREEMPT_RT
+and PROVE_LOCKING have highlighted an issue. As the TMU registers itself
+as a clockevent provider, clockevents_register_device(), it needs to use
+raw spinlocks internally as this is the context of which the clockevent
+framework interacts with the TMU driver. However in the context of
+holding a raw spinlock the TMU driver can't really manage its power
+state or clock with calls to pm_runtime_*() and clk_*() as these calls
+end up in other platform drivers using regular spinlocks to control
+power and clocks.
+
+This mix of spinlock contexts trips a lockdep warning.
+
+ =============================
+ [ BUG: Invalid wait context ]
+ 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted
+ -----------------------------
+ swapper/0/0 is trying to lock:
+ ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88
+ other info that might help us debug this:
+ context-{5:5}
+ 1 lock held by swapper/0/0:
+ ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0
+ #0: ffff8000817ec298
+ ccree e6601000.crypto: ARM ccree device initialized
+ (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT
+ Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
+ Call trace:
+ show_stack+0x14/0x1c (C)
+ dump_stack_lvl+0x6c/0x90
+ dump_stack+0x14/0x1c
+ __lock_acquire+0x904/0x1584
+ lock_acquire+0x220/0x34c
+ _raw_spin_lock_irqsave+0x58/0x80
+ __pm_runtime_resume+0x38/0x88
+ sh_tmu_clock_event_set_oneshot+0x84/0xd4
+ clockevents_switch_state+0xfc/0x13c
+ tick_broadcast_set_event+0x30/0xa4
+ __tick_broadcast_oneshot_control+0x1e0/0x3a8
+ tick_broadcast_oneshot_control+0x30/0x40
+ cpuidle_enter_state+0x40c/0x680
+ cpuidle_enter+0x30/0x40
+ do_idle+0x1f4/0x280
+ cpu_startup_entry+0x34/0x40
+ kernel_init+0x0/0x130
+ do_one_initcall+0x0/0x230
+ __primary_switched+0x88/0x90
+
+For non-PREEMPT_RT builds this is not really an issue, but for
+PREEMPT_RT builds where normal spinlocks can sleep this might be an
+issue. Be cautious and always leave the power and clock running after
+probe.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/sh_tmu.c | 18 ------------------
+ 1 file changed, 18 deletions(-)
+
+diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
+index b00dec0655cb2..2e35bb39ef42f 100644
+--- a/drivers/clocksource/sh_tmu.c
++++ b/drivers/clocksource/sh_tmu.c
+@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start)
+
+ static int __sh_tmu_enable(struct sh_tmu_channel *ch)
+ {
+- int ret;
+-
+- /* enable clock */
+- ret = clk_enable(ch->tmu->clk);
+- if (ret) {
+- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n",
+- ch->index);
+- return ret;
+- }
+-
+ /* make sure channel is disabled */
+ sh_tmu_start_stop_ch(ch, 0);
+
+@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch)
+ if (ch->enable_count++ > 0)
+ return 0;
+
+- pm_runtime_get_sync(&ch->tmu->pdev->dev);
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, true);
+
+ return __sh_tmu_enable(ch);
+@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch)
+
+ /* disable interrupts in TMU block */
+ sh_tmu_write(ch, TCR, TCR_TPSC_CLK4);
+-
+- /* stop clock */
+- clk_disable(ch->tmu->clk);
+ }
+
+ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+ __sh_tmu_disable(ch);
+
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, false);
+- pm_runtime_put(&ch->tmu->pdev->dev);
+ }
+
+ static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta,
+@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
+ goto err_clk_unprepare;
+
+ tmu->rate = clk_get_rate(tmu->clk) / 4;
+- clk_disable(tmu->clk);
+
+ /* Map the memory resource. */
+ ret = sh_tmu_map_memory(tmu);
+@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev)
+ out:
+ if (tmu->has_clockevent || tmu->has_clocksource)
+ pm_runtime_irq_safe(&pdev->dev);
+- else
+- pm_runtime_idle(&pdev->dev);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 87cdca6ee9c0b11d319be0be46cc6efc2ffd75ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 12:17:23 +0100
+Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig
+ dependency on OF
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ]
+
+This driver accesses the of_aliases global variable declared in
+linux/of.h and defined in drivers/base/of.c. It requires OF support or
+will cause a link failure. Add the missing Kconfig dependency.
+
+Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index c957bd470507e..18283d9879025 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -236,6 +236,7 @@ config KEYSTONE_TIMER
+
+ config INTEGRATOR_AP_TIMER
+ bool "Integrator-AP timer driver" if COMPILE_TEST
++ depends on OF
+ select CLKSRC_MMIO
+ help
+ Enables support for the Integrator-AP timer.
+--
+2.51.0
+
--- /dev/null
+From 821fd9c58083cb54cabf6085e25556ebd8de21da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 20:03:50 +0800
+Subject: dm: remove fake timeout to avoid leak request
+
+From: Ding Hui <dinghui@sangfor.com.cn>
+
+[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ]
+
+Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
+blk_mq_complete_request"), drivers are responsible for calling
+blk_should_fake_timeout() at appropriate code paths and opportunities.
+
+However, the dm driver does not implement its own timeout handler and
+relies on the timeout handling of its slave devices.
+
+If an io-timeout-fail error is injected to a dm device, the request
+will be leaked and never completed, causing tasks to hang indefinitely.
+
+Reproduce:
+1. prepare dm which has iscsi slave device
+2. inject io-timeout-fail to dm
+ echo 1 >/sys/class/block/dm-0/io-timeout-fail
+ echo 100 >/sys/kernel/debug/fail_io_timeout/probability
+ echo 10 >/sys/kernel/debug/fail_io_timeout/times
+3. read/write dm
+4. iscsiadm -m node -u
+
+Result: hang task like below
+[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
+[ 862.244133] Tainted: G E 6.19.0-rc1+ #51
+[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000
+[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
+[ 862.245264] Call Trace:
+[ 862.245587] <TASK>
+[ 862.245814] __schedule+0x810/0x15c0
+[ 862.246557] schedule+0x69/0x180
+[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120
+[ 862.247688] elevator_change+0x16d/0x460
+[ 862.247893] elevator_set_none+0x87/0xf0
+[ 862.248798] blk_unregister_queue+0x12e/0x2a0
+[ 862.248995] __del_gendisk+0x231/0x7e0
+[ 862.250143] del_gendisk+0x12f/0x1d0
+[ 862.250339] sd_remove+0x85/0x130 [sd_mod]
+[ 862.250650] device_release_driver_internal+0x36d/0x530
+[ 862.250849] bus_remove_device+0x1dd/0x3f0
+[ 862.251042] device_del+0x38a/0x930
+[ 862.252095] __scsi_remove_device+0x293/0x360
+[ 862.252291] scsi_remove_target+0x486/0x760
+[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
+[ 862.252886] process_one_work+0x633/0xe50
+[ 862.253101] worker_thread+0x6df/0xf10
+[ 862.253647] kthread+0x36d/0x720
+[ 862.254533] ret_from_fork+0x2a6/0x470
+[ 862.255852] ret_from_fork_asm+0x1a/0x30
+[ 862.256037] </TASK>
+
+Remove the blk_should_fake_timeout() check from dm, as dm has no
+native timeout handling and should not attempt to fake timeouts.
+
+Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 6685dc3b8b448..53e3d0e8a99af 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -276,8 +276,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error)
+ struct dm_rq_target_io *tio = tio_from_request(rq);
+
+ tio->error = error;
+- if (likely(!blk_should_fake_timeout(rq->q)))
+- blk_mq_complete_request(rq);
++ blk_mq_complete_request(rq);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 8cf5fd9cd9aa55ba2dba0c3694e22a30aed2b5f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 09:15:03 +0100
+Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix
+ warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ]
+
+m2m_hw_period is initialized only when chan_config->m2m_hw is true. This
+triggers a warning:
+‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized]
+Although m2m_hw_period is only used when chan_config->m2m_hw is true and
+ignored otherwise, initialize it unconditionally to 0.
+
+ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not
+empty. This triggers a warning:
+‘ccr’ may be used uninitialized [-Wmaybe-uninitialized]
+Indeed, it could be used uninitialized if the sg list is empty. Initialize
+it to 0.
+
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Reviewed-by: Clément Le Goffic <legoffic.clement@gmail.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32-mdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
+index 65ef1f5ca6b89..405c1fe2d6a3e 100644
+--- a/drivers/dma/stm32-mdma.c
++++ b/drivers/dma/stm32-mdma.c
+@@ -733,7 +733,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan,
+ struct stm32_mdma_chan_config *chan_config = &chan->chan_config;
+ struct scatterlist *sg;
+ dma_addr_t src_addr, dst_addr;
+- u32 m2m_hw_period, ccr, ctcr, ctbr;
++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr;
+ int i, ret = 0;
+
+ if (chan_config->m2m_hw)
+--
+2.51.0
+
--- /dev/null
+From 8695c9fd215f0460cf8e11de170dd02dd44a66f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:04:48 +0800
+Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst
+
+From: Chen-Yu Tsai <wens@kernel.org>
+
+[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ]
+
+maxburst, as provided by the client, specifies the largest amount of
+data that is allowed to be transferred in one burst. This limit is
+normally provided to avoid a data burst overflowing the target FIFO.
+It does not mean that the DMA engine can only do bursts in that size.
+
+Let the driver pick the largest supported burst length within the
+given limit. This lets the driver work correctly with some clients that
+give a large maxburst value. In particular, the 8250_dw driver will give
+a quarter of the UART's FIFO size as maxburst. On some systems the FIFO
+size is 256 bytes, giving a maxburst of 64 bytes, while the hardware
+only supports bursts of up to 16 bytes.
+
+Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
+index b7557f4379362..7ca0c26f9e872 100644
+--- a/drivers/dma/sun6i-dma.c
++++ b/drivers/dma/sun6i-dma.c
+@@ -581,6 +581,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id)
+ return ret;
+ }
+
++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst)
++{
++ if (!maxburst)
++ return 1;
++
++ if (BIT(maxburst) & burst_lengths)
++ return maxburst;
++
++ /* Hardware only does power-of-two bursts. */
++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2)
++ if (BIT(burst) & burst_lengths)
++ return burst;
++
++ return 1;
++}
++
+ static int set_config(struct sun6i_dma_dev *sdev,
+ struct dma_slave_config *sconfig,
+ enum dma_transfer_direction direction,
+@@ -614,15 +630,13 @@ static int set_config(struct sun6i_dma_dev *sdev,
+ return -EINVAL;
+ if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths))
+ return -EINVAL;
+- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths))
+- return -EINVAL;
+- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths))
+- return -EINVAL;
+
+ src_width = convert_buswidth(src_addr_width);
+ dst_width = convert_buswidth(dst_addr_width);
+- dst_burst = convert_burst(dst_maxburst);
+- src_burst = convert_burst(src_maxburst);
++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst);
++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst);
++ dst_burst = convert_burst(dst_burst);
++ src_burst = convert_burst(src_burst);
+
+ *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) |
+ DMA_CHAN_CFG_DST_WIDTH(dst_width);
+--
+2.51.0
+
--- /dev/null
+From 5b0a3d54428e717b5a61d95168fb4c1f4e0875f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 08:22:26 -0500
+Subject: drm: Account property blob allocations to memcg
+
+From: Xiao Kan <814091656@qq.com>
+
+[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ]
+
+DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
+property blobs backed by kernel memory.
+
+Currently, the blob data allocation is not accounted to the allocating
+process's memory cgroup, allowing unprivileged users to trigger unbounded
+kernel memory consumption and potentially cause system-wide OOM.
+
+Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
+is properly charged to the caller's memcg. This ensures existing cgroup
+memory limits apply and prevents uncontrolled kernel memory growth without
+introducing additional policy or per-file limits.
+
+Signed-off-by: Xiao Kan <814091656@qq.com>
+Signed-off-by: Xiao Kan <xiao.kan@samsung.com>
+Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
+index dfec479830e49..b4ee7d4110f84 100644
+--- a/drivers/gpu/drm/drm_property.c
++++ b/drivers/gpu/drm/drm_property.c
+@@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
+ if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
+ return ERR_PTR(-EINVAL);
+
+- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT);
+ if (!blob)
+ return ERR_PTR(-ENOMEM);
+
+--
+2.51.0
+
--- /dev/null
+From a997ecde706afe2b8d67982d21afe6d1fd953cbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 14:47:01 +0800
+Subject: drm/amd/display: Avoid updating surface with the same surface under
+ MPO
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ]
+
+[Why & How]
+Although it's dummy updates of surface update for committing stream
+updates, we should not have dummy_updates[j].surface all indicating
+to the same surface under multiple surfaces case. Otherwise,
+copy_surface_update_to_plane() in update_planes_and_stream_state()
+will update to the same surface only.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index f7fbc7932bb5b..2130540719043 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -8695,7 +8695,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
+ * To fix this, DC should permit updating only stream properties.
+ */
+ for (j = 0; j < status->plane_count; j++)
+- dummy_updates[j].surface = status->plane_states[0];
++ dummy_updates[j].surface = status->plane_states[j];
+
+
+ mutex_lock(&dm->dc_lock);
+--
+2.51.0
+
--- /dev/null
+From 600a8b74d0c7c072ac25ddcddab9a643eb5f73fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 22:05:16 -0700
+Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ]
+
+[Why]
+Shaper programming has high chance to fail on first time after
+power-on or reboot. This can be verified by running IGT's kms_colorop.
+
+[How]
+Always power on the shaper and 3DLUT before programming by
+removing the debug flag of low power mode.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
+index 4edd0655965b8..34c10cffd3061 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
+@@ -716,8 +716,7 @@ static bool mpc32_program_shaper(
+ return false;
+ }
+
+- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc)
+- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
+
+ current_mode = mpc32_get_shaper_current(mpc, mpcc_id);
+
+--
+2.51.0
+
--- /dev/null
+From 05a92a93d7e4b7155dedfad54734c12f32313065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:24:01 +0000
+Subject: drm/amdgpu: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for amdgpu.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index bcc4d9fa5b0d2..0972d1a58579b 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3449,6 +3449,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((adev->pdev->device == 0x666f) &&
++ (adev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (adev->asic_type == CHIP_OLAND) {
+ if ((adev->pdev->revision == 0xC7) ||
+ (adev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From df03175bc251da7ae6e6bb4bb76647d8b8e56eef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 15:32:01 +0800
+Subject: drm/amdgpu: Adjust usleep_range in fence wait
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ]
+
+Tune the sleep interval in the PSP fence wait loop from 10-100us to
+60-100us.This adjustment results in an overall wait window of 1.2s
+(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations),
+which guarantees that we can retrieve the correct fence value
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 9153459455910..c85c5c159554b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -633,7 +633,7 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ ras_intr = amdgpu_ras_intr_triggered();
+ if (ras_intr)
+ break;
+- usleep_range(10, 100);
++ usleep_range(60, 100);
+ amdgpu_device_invalidate_hdp(psp->adev, NULL);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3a1bb96ead1cb5943eec5e3b2eb673f5cd02967d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 19:36:56 +0530
+Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in
+ svm_migrate_gart_map()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ]
+
+In svm_migrate_gart_map(), while migrating GART mapping, the number of
+bytes copied for the GART table only accounts for CPU pages. On non-4K
+systems, each CPU page can contain multiple GPU pages, and the GART
+requires one 8-byte PTE per GPU page. As a result, an incorrect size was
+passed to the DMA, causing only a partial update of the GART table.
+
+Fix this function to work correctly on non-4K page-size systems by
+accounting for the number of GPU pages per CPU page when calculating the
+number of bytes to be copied.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index 730746512af84..72e84b26370ef 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -63,7 +63,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, uint64_t npages,
+ *gart_addr = adev->gmc.gart_start;
+
+ num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8);
+- num_bytes = npages * 8;
++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE;
+
+ r = amdgpu_job_alloc_with_ib(adev, &adev->mman.entity,
+ AMDGPU_FENCE_OWNER_UNDEFINED,
+--
+2.51.0
+
--- /dev/null
+From 43332636314f4b722005ebe76a08a93e3818f0d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 11:38:25 +0100
+Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has
+ fractional parts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ]
+
+Don’t reject the commit when the source rectangle has fractional parts.
+This can occur due to scaling: drm_atomic_helper_check_plane_state() calls
+drm_rect_clip_scaled(), which may introduce fractional parts while
+computing the clipped source rectangle. This does not imply the commit is
+invalid, so we should accept it instead of discarding it.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 390c4fc62af7c..ec4fe0de989d4 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -78,8 +78,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s)
+ return container_of(s, struct atmel_hlcdc_plane_state, base);
+ }
+
+-#define SUBPIXEL_MASK 0xffff
+-
+ static uint32_t rgb_formats[] = {
+ DRM_FORMAT_C8,
+ DRM_FORMAT_XRGB4444,
+@@ -619,24 +617,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p,
+ if (ret || !s->visible)
+ return ret;
+
+- hstate->src_x = s->src.x1;
+- hstate->src_y = s->src.y1;
+- hstate->src_w = drm_rect_width(&s->src);
+- hstate->src_h = drm_rect_height(&s->src);
++ hstate->src_x = s->src.x1 >> 16;
++ hstate->src_y = s->src.y1 >> 16;
++ hstate->src_w = drm_rect_width(&s->src) >> 16;
++ hstate->src_h = drm_rect_height(&s->src) >> 16;
+ hstate->crtc_x = s->dst.x1;
+ hstate->crtc_y = s->dst.y1;
+ hstate->crtc_w = drm_rect_width(&s->dst);
+ hstate->crtc_h = drm_rect_height(&s->dst);
+
+- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) &
+- SUBPIXEL_MASK)
+- return -EINVAL;
+-
+- hstate->src_x >>= 16;
+- hstate->src_y >>= 16;
+- hstate->src_w >>= 16;
+- hstate->src_h >>= 16;
+-
+ hstate->nplanes = fb->format->num_planes;
+ if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 638efb1dbc6502fe920a073142a3cec5f85782fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:52 +0200
+Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state
+ callback
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ]
+
+After several commits, the slab memory increases. Some drm_crtc_commit
+objects are not freed. The atomic_destroy_state callback only put the
+framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
+to put all the objects that are no longer needed.
+
+It has been seen after hours of usage of a graphics application or using
+kmemleak:
+
+unreferenced object 0xc63a6580 (size 64):
+ comm "egt_basic", pid 171, jiffies 4294940784
+ hex dump (first 32 bytes):
+ 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.
+ 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.
+ backtrace (crc c25aa925):
+ kmemleak_alloc+0x34/0x3c
+ __kmalloc_cache_noprof+0x150/0x1a4
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index daa508504f47d..390c4fc62af7c 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -934,8 +934,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
+ state->dscrs[i]->self);
+ }
+
+- if (s->fb)
+- drm_framebuffer_put(s->fb);
++ __drm_atomic_helper_plane_destroy_state(s);
+
+ kfree(state);
+ }
+--
+2.51.0
+
--- /dev/null
+From ed54d60d095b74a5a46b8228c782f1f26df16aa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:53 +0200
+Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ]
+
+The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
+the atmel_hlcdc_plane state structure without properly duplicating the
+drm_plane_state. In particular, state->commit remained set to the old
+state commit, which can lead to a use-after-free in the next
+drm_atomic_commit() call.
+
+Fix this by calling
+__drm_atomic_helper_duplicate_plane_state(), which correctly clones
+the base drm_plane_state (including the ->commit pointer).
+
+It has been seen when closing and re-opening the device node while
+another DRM client (e.g. fbdev) is still attached:
+
+=============================================================================
+BUG kmalloc-64 (Not tainted): Poison overwritten
+-----------------------------------------------------------------------------
+
+0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b
+FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b
+Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0
+pid=29
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_framebuffer_remove+0x4cc/0x5a8
+ drm_mode_rmfb_work_fn+0x6c/0x80
+ process_one_work+0x12c/0x2cc
+ worker_thread+0x2a8/0x400
+ kthread+0xc0/0xdc
+ ret_from_fork+0x14/0x28
+Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0
+pid=169
+ drm_atomic_helper_commit_hw_done+0x100/0x150
+ drm_atomic_helper_commit_tail+0x64/0x8c
+ commit_tail+0x168/0x18c
+ drm_atomic_helper_commit+0x138/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0
+flags=0x200(workingset|zone=0)
+Object 0xc611b340 @offset=832 fp=0xc611b7c0
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index ec4fe0de989d4..b35d367b86141 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -904,8 +904,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
+ return NULL;
+ }
+
+- if (copy->base.fb)
+- drm_framebuffer_get(copy->base.fb);
++ __drm_atomic_helper_plane_duplicate_state(p, ©->base);
+
+ return ©->base;
+ }
+--
+2.51.0
+
--- /dev/null
+From b08f9827229531360e6dc77f7c43c12fb8f77625 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 15:16:50 +0530
+Subject: drm/display/dp_mst: Add protection against 0 vcpi
+
+From: Suraj Kandpal <suraj.kandpal@intel.com>
+
+[ Upstream commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa ]
+
+When releasing a timeslot there is a slight chance we may end up
+with the wrong payload mask due to overflow if the delayed_destroy_work
+ends up coming into play after a DP 2.1 monitor gets disconnected
+which causes vcpi to become 0 then we try to make the payload =
+~BIT(vcpi - 1) which is a negative shift. VCPI id should never
+really be 0 hence skip changing the payload mask if VCPI is 0.
+
+Otherwise it leads to
+<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc
+[drm_display_helper]] port ffff888126ce9000 (3)
+<4> [515.287267] -----------[ cut here ]-----------
+<3> [515.287268] UBSAN: shift-out-of-bounds in
+../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36
+<3> [515.287271] shift exponent -1 is negative
+<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G
+S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)
+<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
+<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P
+WIFI, BIOS 1645 03/15/2024
+<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work
+[drm_display_helper]
+<4> [515.287303] Call Trace:
+<4> [515.287304] <TASK>
+<4> [515.287306] dump_stack_lvl+0xc1/0xf0
+<4> [515.287313] dump_stack+0x10/0x20
+<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0
+<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0
+<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d
+[drm_display_helper]
+<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]
+<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0
+<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60
+<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe]
+<4> [515.287740] ? find_held_lock+0x31/0x90
+<4> [515.287747] ? lock_release+0xce/0x2a0
+<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40
+<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140
+<4> [515.287765] drm_atomic_commit+0x6e/0xf0
+<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10
+<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0
+<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0
+<4> [515.287795] ? mutex_lock_nested+0x1b/0x30
+<4> [515.287801] drm_client_modeset_commit+0x26/0x50
+<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110
+<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140
+<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0
+<4> [515.287819] drm_client_hotplug+0x6c/0xf0
+<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0
+<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30
+<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410
+[drm_display_helper]
+<4> [515.287861] process_one_work+0x22b/0x6f0
+<4> [515.287874] worker_thread+0x1e8/0x3d0
+<4> [515.287879] ? __pfx_worker_thread+0x10/0x10
+<4> [515.287882] kthread+0x11c/0x250
+<4> [515.287886] ? __pfx_kthread+0x10/0x10
+<4> [515.287890] ret_from_fork+0x2d7/0x310
+<4> [515.287894] ? __pfx_kthread+0x10/0x10
+<4> [515.287897] ret_from_fork_asm+0x1a/0x30
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303
+Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+index a4d84a2c8b4ec..65722f4b30ae8 100644
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -4464,7 +4464,8 @@ int drm_dp_atomic_release_time_slots(struct drm_atomic_state *state,
+ if (!payload->delete) {
+ payload->pbn = 0;
+ payload->delete = true;
+- topology_state->payload_mask &= ~BIT(payload->vcpi - 1);
++ if (payload->vcpi > 0)
++ topology_state->payload_mask &= ~BIT(payload->vcpi - 1);
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From f4412a64756a748ab65ed8fa69356ac874346b2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:26:00 +0000
+Subject: drm/radeon: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for radeon.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index fbf968e3f6d78..c688b4d914819 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2969,6 +2969,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((rdev->pdev->device == 0x666f) &&
++ (rdev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (rdev->family == CHIP_OLAND) {
+ if ((rdev->pdev->revision == 0xC7) ||
+ (rdev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From 042713006366fc9539b45270860950fa4a9a0b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 21:03:23 +0800
+Subject: drm/v3d: Set DMA segment size to avoid debug warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ]
+
+When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
+kernel occasionally reports a segment size mismatch. This is because
+'max_seg_size' is not set. The kernel defaults to 64K. setting
+'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
+from complaining about the over-mapping of the V3D segment length.
+
+DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device
+ claims to support [len=8290304] [max=65536]
+WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388
+CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1
+Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : debug_dma_map_sg+0x330/0x388
+lr : debug_dma_map_sg+0x330/0x388
+sp : ffff8000829a3ac0
+x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000
+x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000
+x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002
+x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff
+x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573
+x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000
+x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c
+x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001
+x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280
+Call trace:
+ debug_dma_map_sg+0x330/0x388
+ __dma_map_sg_attrs+0xc0/0x278
+ dma_map_sgtable+0x30/0x58
+ drm_gem_shmem_get_pages_sgt+0xb4/0x140
+ v3d_bo_create_finish+0x28/0x130 [v3d]
+ v3d_create_bo_ioctl+0x54/0x180 [v3d]
+ drm_ioctl_kernel+0xc8/0x140
+ drm_ioctl+0x2d4/0x4d8
+
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
+index e8c975b815859..d51910a42570f 100644
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -236,6 +236,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
++ dma_set_max_seg_size(&pdev->dev, UINT_MAX);
++
+ v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH);
+
+ ident1 = V3D_READ(V3D_HUB_IDENT1);
+--
+2.51.0
+
--- /dev/null
+From 9caa0a68d4d29177fd19e4baac488354cd95025a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:06 +0100
+Subject: EFI/CPER: don't dump the entire memory region
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ]
+
+The current logic at cper_print_fw_err() doesn't check if the
+error record length is big enough to handle offset. On a bad firmware,
+if the ofset is above the actual record, length -= offset will
+underflow, making it dump the entire memory.
+
+The end result can be:
+
+ - the logic taking a lot of time dumping large regions of memory;
+ - data disclosure due to the memory dumps;
+ - an OOPS, if it tries to dump an unmapped memory region.
+
+Fix it by checking if the section length is too small before doing
+a hex dump.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 9d6650f50ffe7..f0e8ee2641b89 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -551,6 +551,11 @@ static void cper_print_fw_err(const char *pfx,
+ } else {
+ offset = sizeof(*fw_err);
+ }
++ if (offset > length) {
++ printk("%s""error section length is too small: offset=%d, length=%d\n",
++ pfx, offset, length);
++ return;
++ }
+
+ buf += offset;
+ length -= offset;
+--
+2.51.0
+
--- /dev/null
+From 1d86aa8ebe3d47bef699088bf4aa02e6fcbad805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:04 +0100
+Subject: EFI/CPER: don't go past the ARM processor CPER record buffer
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ]
+
+There's a logic inside GHES/CPER to detect if the section_length
+is too small, but it doesn't detect if it is too big.
+
+Currently, if the firmware receives an ARM processor CPER record
+stating that a section length is big, kernel will blindly trust
+section_length, producing a very long dump. For instance, a 67
+bytes record with ERR_INFO_NUM set 46198 and section length
+set to 854918320 would dump a lot of data going a way past the
+firmware memory-mapped area.
+
+Fix it by adding a logic to prevent it to go past the buffer
+if ERR_INFO_NUM is too big, making it report instead:
+
+ [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+ [Hardware Error]: event severity: recoverable
+ [Hardware Error]: Error 0, type: recoverable
+ [Hardware Error]: section_type: ARM processor error
+ [Hardware Error]: MIDR: 0xff304b2f8476870a
+ [Hardware Error]: section length: 854918320, CPER size: 67
+ [Hardware Error]: section length is too big
+ [Hardware Error]: firmware-generated error record is incorrect
+ [Hardware Error]: ERR_INFO_NUM is 46198
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject and changelog tweaks ]
+Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper-arm.c | 12 ++++++++----
+ drivers/firmware/efi/cper.c | 3 ++-
+ include/linux/cper.h | 3 ++-
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
+index ea43589944ba5..26a12f8076359 100644
+--- a/drivers/firmware/efi/cper-arm.c
++++ b/drivers/firmware/efi/cper-arm.c
+@@ -227,7 +227,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
+ }
+
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc)
++ const struct cper_sec_proc_arm *proc,
++ u32 length)
+ {
+ int i, len, max_ctx_type;
+ struct cper_arm_err_info *err_info;
+@@ -239,9 +240,12 @@ void cper_print_proc_arm(const char *pfx,
+
+ len = proc->section_length - (sizeof(*proc) +
+ proc->err_info_num * (sizeof(*err_info)));
+- if (len < 0) {
+- printk("%ssection length: %d\n", pfx, proc->section_length);
+- printk("%ssection length is too small\n", pfx);
++
++ if (len < 0 || proc->section_length > length) {
++ printk("%ssection length: %d, CPER size: %d\n",
++ pfx, proc->section_length, length);
++ printk("%ssection length is too %s\n", pfx,
++ (len < 0) ? "small" : "big");
+ printk("%sfirmware-generated error record is incorrect\n", pfx);
+ printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num);
+ return;
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index f0e8ee2641b89..8669d1e8d84df 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -636,7 +636,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata
+
+ printk("%ssection_type: ARM processor error\n", newpfx);
+ if (gdata->error_data_length >= sizeof(*arm_err))
+- cper_print_proc_arm(newpfx, arm_err);
++ cper_print_proc_arm(newpfx, arm_err,
++ gdata->error_data_length);
+ else
+ goto err_section_too_small;
+ #endif
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index ff84d72cdee82..efd076715bb7f 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -568,7 +568,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *,
+ const char *cper_mem_err_unpack(struct trace_seq *,
+ struct cper_mem_err_compact *);
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc);
++ const struct cper_sec_proc_arm *proc,
++ u32 length);
+ void cper_print_proc_ia(const char *pfx,
+ const struct cper_sec_proc_ia *proc);
+ int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg);
+--
+2.51.0
+
--- /dev/null
+From bf16fa8572ba23c809eaeb51cb39123c171c0726 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:41 +0800
+Subject: ext4: mark group add fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ]
+
+Fast commits only log operations that have dedicated replay support.
+Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group
+descriptor metadata without going through the fast commit tracking
+paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+ext4_ioctl_group_add() adds new block groups.
+This forces those transactions to fall back to a full commit,
+ensuring that the filesystem geometry updates are captured by the
+normal journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_ADD safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted
+ filesystem and checked the resize ineligible reason:
+ ./group_add_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows "Resize": > 0.
+3. Fsynced a file on the resized filesystem and verified that the fast
+ commit stats report at least one ineligible commit:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+ shows fc stats ineligible > 0.
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 3784f70416492..8a10d028c0a32 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -950,6 +950,7 @@ static long ext4_ioctl_group_add(struct file *file,
+
+ err = ext4_group_add(sb, input);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From 203e85b6dd2e8ea59d3b2794faa2046dbbbc8061 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:42 +0800
+Subject: ext4: mark group extend fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ]
+
+Fast commits only log operations that have dedicated replay support.
+EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last
+block group and updates the same on-disk metadata without going
+through the fast commit tracking paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+EXT4_IOC_GROUP_EXTEND grows the filesystem.
+This forces those transactions to fall back to a full commit,
+ensuring that the group extension changes are captured by the normal
+journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_EXTEND safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Extended the filesystem to the end of the last block group using a
+ helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem
+ and checked fc_info:
+ ./group_extend_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows the "Resize" ineligible reason increased.
+3. Fsynced a file on the resized filesystem and confirmed that the fast
+ commit ineligible counter incremented for the resize transaction:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 8a10d028c0a32..8447076eae676 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1303,6 +1303,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+
+ err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE,
++ NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From e09852349d803f34f5fc9fb06547a0d6ca162e70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 13:11:24 +0100
+Subject: fix it87_wdt early reboot by reporting running timer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ]
+
+Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87
+wdt enabled by the firmware and a broken BIOS option that does not
+allow to change the time or turn it off. As this makes installing
+Linux rather difficult, change the it87_wdt to report it running to
+the watchdog core.
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/it87_wdt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
+index 239947df613db..1392e557fa371 100644
+--- a/drivers/watchdog/it87_wdt.c
++++ b/drivers/watchdog/it87_wdt.c
+@@ -183,6 +183,12 @@ static void _wdt_update_timeout(unsigned int t)
+ superio_outb(t >> 8, WDTVALMSB);
+ }
+
++/* Internal function, should be called after superio_select(GPIO) */
++static bool _wdt_running(void)
++{
++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB));
++}
++
+ static int wdt_update_timeout(unsigned int t)
+ {
+ int ret;
+@@ -365,6 +371,12 @@ static int __init it87_wdt_init(void)
+ }
+ }
+
++ /* wdt already left running by firmware? */
++ if (_wdt_running()) {
++ pr_info("Left running by firmware.\n");
++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status);
++ }
++
+ superio_exit();
+
+ if (timeout < 1 || timeout > max_units * 60) {
+--
+2.51.0
+
--- /dev/null
+From 58f10eab6622c3f9809cfe01d9d44412e9767b6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 16:58:48 +0100
+Subject: fpga: of-fpga-region: Fail if any bridge is missing
+
+From: Romain Gantois <romain.gantois@bootlin.com>
+
+[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ]
+
+When parsing the region bridge list from the "fpga-bridges" device tree
+property, the of-fpga-region driver will silently ignore bridges which fail
+to be obtained, for example due to a missing bridge driver or invalid
+phandle.
+
+This can lead to hardware issues if a region bridge stays coupled when
+partial programming is performed.
+
+Fail if any of the bridges specified in "fpga-bridges" cannot be obtained.
+
+Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
+Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com
+Reviewed-by: Xu Yilun <yilun.xu@intel.com>
+Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/of-fpga-region.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
+index ae82532fc127c..4a7b3f0059c3f 100644
+--- a/drivers/fpga/of-fpga-region.c
++++ b/drivers/fpga/of-fpga-region.c
+@@ -81,7 +81,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np)
+ * done with the bridges.
+ *
+ * Return: 0 for success (even if there are no bridges specified)
+- * or -EBUSY if any of the bridges are in use.
++ * or an error code if any of the bridges are not available.
+ */
+ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ {
+@@ -128,10 +128,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ ®ion->bridge_list);
+ of_node_put(br);
+
+- /* If any of the bridges are in use, give up */
+- if (ret == -EBUSY) {
++ /* If any of the bridges are not available, give up */
++ if (ret) {
+ fpga_bridges_put(®ion->bridge_list);
+- return -EBUSY;
++ return ret;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1fc5e656749406631ca700e747c4c25c5491ed26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 18:42:11 +0530
+Subject: fs/buffer: add alert in try_to_free_buffers() for folios without
+ buffers
+
+From: Deepakkumar Karn <dkarn@redhat.com>
+
+[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ]
+
+try_to_free_buffers() can be called on folios with no buffers attached
+when filemap_release_folio() is invoked on a folio belonging to a mapping
+with AS_RELEASE_ALWAYS set but no release_folio operation defined.
+
+In such cases, folio_needs_release() returns true because of the
+AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This
+causes try_to_free_buffers() to call drop_buffers() on a folio with no
+buffers, leading to a null pointer dereference.
+
+Adding a check in try_to_free_buffers() to return early if the folio has no
+buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.
+This provides defensive hardening.
+
+Signed-off-by: Deepakkumar Karn <dkarn@redhat.com>
+Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/buffer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 3033a937e3a56..8bcb421d2816e 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2822,6 +2822,10 @@ bool try_to_free_buffers(struct folio *folio)
+ if (folio_test_writeback(folio))
+ return false;
+
++ /* Misconfigured folio check */
++ if (WARN_ON_ONCE(!folio_buffers(folio)))
++ return true;
++
+ if (mapping == NULL) { /* can this still happen? */
+ ret = drop_buffers(folio, &buffers_to_free);
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From d29589dbacb0545576009faef2367b81a339c967 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 16:07:32 +0100
+Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in
+ ntfs_read_run_nb_ra()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ]
+
+When ntfs_read_run_nb_ra() is invoked with run == NULL the code later
+assumes run is valid and may call run_get_entry(NULL, ...), and also
+uses clen/idx without initializing them. Smatch reported uninitialized
+variable warnings and this can lead to undefined behaviour. This patch
+fixes it.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fsntfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index 8c165b791a1c8..f28bbec5fab45 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -1241,6 +1241,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run,
+
+ } while (len32);
+
++ if (!run) {
++ err = -EINVAL;
++ goto out;
++ }
++
++ /* Get next fragment to read. */
+ vcn_next = vcn + clen;
+ if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) ||
+ vcn != vcn_next) {
+--
+2.51.0
+
--- /dev/null
+From ab8001f8ab7c199f3f17d341f2b4369ed63cf0d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 19:59:59 +0900
+Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed dentry in the ntfs3 filesystem can cause the kernel to hang
+during the lookup operations. By setting the HAS_SUB_NODE flag in an
+INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the
+VCN pointer, an attacker can cause the indx_find() function to repeatedly
+read the same block, allocating 4 KB of memory each time. The kernel lacks
+VCN loop detection and depth limits, causing memory exhaustion and an OOM
+crash.
+
+This patch adds a return value check for fnd_push() to prevent a memory
+exhaustion vulnerability caused by infinite loops. When the index exceeds the
+size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()
+function checks this return value and stops processing, preventing further
+memory allocation.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index ee6de53d2ad12..8ceef90ee5a50 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1190,7 +1190,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni,
+ return -EINVAL;
+ }
+
+- fnd_push(fnd, node, e);
++ err = fnd_push(fnd, node, e);
++
++ if (err) {
++ put_indx_node(node);
++ return err;
++ }
+ }
+
+ *entry = e;
+--
+2.51.0
+
--- /dev/null
+From 2a467d6ed1ab0b6ffd66b114726fca0bf9e51cdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 14:27:48 +0300
+Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ]
+
+Do not keep preallocated clusters for sparsed and compressed files.
+Preserving preallocation in these cases causes fsx failures when running
+with sparse files and preallocation enabled.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index 96a6ebce0928a..f4573d276a2cc 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -473,8 +473,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type,
+
+ is_ext = is_attr_ext(attr_b);
+ align = sbi->cluster_size;
+- if (is_ext)
++ if (is_ext) {
+ align <<= attr_b->nres.c_unit;
++ keep_prealloc = false;
++ }
+
+ old_valid = le64_to_cpu(attr_b->nres.valid_size);
+ old_size = le64_to_cpu(attr_b->nres.data_size);
+--
+2.51.0
+
--- /dev/null
+From b7953432f90017833fafeb7c282feb6c7568a9c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:09 +0900
+Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
+ metadata
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an attribute header
+indicates an empty run list, while directory entries reference it as
+containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way
+to represent an empty run list, and run_unpack() correctly handles this by
+checking if evcn + 1 equals svcn and returning early without parsing any run
+data. However, this creates a problem when there is metadata inconsistency,
+where the attribute header claims to be empty (evcn=-1) but the caller
+expects to read actual data. When run_unpack() immediately returns success
+upon seeing this condition, it leaves the runs_tree uninitialized with
+run->runs as a NULL. The calling function attr_load_runs_range() assumes
+that a successful return means that the runs were loaded and sets clen to 0,
+expecting the next run_lookup_entry() call to succeed. Because runs_tree
+remains uninitialized, run_lookup_entry() continues to fail, and the loop
+increments vcn by zero (vcn += 0), leading to an infinite loop.
+
+This patch adds a retry counter to detect when run_lookup_entry() fails
+consecutively after attr_load_runs_vcn(). If the run is still not found on
+the second attempt, it indicates corrupted metadata and returns -EINVAL,
+preventing the Denial-of-Service (DoS) vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index feda45c7ca8e3..96a6ebce0928a 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -1335,19 +1335,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type,
+ CLST vcn;
+ CLST vcn_last = (to - 1) >> cluster_bits;
+ CLST lcn, clen;
+- int err;
++ int err = 0;
++ int retry = 0;
+
+ for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) {
+ if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) {
++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */
++ err = -EINVAL;
++ break;
++ }
+ err = attr_load_runs_vcn(ni, type, name, name_len, run,
+ vcn);
+ if (err)
+- return err;
++ break;
++
+ clen = 0; /* Next run_lookup_entry(vcn) must be success. */
++ retry++;
+ }
++ else
++ retry = 0;
+ }
+
+- return 0;
++ return err;
+ }
+
+ #ifdef CONFIG_NTFS3_LZX_XPRESS
+--
+2.51.0
+
--- /dev/null
+From a06d46e9174588728da20b6f0e27823759858d3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:46 +0900
+Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
+indicates a zero data size while the driver allocates memory for it.
+
+When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
+to zero, it still allocates memory because of al_aligned(0). This creates an
+inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
+non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
+list exists and enumerates only the primary MFT record. When it finds
+ATTR_LIST, the code reloads it and restarts the enumeration, repeating
+indefinitely. The mount operation never completes, hanging the kernel thread.
+
+This patch adds validation to ensure that data_size is non-zero before memory
+allocation. When a zero-sized ATTR_LIST is detected, the function returns
+-EINVAL, preventing a DoS vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrlist.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
+index 82bd9b5d9bd80..64da2196711ed 100644
+--- a/fs/ntfs3/attrlist.c
++++ b/fs/ntfs3/attrlist.c
+@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+
+ if (!attr->non_res) {
+ lsize = le32_to_cpu(attr->res.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ /* attr is resident: lsize < record_size (1K or 4K) */
+ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+ u16 run_off = le16_to_cpu(attr->nres.run_off);
+
+ lsize = le64_to_cpu(attr->nres.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
+
+ run_init(&ni->attr_list.run);
+
+--
+2.51.0
+
--- /dev/null
+From 6c34b841761c0ce99dbae5461cc1a44f4cf7fe2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 15:52:57 +0100
+Subject: gfs2: fiemap page fault fix
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ]
+
+In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode
+glock. This can lead to recursive glock taking if the fiemap buffer is
+memory mapped to the same inode and accessing it triggers a page fault.
+
+Fix by disabling page faults for iomap_fiemap() and faulting in the
+buffer by hand if necessary.
+
+Fixes xfstest generic/742.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/inode.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index 06629aeefbe6f..3048e3ca4b382 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -2073,6 +2073,14 @@ static int gfs2_getattr(struct user_namespace *mnt_userns,
+ return 0;
+ }
+
++static bool fault_in_fiemap(struct fiemap_extent_info *fi)
++{
++ struct fiemap_extent __user *dest = fi->fi_extents_start;
++ size_t size = sizeof(*dest) * fi->fi_extents_max;
++
++ return fault_in_safe_writeable((char __user *)dest, size) == 0;
++}
++
+ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ u64 start, u64 len)
+ {
+@@ -2082,14 +2090,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+
+ inode_lock_shared(inode);
+
++retry:
+ ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh);
+ if (ret)
+ goto out;
+
++ pagefault_disable();
+ ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops);
++ pagefault_enable();
+
+ gfs2_glock_dq_uninit(&gh);
+
++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) {
++ fieinfo->fi_extents_mapped = 0;
++ goto retry;
++ }
++
+ out:
+ inode_unlock_shared(inode);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 90124111993c5d7859e5b0d769710189a9ba7ee3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:26:26 +0800
+Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ]
+
+Use module_platform_driver() to replace module_platform_driver_probe().
+The former utilizes platform_driver_register(), which allows the driver to
+defer probing when it doesn't acquire the necessary resources due to probe
+order. In contrast, the latter uses __platform_driver_probe(), which
+includes the comment "Note that this is incompatible with deferred
+probing." Since our SGPIO driver requires access to the clock resource, the
+former is more suitable.
+
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed-sgpio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
+index 454cefbeecf0e..e523a539410a8 100644
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -508,7 +508,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = {
+
+ MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table);
+
+-static int __init aspeed_sgpio_probe(struct platform_device *pdev)
++static int aspeed_sgpio_probe(struct platform_device *pdev)
+ {
+ u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask;
+ const struct aspeed_sgpio_pdata *pdata;
+@@ -601,12 +601,13 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ }
+
+ static struct platform_driver aspeed_sgpio_driver = {
++ .probe = aspeed_sgpio_probe,
+ .driver = {
+ .name = KBUILD_MODNAME,
+ .of_match_table = aspeed_sgpio_of_table,
+ },
+ };
+
+-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe);
++module_platform_driver(aspeed_sgpio_driver);
+ MODULE_DESCRIPTION("Aspeed Serial GPIO Driver");
+ MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From 356584ca63ab1746e138496e40304e61d260003a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 04:57:17 +0000
+Subject: gro: change the BUG_ON() in gro_pull_from_frag0()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ]
+
+Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE()
+
+$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2
+add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116)
+Function old new delta
+gro_try_pull_from_frag0 - 196 +196
+napi_gro_frags 771 929 +158
+__pfx_gro_try_pull_from_frag0 - 16 +16
+__pfx_gro_pull_from_frag0 16 - -16
+dev_gro_receive 1514 1464 -50
+gro_pull_from_frag0 188 - -188
+Total: Before=22565899, After=22566015, chg +0.00%
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/gro.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/gro.c b/net/core/gro.c
+index c4cbf398c5f78..52b91cfb3bf19 100644
+--- a/net/core/gro.c
++++ b/net/core/gro.c
+@@ -444,7 +444,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow)
+ {
+ struct skb_shared_info *pinfo = skb_shinfo(skb);
+
+- BUG_ON(skb->end - skb->tail < grow);
++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow);
+
+ memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
+
+--
+2.51.0
+
--- /dev/null
+From 397afd95d085f42b105b2cfc59cf620d62bf34fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Dec 2025 19:58:22 -0800
+Subject: hfsplus: fix volume corruption issue for generic/498
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ]
+
+The xfstests' test-case generic/498 leaves HFS+ volume
+in corrupted state:
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
+(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details)
+
+Ran: generic/498
+Failures: generic/498
+Failed 1 of 1 tests
+
+sudo fsck.hfsplus -d /dev/loop51
+** /dev/loop51
+Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+Executing fsck_hfs (version 540.1-Linux).
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+Invalid leaf record count
+(It should be 16 instead of 2)
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
+CBTStat = 0x8000 CatStat = 0x00000000
+** Repairing volume.
+** Rechecking volume.
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled was repaired successfully.
+
+The generic/498 test executes such steps on final phase:
+
+mkdir $SCRATCH_MNT/A
+mkdir $SCRATCH_MNT/B
+mkdir $SCRATCH_MNT/A/C
+touch $SCRATCH_MNT/B/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo
+
+ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A
+
+"Simulate a power failure and mount the filesystem
+to check that what we explicitly fsync'ed exists."
+
+_flakey_drop_and_remount
+
+The FSCK tool complains about "Invalid leaf record count".
+HFS+ b-tree header contains leaf_count field is updated
+by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert()
+is involved into hard link creation process. However,
+modified in-core leaf_count field is stored into HFS+
+b-tree header by hfs_btree_write() method. But,
+unfortunately, hfs_btree_write() hasn't been called
+by hfsplus_cat_write_inode() and hfsplus_file_fsync()
+stores not fully consistent state of the Catalog File's
+b-tree.
+
+This patch adds calling hfs_btree_write() method in
+the hfsplus_cat_write_inode() with the goal of
+storing consistent state of Catalog File's b-tree.
+Finally, it makes FSCK tool happy.
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 33s ... 31s
+Ran: generic/498
+Passed all 1 tests
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/inode.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 98291bd73b65f..f065015f237c4 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -601,6 +601,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ int hfsplus_cat_write_inode(struct inode *inode)
+ {
+ struct inode *main_inode = inode;
++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree;
+ struct hfs_find_data fd;
+ hfsplus_cat_entry entry;
+ int res = 0;
+@@ -611,7 +612,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ if (!main_inode->i_nlink)
+ return 0;
+
+- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd))
++ if (hfs_find_init(tree, &fd))
+ /* panic? */
+ return -EIO;
+
+@@ -676,6 +677,15 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags);
+ out:
+ hfs_find_exit(&fd);
++
++ if (!res) {
++ res = hfs_btree_write(tree);
++ if (res) {
++ pr_err("b-tree write err: %d, ino %lu\n",
++ res, inode->i_ino);
++ }
++ }
++
+ return res;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a6b832bbc4f4e25dccef71509a1dc2bc0fa23dcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 18:39:33 +0900
+Subject: hfsplus: pretend special inodes as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index 7e889820a63d0..954ceaa748e62 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode)
+ return -EIO;
+ }
+
++ /*
++ * Assign a dummy file type, for may_open() requires that
++ * an inode has a valid file type.
++ */
++ inode->i_mode = S_IFREG;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From caed7c2435a164ba001565bb7a4d88c9be379654 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 06:06:23 +0000
+Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple
+ keyboards
+
+From: Joey Bednar <linux@joeybednar.com>
+
+[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ]
+
+The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium
+Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX
+KN85 Keyboard" to the list of non-apple keyboards fixes the function
+keys.
+
+Signed-off-by: Joey Bednar <linux@joeybednar.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 2de1a97eafc14..0dff3f557e632 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -319,6 +319,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+ };
+
+ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
++ { "SONiX KN85 Keyboard" },
+ { "SONiX USB DEVICE" },
+ { "SONiX AK870 PRO" },
+ { "Keychron" },
+--
+2.51.0
+
--- /dev/null
+From 11103e5e93101cba43425a2fce38a541453a33ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 12:56:09 +0900
+Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
+
+From: David Phillips <david@profile.sh>
+
+[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ]
+
+New model in the ELECOM HUGE trackball line that has 8 buttons but the
+report descriptor specifies only 5. The HUGE Plus supports connecting via
+Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable.
+Each connection type reports a different device id, 01AA for cable,
+01AB for USB dongle, and 01AC for Bluetooth.
+
+This patch adds these device IDs and applies the fixups similar to the
+other ELECOM devices to get all 8 buttons working for all 3 connection
+types.
+
+For reference, the usbhid-dump output:
+001:013:001:DESCRIPTOR 1769085639.598405
+ 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01
+ 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01
+ 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10
+ 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06
+ 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0
+ C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01
+ 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01
+ 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03
+ 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00
+ A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81
+ 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26
+ FF 00 75 08 95 07 B1 02 C0
+
+Signed-off-by: David Phillips <david@profile.sh>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-elecom.c | 16 ++++++++++++++++
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 3 +++
+ 4 files changed, 23 insertions(+)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 9ad5e43d9961b..2693675824880 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -321,6 +321,7 @@ config HID_ELECOM
+ - EX-G Trackballs (M-XT3DRBK, M-XT3URBK)
+ - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ - HUGE Plus Trackball (M-HT1MRBK)
+
+ config HID_ELO
+ tristate "ELO USB 4000/4500 touchscreen"
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index f76fec79e8903..9aeb2d2b43a43 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -5,6 +5,7 @@
+ * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK)
+ * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ * - HUGE Plus Trackball (M-HT1MRBK)
+ *
+ * Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
+ * Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
+@@ -111,12 +112,25 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
+ break;
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC:
++ /*
++ * Report descriptor format:
++ * 24: button bit count
++ * 28: padding bit count
++ * 22: button report size
++ * 16: button usage maximum
++ */
++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8);
++ break;
+ }
+ return rdesc;
+ }
+
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+@@ -127,6 +141,8 @@ static const struct hid_device_id elecom_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, elecom_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 8b4e146fdd6ce..fd3198d4b7c5b 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -453,6 +453,9 @@
+ #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac
+
+ #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34
+ #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 457a52cfa17c6..030ad260e7566 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -403,6 +403,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+@@ -412,6 +413,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_ELO)
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
+--
+2.51.0
+
--- /dev/null
+From fb01ae5b9c69d5f363885a8dc40895183e718395 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 09:57:05 +0100
+Subject: HID: multitouch: add eGalaxTouch EXC3188 support
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ]
+
+Add support for the for the EXC3188 touchscreen from eGalaxy.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index bac298a4930a4..8b4e146fdd6ce 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -416,6 +416,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
+
+ #define USB_VENDOR_ID_EDIFIER 0x2d99
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 6d9a85c5fc409..b6c2cb7153fde 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2020,6 +2020,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
++ { .driver_data = MT_CLS_EGALAX_SERIAL,
++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) },
+ { .driver_data = MT_CLS_EGALAX,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
+--
+2.51.0
+
--- /dev/null
+From 762c5494271c6e3accd617e2a6c4201b2b59b388 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 10:02:03 +0800
+Subject: hisi_acc_vfio_pci: update status after RAS error
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ]
+
+After a RAS error occurs on the accelerator device, the accelerator
+device will be reset. The live migration state will be abnormal
+after reset, and the original state needs to be restored during
+the reset process.
+Therefore, reset processing needs to be performed in a live
+migration scenario.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+index de3e1a148ddab..e682c14614998 100644
+--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+@@ -1019,8 +1019,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev)
+ {
+ struct hisi_acc_vf_core_device *hisi_acc_vdev = hisi_acc_drvdata(pdev);
+
+- if (hisi_acc_vdev->core_device.vdev.migration_flags !=
+- VFIO_MIGRATION_STOP_COPY)
++ if (!hisi_acc_vdev->core_device.vdev.mig_ops)
+ return;
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From a7c4d72988b3b365d4469082c8b52ee7edaa1831 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 13:10:40 +0800
+Subject: hwmon: (f71882fg) Add F81968 support
+
+From: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+
+[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ]
+
+Add hardware monitoring support for the Fintek F81968 Super I/O chip.
+It is fully compatible with F81866.
+
+Several products share compatibility with the F81866. To better distinguish
+between them, ensure that the Product ID is displayed when the device is
+probed.
+
+Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/f71882fg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
+index 27207ec6f7feb..5e3c8be255e87 100644
+--- a/drivers/hwmon/f71882fg.c
++++ b/drivers/hwmon/f71882fg.c
+@@ -51,6 +51,7 @@
+ #define SIO_F81866_ID 0x1010 /* Chipset ID */
+ #define SIO_F71858AD_ID 0x0903 /* Chipset ID */
+ #define SIO_F81966_ID 0x1502 /* Chipset ID */
++#define SIO_F81968_ID 0x1806 /* Chipset ID */
+
+ #define REGION_LENGTH 8
+ #define ADDR_REG_OFFSET 5
+@@ -2571,6 +2572,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ break;
+ case SIO_F81866_ID:
+ case SIO_F81966_ID:
++ case SIO_F81968_ID:
+ sio_data->type = f81866a;
+ break;
+ default:
+@@ -2600,9 +2602,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */
+
+ err = address;
+- pr_info("Found %s chip at %#x, revision %d\n",
++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n",
+ f71882fg_names[sio_data->type], (unsigned int)address,
+- (int)superio_inb(sioaddr, SIO_REG_DEVREV));
++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid);
+ exit:
+ superio_exit(sioaddr);
+ return err;
+--
+2.51.0
+
--- /dev/null
+From eff757f66496da87235817785e4d6f16cceadfe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:44 +0100
+Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ]
+
+The unpacked union within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value'
+ is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)'
+ and is usually due to 'struct hv_kvp_exchg_msg_value' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 361 | union {
+ | ^
+
+With the recent changes to compile-test the UAPI headers in more cases,
+this warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warning.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/hyperv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h
+index aaa502a7bff46..1749b35ab2c21 100644
+--- a/include/uapi/linux/hyperv.h
++++ b/include/uapi/linux/hyperv.h
+@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value {
+ __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE];
+ __u32 value_u32;
+ __u64 value_u64;
+- };
++ } __attribute__((packed));
+ } __attribute__((packed));
+
+ struct hv_kvp_msg_enumerate {
+--
+2.51.0
+
--- /dev/null
+From 70926b7e15c10b831c7b51a8793685856fac8aee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:08:51 -0500
+Subject: i3c: master: svc: Initialize 'dev' to NULL in
+ svc_i3c_master_ibi_isr()
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ]
+
+Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add
+a NULL check in the error path.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 21ea4166057d8..e533847f058b2 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -410,8 +410,8 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ {
+ struct svc_i3c_master *master = container_of(work, struct svc_i3c_master, ibi_work);
+ struct svc_i3c_i2c_dev_data *data;
++ struct i3c_dev_desc *dev = NULL;
+ unsigned int ibitype, ibiaddr;
+- struct i3c_dev_desc *dev;
+ u32 status, val;
+ int ret;
+
+@@ -495,7 +495,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ * for the slave to interrupt again.
+ */
+ if (svc_i3c_master_error(master)) {
+- if (master->ibi.tbq_slot) {
++ if (master->ibi.tbq_slot && dev) {
+ data = i3c_dev_get_master_data(dev);
+ i3c_generic_ibi_recycle_slot(data->ibi_pool,
+ master->ibi.tbq_slot);
+--
+2.51.0
+
--- /dev/null
+From 1d8380e002f9a56b515106197136a547b1752877 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:38 +0100
+Subject: iio: magnetometer: Remove IRQF_ONESHOT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+The force-threading functionality is required on PREEMPT_RT because the
+handler is using locks with can sleep on PREEMPT_RT.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index 13929b77f8c84..88396232c70b6 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -542,7 +542,7 @@ static int ak8975_setup_irq(struct ak8975_data *data)
+ irq = gpiod_to_irq(data->eoc_gpiod);
+
+ rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ dev_name(&client->dev), data);
+ if (rc < 0) {
+ dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc);
+--
+2.51.0
+
--- /dev/null
+From 6c18a5ba26abf24a155733f61a39fce21dc7074a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:36 +0100
+Subject: iio: Use IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ]
+
+The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke
+other interrupt handler and this supposed to happen from within the
+hardirq.
+
+Use IRQF_NO_THREAD to forbid forced-threading.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/bma180.c | 5 +++--
+ drivers/iio/adc/ad7766.c | 2 +-
+ drivers/iio/gyro/itg3200_buffer.c | 8 +++-----
+ drivers/iio/light/si1145.c | 2 +-
+ 4 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
+index d03fc3400f94e..1667f38aa7bb8 100644
+--- a/drivers/iio/accel/bma180.c
++++ b/drivers/iio/accel/bma180.c
+@@ -997,8 +997,9 @@ static int bma180_probe(struct i2c_client *client,
+ }
+
+ ret = devm_request_irq(dev, client->irq,
+- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING,
+- "bma180_event", data->trig);
++ iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "bma180_event", data->trig);
+ if (ret) {
+ dev_err(dev, "unable to request IRQ\n");
+ goto err_trigger_free;
+diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c
+index 3079a0872947e..d1d010c1dbf6c 100644
+--- a/drivers/iio/adc/ad7766.c
++++ b/drivers/iio/adc/ad7766.c
+@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi)
+ * don't enable the interrupt to avoid extra load on the system
+ */
+ ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq,
+- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD,
+ dev_name(&spi->dev),
+ ad7766->trig);
+ if (ret < 0)
+diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
+index 4cfa0d4395605..d1c125a77308a 100644
+--- a/drivers/iio/gyro/itg3200_buffer.c
++++ b/drivers/iio/gyro/itg3200_buffer.c
+@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev)
+ if (!st->trig)
+ return -ENOMEM;
+
+- ret = request_irq(st->i2c->irq,
+- &iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_RISING,
+- "itg3200_data_rdy",
+- st->trig);
++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "itg3200_data_rdy", st->trig);
+ if (ret)
+ goto error_free_trig;
+
+diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c
+index e8f6cdf26f22a..50b424b4f23b9 100644
+--- a/drivers/iio/light/si1145.c
++++ b/drivers/iio/light/si1145.c
+@@ -1251,7 +1251,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev)
+
+ ret = devm_request_irq(&client->dev, client->irq,
+ iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_FALLING,
++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD,
+ "si1145_irq",
+ trig);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From 8c6cab2d9258e3b02ad11ebadce7276eaa32d14a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 15:54:06 +0100
+Subject: include: uapi: netfilter_bridge.h: Cover for musl libc
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ]
+
+Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
+zero. To avoid struct redefinition errors, user space is therefore
+supposed to include netinet/if_ether.h before (or instead of)
+linux/if_ether.h. To relieve them from this burden, include the libc
+header here if not building for kernel space.
+
+Reported-by: Alyssa Ross <hi@alyssa.is>
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter_bridge.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 1610fdbab98df..ad520d3e9df8f 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -5,6 +5,10 @@
+ /* bridge-specific defines for netfilter.
+ */
+
++#ifndef __KERNEL__
++#include <netinet/if_ether.h> /* for __UAPI_DEF_ETHHDR if defined */
++#endif
++
+ #include <linux/in.h>
+ #include <linux/netfilter.h>
+ #include <linux/if_ether.h>
+--
+2.51.0
+
--- /dev/null
+From a2a799267ec62cb048d83e1c5473f670b55995ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 13:28:57 -0800
+Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
+
+From: Alexander Grest <Alexander.Grest@microsoft.com>
+
+[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ]
+
+The SMMU CMDQ lock is highly contentious when there are multiple CPUs
+issuing commands and the queue is nearly full.
+
+The lock has the following states:
+ - 0: Unlocked
+ - >0: Shared lock held with count
+ - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters
+ - INT_MIN: Exclusive lock held, no shared waiters
+
+When multiple CPUs are polling for space in the queue, they attempt to
+grab the exclusive lock to update the cons pointer from the hardware. If
+they fail to get the lock, they will spin until either the cons pointer
+is updated by another CPU.
+
+The current code allows the possibility of shared lock starvation
+if there is a constant stream of CPUs trying to grab the exclusive lock.
+This leads to severe latency issues and soft lockups.
+
+Consider the following scenario where CPU1's attempt to acquire the
+shared lock is starved by CPU2 and CPU0 contending for the exclusive
+lock.
+
+CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock`
+--------------------------------------------------------------------------
+trylock() //takes | | | 0
+ | shared_lock() | | INT_MIN
+ | fetch_inc() | | INT_MIN
+ | no return | | INT_MIN + 1
+ | spins // VAL >= 0 | | INT_MIN + 1
+unlock() | spins... | | INT_MIN + 1
+set_release(0) | spins... | | 0 see[NOTE]
+(done) | (sees 0) | trylock() // takes | 0
+ | *exits loop* | cmpxchg(0, INT_MIN) | 0
+ | | *cuts in* | INT_MIN
+ | cmpxchg(0, 1) | | INT_MIN
+ | fails // != 0 | | INT_MIN
+ | spins // VAL >= 0 | | INT_MIN
+ | *starved* | | INT_MIN
+
+[NOTE] The current code resets the exclusive lock to 0 regardless of the
+state of the lock. This causes two problems:
+1. It opens the possibility of back-to-back exclusive locks and the
+ downstream effect of starving shared lock.
+2. The count of shared lock waiters are lost.
+
+To mitigate this, we release the exclusive lock by only clearing the sign
+bit while retaining the shared lock waiter count as a way to avoid
+starving the shared lock waiters.
+
+Also deleted cmpxchg loop while trying to acquire the shared lock as it
+is not needed. The waiters can see the positive lock count and proceed
+immediately after the exclusive lock is released.
+
+Exclusive lock is not starved in that submitters will try exclusive lock
+first when new spaces become available.
+
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Alexander Grest <Alexander.Grest@microsoft.com>
+Signed-off-by: Jacob Pan <jacob.pan@linux.microsoft.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++-------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+index 6a60bad48b277..eba2b2e2da0b9 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+@@ -443,20 +443,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
+ */
+ static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq)
+ {
+- int val;
+-
+ /*
+- * We can try to avoid the cmpxchg() loop by simply incrementing the
+- * lock counter. When held in exclusive state, the lock counter is set
+- * to INT_MIN so these increments won't hurt as the value will remain
+- * negative.
++ * When held in exclusive state, the lock counter is set to INT_MIN
++ * so these increments won't hurt as the value will remain negative.
++ * The increment will also signal the exclusive locker that there are
++ * shared waiters.
+ */
+ if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0)
+ return;
+
+- do {
+- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0);
+- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val);
++ /*
++ * Someone else is holding the lock in exclusive state, so wait
++ * for them to finish. Since we already incremented the lock counter,
++ * no exclusive lock can be acquired until we finish. We don't need
++ * the return value since we only care that the exclusive lock is
++ * released (i.e. the lock counter is non-negative).
++ * Once the exclusive locker releases the lock, the sign bit will
++ * be cleared and our increment will make the lock counter positive,
++ * allowing us to proceed.
++ */
++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0);
+ }
+
+ static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq)
+@@ -483,9 +489,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq)
+ __ret; \
+ })
+
++/*
++ * Only clear the sign bit when releasing the exclusive lock this will
++ * allow any shared_lock() waiters to proceed without the possibility
++ * of entering the exclusive lock in a tight loop.
++ */
+ #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \
+ ({ \
+- atomic_set_release(&cmdq->lock, 0); \
++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \
+ local_irq_restore(flags); \
+ })
+
+--
+2.51.0
+
--- /dev/null
+From 6eeea76a41bf1650b2d090df85bcfcd6bf246bd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 04:35:24 +0000
+Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ]
+
+syzbot reported that struct fib_alias.fa_state can be
+modified locklessly by RCU readers. [0]
+
+Let's use READ_ONCE()/WRITE_ONCE() properly.
+
+[0]:
+BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup
+
+write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0:
+ fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline]
+ fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1:
+ fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline]
+ fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+value changed: 0x00 -> 0x01
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
+
+Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/fib_lookup.h | 6 ++++--
+ net/ipv4/fib_trie.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
+index f9b9e26c32c19..0b72796dd1ad3 100644
+--- a/net/ipv4/fib_lookup.h
++++ b/net/ipv4/fib_lookup.h
+@@ -28,8 +28,10 @@ struct fib_alias {
+ /* Don't write on fa_state unless needed, to keep it shared on all cpus */
+ static inline void fib_alias_accessed(struct fib_alias *fa)
+ {
+- if (!(fa->fa_state & FA_S_ACCESSED))
+- fa->fa_state |= FA_S_ACCESSED;
++ u8 fa_state = READ_ONCE(fa->fa_state);
++
++ if (!(fa_state & FA_S_ACCESSED))
++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED);
+ }
+
+ /* Exported by fib_semantics.c */
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 4d148d0892327..c9e1526e749b2 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1285,7 +1285,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
+ new_fa->fa_dscp = fa->fa_dscp;
+ new_fa->fa_info = fi;
+ new_fa->fa_type = cfg->fc_type;
+- state = fa->fa_state;
++ state = READ_ONCE(fa->fa_state);
+ new_fa->fa_state = state & ~FA_S_ACCESSED;
+ new_fa->fa_slen = fa->fa_slen;
+ new_fa->tb_id = tb->tb_id;
+@@ -1751,7 +1751,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb,
+
+ fib_remove_alias(t, tp, l, fa_to_delete);
+
+- if (fa_to_delete->fa_state & FA_S_ACCESSED)
++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED)
+ rt_cache_flush(cfg->fc_nlinfo.nl_net);
+
+ fib_release_info(fa_to_delete->fa_info);
+--
+2.51.0
+
--- /dev/null
+From a7d69196f43dfdc6fa653d04ce6a04a0dd5e3f69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:37 +0000
+Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ]
+
+Add missing READ_ONCE() when reading sysctl values.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ipv6.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 3bf743d601e1c..f4307b35294cf 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -982,11 +982,11 @@ static inline int ip6_default_np_autolabel(struct net *net)
+ #if IS_ENABLED(CONFIG_IPV6)
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_policy;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy);
+ }
+ static inline u32 ip6_multipath_hash_fields(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_fields;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields);
+ }
+ #else
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+--
+2.51.0
+
--- /dev/null
+From 77af213b2e97fdec1c46b794ee0290ad76f9df63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:40 +0000
+Subject: ipv6: exthdrs: annotate data-race over multiple sysctl
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ]
+
+Following four sysctls can change under us, add missing READ_ONCE().
+
+- ipv6.sysctl.max_dst_opts_len
+- ipv6.sysctl.max_dst_opts_cnt
+- ipv6.sysctl.max_hbh_opts_len
+- ipv6.sysctl.max_hbh_opts_cnt
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/exthdrs.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index 1cfdd9d950123..a64281cc3a0cc 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -316,7 +316,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_dst_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len))
+ goto fail_and_free;
+
+ opt->lastopt = opt->dst1 = skb_network_header_len(skb);
+@@ -324,7 +324,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ dstbuf = opt->dst1;
+ #endif
+
+- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) {
++ if (ip6_parse_tlv(false, skb,
++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ #if IS_ENABLED(CONFIG_IPV6_MIP6)
+@@ -1084,11 +1085,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len))
+ goto fail_and_free;
+
+ opt->flags |= IP6SKB_HOPBYHOP;
+- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) {
++ if (ip6_parse_tlv(true, skb,
++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ opt->nhoff = sizeof(struct ipv6hdr);
+--
+2.51.0
+
--- /dev/null
+From fab177650e1ec7a11a739b5c343cf6aa7ca70c8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 19:38:01 +0800
+Subject: jfs: Add missing set_freezable() for freezable kthread
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ]
+
+The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(),
+causing it to remain non-freezable by default. This prevents proper
+freezing during system suspend.
+
+Add set_freezable() to make the thread freezable as intended.
+
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_logmgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
+index 695415cbfe985..409fa6d92fce1 100644
+--- a/fs/jfs/jfs_logmgr.c
++++ b/fs/jfs/jfs_logmgr.c
+@@ -2307,6 +2307,7 @@ int jfsIOWait(void *arg)
+ {
+ struct lbuf *bp;
+
++ set_freezable();
+ do {
+ spin_lock_irq(&log_redrive_lock);
+ while ((bp = log_redrive_list)) {
+--
+2.51.0
+
--- /dev/null
+From 8c161eb540d499cc276b767610febc9898070b15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 13:22:12 +0100
+Subject: jfs: nlink overflow in jfs_rename
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ]
+
+If nlink is maximal for a directory (-1) and inside that directory you
+perform a rename for some child directory (not moving from the parent),
+then the nlink of the first directory is first incremented and later
+decremented. Normally this is fine, but when nlink = -1 this causes a
+wrap around to 0, and then drop_nlink issues a warning.
+
+After applying the patch syzbot no longer issues any warnings. I also
+ran some basic fs tests to look for any regressions.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
+Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/namei.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
+index b3a0fe0649c49..df6bde0206bb4 100644
+--- a/fs/jfs/namei.c
++++ b/fs/jfs/namei.c
+@@ -1227,7 +1227,7 @@ static int jfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
+ jfs_err("jfs_rename: dtInsert returned -EIO");
+ goto out_tx;
+ }
+- if (S_ISDIR(old_ip->i_mode))
++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
+ inc_nlink(new_dir);
+ }
+ /*
+@@ -1243,7 +1243,9 @@ static int jfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
+ goto out_tx;
+ }
+ if (S_ISDIR(old_ip->i_mode)) {
+- drop_nlink(old_dir);
++ if (new_ip || old_dir != new_dir)
++ drop_nlink(old_dir);
++
+ if (old_dir != new_dir) {
+ /*
+ * Change inode number of parent for moved directory
+--
+2.51.0
+
--- /dev/null
+From 3ad5eb83c45173e21dcd43560e3e9d6968f8f8f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 16:30:50 +0200
+Subject: libceph: define and enforce CEPH_MAX_KEY_LEN
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ]
+
+When decoding the key, verify that the key material would fit into
+a fixed-size buffer in process_auth_done() and generally has a sane
+length.
+
+The new CEPH_MAX_KEY_LEN check replaces the existing check for a key
+with no key material which is a) not universal since CEPH_CRYPTO_NONE
+has to be excluded and b) doesn't provide much value since a smaller
+than needed key is just as invalid as no key -- this has to be handled
+elsewhere anyway.
+
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/crypto.c | 8 +++++---
+ net/ceph/crypto.h | 2 +-
+ net/ceph/messenger_v2.c | 2 +-
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
+index 051d22c0e4ad4..3397d105f74f9 100644
+--- a/net/ceph/crypto.c
++++ b/net/ceph/crypto.c
+@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf)
+ return -ENOTSUPP;
+ }
+
+- if (!key->len)
+- return -EINVAL;
+-
+ key->key = kmemdup(buf, key->len, GFP_NOIO);
+ if (!key->key) {
+ ret = -ENOMEM;
+@@ -95,6 +92,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
+ ceph_decode_copy(p, &key->created, sizeof(key->created));
+ key->len = ceph_decode_16(p);
+ ceph_decode_need(p, end, key->len, bad);
++ if (key->len > CEPH_MAX_KEY_LEN) {
++ pr_err("secret too big %d\n", key->len);
++ return -EINVAL;
++ }
++
+ ret = set_secret(key, *p);
+ memzero_explicit(*p, key->len);
+ *p += key->len;
+diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h
+index 13bd526349fa1..0d32f1649f3d0 100644
+--- a/net/ceph/crypto.h
++++ b/net/ceph/crypto.h
+@@ -5,7 +5,7 @@
+ #include <linux/ceph/types.h>
+ #include <linux/ceph/buffer.h>
+
+-#define CEPH_KEY_LEN 16
++#define CEPH_MAX_KEY_LEN 16
+ #define CEPH_MAX_CON_SECRET_LEN 64
+
+ /*
+diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
+index 787cde055ab17..4fbd820a53502 100644
+--- a/net/ceph/messenger_v2.c
++++ b/net/ceph/messenger_v2.c
+@@ -2171,7 +2171,7 @@ static int process_auth_reply_more(struct ceph_connection *con,
+ */
+ static int process_auth_done(struct ceph_connection *con, void *p, void *end)
+ {
+- u8 session_key_buf[CEPH_KEY_LEN + 16];
++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16];
+ u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16];
+ u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16);
+ u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16);
+--
+2.51.0
+
--- /dev/null
+From 27e71b7c269ba0e9df6a5c6936fd1f79ad361ad0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:09:18 -0800
+Subject: libperf build: Always place libperf includes first
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ]
+
+When building tools/perf the CFLAGS can contain a directory for the
+installed headers.
+
+As the headers may be being installed while building libperf.a this can
+cause headers to be partially installed and found in the include path
+while building an object file for libperf.a.
+
+The installed header may reference other installed headers that are
+missing given the partial nature of the install and then the build fails
+with a missing header file.
+
+Avoid this by ensuring the libperf source headers are always first in
+the CFLAGS.
+
+Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index b7a17e0bc8758..b6456cd8d569f 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -63,9 +63,9 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
++override CFLAGS := $(INCLUDES) $(CFLAGS)
+ override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+-override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += $(EXTRA_CFLAGS)
+--
+2.51.0
+
--- /dev/null
+From ec7286355a3a813efb57504dd2f6e41e3f62fed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 11:40:09 +0000
+Subject: libperf: Don't remove -g when EXTRA_CFLAGS are used
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit f5b07010c13c77541e8ade167d05bef3b8a63739 ]
+
+When using EXTRA_CFLAGS, for example "EXTRA_CFLAGS=-DREFCNT_CHECKING=1",
+this construct stops setting -g which you'd expect would not be affected
+by adding extra flags. Additionally, EXTRA_CFLAGS should be the last
+thing to be appended so that it can be used to undo any defaults. And no
+condition is required, just += appends to any existing CFLAGS and also
+appends or doesn't append EXTRA_CFLAGS if they are or aren't set.
+
+It's not clear why DEBUG=1 is required for -g in Perf when in libperf
+it's always on, but I don't think we need to change that behavior now
+because someone may be depending on it.
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250319114009.417865-1-james.clark@linaro.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 8c5b40678c63 ("libperf build: Always place libperf includes first")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index 21df023a2103e..b7a17e0bc8758 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -54,13 +54,6 @@ endif
+
+ TEST_ARGS := $(if $(V),-v)
+
+-# Set compile option CFLAGS
+-ifdef EXTRA_CFLAGS
+- CFLAGS := $(EXTRA_CFLAGS)
+-else
+- CFLAGS := -g -Wall
+-endif
+-
+ INCLUDES = \
+ -I$(srctree)/tools/lib/perf/include \
+ -I$(srctree)/tools/lib/ \
+@@ -70,11 +63,12 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
+-override CFLAGS += $(EXTRA_WARNINGS)
+-override CFLAGS += -Werror -Wall
++override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+ override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
++override CFLAGS += $(EXTRA_WARNINGS)
++override CFLAGS += $(EXTRA_CFLAGS)
+
+ all:
+
+--
+2.51.0
+
--- /dev/null
+From 407c2731acdc31bb2230f9513be5de0676ccab9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Dec 2025 21:04:01 +0900
+Subject: m68k: nommu: fix memmove() with differently aligned src and dest for
+ 68000
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ]
+
+68000 has different alignment needs to 68020+.
+memcpy() checks if the destination is aligned and does a smaller copy
+to fix the alignment and then critically for 68000 it checks if the
+source is still unaligned and if it is reverts to smaller copies.
+
+memmove() does not currently do the second part and malfunctions if
+one of the pointers is aligned and the other isn't.
+
+This is apparently getting triggered by printk. If I put breakpoints
+into the new checks added by this commit the first hit looks like this:
+
+memmove (n=205, src=0x2f3971 <printk_shared_pbufs+205>, dest=0x2f3980 <printk_shared_pbufs+220>) at arch/m68k/lib/memmove.c:82
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Signed-off-by: Greg Ungerer <gerg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/lib/memmove.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c
+index 6519f7f349f66..e33f00b02e4c0 100644
+--- a/arch/m68k/lib/memmove.c
++++ b/arch/m68k/lib/memmove.c
+@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *cdest++ = *csrc++;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *--cdest = *--csrc;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+--
+2.51.0
+
--- /dev/null
+From 8d0e06a8318e8bc51a3717c08ed59234e10f94c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:24 +0100
+Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ]
+
+request_threaded_irq() is invoked with a primary and a secondary handler
+and no flags are passed. The primary handler is the same as
+irq_default_primary_handler() so there is no need to have an identical
+copy.
+
+The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt
+source is not masked while the threaded handler is active. This means,
+especially on LEVEL typed interrupt lines, the interrupt can fire again
+before the threaded handler had a chance to run.
+
+Use the default primary interrupt handler by specifying NULL and set
+IRQF_ONESHOT so the interrupt source is masked until the secondary handler
+is done.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index bf6e86b0ed09c..d58c0ece437d0 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset)
+
+ /* ====== FlexRM interrupt handler ===== */
+
+-static irqreturn_t flexrm_irq_event(int irq, void *dev_id)
+-{
+- /* We only have MSI for completions so just wakeup IRQ thread */
+- /* Ring related errors will be informed via completion descriptors */
+-
+- return IRQ_WAKE_THREAD;
+-}
+-
+ static irqreturn_t flexrm_irq_thread(int irq, void *dev_id)
+ {
+ flexrm_process_completions(dev_id);
+@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan)
+ ret = -ENODEV;
+ goto fail_free_cmpl_memory;
+ }
+- ret = request_threaded_irq(ring->irq,
+- flexrm_irq_event,
+- flexrm_irq_thread,
+- 0, dev_name(ring->mbox->dev), ring);
++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread,
++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring);
+ if (ret) {
+ dev_err(ring->mbox->dev,
+ "failed to request ring%d IRQ\n", ring->num);
+--
+2.51.0
+
--- /dev/null
+From 5ade5b7f8c084298149ce5e0b673835172445a8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 16:00:54 +0800
+Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP
+
+From: Jacky Bai <ping.bai@nxp.com>
+
+[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ]
+
+In current imx-mailbox driver, the MU IRQ is configured with
+'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow,
+the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx:
+fix wakeup failure from freeze mode"), if the MU IRQ is triggered after
+the priv->suspended flag has been set, the system suspend will be
+aborted.
+
+On i.MX7ULP platform, certain drivers that depend on rpmsg may need
+to send rpmsg request and receive an acknowledgment from the remote
+core during the late_suspend stage. Early suspend abort is not
+expected, and the i.MX7ULP already has additional hardware and
+software to make sure the system can be wakeup from freeze mode
+correctly when MU IRQ is trigger.
+
+Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the
+early abort when doing suspend.
+
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/imx-mailbox.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
+index 20f2ec880ad69..3292fb2dc3bf2 100644
+--- a/drivers/mailbox/imx-mailbox.c
++++ b/drivers/mailbox/imx-mailbox.c
+@@ -112,6 +112,7 @@ struct imx_mu_dcfg {
+ u32 xRR; /* Receive Register0 */
+ u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */
+ u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */
++ bool skip_suspend_flag;
+ };
+
+ #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x))))
+@@ -905,6 +906,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = {
+ .xRR = 0x40,
+ .xSR = {0x60, 0x60, 0x60, 0x60},
+ .xCR = {0x64, 0x64, 0x64, 0x64, 0x64},
++ .skip_suspend_flag = true,
+ };
+
+ static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = {
+@@ -985,7 +987,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev)
+ priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = true;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = true;
+
+ return 0;
+ }
+@@ -1008,7 +1011,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev)
+ imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = false;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = false;
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 127aaa522a082cdbb7878e3659ba86bffc81bc89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 14:07:40 +0000
+Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ]
+
+The PCC code currently specifies IRQF_ONESHOT if the interrupt could
+potentially be shared but doesn't actually use request_threaded_irq() and
+the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is
+never relevant. Since commit aef30c8d569c ("genirq: Warn about using
+IRQF_ONESHOT without a threaded handler") specifying it has resulted in a
+WARN_ON(), fix this by removing IRQF_ONESHOT.
+
+Reported-by: Aishwarya TCV <Aishwarya.TCV@arm.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/pcc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
+index 0729988467554..be295313119cb 100644
+--- a/drivers/mailbox/pcc.c
++++ b/drivers/mailbox/pcc.c
+@@ -470,7 +470,7 @@ static int pcc_startup(struct mbox_chan *chan)
+
+ if (pchan->plat_irq > 0) {
+ irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ?
+- IRQF_SHARED | IRQF_ONESHOT : 0;
++ IRQF_SHARED : 0;
+ rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq,
+ irqflags, MBOX_IRQ_NAME, chan);
+ if (unlikely(rc)) {
+--
+2.51.0
+
--- /dev/null
+From b15669257e510db7929b466998d5a7f4662f8425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:36 +0100
+Subject: mailbox: sprd: clear delivery flag before handling TX done
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ]
+
+If there are any pending messages in the mailbox queue, they are sent
+as soon as a TX done event arrives from the driver. This may trigger a
+new delivery interrupt while the previous one is still being handled.
+If the delivery status is cleared after this, the interrupt is lost.
+To prevent this from happening, clear the delivery status immediately
+after checking it and before any new messages are sent.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index 0dc609592c46a..2a43fb375bcb9 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -167,6 +167,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ return IRQ_NONE;
+ }
+
++ /* Clear FIFO delivery and overflow status first */
++ writel(fifo_sts &
++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
++ priv->inbox_base + SPRD_MBOX_FIFO_RST);
++
+ while (send_sts) {
+ id = __ffs(send_sts);
+ send_sts &= (send_sts - 1);
+@@ -182,11 +187,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ mbox_chan_txdone(chan, 0);
+ }
+
+- /* Clear FIFO delivery and overflow status */
+- writel(fifo_sts &
+- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
+- priv->inbox_base + SPRD_MBOX_FIFO_RST);
+-
+ /* Clear irq status */
+ writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS);
+
+--
+2.51.0
+
--- /dev/null
+From a34f5fb4da3b695605f5bad895aec521d2c22429 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:38 +0100
+Subject: mailbox: sprd: mask interrupts that are not handled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ]
+
+To reduce the amount of spurious interrupts, disable the interrupts that
+are not handled in this driver.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index e3c899abeed8b..0dc609592c46a 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -244,21 +244,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan)
+ /* Select outbox FIFO mode and reset the outbox FIFO status */
+ writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST);
+
+- /* Enable inbox FIFO overflow and delivery interrupt */
+- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ);
++ /* Enable inbox FIFO delivery interrupt */
++ val = SPRD_INBOX_FIFO_IRQ_MASK;
++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ;
+ writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable outbox FIFO not empty interrupt */
+- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ val = SPRD_OUTBOX_FIFO_IRQ_MASK;
+ val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable supplementary outbox as the fundamental one */
+ if (priv->supp_base) {
+ writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST);
+- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From c885a85ac6fe95abc757172f4a81e1152b75faa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 15:29:57 +0100
+Subject: media: adv7180: fix frame interval in progressive mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ]
+
+The ADV7280-M may internally convert interlaced video input to
+progressive video. If this mode is enabled, the ADV7280-M delivers
+progressive video frames at the field rate of 50 fields per second (PAL)
+or 60 fields per second (NTSC).
+
+Fix the reported frame interval if progressive video is enabled.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 5d10edcfcc3b5..b34e1a7bd2c45 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -471,6 +471,13 @@ static int adv7180_g_frame_interval(struct v4l2_subdev *sd,
+ fi->interval.denominator = 25;
+ }
+
++ /*
++ * If the de-interlacer is active, the chip produces full video frames
++ * at the field rate.
++ */
++ if (state->field == V4L2_FIELD_NONE)
++ fi->interval.denominator *= 2;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 116ecc72f5e93318bc4ac94ae8718b8b0cef87db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 11:02:22 +0800
+Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
+
+From: Ming Qian <ming.qian@oss.nxp.com>
+
+[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ]
+
+The V4L2_DEC_CMD_START command may be used to handle the dynamic source
+change, which will triggers an implicit decoder drain.
+The last_buffer_dequeued flag is set in the implicit decoder drain,
+so driver need to clear it to continue the following decoding flow.
+
+Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vdec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
+index 2bfab4467b81c..ac71eae9ef10a 100644
+--- a/drivers/media/platform/amphion/vdec.c
++++ b/drivers/media/platform/amphion/vdec.c
+@@ -578,6 +578,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd
+ switch (cmd->cmd) {
+ case V4L2_DEC_CMD_START:
+ vdec_cmd_start(inst);
++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx));
+ break;
+ case V4L2_DEC_CMD_STOP:
+ vdec_cmd_stop(inst);
+--
+2.51.0
+
--- /dev/null
+From 31d9ccf34a734e24512b19d749c3502fdf97edab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 15:46:47 +0800
+Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ]
+
+Add release_mem_region() if ioremap() fails to release the memory
+region obtained by cx25821_get_resources().
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index 6627fa9166d30..a7336be444748 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
+
+ if (!dev->lmmio) {
+ CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n");
++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0));
+ cx25821_iounmap(dev);
+ return -ENOMEM;
+ }
+--
+2.51.0
+
--- /dev/null
+From 4df61dd4aa94b95c6ac108bb13683c3c65fecf3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 08:57:35 +0200
+Subject: media: dvb-core: dmxdevfilter must always flush bufs
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ]
+
+Currently the buffers are being filled until full, which works fine
+for the transport stream, but not when reading sections, those have
+to be returned to userspace immediately, otherwise dvbv5-scan will
+just wait forever.
+
+Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether
+the buffer must be flushed or wait until it is full.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dmxdev.c | 8 ++++----
+ drivers/media/dvb-core/dvb_vb2.c | 5 +++--
+ include/media/dvb_vb2.h | 6 ++++--
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index 9ce5f010de3f8..804fb339f7355 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -396,11 +396,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
+ if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) {
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, true);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, true);
+ } else {
+ ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer,
+ buffer1, buffer1_len);
+@@ -451,10 +451,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
+
+ if (dvb_vb2_is_streaming(ctx)) {
+ ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, false);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, false);
+ } else {
+ if (buffer->error) {
+ spin_unlock(&dmxdevfilter->dev->lock);
+diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c
+index 909df82fed332..8950e608a87a4 100644
+--- a/drivers/media/dvb-core/dvb_vb2.c
++++ b/drivers/media/dvb-core/dvb_vb2.c
+@@ -252,7 +252,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx)
+
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags)
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush)
+ {
+ unsigned long flags = 0;
+ void *vbuf = NULL;
+@@ -309,7 +310,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ }
+ }
+
+- if (ctx->nonblocking && ctx->buf) {
++ if (flush && ctx->buf) {
+ vb2_set_plane_payload(&ctx->buf->vb, 0, ll);
+ vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE);
+ list_del(&ctx->buf->list);
+diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h
+index 8cb88452cd6c2..0fbbfc65157e6 100644
+--- a/include/media/dvb_vb2.h
++++ b/include/media/dvb_vb2.h
+@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx)
+ return 0;
+ };
+ #define dvb_vb2_is_streaming(ctx) (0)
+-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0)
++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0)
+
+ static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx,
+ struct file *file,
+@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx);
+ * @buffer_flags:
+ * pointer to buffer flags as defined by &enum dmx_buffer_flags.
+ * can be NULL.
++ * @flush: flush the buffer, even if it isn't full.
+ */
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags);
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush);
+
+ /**
+ * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV
+--
+2.51.0
+
--- /dev/null
+From 50b41c93c4892d5d66d939a180fd48ae37a70623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 15:26:40 +0200
+Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ]
+
+The isp_video_mbus_to_pix/pix_to_mbus functions did not take
+the last empty entry { 0, } of the formats array into account.
+
+As a result, isp_video_mbus_to_pix would accept code 0 and
+isp_video_pix_to_mbus would select code 0 if no match was found.
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index 3e5348c63773a..7094379a705fa 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video,
+ pix->width = mbus->width;
+ pix->height = mbus->height;
+
+- for (i = 0; i < ARRAY_SIZE(formats); ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
+ if (formats[i].code == mbus->code)
+ break;
+ }
+
+- if (WARN_ON(i == ARRAY_SIZE(formats)))
++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1))
+ return 0;
+
+ min_bpl = pix->width * formats[i].bpp;
+@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix,
+ /* Skip the last format in the loop so that it will be selected if no
+ * match is found.
+ */
+- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) {
+ if (formats[i].pixelformat == pix->pixelformat)
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 1b0e943a69379cd7beec13bcb10bcc35b28fc73c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 17:09:18 +0200
+Subject: media: omap3isp: isppreview: always clamp in preview_try_format()
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ]
+
+If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't
+clamped. Just always clamp.
+
+This fixes a v4l2-compliance error:
+
+ fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
+ fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
+test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c
+index 53aedec7990da..32e4348e6837a 100644
+--- a/drivers/media/platform/ti/omap3isp/isppreview.c
++++ b/drivers/media/platform/ti/omap3isp/isppreview.c
+@@ -1744,22 +1744,17 @@ static void preview_try_format(struct isp_prev_device *prev,
+
+ switch (pad) {
+ case PREV_PAD_SINK:
+- /* When reading data from the CCDC, the input size has already
+- * been mangled by the CCDC output pad so it can be accepted
+- * as-is.
+- *
+- * When reading data from memory, clamp the requested width and
+- * height. The TRM doesn't specify a minimum input height, make
++ /*
++ * Clamp the requested width and height.
++ * The TRM doesn't specify a minimum input height, make
+ * sure we got enough lines to enable the noise filter and color
+ * filter array interpolation.
+ */
+- if (prev->input == PREVIEW_INPUT_MEMORY) {
+- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
+- preview_max_out_width(prev));
+- fmt->height = clamp_t(u32, fmt->height,
+- PREV_MIN_IN_HEIGHT,
+- PREV_MAX_IN_HEIGHT);
+- }
++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
++ preview_max_out_width(prev));
++ fmt->height = clamp_t(u32, fmt->height,
++ PREV_MIN_IN_HEIGHT,
++ PREV_MAX_IN_HEIGHT);
+
+ fmt->colorspace = V4L2_COLORSPACE_SRGB;
+
+--
+2.51.0
+
--- /dev/null
+From 0dd33582765558fe8682650bb74d389ee646a717 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 09:21:53 +0200
+Subject: media: omap3isp: set initial format
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ]
+
+Initialize the v4l2_format to a default. Empty formats are
+not allowed in V4L2, so this fixes v4l2-compliance issues:
+
+ fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height
+test VIDIOC_G_FMT: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index 7094379a705fa..c0c7a743d8813 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -1292,6 +1292,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = {
+ static int isp_video_open(struct file *file)
+ {
+ struct isp_video *video = video_drvdata(file);
++ struct v4l2_mbus_framefmt fmt;
+ struct isp_video_fh *handle;
+ struct vb2_queue *queue;
+ int ret = 0;
+@@ -1333,6 +1334,13 @@ static int isp_video_open(struct file *file)
+
+ memset(&handle->format, 0, sizeof(handle->format));
+ handle->format.type = video->type;
++ handle->format.fmt.pix.width = 720;
++ handle->format.fmt.pix.height = 480;
++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY;
++ handle->format.fmt.pix.field = V4L2_FIELD_NONE;
++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt);
++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix);
+ handle->timeperframe.denominator = 1;
+
+ handle->video = video;
+--
+2.51.0
+
--- /dev/null
+From f2c077d939a73f52975009ae5e64cb484d279d35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 19:24:19 +0100
+Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex
+
+From: Szymon Wilczek <szymonwilczek@gmx.com>
+
+[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ]
+
+When pvr2_send_request_ex() submits a write URB successfully but fails to
+submit the read URB (e.g. returns -ENOMEM), it returns immediately without
+waiting for the write URB to complete. Since the driver reuses the same
+URB structure, a subsequent call to pvr2_send_request_ex() attempts to
+submit the still-active write URB, triggering a 'URB submitted while
+active' warning in usb_submit_urb().
+
+Fix this by ensuring the write URB is unlinked and waited upon if the read
+URB submission fails.
+
+Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
+Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com>
+Acked-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 9bec1435f357e..9acc0c8eb1194 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -3707,6 +3707,11 @@ status);
+ "Failed to submit read-control URB status=%d",
+ status);
+ hdw->ctl_read_pend_flag = 0;
++ if (hdw->ctl_write_pend_flag) {
++ usb_unlink_urb(hdw->ctl_write_urb);
++ while (hdw->ctl_write_pend_flag)
++ wait_for_completion(&hdw->ctl_done);
++ }
+ goto done;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 3de7cf7ef0e84327586dad88680fbcc7479d9f1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 12:11:42 -0500
+Subject: media: rkisp1: Fix filter mode register configuration
+
+From: Rui Wang <rui.wang@ideasonboard.com>
+
+[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ]
+
+The rkisp1_flt_config() function performs an initial direct write to
+RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA
+bit, which clears the filter enable bit in the hardware.
+
+The subsequent read/modify/write sequence then reads back the register
+with the enable bit already cleared and cannot restore it, resulting in
+the filter being inadvertently disabled.
+
+Remove the redundant direct write. The read/modify/write sequence alone
+correctly preserves the existing enable bit state while updating the
+DNR mode and filter configuration bits.
+
+Signed-off-by: Rui Wang <rui.wang@ideasonboard.com>
+Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+index d8731ebbf479e..0e670aa70de89 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+@@ -385,12 +385,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params,
+ rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT,
+ arg->lum_weight);
+
+- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE,
+- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) |
+- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) |
+- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) |
+- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1));
+-
+ /* avoid to override the old enable value */
+ filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE);
+ filt_mode &= RKISP1_CIF_ISP_FLT_ENA;
+--
+2.51.0
+
--- /dev/null
+From b648c28e14f866a66b8e3938909036c7c83f891e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:00:35 -0800
+Subject: media: solo6x10: Check for out of bounds chip_id
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ]
+
+Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
+(literal "1" is an "int") could end up being shifted beyond 32 bits,
+so instrumentation was added (and due to the double is_tw286x() call
+seen via inlining), Clang decides the second one must now be undefined
+behavior and elides the rest of the function[1]. This is a known problem
+with Clang (that is still being worked on), but we can avoid the entire
+problem by actually checking the existing max chip ID, and now there is
+no runtime instrumentation added at all since everything is known to be
+within bounds.
+
+Additionally use an unsigned value for the shift to remove the
+instrumentation even without the explicit bounds checking.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
+Suggested-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: fix checkpatch warning for is_tw286x]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+index 1b7c22a9bc94f..8f53946c67928 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c
++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = {
+ 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0,
+ };
+
+-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id)))
++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id))))
+
+ static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off,
+ u8 tw_off)
+@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ if (val > 255 || val < 0)
+ return -ERANGE;
+
+@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ switch (ctrl) {
+ case V4L2_CID_SHARPNESS:
+ /* Only 286x has sharpness */
+--
+2.51.0
+
--- /dev/null
+From 1137e5746a6836e4f8b2404c01df0e62690ebc76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 16:39:47 +0100
+Subject: minix: Add required sanity checking to minix_check_superblock()
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ]
+
+The fs/minix implementation of the minix filesystem does not currently
+support any other value for s_log_zone_size than 0. This is also the
+only value supported in util-linux; see mkfs.minix.c line 511. In
+addition, this patch adds some sanity checking for the other minix
+superblock fields, and moves the minix_blocks_needed() checks for the
+zmap and imap also to minix_check_super_block().
+
+This also closes a related syzbot bug report.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/inode.c | 50 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 29 insertions(+), 21 deletions(-)
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 9da6903e306c6..fbbc4ef1b7a2e 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -153,10 +153,38 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)
+ static bool minix_check_superblock(struct super_block *sb)
+ {
+ struct minix_sb_info *sbi = minix_sb(sb);
++ unsigned long block;
+
+- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
++ if (sbi->s_log_zone_size != 0) {
++ printk("minix-fs error: zone size must equal block size. "
++ "s_log_zone_size > 0 is not supported.\n");
++ return false;
++ }
++
++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
++ sbi->s_firstdatazone >= sbi->s_nzones)
+ return false;
+
++ /* Apparently minix can create filesystems that allocate more blocks for
++ * the bitmaps than needed. We simply ignore that, but verify it didn't
++ * create one with not enough blocks and bail out if so.
++ */
++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize);
++ if (sbi->s_imap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "imap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
++ block = minix_blocks_needed(
++ (sbi->s_nzones - sbi->s_firstdatazone + 1),
++ sb->s_blocksize);
++ if (sbi->s_zmap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "zmap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
+ /*
+ * s_max_size must not exceed the block mapping limitation. This check
+ * is only needed for V1 filesystems, since V2/V3 support an extra level
+@@ -275,26 +303,6 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ minix_set_bit(0,sbi->s_imap[0]->b_data);
+ minix_set_bit(0,sbi->s_zmap[0]->b_data);
+
+- /* Apparently minix can create filesystems that allocate more blocks for
+- * the bitmaps than needed. We simply ignore that, but verify it didn't
+- * create one with not enough blocks and bail out if so.
+- */
+- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
+- if (sbi->s_imap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "imap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+- block = minix_blocks_needed(
+- (sbi->s_nzones - sbi->s_firstdatazone + 1),
+- s->s_blocksize);
+- if (sbi->s_zmap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "zmap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+ /* set up enough so that it can read an inode */
+ s->s_op = &minix_sops;
+ s->s_time_min = 0;
+--
+2.51.0
+
--- /dev/null
+From 50c3a7c4a28cc03b9ea009f8e5e25c6f772e3fe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 09:40:06 +0000
+Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ]
+
+The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which
+is a valid index - so add a check for this.
+
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mach-loongson64/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h
+index 3414a1fd17835..89bb4deab98a6 100644
+--- a/arch/mips/include/asm/mach-loongson64/topology.h
++++ b/arch/mips/include/asm/mach-loongson64/topology.h
+@@ -7,7 +7,7 @@
+ #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2)
+
+ extern cpumask_t __node_cpumask[];
+-#define cpumask_of_node(node) (&__node_cpumask[node])
++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node])
+
+ struct pci_bus;
+ extern int pcibus_to_node(struct pci_bus *);
+--
+2.51.0
+
--- /dev/null
+From 9e176b30d87f7d8d9ad0ccc4bebcfd77ced97d51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 14:36:37 +0800
+Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ]
+
+In the function bcm_vk_read(), the pointer entry is checked, indicating
+that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
+following code may cause null-pointer dereferences:
+
+ struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+ set_msg_id(&tmp_msg, entry->usr_msg_id);
+ tmp_msg.size = entry->to_h_blks - 1;
+
+To prevent these possible null-pointer dereferences, copy to_h_msg,
+usr_msg_id, and to_h_blks from iter into temporary variables, and return
+these temporary variables to the application instead of accessing them
+through a potentially NULL entry.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Reviewed-by: Scott Branden <scott.branden@broadcom.com>
+Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
+index 3c081504f38ca..97888c83c5ef3 100644
+--- a/drivers/misc/bcm-vk/bcm_vk_msg.c
++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
+@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ struct device *dev = &vk->pdev->dev;
+ struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan;
+ struct bcm_vk_wkent *entry = NULL, *iter;
++ struct vk_msg_blk tmp_msg;
++ u32 tmp_usr_msg_id;
++ u32 tmp_blks;
+ u32 q_num;
+ u32 rsp_length;
+
+@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ entry = iter;
+ } else {
+ /* buffer not big enough */
++ tmp_msg = iter->to_h_msg[0];
++ tmp_usr_msg_id = iter->usr_msg_id;
++ tmp_blks = iter->to_h_blks;
+ rc = -EMSGSIZE;
+ }
+ goto read_loop_exit;
+@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file,
+
+ bcm_vk_free_wkent(dev, entry);
+ } else if (rc == -EMSGSIZE) {
+- struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+-
+ /*
+ * in this case, return just the first block, so
+ * that app knows what size it is looking for.
+ */
+- set_msg_id(&tmp_msg, entry->usr_msg_id);
+- tmp_msg.size = entry->to_h_blks - 1;
++ set_msg_id(&tmp_msg, tmp_usr_msg_id);
++ tmp_msg.size = tmp_blks - 1;
+ if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) {
+ dev_err(dev, "Error return 1st block in -EMSGSIZE\n");
+ rc = -EFAULT;
+--
+2.51.0
+
--- /dev/null
+From 8e33a7f5cf4ecd8c990e4170330bec0141c4277f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 11:48:24 +0100
+Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
+
+From: Markus Perkins <markus@notsyncing.net>
+
+[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ]
+
+commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66
+compatible strings") added support for 93xx56 and 93xx66 eeproms, but
+didn't take into account that the write enable/disable + erase all
+commands are hardcoded for the 6-bit address of the 93xx46.
+
+This commit fixes the command word generation by increasing the number
+of shifts as the address field grows, keeping the command intact.
+
+Also, the check for 8-bit or 16-bit mode is no longer required as this
+is already taken into account in the edev->addrlen field.
+
+Signed-off-by: Markus Perkins <markus@notsyncing.net>
+Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index b630625b3024b..b510d0b5ddfa7 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -23,6 +23,7 @@
+ #define OP_START 0x4
+ #define OP_WRITE (OP_START | 0x1)
+ #define OP_READ (OP_START | 0x2)
++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */
+ #define ADDR_EWDS 0x00
+ #define ADDR_ERAL 0x20
+ #define ADDR_EWEN 0x30
+@@ -173,10 +174,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1;
+- else
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS);
++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+@@ -320,10 +318,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= ADDR_ERAL << 1;
+- else
+- cmd_addr |= ADDR_ERAL;
++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+--
+2.51.0
+
--- /dev/null
+From fc842c9dc08a1d55888ab8d74d0bf7f5c2f46ada Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 13:13:30 +0100
+Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ]
+
+Building a size optimized ppc64 kernel (-Os), gcc emits more FP
+save/restore symbols, that the linker generates on demand into the
+.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c,
+too. They are needed for the amdgpu in-kernel floating point support.
+
+MODPOST Module.symvers
+ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many)
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index c2161d77672de..06adeff43b5eb 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -608,6 +608,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
+ /* Special register function linked on all modules during final link of .ko */
+ if (strstarts(symname, "_restgpr0_") ||
+ strstarts(symname, "_savegpr0_") ||
++ strstarts(symname, "_restgpr1_") ||
++ strstarts(symname, "_savegpr1_") ||
++ strstarts(symname, "_restfpr_") ||
++ strstarts(symname, "_savefpr_") ||
+ strstarts(symname, "_restvr_") ||
+ strstarts(symname, "_savevr_") ||
+ strcmp(symname, ".TOC.") == 0)
+--
+2.51.0
+
--- /dev/null
+From 85126a8434298932510dd52de37f3410ff51caa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 17:28:09 +0100
+Subject: myri10ge: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ]
+
+While compile testing on less common architectures, I noticed that gcc-10 on
+s390 finds a bug that all other configurations seem to miss:
+
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized]
+ 391 | buf->data0 = htonl(data->data0);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+ | ^~~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized]
+ 393 | buf->data2 = htonl(data->data2);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+
+It would be nice to understand how to make other compilers catch this as
+well, but for the moment I'll just shut up the warning by fixing the
+undefined behavior in this driver.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index 9a9341a348c00..4e39f948952ee 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
+
+ /* probe for IPv6 TSO support */
+ mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE,
+ &cmd, 0);
+ if (status == 0) {
+@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp,
+ | (addr[2] << 8) | addr[3]);
+
+ cmd.data1 = ((addr[4] << 8) | (addr[5]));
++ cmd.data2 = 0;
+
+ status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0);
+ return status;
+@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause)
+ int status, ctl;
+
+ ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, 0);
+
+ if (status) {
+@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic)
+ int status, ctl;
+
+ ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC;
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic);
+ if (status)
+ netdev_err(mgp->dev, "Failed to set promisc mode\n");
+@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss)
+ /* get ring sizes */
+ slice = ss - mgp->ss;
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
+ tx_ring_size = cmd.data0;
+ cmd.data0 = slice;
+@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice)
+ status = 0;
+ if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) {
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET,
+ &cmd, 0);
+ ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *)
+ (mgp->sram + cmd.data0);
+ }
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET,
+ &cmd, 0);
+ ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *)
+@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev)
+ if (mgp->num_slices > 1) {
+ cmd.data0 = mgp->num_slices;
+ cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE;
++ cmd.data2 = 0;
+ if (mgp->dev->real_num_tx_queues > 1)
+ cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES,
+@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev)
+
+ /* now give firmware buffers sizes, and MTU */
+ cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0);
+ cmd.data0 = mgp->small_bytes;
+ status |=
+@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev)
+ static int myri10ge_close(struct net_device *dev)
+ {
+ struct myri10ge_priv *mgp = netdev_priv(dev);
+- struct myri10ge_cmd cmd;
+ int status, old_down_cnt;
+ int i;
+
+@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev)
+
+ netif_tx_stop_all_queues(dev);
+ if (mgp->rebooted == 0) {
++ struct myri10ge_cmd cmd;
++
+ old_down_cnt = mgp->down_cnt;
+ mb();
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status =
+ myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0);
+ if (status)
+@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev)
+
+ /* Disable multicast filtering */
+
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1);
+ if (err != 0) {
+ netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n",
+--
+2.51.0
+
--- /dev/null
+From d7576d87b716e0691b83190229394c16c884c760 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:47:55 +0800
+Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits
+
+From: Jijie Shao <shaojijie@huawei.com>
+
+[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ]
+
+Currently, HCLGE_FD_AD_QID has only 10 bits and supports a
+maximum of 1023 queues. However, there are actually scenarios
+where the queue_id exceeds 1023.
+
+This patch adds an additional bit to HCLGE_FD_AD_QID to ensure
+that queue_id greater than 1023 are supported.
+
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++--
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 0b9d3fc749b95..cbc8ba429820a 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd {
+
+ #define HCLGE_FD_AD_DROP_B 0
+ #define HCLGE_FD_AD_DIRECT_QID_B 1
+-#define HCLGE_FD_AD_QID_S 2
+-#define HCLGE_FD_AD_QID_M GENMASK(11, 2)
++#define HCLGE_FD_AD_QID_L_S 2
++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2)
+ #define HCLGE_FD_AD_USE_COUNTER_B 12
+ #define HCLGE_FD_AD_COUNTER_NUM_S 13
+ #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)
+@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd {
+ #define HCLGE_FD_AD_TC_OVRD_B 16
+ #define HCLGE_FD_AD_TC_SIZE_S 17
+ #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17)
++#define HCLGE_FD_AD_QID_H_B 21
+
+ struct hclge_fd_ad_config_cmd {
+ u8 stage;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 42173a076163f..0a5b1c83cbea8 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5706,11 +5706,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc,
+ hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M,
+ HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size);
+ }
++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B,
++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0);
+ ad_data <<= 32;
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B,
+ action->forward_to_direct_queue);
+- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S,
++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S,
+ action->queue_id);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter);
+ hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M,
+--
+2.51.0
+
--- /dev/null
+From 67373755f09580639d96d32c0f4580ba2baef576 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:57:20 -0700
+Subject: net/rds: Clear reconnect pending bit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ]
+
+When canceling the reconnect worker, care must be taken to reset the
+reconnect-pending bit. If the reconnect worker has not yet been
+scheduled before it is canceled, the reconnect-pending bit will stay
+on forever.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 00bda534b9ce2..98c0d5ff9de9c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ * to the conn hash, so we never trigger a reconnect on this
+ * conn - the reconnect is always triggered by the active peer. */
+ cancel_delayed_work_sync(&cp->cp_conn_w);
++
++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags);
+ rcu_read_lock();
+ if (!hlist_unhashed(&conn->c_hash_node)) {
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From 334ed6d43beb7a4f3e87f536fc5a1b123a6df9c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 22:52:12 -0700
+Subject: net/rds: No shortcut out of RDS_CONN_ERROR
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ]
+
+RDS connections carry a state "rds_conn_path::cp_state"
+and transitions from one state to another and are conditional
+upon an expected state: "rds_conn_path_transition."
+
+There is one exception to this conditionality, which is
+"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"
+regardless of what state the condition is currently in.
+
+But as soon as a connection enters state "RDS_CONN_ERROR",
+the connection handling code expects it to go through the
+shutdown-path.
+
+The RDS/TCP multipath changes added a shortcut out of
+"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"
+via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").
+
+A subsequent "rds_tcp_reset_callbacks" can then transition
+the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.
+
+That'll trip up "rds_conn_init_shutdown", which was
+never adjusted to handle "RDS_CONN_RESETTING" and subsequently
+drops the connection with the dreaded "DR_INV_CONN_STATE",
+which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever.
+
+So we do two things here:
+
+a) Don't shortcut "RDS_CONN_ERROR", but take the longer
+ path through the shutdown code.
+
+b) Add "RDS_CONN_RESETTING" to the expected states in
+ "rds_conn_init_shutdown" so that we won't error out
+ and get stuck, if we ever hit weird state transitions
+ like this again."
+
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ net/rds/tcp_listen.c | 5 -----
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index b4cc699c5fad3..00bda534b9ce2 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ if (!rds_conn_path_transition(cp, RDS_CONN_UP,
+ RDS_CONN_DISCONNECTING) &&
+ !rds_conn_path_transition(cp, RDS_CONN_ERROR,
++ RDS_CONN_DISCONNECTING) &&
++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING,
+ RDS_CONN_DISCONNECTING)) {
+ rds_conn_path_error(cp,
+ "shutdown called in state %d\n",
+diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
+index b576bd252fecb..353b88833f787 100644
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -58,9 +58,6 @@ void rds_tcp_keepalive(struct socket *sock)
+ * socket and force a reconneect from smaller -> larger ip addr. The reason
+ * we special case cp_index 0 is to allow the rds probe ping itself to itself
+ * get through efficiently.
+- * Since reconnects are only initiated from the node with the numerically
+- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side
+- * by moving them to CONNECTING in this function.
+ */
+ static
+ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+@@ -85,8 +82,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+ struct rds_conn_path *cp = &conn->c_path[i];
+
+ if (rds_conn_path_transition(cp, RDS_CONN_DOWN,
+- RDS_CONN_CONNECTING) ||
+- rds_conn_path_transition(cp, RDS_CONN_ERROR,
+ RDS_CONN_CONNECTING)) {
+ return cp->cp_transport_data;
+ }
+--
+2.51.0
+
--- /dev/null
+From 440786395eab682e5dd97c27804bf6e1be428967 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 09:59:49 +0800
+Subject: net: usb: r8152: fix transmit queue timeout
+
+From: Mingj Ye <insyelu@gmail.com>
+
+[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ]
+
+When the TX queue length reaches the threshold, the netdev watchdog
+immediately detects a TX queue timeout.
+
+This patch updates the trans_start timestamp of the transmit queue
+on every asynchronous USB URB submission along the transmit path,
+ensuring that the network watchdog accurately reflects ongoing
+transmission activity.
+
+Signed-off-by: Mingj Ye <insyelu@gmail.com>
+Reviewed-by: Hayes Wang <hayeswang@realtek.com>
+Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 63f418299c3ee..fef3e3fd26e6b 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -2342,6 +2342,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
+ ret = usb_submit_urb(agg->urb, GFP_ATOMIC);
+ if (ret < 0)
+ usb_autopm_put_interface_async(tp->intf);
++ else
++ netif_trans_update(tp->netdev);
+
+ out_tx_fill:
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 85008bf59d4b005ad550842652c419d525f27e73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:39:09 -0800
+Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter
+
+From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+
+[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ]
+
+Several registers referenced in this driver's source code do not
+actually exist (they are not writable and read as zero in my testing).
+They exist in this driver because it originated as a copy of the dm9601
+driver. Notably, these include the multicast filter registers - this
+causes the driver to not support multicast packets correctly. Remove
+the multicast filter code and register definitions. Instead, set the
+chip to receive all multicast filter packets when any multicast
+addresses are in the list.
+
+Reviewed-by: Simon Horman <horms@kernel.org> (from v1)
+Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/Kconfig | 1 -
+ drivers/net/usb/sr9700.c | 25 ++++---------------------
+ drivers/net/usb/sr9700.h | 7 +------
+ 3 files changed, 5 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index 4402eedb3d1a2..729b78ef78bee 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -320,7 +320,6 @@ config USB_NET_DM9601
+ config USB_NET_SR9700
+ tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
+ depends on USB_USBNET
+- select CRC32
+ help
+ This option adds support for CoreChip-sz SR9700 based USB 1.1
+ 10/100 Ethernet adapters.
+diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
+index 213b4817cfdf6..e4d7bcd0d99c2 100644
+--- a/drivers/net/usb/sr9700.c
++++ b/drivers/net/usb/sr9700.c
+@@ -18,7 +18,6 @@
+ #include <linux/ethtool.h>
+ #include <linux/mii.h>
+ #include <linux/usb.h>
+-#include <linux/crc32.h>
+ #include <linux/usb/usbnet.h>
+
+ #include "sr9700.h"
+@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = {
+ static void sr9700_set_multicast(struct net_device *netdev)
+ {
+ struct usbnet *dev = netdev_priv(netdev);
+- /* We use the 20 byte dev->data for our 8 byte filter buffer
+- * to avoid allocating memory that is tricky to free later
+- */
+- u8 *hashes = (u8 *)&dev->data;
+ /* rx_ctl setting : enable, disable_long, disable_crc */
+ u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG;
+
+- memset(hashes, 0x00, SR_MCAST_SIZE);
+- /* broadcast address */
+- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG;
+- if (netdev->flags & IFF_PROMISC) {
++ if (netdev->flags & IFF_PROMISC)
+ rx_ctl |= RCR_PRMSC;
+- } else if (netdev->flags & IFF_ALLMULTI ||
+- netdev_mc_count(netdev) > SR_MCAST_MAX) {
+- rx_ctl |= RCR_RUNT;
+- } else if (!netdev_mc_empty(netdev)) {
+- struct netdev_hw_addr *ha;
+-
+- netdev_for_each_mc_addr(ha, netdev) {
+- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26;
+- hashes[crc >> 3] |= 1 << (crc & 0x7);
+- }
+- }
++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev))
++ /* The chip has no multicast filter */
++ rx_ctl |= RCR_ALL;
+
+- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes);
+ sr_write_reg_async(dev, SR_RCR, rx_ctl);
+ }
+
+diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
+index ea2b4de621c86..c479908f7d823 100644
+--- a/drivers/net/usb/sr9700.h
++++ b/drivers/net/usb/sr9700.h
+@@ -104,9 +104,7 @@
+ #define WCR_LINKEN (1 << 5)
+ /* Physical Address Reg */
+ #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */
+-/* Multicast Address Reg */
+-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */
+-/* 0x1e unused */
++/* 0x16 --> 0x1E unused */
+ /* Phy Reset Reg */
+ #define SR_PRR 0x1F
+ #define PRR_PHY_RST (1 << 0)
+@@ -161,9 +159,6 @@
+ /* parameters */
+ #define SR_SHARE_TIMEOUT 1000
+ #define SR_EEPROM_LEN 256
+-#define SR_MCAST_SIZE 8
+-#define SR_MCAST_ADDR_FLAG 0x80
+-#define SR_MCAST_MAX 64
+ #define SR_TX_OVERHEAD 2 /* 2bytes header */
+ #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */
+
+--
+2.51.0
+
--- /dev/null
+From e28f260b403ac4aa476d5d9b06e0478cda8a84a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Dec 2025 20:53:51 +0900
+Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler
+
+From: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+
+[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ]
+
+The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
+ ("netfilter: conntrack: introduce clash resolution on insertion race"),
+sets allow_clash=true in the UDP/UDPLITE protocol handler
+but does not set it in the generic protocol handler.
+
+As a result, packets composed of connectionless protocols at each layer,
+such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
+
+To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.
+
+Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_generic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
+index e831637bc8ca8..cb260eb3d012c 100644
+--- a/net/netfilter/nf_conntrack_proto_generic.c
++++ b/net/netfilter/nf_conntrack_proto_generic.c
+@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net)
+ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
+ {
+ .l4proto = 255,
++ .allow_clash = true,
+ #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ .ctnl_timeout = {
+ .nlattr_to_obj = generic_timeout_nlattr_to_obj,
+--
+2.51.0
+
--- /dev/null
+From 0249b60b8ad651239ceeb1727b0ee710816ca197 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 12:30:42 +0100
+Subject: netfilter: xt_tcpmss: check remaining length before reading optlen
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ]
+
+Quoting reporter:
+ In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
+ op[i+1] directly without validating the remaining option length.
+
+ If the last byte of the option field is not EOL/NOP (0/1), the code attempts
+ to index op[i+1]. In the case where i + 1 == optlen, this causes an
+ out-of-bounds read, accessing memory past the optlen boundary
+ (either reading beyond the stack buffer _opt or the
+ following payload).
+
+Reported-by: sungzii <sungzii@pm.me>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_tcpmss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
+index 37704ab017992..0d32d4841cb32 100644
+--- a/net/netfilter/xt_tcpmss.c
++++ b/net/netfilter/xt_tcpmss.c
+@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ return (mssval >= info->mss_min &&
+ mssval <= info->mss_max) ^ info->invert;
+ }
+- if (op[i] < 2)
++ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i+1] ? : 1;
+--
+2.51.0
+
--- /dev/null
+From 6767b84b14d9bbbdbadb88c5d1383af13a0c4d00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 19:11:39 +0800
+Subject: nfc: nxp-nci: remove interrupt trigger type
+
+From: Carl Lee <carl.lee@amd.com>
+
+[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ]
+
+For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and
+active high, not edge-triggered.
+
+Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail
+to trigger correctly.
+
+Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured
+via Device Tree.
+
+Signed-off-by: Carl Lee <carl.lee@amd.com>
+Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index ec6446511984d..b9d311acfbfb2 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -306,7 +306,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client,
+
+ r = request_threaded_irq(client->irq, NULL,
+ nxp_nci_i2c_irq_thread_fn,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_ONESHOT,
+ NXP_NCI_I2C_DRIVER_NAME, phy);
+ if (r < 0)
+ nfc_err(&client->dev, "Unable to register IRQ handler\n");
+--
+2.51.0
+
--- /dev/null
+From 7818cb2e26390a8a13e93247ba89f1ac2dd7bd47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:18 -0800
+Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]
+
+Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
+This patch protects against invalid index out of bounds access to mw_sizes
+When invalid access print message to user that configuration is not valid.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index 1bdec59100019..d7de52720209f 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev)
+ for (i = 0; i < sndev->nr_lut_mw; i++) {
+ int idx = sndev->nr_direct_mw + i;
+
++ if (idx >= MAX_MWS) {
++ dev_err(&sndev->stdev->dev,
++ "Total number of MW cannot be bigger than %d", MAX_MWS);
++ break;
++ }
++
+ sndev->self_shared->mw_sizes[idx] = LUT_SIZE;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 66d477c4d3e8403fe647d0bf88283a4adf0572ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:17 -0800
+Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]
+
+Number of MW LUTs depends on NTB configuration and can be set to zero,
+in such scenario rounddown_pow_of_two will cause undefined behaviour and
+should not be performed.
+This patch ensures that rounddown_pow_of_two is called on valid value.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index d7de52720209f..0f3f79f310ae3 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+ sndev->mmio_self_ctrl);
+
+ sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries);
+- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
++ if (sndev->nr_lut_mw)
++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n",
+ sndev->nr_direct_mw, sndev->nr_lut_mw);
+@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+
+ sndev->peer_nr_lut_mw =
+ ioread16(&sndev->mmio_peer_ctrl->lut_table_entries);
+- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
++ if (sndev->peer_nr_lut_mw)
++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n",
+ sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw);
+--
+2.51.0
+
--- /dev/null
+From 80d22dde6e0a3f29d4381dd0d534537cea21deb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 18:21:47 +0530
+Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ]
+
+NIX SQ manager sticky mode is known to cause stalls when multiple SQs
+share an SMQ and transmit concurrently. Additionally, PSE may deadlock
+on transitions between sticky and non-sticky transmissions. There is
+also a credit drop issue observed when certain condition clocks are
+gated.
+
+work around these hardware errata by:
+- Disabling SQM sticky operation:
+ - Clear TM6 (bit 15)
+ - Clear TM11 (bit 14)
+- Disabling sticky → non-sticky transition path that can deadlock PSE:
+ - Clear TM5 (bit 23)
+- Preventing credit drops by keeping the control-flow clock enabled:
+ - Set TM9 (bit 21)
+
+These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this
+configuration the SQM/PSE maintain forward progress under load without
+credit loss, at the cost of disabling sticky optimizations.
+
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index 95a8ccd18a4f7..f56ffb587fc53 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -4464,12 +4464,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw)
+ /* Set chan/link to backpressure TL3 instead of TL2 */
+ rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
+
+- /* Disable SQ manager's sticky mode operation (set TM6 = 0)
++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0)
+ * This sticky mode is known to cause SQ stalls when multiple
+- * SQs are mapped to same SMQ and transmitting pkts at a time.
++ * SQs are mapped to same SMQ and transmitting pkts simultaneously.
++ * NIX PSE may deadlock when there are any sticky to non-sticky
++ * transmission. Hence disable it (TM5 = 0).
+ */
+ cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
+- cfg &= ~BIT_ULL(15);
++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23));
++ /* NIX may drop credits when condition clocks are turned off.
++ * Hence enable control flow clk (set TM9 = 1).
++ */
++ cfg |= BIT_ULL(21);
+ rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
+
+ ltdefs = rvu->kpu.lt_def;
+--
+2.51.0
+
--- /dev/null
+From 005e54033c8d60a9cba2141662d1931f8fadb395 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 12:07:23 -0500
+Subject: openrisc: define arch-specific version of nop()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ]
+
+When compiling a driver written for MIPS on OpenRISC that uses the nop()
+function, it fails due to the following error:
+
+ drivers/watchdog/pic32-wdt.c: Assembler messages:
+ drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop'
+
+The driver currently uses the generic version of nop() from
+include/asm-generic/barrier.h:
+
+ #ifndef nop
+ #define nop() asm volatile ("nop")
+ #endif
+
+Let's fix this on OpenRISC by defining an architecture-specific version
+of nop().
+
+This was tested by performing an allmodconfig openrisc cross compile on
+an aarch64 host.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/barrier.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+index 7538294721bed..8e592c9909023 100644
+--- a/arch/openrisc/include/asm/barrier.h
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -4,6 +4,8 @@
+
+ #define mb() asm volatile ("l.msync" ::: "memory")
+
++#define nop() asm volatile ("l.nop")
++
+ #include <asm-generic/barrier.h>
+
+ #endif /* __ASM_BARRIER_H */
+--
+2.51.0
+
--- /dev/null
+From 283c68bdec255414aecfc81edc4249887403e6aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 17:58:55 +0100
+Subject: parisc: Prevent interrupts during reboot
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/process.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index b62d60009fac9..fd753a0e75d79 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -85,6 +85,9 @@ void machine_restart(char *cmd)
+ #endif
+ /* set up a new led state on systems shipped with a LED State panel */
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN);
++
++ /* prevent interrupts during reboot */
++ set_eiem(0);
+
+ /* "Normal" system reset */
+ pdc_do_reset();
+--
+2.51.0
+
--- /dev/null
+From e7db3e9fc03249ec477d9eea19db935e2d7971e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:53:32 +0530
+Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
+
+From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+
+[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ]
+
+The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability,
+but they do provide ACS-like features to disable peer transactions and
+validate bus numbers in requests.
+
+Add an ACS quirk for Hamoa & Glymur.
+
+Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 28f8add367c00..11041831ed3c2 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5002,6 +5002,10 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
+ /* QCOM SA8775P root port */
+ { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },
++ /* QCOM Hamoa root port */
++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs },
++ /* QCOM Glymur root port */
++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs },
+ /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */
+ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs },
+ /* Intel PCH root ports */
+--
+2.51.0
+
--- /dev/null
+From 839f849fcd838b377c047721a667ef21f9cf007f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 10:25:51 +0100
+Subject: PCI/AER: Clear stale errors on reporting agents upon probe
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ]
+
+Correctable and Uncorrectable Error Status Registers on reporting agents
+are cleared upon PCI device enumeration in pci_aer_init() to flush past
+events. They're cleared again when an error is handled by the AER driver.
+
+If an agent reports a new error after pci_aer_init() and before the AER
+driver has probed on the corresponding Root Port or Root Complex Event
+Collector, that error is not handled by the AER driver: It clears the
+Root Error Status Register on probe, but neglects to re-clear the
+Correctable and Uncorrectable Error Status Registers on reporting agents.
+
+The error will eventually be reported when another error occurs. Which
+is irritating because to an end user it appears as if the earlier error
+has just happened.
+
+Amend the AER driver to clear stale errors on reporting agents upon probe.
+
+Skip reporting agents which have not invoked pci_aer_init() yet to avoid
+using an uninitialized pdev->aer_cap. They're recognizable by the error
+bits in the Device Control register still being clear.
+
+Reporting agents may execute pci_aer_init() after the AER driver has
+probed, particularly when devices are hotplugged or removed/rescanned via
+sysfs. For this reason, it continues to be necessary that pci_aer_init()
+clears Correctable and Uncorrectable Error Status Registers.
+
+Reported-by: Lucas Van <lucas.van@intel.com> # off-list
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Lucas Van <lucas.van@intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 866426a8fb862..fe3a4a3cb46d4 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -1259,6 +1259,20 @@ static void set_downstream_devices_error_reporting(struct pci_dev *dev,
+
+ }
+
++static int clear_status_iter(struct pci_dev *dev, void *data)
++{
++ u16 devctl;
++
++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */
++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl);
++ if (!(devctl & PCI_EXP_AER_FLAGS))
++ return 0;
++
++ pci_aer_clear_status(dev);
++ pcie_clear_device_status(dev);
++ return 0;
++}
++
+ /**
+ * aer_enable_rootport - enable Root Port's interrupts when receiving messages
+ * @rpc: pointer to a Root Port data structure
+@@ -1280,9 +1294,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc)
+ pcie_capability_clear_word(pdev, PCI_EXP_RTCTL,
+ SYSTEM_ERROR_INTR_ON_MESG_MASK);
+
+- /* Clear error status */
++ /* Clear error status of this Root Port or RCEC */
+ pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32);
++
++ /* Clear error status of agents reporting to this Root Port or RCEC */
++ if (reg32 & AER_ERR_STATUS_MASK) {
++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC)
++ pcie_walk_rcec(pdev, clear_status_iter, NULL);
++ else if (pdev->subordinate)
++ pci_walk_bus(pdev->subordinate, clear_status_iter,
++ NULL);
++ }
++
+ pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32);
+ pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32);
+--
+2.51.0
+
--- /dev/null
+From 51cc51433d0e96603710207c58252aa38f359aaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 18:01:01 +0800
+Subject: PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+[ Upstream commit b5d712e5b87fc56ff838684afb1bae359eb8069f ]
+
+Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR
+memories and they cause below resource allocation issue during probe.
+
+ pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port
+ pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff]
+ pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff]
+ pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref]
+ ...
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
+ pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing
+ pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
+
+Since there is no use of the Root Port BAR memories, disable both of them.
+
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+[mani: reworded the description and comment]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-dw-rockchip.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+index df0b9eb19c4de..02f781c886035 100644
+--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c
++++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+@@ -48,6 +48,8 @@
+ #define PCIE_LTSSM_ENABLE_ENHANCE BIT(4)
+ #define PCIE_LTSSM_STATUS_MASK GENMASK(5, 0)
+
++#define PCIE_TYPE0_HDR_DBI2_OFFSET 0x100000
++
+ struct rockchip_pcie {
+ struct dw_pcie pci;
+ void __iomem *apb_base;
+@@ -198,6 +200,8 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
+ if (irq < 0)
+ return irq;
+
++ pci->dbi_base2 = pci->dbi_base + PCIE_TYPE0_HDR_DBI2_OFFSET;
++
+ ret = rockchip_pcie_init_irq_domain(rockchip);
+ if (ret < 0)
+ dev_err(dev, "failed to init irq domain\n");
+@@ -211,6 +215,10 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
+ rockchip_pcie_writel_apb(rockchip, PCIE_CLIENT_RC_MODE,
+ PCIE_CLIENT_GENERAL_CONTROL);
+
++ /* Disable Root Ports BAR0 and BAR1 as they report bogus size */
++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_0, 0x0);
++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_1, 0x0);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3759237da48f6a9ddf536501b883e7f03d3e0118 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 21:04:47 +0530
+Subject: PCI: Enable ACS after configuring IOMMU for OF platforms
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ]
+
+Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets
+'pci_acs_enable' to request that ACS be enabled for any devices enumerated
+in the future.
+
+OF platforms called pci_enable_acs() for the first device before
+of_iommu_configure() called pci_request_acs(), so ACS was never enabled for
+that device (typically a Root Port).
+
+Call pci_enable_acs() later, from pci_dma_configure(), after
+of_dma_configure() has had a chance to call pci_request_acs().
+
+Here's the call path, showing the move of pci_enable_acs() from
+pci_acs_init() to pci_dma_configure(), where it always happens after
+pci_request_acs():
+
+ pci_device_add
+ pci_init_capabilities
+ pci_acs_init
+ - pci_enable_acs
+ - if (pci_acs_enable) <-- previous test
+ - ...
+ device_add
+ bus_notify(BUS_NOTIFY_ADD_DEVICE)
+ iommu_bus_notifier
+ iommu_probe_device
+ iommu_init_device
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ of_dma_configure
+ of_iommu_configure
+ pci_request_acs
+ pci_acs_enable = 1 <-- set
+ + pci_enable_acs
+ + if (pci_acs_enable) <-- new test
+ + ...
+ bus_probe_device
+ device_initial_probe
+ ...
+ really_probe
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ ...
+ pci_enable_acs
+
+Note that we will now call pci_enable_acs() twice for every device, first
+from the iommu_probe_device() path and again from the really_probe() path.
+Presumably that's not an issue since we also call dev->bus->dma_configure()
+twice.
+
+For the ACPI platforms, pci_request_acs() is called during ACPI
+initialization time itself, independent of the IOMMU framework.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 8 ++++++++
+ drivers/pci/pci.c | 10 +---------
+ drivers/pci/pci.h | 1 +
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index fe6e5f716543a..8b5796a6ed5ff 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1667,6 +1667,14 @@ static int pci_dma_configure(struct device *dev)
+ ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
+ }
+
++ /*
++ * Attempt to enable ACS regardless of capability because some Root
++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
++ * the standard ACS capability but still support ACS via those
++ * quirks.
++ */
++ pci_enable_acs(to_pci_dev(dev));
++
+ pci_put_host_bridge_device(bridge);
+
+ if (!ret && !driver->driver_managed_dma) {
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index c702d9feb905e..516c9f6dea202 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -980,7 +980,7 @@ static void pci_std_enable_acs(struct pci_dev *dev)
+ * pci_enable_acs - enable ACS if hardware support it
+ * @dev: the PCI device
+ */
+-static void pci_enable_acs(struct pci_dev *dev)
++void pci_enable_acs(struct pci_dev *dev)
+ {
+ if (!pci_acs_enable)
+ goto disable_acs_redir;
+@@ -3715,14 +3715,6 @@ bool pci_acs_path_enabled(struct pci_dev *start,
+ void pci_acs_init(struct pci_dev *dev)
+ {
+ dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
+-
+- /*
+- * Attempt to enable ACS regardless of capability because some Root
+- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+- * the standard ACS capability but still support ACS via those
+- * quirks.
+- */
+- pci_enable_acs(dev);
+ }
+
+ /**
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 38ad75ce52c32..fc760fd3ad948 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -521,6 +521,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
+ }
+
+ void pci_acs_init(struct pci_dev *dev);
++void pci_enable_acs(struct pci_dev *dev);
+ #ifdef CONFIG_PCI_QUIRKS
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);
+--
+2.51.0
+
--- /dev/null
+From b1afe02078fa8ac285d89605a3ac4cf654761b87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 08:59:51 -0800
+Subject: PCI: Fix pci_slot_lock () device locking
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ]
+
+Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to
+prevent warnings like:
+
+ pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0
+
+Take and release the lock for the bridge providing the slot for the
+lock/trylock and unlock routines.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index bafa695bd7ec7..c702d9feb905e 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5657,10 +5657,9 @@ static int pci_bus_trylock(struct pci_bus *bus)
+ /* Do any devices on or below this slot prevent a bus reset? */
+ static bool pci_slot_resetable(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+- if (slot->bus->self &&
+- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
+ return false;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+@@ -5677,7 +5676,10 @@ static bool pci_slot_resetable(struct pci_slot *slot)
+ /* Lock devices from the top of the tree down */
+ static void pci_slot_lock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge)
++ pci_dev_lock(bridge);
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5692,7 +5694,7 @@ static void pci_slot_lock(struct pci_slot *slot)
+ /* Unlock devices from the bottom of the tree up */
+ static void pci_slot_unlock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5702,12 +5704,18 @@ static void pci_slot_unlock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ }
+
+ /* Return 1 on successful lock, 0 on contention */
+ static int pci_slot_trylock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge && !pci_dev_trylock(bridge))
++ return 0;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5732,6 +5740,9 @@ static int pci_slot_trylock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 65b781b9cf8bced1d984842b661748b4f778b73d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 17:02:08 -0700
+Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset
+
+From: Alex Williamson <alex.williamson@nvidia.com>
+
+[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ]
+
+User forums report issues when assigning ASM1164 SATA controllers to VMs,
+especially in configurations with multiple controllers. Logs show the
+device fails to retrain after bus reset. Reports suggest this is an issue
+across multiple platforms. The device indicates support for PM reset,
+therefore the device still has a viable function level reset mechanism.
+The reporting user confirms the device is well behaved in this use case
+with bus reset disabled.
+
+Reported-by: Patrick Bianchi <patrick.w.bianchi@gmail.com>
+Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
+Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 9a2076ddfe4e1..28f8add367c00 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3676,6 +3676,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset);
+ */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
+
++/*
++ * Reports from users making use of PCI device assignment with ASM1164
++ * controllers indicate an issue with bus reset where the device fails to
++ * retrain. The issue appears more common in configurations with multiple
++ * controllers. The device does indicate PM reset support (NoSoftRst-),
++ * therefore this still leaves a viable reset method.
++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset);
++
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
+ /*
+--
+2.51.0
+
--- /dev/null
+From e44aa8fb945d0e543a9293b3873d870a33743ff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 16:44:06 +0800
+Subject: PCI: Mark Nvidia GB10 to avoid bus reset
+
+From: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+
+[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ]
+
+After asserting Secondary Bus Reset to downstream devices via a GB10 Root
+Port, the link may not retrain correctly, e.g., the link may retrain with a
+lower lane count or config accesses to downstream devices may fail.
+
+Prevent use of Secondary Bus Reset for devices below GB10.
+
+Signed-off-by: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+[bhelgaas: drop pci_ids.h update (only used once), update commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 11041831ed3c2..ce57d59a047e4 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3633,6 +3633,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+ }
+
++/*
++ * After asserting Secondary Bus Reset to downstream devices via a GB10
++ * Root Port, the link may not retrain correctly.
++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset);
++
+ /*
+ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
+ * prevented for those affected devices.
+--
+2.51.0
+
--- /dev/null
+From fafdf5f8f12c68e8a59dfab34d96756a5eb7c0e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 22:44:52 +0800
+Subject: PCI/MSI: Unmap MSI-X region on error
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ]
+
+msix_capability_init() fails to unmap the MSI-X region if
+msix_setup_interrupts() fails.
+
+Add the missing iounmap() for that error path.
+
+[ tglx: Massaged change log ]
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi/msi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
+index 7110aed956c75..7a2375585338b 100644
+--- a/drivers/pci/msi/msi.c
++++ b/drivers/pci/msi/msi.c
+@@ -648,7 +648,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+
+ ret = msix_setup_interrupts(dev, base, entries, nvec, affd);
+ if (ret)
+- goto out_disable;
++ goto out_unmap;
+
+ /* Disable INTX */
+ pci_intx_for_msi(dev, 0);
+@@ -667,6 +667,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ pcibios_free_irq(dev);
+ return 0;
+
++out_unmap:
++ iounmap(dev->msix_base);
+ out_disable:
+ dev->msix_enabled = 0;
+ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
+--
+2.51.0
+
--- /dev/null
+From f5ccb4145327e7fdf90edf71a60eea9194cb3299 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 16:39:54 +0000
+Subject: perf/arm-cmn: Support CMN-600AE
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ]
+
+The functional safety features of CMN-600AE have little to no impact on
+the PMU relative to the base CMN-600 design, so for simplicity we can
+reasonably just treat it as the same thing. The only obvious difference
+is that the revision numbers aren't aligned, so we may hide some aliases
+for events which do actually exist, but those can still be specified via
+the underlying "type,eventid" format so it's not too big a deal.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Tested-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index b2e0a79254f1e..1270e40c95226 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -202,6 +202,7 @@ enum cmn_model {
+ enum cmn_part {
+ PART_CMN600 = 0x434,
+ PART_CMN650 = 0x436,
++ PART_CMN600AE = 0x438,
+ PART_CMN700 = 0x43c,
+ PART_CI700 = 0x43a,
+ };
+@@ -2043,6 +2044,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01);
+ part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg);
+ part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8;
++ /* 600AE is close enough that it's not really worth more complexity */
++ if (part == PART_CMN600AE)
++ part = PART_CMN600;
+ if (cmn->part && cmn->part != part)
+ dev_warn(cmn->dev,
+ "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n",
+--
+2.51.0
+
--- /dev/null
+From 225f51313f0d325684ecfb3aef86590fad274b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:36 -0800
+Subject: perf callchain: Fix srcline printing with inlines
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ]
+
+sample__fprintf_callchain() was using map__fprintf_srcline() which won't
+report inline line numbers.
+
+Fix by using the srcline from the callchain and falling back to the map
+variant.
+
+Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel_fprintf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
+index 8c2ea80013291..1f672449cb513 100644
+--- a/tools/perf/util/evsel_fprintf.c
++++ b/tools/perf/util/evsel_fprintf.c
+@@ -177,8 +177,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
+ printed += fprintf(fp, ")");
+ }
+
+- if (print_srcline)
+- printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ if (print_srcline) {
++ if (node->srcline)
++ printed += fprintf(fp, "\n %s", node->srcline);
++ else
++ printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ }
+
+ if (sym && sym->inlined)
+ printed += fprintf(fp, " (inlined)");
+--
+2.51.0
+
--- /dev/null
+From 0b784b67477ac2665207e7589e41373d29c55312 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 19:17:12 +0800
+Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ]
+
+Disabling PHYs in runtime usually causes the client with external abort
+exception or similar issue due to lack of API to notify clients about PHY
+removal. This patch removes the possibility to unbind i.MX PHY drivers in
+runtime.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+index a29b4a6f7c249..c2a6e70493ff7 100644
+--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+@@ -192,6 +192,7 @@ static struct platform_driver imx8mq_usb_phy_driver = {
+ .driver = {
+ .name = "imx8mq-usb-phy",
+ .of_match_table = imx8mq_usb_phy_of_match,
++ .suppress_bind_attrs = true,
+ }
+ };
+ module_platform_driver(imx8mq_usb_phy_driver);
+--
+2.51.0
+
--- /dev/null
+From 633bf4e37f7d7b68fac9c751427156201edf0fe2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 15:06:43 +0000
+Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts
+
+From: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+
+[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ]
+
+The problem with the current implementation is that it does not consider
+that the USB controller can have multiple PHY handles with different
+arguments count, as for example we have in our cn9131 based platform:
+"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;".
+
+In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells)
+leads to not proper phy detection, taking the "marvell,cp110-utmi-phy"
+dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0
+(#phy-cells = <0>) and safely look for that phy.
+
+Signed-off-by: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+index aa27c79946104..1f4ead2583a47 100644
+--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+@@ -326,7 +326,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
+- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1);
++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0);
+ if ((port->dr_mode != USB_DR_MODE_HOST) &&
+ (port->dr_mode != USB_DR_MODE_PERIPHERAL)) {
+ dev_err(&pdev->dev,
+--
+2.51.0
+
--- /dev/null
+From 0c7acbb806ae97bdb6fa9f287132dbb5305ebe54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 10:03:58 +0800
+Subject: pstore: ram_core: fix incorrect success return when vmap() fails
+
+From: Ruipeng Qi <ruipengqi3@gmail.com>
+
+[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ]
+
+In persistent_ram_vmap(), vmap() may return NULL on failure.
+
+If offset is non-zero, adding offset_in_page(start) causes the function
+to return a non-NULL pointer even though the mapping failed.
+persistent_ram_buffer_map() therefore incorrectly returns success.
+
+Subsequent access to prz->buffer may dereference an invalid address
+and cause crashes.
+
+Add proper NULL checking for vmap() failures.
+
+Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
+Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 03d586f1ebc8c..0e58eb7ffac84 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot);
+ kfree(pages);
+
++ /*
++ * vmap() may fail and return NULL. Do not add the offset in this
++ * case, otherwise a NULL mapping would appear successful.
++ */
++ if (!vaddr)
++ return NULL;
++
+ /*
+ * Since vmap() uses page granularity, we must add the offset
+ * into the page here, to get the byte granularity address
+--
+2.51.0
+
--- /dev/null
+From aacd99f9b7b552f359e20835406161634c6d5e92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:15:16 +0100
+Subject: RDMA/rtrs-clt: For conn rejection use actual err number
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ]
+
+When the connection establishment request is rejected from the server
+side, then the actual error number sent back should be used.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com
+Reviewed-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 7c81452d73cfa..905693c686413 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1923,7 +1923,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ struct rtrs_path *s = con->c.path;
+ const struct rtrs_msg_conn_rsp *msg;
+ const char *rej_msg;
+- int status, errno;
++ int status, errno = -ECONNRESET;
+ u8 data_len;
+
+ status = ev->status;
+@@ -1945,7 +1945,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ status, rej_msg);
+ }
+
+- return -ECONNRESET;
++ return errno;
+ }
+
+ void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait)
+--
+2.51.0
+
--- /dev/null
+From 1175aac12eb6243421d8630fb3d02f3a4c610c60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 14:28:23 +0200
+Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox
+ TX channel is uninitialized
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ]
+
+Firmwares that do not use mailbox communication (e.g., the hello_world
+sample) leave priv->tx_ch as NULL. The current suspend logic
+unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without
+an initialized TX channel.
+
+Detect the no_mailboxes case early and skip sending the suspend
+message. Instead, proceed directly to the runtime PM suspend path,
+which is the correct behavior for firmwares that cannot respond to
+mailbox requests.
+
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c
+index dcd07a6a5e945..7853d1a4ded85 100644
+--- a/drivers/remoteproc/imx_dsp_rproc.c
++++ b/drivers/remoteproc/imx_dsp_rproc.c
+@@ -1229,6 +1229,15 @@ static __maybe_unused int imx_dsp_suspend(struct device *dev)
+ if (rproc->state != RPROC_RUNNING)
+ goto out;
+
++ /*
++ * No channel available for sending messages;
++ * indicates no mailboxes present, so trigger PM runtime suspend
++ */
++ if (!priv->tx_ch) {
++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n");
++ goto out;
++ }
++
+ reinit_completion(&priv->pm_comp);
+
+ /* Tell DSP that suspend is happening */
+--
+2.51.0
+
--- /dev/null
+From 41c4c2c5d205b18ef766ab82a1c8443bfee84cf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 11:07:55 +0000
+Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock`
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ]
+
+A potential circular locking dependency (ABBA deadlock) exists between
+`ec_dev->lock` and the clock framework's `prepare_lock`.
+
+The first order (A -> B) occurs when scp_ipi_send() is called while
+`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()):
+1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send().
+2. scp_ipi_send() calls clk_prepare_enable(), which acquires
+ `prepare_lock`.
+See #0 in the following example calling trace.
+(Lock Order: `ec_dev->lock` -> `prepare_lock`)
+
+The reverse order (B -> A) is more complex and has been observed
+(learned) by lockdep. It involves the clock prepare operation
+triggering power domain changes, which then propagates through sysfs
+and power supply uevents, eventually calling back into the ChromeOS EC
+driver and attempting to acquire `ec_dev->lock`:
+1. Something calls clk_prepare(), which acquires `prepare_lock`. It
+ then triggers genpd operations like genpd_runtime_resume(), which
+ takes `&genpd->mlock`.
+2. Power domain changes can trigger regulator changes; regulator
+ changes can then trigger device link changes; device link changes
+ can then trigger sysfs changes. Eventually, power_supply_uevent()
+ is called.
+3. This leads to calls like cros_usbpd_charger_get_prop(), which calls
+ cros_ec_cmd_xfer_status(), which then attempts to acquire
+ `ec_dev->lock`.
+See #1 ~ #6 in the following example calling trace.
+(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`)
+
+Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the
+remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock`
+is only acquired in prepare()/unprepare() callbacks. Since
+`ec_dev->lock` is not involved in the callbacks, the dependency loop is
+broken.
+
+This means the clock is always "prepared" when the SCP is running. The
+prolonged "prepared time" for the clock should be acceptable as SCP is
+designed to be a very power efficient processor. The power consumption
+impact can be negligible.
+
+A simplified calling trace reported by lockdep:
+> -> #6 (&ec_dev->lock)
+> cros_ec_cmd_xfer
+> cros_ec_cmd_xfer_status
+> cros_usbpd_charger_get_port_status
+> cros_usbpd_charger_get_prop
+> power_supply_get_property
+> power_supply_show_property
+> power_supply_uevent
+> dev_uevent
+> uevent_show
+> dev_attr_show
+> sysfs_kf_seq_show
+> kernfs_seq_show
+> -> #5 (kn->active#2)
+> kernfs_drain
+> __kernfs_remove
+> kernfs_remove_by_name_ns
+> sysfs_remove_file_ns
+> device_del
+> __device_link_del
+> device_links_driver_bound
+> -> #4 (device_links_lock)
+> device_link_remove
+> _regulator_put
+> regulator_put
+> -> #3 (regulator_list_mutex)
+> regulator_lock_dependent
+> regulator_disable
+> scpsys_power_off
+> _genpd_power_off
+> genpd_power_off
+> -> #2 (&genpd->mlock/1)
+> genpd_add_subdomain
+> pm_genpd_add_subdomain
+> scpsys_add_subdomain
+> scpsys_probe
+> -> #1 (&genpd->mlock)
+> genpd_runtime_resume
+> __rpm_callback
+> rpm_callback
+> rpm_resume
+> __pm_runtime_resume
+> clk_core_prepare
+> clk_prepare
+> -> #0 (prepare_lock)
+> clk_prepare
+> scp_ipi_send
+> scp_send_ipi
+> mtk_rpmsg_send
+> rpmsg_send
+> cros_ec_pkt_xfer_rpmsg
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++---------
+ drivers/remoteproc/mtk_scp_ipi.c | 4 ++--
+ 2 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
+index ffec5299b5c1d..8f513e66ef6bb 100644
+--- a/drivers/remoteproc/mtk_scp.c
++++ b/drivers/remoteproc/mtk_scp.c
+@@ -225,7 +225,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+ struct mtk_scp *scp = priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return IRQ_NONE;
+@@ -233,7 +233,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+
+ scp->data->scp_irq_handler(scp);
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return IRQ_HANDLED;
+ }
+@@ -467,7 +467,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -482,7 +482,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+
+ ret = scp_elf_load_segments(rproc, fw);
+ leave:
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+@@ -493,14 +493,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+ }
+
+ ret = scp_ipi_init(scp, fw);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -511,7 +511,7 @@ static int scp_start(struct rproc *rproc)
+ struct scp_run *run = &scp->run;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -536,14 +536,14 @@ static int scp_start(struct rproc *rproc)
+ goto stop;
+ }
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver);
+
+ return 0;
+
+ stop:
+ scp->data->scp_reset_assert(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -638,7 +638,7 @@ static int scp_stop(struct rproc *rproc)
+ struct mtk_scp *scp = (struct mtk_scp *)rproc->priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return ret;
+@@ -646,12 +646,29 @@ static int scp_stop(struct rproc *rproc)
+
+ scp->data->scp_reset_assert(scp);
+ scp->data->scp_stop(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return 0;
+ }
+
++static int scp_prepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ return clk_prepare(scp->clk);
++}
++
++static int scp_unprepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ clk_unprepare(scp->clk);
++ return 0;
++}
++
+ static const struct rproc_ops scp_ops = {
++ .prepare = scp_prepare,
++ .unprepare = scp_unprepare,
+ .start = scp_start,
+ .stop = scp_stop,
+ .load = scp_load,
+diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c
+index 4c0d121c2f54d..156447dc59bbc 100644
+--- a/drivers/remoteproc/mtk_scp_ipi.c
++++ b/drivers/remoteproc/mtk_scp_ipi.c
+@@ -164,7 +164,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+ WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf))
+ return -EINVAL;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clock\n");
+ return ret;
+@@ -207,7 +207,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+
+ unlock_mutex:
+ mutex_unlock(&scp->send_lock);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From da9f6acd74c5a6a8f745c7c43e1ed993a3643ffb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 17:16:51 +0100
+Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask"
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ]
+
+This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed.
+
+Almost every register in this chip can be customized via OTP
+memory. Somehow the value for R19, which decide if the flag is set
+on read or write operation, seems to have been overwritten for the chip
+the original patch were written for.
+
+Revert the change to follow the default behavior.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9052-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c
+index 458f919de4cb4..b79a57b45c1e8 100644
+--- a/drivers/mfd/da9052-spi.c
++++ b/drivers/mfd/da9052-spi.c
+@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)
+ spi_set_drvdata(spi, da9052);
+
+ config = da9052_regmap_config;
+- config.write_flag_mask = 1;
++ config.read_flag_mask = 1;
+ config.reg_bits = 7;
+ config.pad_bits = 1;
+ config.val_bits = 8;
+--
+2.51.0
+
--- /dev/null
+From 84a0026c17a224ac365bca5c3010789f370f2536 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 13:47:33 +0100
+Subject: rnbd-srv: Zero the rsp buffer before using it
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ]
+
+Before using the data buffer to send back the response message, zero it
+completely. This prevents any stray bytes to be picked up by the client
+side when there the message is exchanged between different protocol
+versions.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-srv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
+index ad451224e6634..549b6581b7fea 100644
+--- a/drivers/block/rnbd/rnbd-srv.c
++++ b/drivers/block/rnbd/rnbd-srv.c
+@@ -538,6 +538,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp,
+ {
+ struct block_device *bdev = sess_dev->bdev;
+
++ memset(rsp, 0, sizeof(*rsp));
++
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP);
+ rsp->device_id = cpu_to_le32(sess_dev->device_id);
+ rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev));
+@@ -643,6 +645,7 @@ static int process_msg_sess_info(struct rnbd_srv_session *srv_sess,
+
+ trace_process_msg_sess_info(srv_sess, sess_info_msg);
+
++ memset(rsp, 0, sizeof(*rsp));
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP);
+ rsp->ver = srv_sess->ver;
+
+--
+2.51.0
+
--- /dev/null
+From d5dbdf8e0e7497e84aa7f6d059cd54b37000b507 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 17:35:19 +0000
+Subject: rtc: interface: Alarm race handling should not discard preceding
+ error
+
+From: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+
+[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ]
+
+Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting
+alarm") should not discard any errors from the preceding validations.
+
+Prior to that commit, if the alarm feature was disabled, or the
+set_alarm failed, a meaningful error code would be returned to the
+caller for further action.
+
+After, more often than not, the __rtc_read_time will cause a success
+return code instead, misleading the caller.
+
+An example of this is when timer_enqueue is called for a rtc-abx080x
+device. Since that driver does not clear the alarm feature bit, but
+instead relies on the set_alarm operation to return invalid, the discard
+of the return code causes very different behaviour; i.e.
+ hwclock: select() to /dev/rtc0 to wait for clock tick timed out
+
+Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm")
+Signed-off-by: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+Reviewed-by: Esben Haabendal <esben@geanix.com>
+Tested-by: Nick Bowler <nbowler@draconx.ca>
+Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 6cfeaed49d076..36642471c4a0c 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ * are in, we can return -ETIME to signal that the timer has already
+ * expired, which is true in both cases.
+ */
+- if ((scheduled - now) <= 1) {
++ if (!err && (scheduled - now) <= 1) {
+ err = __rtc_read_time(rtc, &tm);
+ if (err)
+ return err;
+--
+2.51.0
+
--- /dev/null
+From fc25185d56b800a7092e590560396b9d0b9c4163 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:53:45 +0000
+Subject: rtc: zynqmp: correct frequency value
+
+From: Tomas Melin <tomas.melin@vaisala.com>
+
+[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ]
+
+Fix calibration value in case a clock reference is provided.
+The actual calibration value written into register is
+frequency - 1.
+
+Reviewed-by: Harini T <harini.t@amd.com>
+Tested-by: Harini T <harini.t@amd.com>
+Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-zynqmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c
+index e8a2cad05e505..d87f2f527b977 100644
+--- a/drivers/rtc/rtc-zynqmp.c
++++ b/drivers/rtc/rtc-zynqmp.c
+@@ -330,7 +330,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev)
+ &xrtcdev->freq);
+ if (ret)
+ xrtcdev->freq = RTC_CALIB_DEF;
++ } else {
++ xrtcdev->freq--;
+ }
++
+ ret = readl(xrtcdev->reg_base + RTC_CALIB_RD);
+ if (!ret)
+ writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR));
+--
+2.51.0
+
--- /dev/null
+From f19be146bb04370a106f87d478f4e8d3109edc6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 10:14:12 +0100
+Subject: s390/perf: Disable register readout on sampling events
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ]
+
+Running commands
+ # ./perf record -IR0,R1 -a sleep 1
+extracts and displays register value of general purpose register r1 and r0.
+However the value displayed of any register is random and does not
+reflect the register value recorded at the time of the sample interrupt.
+
+The sampling device driver on s390 creates a very large buffer
+for the hardware to store the samples. Only when that large buffer
+gets full an interrupt is generated and many hundreds of sample
+entries are processed and copied to the kernel ring buffer and
+eventually get copied to the perf tool. It is during the copy
+to the kernel ring buffer that each sample is processed (on s390)
+and at that time the register values are extracted.
+This is not the original goal, the register values should be read
+when the samples are created not when the samples are copied to the
+kernel ring buffer.
+
+Prevent this event from being installed in the first place and
+return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 46a1a85a0e440..96fd3654abda4 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -887,7 +887,7 @@ static bool is_callchain_event(struct perf_event *event)
+ u64 sample_type = event->attr.sample_type;
+
+ return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER |
+- PERF_SAMPLE_STACK_USER);
++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER);
+ }
+
+ static int cpumsf_pmu_event_init(struct perf_event *event)
+--
+2.51.0
+
--- /dev/null
+From be2c6998baf4ed79f5beea0831890465d338bb5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 16:47:07 +0100
+Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ]
+
+Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
+to scripts/Makefile.extrawarn, since clang generates warnings for the
+dummy variable in typecheck():
+
+ CC arch/s390/purgatory/purgatory.o
+ arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
+ 221 | return psw_bits(regs->psw).pstate;
+ | ^
+ arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
+ 98 | typecheck(psw_t, __psw); \
+ | ^
+ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
+ 11 | typeof(x) __dummy2; \
+ | ^
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/purgatory/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
+index be0626a07dd85..a8c2228b08bc3 100644
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -29,6 +29,7 @@ KBUILD_CFLAGS += -fno-stack-protector
+ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+ KBUILD_CFLAGS += $(CLANG_FLAGS)
+ KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
+ KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS))
+
+ # Since we link purgatory with -r unresolved symbols are not checked, so we
+--
+2.51.0
+
--- /dev/null
+From 30a93021f98ee4ca6171ab6c8ca5e0e960643641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:33:15 +0100
+Subject: scsi: buslogic: Reduce stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ]
+
+Some randconfig builds run into excessive stack usage with gcc-14 or
+higher, which use __attribute__((cold)) where earlier versions did not do
+that:
+
+drivers/scsi/BusLogic.c: In function 'blogic_init':
+drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
+
+The problem is that a lot of code gets inlined into blogic_init() here. Two
+functions stick out, but they are a bit different:
+
+ - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel
+ stack, which is a problem in combination with other functions that also
+ do. Marking this one as noinline means that the stack slots get get
+ reused between function calls
+
+ - blogic_reportconfig() has a few large variables, but whenever it is not
+ inlined into its caller, the compiler is actually smart enough to reuse
+ stack slots for these automatically, so marking it as noinline saves
+ most of the stack space by itself.
+
+The combination of both of these should avoid the problem entirely.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/BusLogic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index f2abffce26599..c4bd4d18a0440 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -919,7 +919,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter)
+ a particular probe order.
+ */
+
+-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter)
++static noinline_for_stack void __init
++blogic_init_probeinfo_list(struct blogic_adapter *adapter)
+ {
+ /*
+ If a PCI BIOS is present, interrogate it for MultiMaster and
+@@ -1689,7 +1690,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter)
+ blogic_reportconfig reports the configuration of Host Adapter.
+ */
+
+-static bool __init blogic_reportconfig(struct blogic_adapter *adapter)
++static noinline_for_stack bool __init
++blogic_reportconfig(struct blogic_adapter *adapter)
+ {
+ unsigned short alltgt_mask = (1 << adapter->maxdev) - 1;
+ unsigned short sync_ok, fast_ok;
+--
+2.51.0
+
--- /dev/null
+From f48e4e94adc919d68a2550ffe5bbbc8e0f4ef9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:29 +0530
+Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
+ termination is done
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ]
+
+Clear rx_running flag only after DMA teardown polling completes. In the
+previous implementation the flag was being cleared while hardware teardown
+was still in progress, creating a mismatch between software state
+(flag = 0, "ready") and hardware state (still terminating).
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 66fbc5ad8c72a..5b5debb1f30d8 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -835,7 +835,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+
+ cookie = dma->rx_cookie;
+- dma->rx_running = 0;
+
+ /* Re-enable RX FIFO interrupt now that transfer is complete */
+ if (priv->habit & UART_HAS_RHR_IT_DIS) {
+@@ -869,6 +868,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+ ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+
++ dma->rx_running = 0;
+ p->port.icount.rx += ret;
+ p->port.icount.buf_overrun += count - ret;
+ out:
+--
+2.51.0
+
--- /dev/null
+From 1011c61392da6d1fb42f84f2f41b9d3b55f2b4e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 17:54:25 +0300
+Subject: serial: 8250_dw: handle clock enable errors in runtime_resume
+
+From: Artem Shimko <a.shimko.dev@gmail.com>
+
+[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ]
+
+Add error checking for clk_prepare_enable() calls in
+dw8250_runtime_resume(). Currently if either clock fails to enable,
+the function returns success while leaving clocks in inconsistent state.
+
+This change implements comprehensive error handling by checking the return
+values of both clk_prepare_enable() calls. If the second clock enable
+operation fails after the first clock has already been successfully
+enabled, the code now properly cleans up by disabling and unpreparing
+the first clock before returning. The error code is then propagated to
+the caller, ensuring that clock enable failures are properly reported
+rather than being silently ignored.
+
+Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
+Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index c9ea854764778..ee589ad526699 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -738,11 +738,18 @@ static int dw8250_runtime_suspend(struct device *dev)
+
+ static int dw8250_runtime_resume(struct device *dev)
+ {
++ int ret;
+ struct dw8250_data *data = dev_get_drvdata(dev);
+
+- clk_prepare_enable(data->pclk);
++ ret = clk_prepare_enable(data->pclk);
++ if (ret)
++ return ret;
+
+- clk_prepare_enable(data->clk);
++ ret = clk_prepare_enable(data->clk);
++ if (ret) {
++ clk_disable_unprepare(data->pclk);
++ return ret;
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
btrfs-fix-invalid-leaf-access-in-btrfs_quota_enable-.patch
asoc-rockchip-i2s-tdm-use-param-rate-if-not-provided.patch
drm-amd-display-use-same-max-plane-scaling-limits-fo.patch
+perf-callchain-fix-srcline-printing-with-inlines.patch
+libperf-don-t-remove-g-when-extra_cflags-are-used.patch
+libperf-build-always-place-libperf-includes-first.patch
+rtc-interface-alarm-race-handling-should-not-discard.patch
+audit-add-fchmodat2-to-change-attributes-class.patch
+hfsplus-fix-volume-corruption-issue-for-generic-498.patch
+fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch
+audit-add-missing-syscalls-to-read-class.patch
+hfsplus-pretend-special-inodes-as-regular-files.patch
+i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch
+minix-add-required-sanity-checking-to-minix_check_su.patch
+smb-client-add-proper-locking-around-ses-iface_last_.patch
+gfs2-fiemap-page-fault-fix.patch
+tools-power-cpupower-reset-errno-before-strtoull.patch
+s390-purgatory-add-wno-default-const-init-unsafe-to-.patch
+perf-arm-cmn-support-cmn-600ae.patch
+arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch
+rnbd-srv-zero-the-rsp-buffer-before-using-it.patch
+x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch
+efi-cper-don-t-dump-the-entire-memory-region.patch
+apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch
+efi-cper-don-t-go-past-the-arm-processor-cper-record.patch
+acpi-processor-fix-null-pointer-dereference-in-acpi_.patch
+acpica-abort-aml-bytecode-execution-when-executing-a.patch
+s390-perf-disable-register-readout-on-sampling-event.patch
+xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch
+blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch
+sparc-synchronize-user-stack-on-fork-and-clone.patch
+sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch
+bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch
+clocksource-drivers-sh_tmu-always-leave-device-runni.patch
+clocksource-drivers-timer-integrator-ap-add-missing-.patch
+pci-msi-unmap-msi-x-region-on-error.patch
+mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch
+char-tpm-cr50-remove-irqf_oneshot.patch
+pstore-ram_core-fix-incorrect-success-return-when-vm.patch
+arm64-tegra-smaug-add-usb-role-switch-support.patch
+parisc-prevent-interrupts-during-reboot.patch
+drm-display-dp_mst-add-protection-against-0-vcpi.patch
+spi-geni-qcom-initialize-mode-related-registers-to-0.patch
+media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch
+spi-stm32-fix-overrun-issue-at-8bpw.patch
+drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch
+media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch
+media-omap3isp-isppreview-always-clamp-in-preview_tr.patch
+media-omap3isp-set-initial-format.patch
+hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch
+asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch
+asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch
+media-amphion-clear-last_buffer_dequeued-flag-for-de.patch
+media-adv7180-fix-frame-interval-in-progressive-mode.patch
+media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch
+media-solo6x10-check-for-out-of-bounds-chip_id.patch
+media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch
+drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch
+drm-account-property-blob-allocations-to-memcg.patch
+hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch
+virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch
+drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch
+drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch
+drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch
+media-rkisp1-fix-filter-mode-register-configuration.patch
+hid-multitouch-add-egalaxtouch-exc3188-support.patch
+hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch
+gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch
+asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch
+spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch
+asoc-codecs-max98390-check-return-value-of-devm_gpio.patch
+hwmon-f71882fg-add-f81968-support.patch
+asoc-es8328-add-error-unwind-in-resume.patch
+modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch
+alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch
+jfs-add-missing-set_freezable-for-freezable-kthread.patch
+jfs-nlink-overflow-in-jfs_rename.patch
+wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch
+wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch
+dm-remove-fake-timeout-to-avoid-leak-request.patch
+iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch
+wifi-libertas-fix-warning-in-usb_tx_block.patch
+pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch
+ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch
+ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch
+ext4-mark-group-add-fast-commit-ineligible.patch
+ext4-mark-group-extend-fast-commit-ineligible.patch
+netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch
+netfilter-xt_tcpmss-check-remaining-length-before-re.patch
+openrisc-define-arch-specific-version-of-nop.patch
+net-usb-r8152-fix-transmit-queue-timeout.patch
+net-rds-no-shortcut-out-of-rds_conn_error.patch
+gro-change-the-bug_on-in-gro_pull_from_frag0.patch
+net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch
+ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch
+bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch
+bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch
+bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch
+octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch
+wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch
+wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch
+net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch
+vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch
+net-rds-clear-reconnect-pending-bit.patch
+pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch
+pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch
+pci-fix-pci_slot_lock-device-locking.patch
+pci-enable-acs-after-configuring-iommu-for-of-platfo.patch
+pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch
+pci-mark-nvidia-gb10-to-avoid-bus-reset.patch
+myri10ge-avoid-uninitialized-variable-use.patch
+nfc-nxp-nci-remove-interrupt-trigger-type.patch
+rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch
+hisi_acc_vfio_pci-update-status-after-ras-error.patch
+scsi-buslogic-reduce-stack-usage.patch
+tracing-fix-false-sharing-in-hwlat-get_sample.patch
+remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch
+mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch
+mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch
+mailbox-sprd-mask-interrupts-that-are-not-handled.patch
+remoteproc-mediatek-break-lock-dependency-to-prepare.patch
+mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch
+clk-microchip-core-correct-return-value-on-_get_pare.patch
+m68k-nommu-fix-memmove-with-differently-aligned-src-.patch
+soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch
+staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch
+serial-8250_dw-handle-clock-enable-errors-in-runtime.patch
+usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch
+fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch
+dmaengine-sun6i-choose-appropriate-burst-length-unde.patch
+dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch
+misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch
+misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch
+staging-rtl8723bs-fix-memory-leak-on-failure-path.patch
+serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch
+fix-it87_wdt-early-reboot-by-reporting-running-timer.patch
+binder-don-t-use-pk-through-printk.patch
+watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch
+phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch
+phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch
+revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch
+iio-use-irqf_no_thread.patch
+iio-magnetometer-remove-irqf_oneshot.patch
+mips-loongson-make-cpumask_of_node-robust-against-nu.patch
+fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch
+fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch
+fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch
+fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch
+fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch
+ceph-supply-snapshot-context-in-ceph_uninline_data.patch
+libceph-define-and-enforce-ceph_max_key_len.patch
+include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch
+arm-9467-1-mm-don-t-use-pk-through-printk.patch
+drm-amd-display-avoid-updating-surface-with-the-same.patch
+drm-amdgpu-adjust-usleep_range-in-fence-wait.patch
+alsa-usb-audio-update-the-number-of-packets-properly.patch
+drm-amdgpu-add-hainan-clock-adjustment.patch
+drm-radeon-add-hainan-clock-adjustment.patch
+alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch
+btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch
+drm-amd-display-remove-conditional-for-shaper-3dlut-.patch
+rtc-zynqmp-correct-frequency-value.patch
+ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch
+ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch
--- /dev/null
+From 383ae05dd8b5a60e97f16396888d4915334563ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 14:54:45 -0300
+Subject: smb: client: add proper locking around ses->iface_last_update
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ]
+
+There is a missing ses->iface_lock in cifs_setup_session,
+around ses->iface_last_update.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/connect.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
+index fba6471973ef0..e909f8d720147 100644
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -4287,7 +4287,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
+ ses->ses_status = SES_IN_SETUP;
+
+ /* force iface_list refresh */
++ spin_lock(&ses->iface_lock);
+ ses->iface_last_update = 0;
++ spin_unlock(&ses->iface_lock);
+ }
+ spin_unlock(&ses->ses_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 725fa052aabf336973c6e7e154ebf7346236e472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:09:47 +0200
+Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of
+ NUC15)
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ]
+
+Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and
+LAPBC710.
+
+Link: https://github.com/thesofproject/linux/issues/5529
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/dmi-quirks.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
+index 91ab97a456fa9..5854218e1a274 100644
+--- a/drivers/soundwire/dmi-quirks.c
++++ b/drivers/soundwire/dmi-quirks.c
+@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
+ },
+ .driver_data = (void *)intel_tgl_bios,
+ },
++ {
++ /*
++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County'
++ * LAPBC510 and LAPBC710)
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"),
++ },
++ .driver_data = (void *)intel_tgl_bios,
++ },
+ {
+ /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From b5be324ebaece5215608186dd7c812861f1293cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 13:40:29 +0000
+Subject: sparc: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ]
+
+Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros").
+
+glibc-2.42 drops the legacy termio struct, but the ioctls.h header still
+defines some TC* constants in terms of termio (via sizeof). Hardcode the
+values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h
+index 7fd2f5873c9e7..a8bbdf9877a41 100644
+--- a/arch/sparc/include/uapi/asm/ioctls.h
++++ b/arch/sparc/include/uapi/asm/ioctls.h
+@@ -5,10 +5,10 @@
+ #include <asm/ioctl.h>
+
+ /* Big T */
+-#define TCGETA _IOR('T', 1, struct termio)
+-#define TCSETA _IOW('T', 2, struct termio)
+-#define TCSETAW _IOW('T', 3, struct termio)
+-#define TCSETAF _IOW('T', 4, struct termio)
++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */
++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */
++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */
++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */
+ #define TCSBRK _IO('T', 5)
+ #define TCXONC _IO('T', 6)
+ #define TCFLSH _IO('T', 7)
+--
+2.51.0
+
--- /dev/null
+From 13846c291a2df2661794866d72b7d47a56e7cad8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:47:52 +0100
+Subject: sparc: Synchronize user stack on fork and clone
+
+From: Andreas Larsson <andreas@gaisler.com>
+
+[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ]
+
+Flush all uncommitted user windows before calling the generic syscall
+handlers for clone, fork, and vfork.
+
+Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the
+arch-specific syscall wrappers for these syscalls will attempt to flush
+all windows (including user windows).
+
+In the window overflow trap handlers on both SPARC{32|64},
+if the window can't be stored (i.e due to MMU related faults) the routine
+backups the user window and increments a thread counter (wsaved).
+
+By adding a synchronization point after the flush attempt, when fault
+handling is enabled, any uncommitted user windows will be flushed.
+
+Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394
+Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++--------------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
+index 0442ab00518d3..7d69877511fac 100644
+--- a/arch/sparc/kernel/process.c
++++ b/arch/sparc/kernel/process.c
+@@ -17,14 +17,18 @@
+
+ asmlinkage long sparc_fork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+ struct kernel_clone_args args = {
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs)
+
+ asmlinkage long sparc_vfork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+-
+ struct kernel_clone_args args = {
+ .flags = CLONE_VFORK | CLONE_VM,
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs)
+
+ asmlinkage long sparc_clone(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
+- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ unsigned long orig_i1;
++ unsigned int flags;
+ long ret;
++ struct kernel_clone_args args = {0};
+
+- struct kernel_clone_args args = {
+- .flags = (flags & ~CSIGNAL),
+- .exit_signal = (flags & CSIGNAL),
+- .tls = regs->u_regs[UREG_I3],
+- };
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ args.flags = (flags & ~CSIGNAL);
++ args.exit_signal = (flags & CSIGNAL);
++ args.tls = regs->u_regs[UREG_I3];
+
+ #ifdef CONFIG_COMPAT
+ if (test_thread_flag(TIF_32BIT)) {
+--
+2.51.0
+
--- /dev/null
+From 5862947cc7057d56ea0fe712ec9370f123d9a658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:01 -0500
+Subject: spi-geni-qcom: initialize mode related registers to 0
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ]
+
+setup_fifo_params assumes these will be zero, it won't write these
+registers if the initial mode is zero.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 17b5299c18c73..61c50adac0435 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -608,6 +608,12 @@ static int spi_geni_init(struct spi_geni_master *mas)
+ case 0:
+ mas->cur_xfer_mode = GENI_SE_FIFO;
+ geni_se_select_mode(se, GENI_SE_FIFO);
++ /* setup_fifo_params assumes that these registers start with a zero value */
++ writel(0, se->base + SE_SPI_LOOPBACK);
++ writel(0, se->base + SE_SPI_DEMUX_SEL);
++ writel(0, se->base + SE_SPI_CPHA);
++ writel(0, se->base + SE_SPI_CPOL);
++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV);
+ ret = 0;
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From bcb95afa81bbbf4c1333d806108371f92f8b7fe1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 20:30:04 +0800
+Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
+
+From: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+
+[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ]
+
+spi_mem_dirmap_create() may reconfigure controller-wide settings,
+which can interfere with concurrent transfers to other devices
+sharing the same SPI controller but using different chip selects.
+
+Wrap the ->dirmap_create() callback with spi_mem_access_start() and
+spi_mem_access_end() to serialize access and prevent cross-CS
+interference during dirmap creation.
+
+This patch has been verified on a setup where a SPI TPM is connected
+to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1
+of the same controller. Without this patch, spi_mem_dirmap_create()
+for the SPI NOR flash interferes with ongoing SPI TPM data transfers,
+resulting in failure to create the TPM device. This was tested on an
+ASPEED AST2700 EVB.
+
+Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 0c79193d96972..b33ccb20598e1 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -553,9 +553,18 @@ spi_mem_dirmap_create(struct spi_mem *mem,
+
+ desc->mem = mem;
+ desc->info = *info;
+- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create)
++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) {
++ ret = spi_mem_access_start(mem);
++ if (ret) {
++ kfree(desc);
++ return ERR_PTR(ret);
++ }
++
+ ret = ctlr->mem_ops->dirmap_create(desc);
+
++ spi_mem_access_end(mem);
++ }
++
+ if (ret) {
+ desc->nodirmap = true;
+ if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
+--
+2.51.0
+
--- /dev/null
+From 2ec0a113cb60060d5670f29d34a4adaf63e41044 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 11:48:28 +0100
+Subject: spi: stm32: fix Overrun issue at < 8bpw
+
+From: Deepak Kumar <deepak.kumar01@st.com>
+
+[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ]
+
+When SPI communication is suspended by hardware automatically, it could
+happen that few bits of next frame are already clocked out due to
+internal synchronization delay.
+
+To achieve a safe suspension, we need to ensure that each word must be
+at least 8 SPI clock cycles long. That's why, if bpw is less than 8
+bits, we need to use midi to reach 8 SPI clock cycles at least.
+
+This will ensure that each word achieve safe suspension and prevent
+overrun condition.
+
+Signed-off-by: Deepak Kumar <deepak.kumar01@st.com>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index c37d557f7d03c..f42fb3be66548 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1486,11 +1486,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, u32 len)
+ cfg2_clrb |= STM32H7_SPI_CFG2_MIDI;
+ if ((len > 1) && (spi->cur_midi > 0)) {
+ u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed);
+- u32 midi = min_t(u32,
+- DIV_ROUND_UP(spi->cur_midi, sck_period_ns),
+- FIELD_GET(STM32H7_SPI_CFG2_MIDI,
+- STM32H7_SPI_CFG2_MIDI));
++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns);
+
++ if ((spi->cur_bpw + midi) < 8)
++ midi = 8 - spi->cur_bpw;
++
++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI));
+
+ dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n",
+ sck_period_ns, midi, midi * sck_period_ns);
+--
+2.51.0
+
--- /dev/null
+From cdfbb17435667b2a095e72d0bdb6478160cf337e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:47:12 +0530
+Subject: staging: rtl8723bs: fix memory leak on failure path
+
+From: Diksha Kumari <dikshakdevgan@gmail.com>
+
+[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ]
+
+cfg80211_inform_bss_frame() may return NULL on failure. In that case,
+the allocated buffer 'buf' is not freed and the function returns early,
+leading to potential memory leak.
+Fix this by ensuring that 'buf' is freed on both success and failure paths.
+
+Signed-off-by: Diksha Kumari <dikshakdevgan@gmail.com>
+Reviewed-by: Mukesh Kumar Chaurasiya <mkchauras@linux.ibm.com>
+Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+index 5c738011322fc..08b8307b96d9e 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -318,9 +318,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl
+ len, notify_signal, GFP_ATOMIC);
+
+ if (unlikely(!bss))
+- goto exit;
++ goto free_buf;
+
+ cfg80211_put_bss(wiphy, bss);
++free_buf:
+ kfree(buf);
+
+ exit:
+--
+2.51.0
+
--- /dev/null
+From ffc120b84d6aefc99cc646fa1f9083dd16d3e81f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:27:28 +0800
+Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq()
+ failure
+
+From: Liang Jie <liangjie@lixiang.com>
+
+[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ]
+
+The return value of sdio_alloc_irq() was not stored in status.
+If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds,
+status remains _SUCCESS and the error path skips resource cleanup,
+while rtw_drv_init() still returns success.
+
+Store the return value of sdio_alloc_irq() in status and reuse the
+existing error handling which relies on status.
+
+Reviewed-by: fanggeng <fanggeng@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+index 4904314845242..335e6002df70f 100644
+--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+@@ -380,7 +380,8 @@ static int rtw_drv_init(
+ if (status != _SUCCESS)
+ goto free_if1;
+
+- if (sdio_alloc_irq(dvobj) != _SUCCESS)
++ status = sdio_alloc_irq(dvobj);
++ if (status != _SUCCESS)
+ goto free_if1;
+
+ rtw_ndev_notifier_register();
+--
+2.51.0
+
--- /dev/null
+From e941b2377b9d493ffefa4c0323453033bc21b09f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:47:45 +0530
+Subject: tools/power cpupower: Reset errno before strtoull()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ]
+
+cpuidle_state_get_one_value() never cleared errno before calling
+strtoull(), so a prior ERANGE caused every cpuidle counter read to
+return zero. Reset errno to 0 before the conversion so each sysfs read
+is evaluated independently.
+
+Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index c15d0de12357f..e7b8c56638370 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -148,6 +148,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu,
+ if (len == 0)
+ return 0;
+
++ errno = 0;
+ value = strtoull(linebuf, &endp, 0);
+
+ if (endp == linebuf || errno == ERANGE)
+--
+2.51.0
+
--- /dev/null
+From b801516416c62aba0474422f3cd124e108991303 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 23:48:10 -0800
+Subject: tracing: Fix false sharing in hwlat get_sample()
+
+From: Colin Lord <clord@mykolab.com>
+
+[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ]
+
+The get_sample() function in the hwlat tracer assumes the caller holds
+hwlat_data.lock, but this is not actually happening. The result is
+unprotected data access to hwlat_data, and in per-cpu mode can result in
+false sharing which may show up as false positive latency events.
+
+The specific case of false sharing observed was primarily between
+hwlat_data.sample_width and hwlat_data.count. These are separated by
+just 8B and are therefore likely to share a cache line. When one thread
+modifies count, the cache line is in a modified state so when other
+threads read sample_width in the main latency detection loop, they fetch
+the modified cache line. On some systems, the fetch itself may be slow
+enough to count as a latency event, which could set up a self
+reinforcing cycle of latency events as each event increments count which
+then causes more latency events, continuing the cycle.
+
+The other result of the unprotected data access is that hwlat_data.count
+can end up with duplicate or missed values, which was observed on some
+systems in testing.
+
+Convert hwlat_data.count to atomic64_t so it can be safely modified
+without locking, and prevent false sharing by pulling sample_width into
+a local variable.
+
+One system this was tested on was a dual socket server with 32 CPUs on
+each numa node. With settings of 1us threshold, 1000us width, and
+2000us window, this change reduced the number of latency events from
+500 per second down to approximately 1 event per minute. Some machines
+tested did not exhibit measurable latency from the false sharing.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com
+Signed-off-by: Colin Lord <clord@mykolab.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_hwlat.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
+index 3bd6071441ade..bc437b6ce8969 100644
+--- a/kernel/trace/trace_hwlat.c
++++ b/kernel/trace/trace_hwlat.c
+@@ -102,9 +102,9 @@ struct hwlat_sample {
+ /* keep the global state somewhere. */
+ static struct hwlat_data {
+
+- struct mutex lock; /* protect changes */
++ struct mutex lock; /* protect changes */
+
+- u64 count; /* total since reset */
++ atomic64_t count; /* total since reset */
+
+ u64 sample_window; /* total sampling window (on+off) */
+ u64 sample_width; /* active sampling portion of window */
+@@ -195,8 +195,7 @@ void trace_hwlat_callback(bool enter)
+ * get_sample - sample the CPU TSC and look for likely hardware latencies
+ *
+ * Used to repeatedly capture the CPU TSC (or similar), looking for potential
+- * hardware-induced latency. Called with interrupts disabled and with
+- * hwlat_data.lock held.
++ * hardware-induced latency. Called with interrupts disabled.
+ */
+ static int get_sample(void)
+ {
+@@ -206,6 +205,7 @@ static int get_sample(void)
+ time_type start, t1, t2, last_t2;
+ s64 diff, outer_diff, total, last_total = 0;
+ u64 sample = 0;
++ u64 sample_width = READ_ONCE(hwlat_data.sample_width);
+ u64 thresh = tracing_thresh;
+ u64 outer_sample = 0;
+ int ret = -1;
+@@ -269,7 +269,7 @@ static int get_sample(void)
+ if (diff > sample)
+ sample = diff; /* only want highest value */
+
+- } while (total <= hwlat_data.sample_width);
++ } while (total <= sample_width);
+
+ barrier(); /* finish the above in the view for NMIs */
+ trace_hwlat_callback_enabled = false;
+@@ -287,8 +287,7 @@ static int get_sample(void)
+ if (kdata->nmi_total_ts)
+ do_div(kdata->nmi_total_ts, NSEC_PER_USEC);
+
+- hwlat_data.count++;
+- s.seqnum = hwlat_data.count;
++ s.seqnum = atomic64_inc_return(&hwlat_data.count);
+ s.duration = sample;
+ s.outer_duration = outer_sample;
+ s.nmi_total_ts = kdata->nmi_total_ts;
+@@ -837,7 +836,7 @@ static int hwlat_tracer_init(struct trace_array *tr)
+
+ hwlat_trace = tr;
+
+- hwlat_data.count = 0;
++ atomic64_set(&hwlat_data.count, 0);
+ tr->max_latency = 0;
+ save_tracing_thresh = tracing_thresh;
+
+--
+2.51.0
+
--- /dev/null
+From f68850d06b1adcfe6e563211e650830e89d7ca17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:48:48 +0000
+Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
+
+From: Benson Leung <bleung@chromium.org>
+
+[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ]
+
+ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated
+using whichever pdo is in the last position of the src_pdos array, presuming
+it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current
+helpers are used on that last pdo.
+
+However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and
+for PPS) may exist, and are always at the end of the array if they do.
+In the event one of these more advanced chargers are attached the helpers for
+fixed return mangled values.
+
+Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger
+with PPS support:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=13400000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=5790000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS
+APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect.
+
+Instead, enumerate through the src_pdos and filter just for Fixed PDOs for
+now, and find the one with the highest voltage and current respectively.
+
+After, from the same charger:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=20000000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=4000000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Signed-off-by: Benson Leung <bleung@chromium.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c
+index c80c23d3384e8..3fc524190baf6 100644
+--- a/drivers/usb/typec/ucsi/psy.c
++++ b/drivers/usb/typec/ucsi/psy.c
+@@ -87,15 +87,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_voltage = 0;
+
+ switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_fixed_voltage(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_voltage = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000;
++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage
++ : max_voltage;
+ }
++ val->intval = max_voltage;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0:
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+@@ -143,6 +148,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_current = 0;
+
+ if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) {
+ val->intval = 0;
+@@ -151,12 +157,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+
+ switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_max_current(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_current = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_current = pdo_max_current(pdo) * 1000;
++ max_current = (pdo_current > max_current) ? pdo_current
++ : max_current;
+ }
++ val->intval = max_current;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+ val->intval = UCSI_TYPEC_1_5_CURRENT * 1000;
+--
+2.51.0
+
--- /dev/null
+From 0991f45d8fb2802c257f8eecb6310a741bf7ec32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:45 +0100
+Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ]
+
+The unpacked unions within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)'
+ and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 239 | } u;
+ | ^
+
+./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+
+With the recent changes to compile-test the UAPI headers in more cases,
+these warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warnings.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/vbox_vmmdev_types.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
+index f8a8d6b3c5219..436678d4fb24f 100644
+--- a/include/uapi/linux/vbox_vmmdev_types.h
++++ b/include/uapi/linux/vbox_vmmdev_types.h
+@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 {
+ /** Relative to the request header. */
+ __u32 offset;
+ } page_list;
+- } u;
++ } __packed u;
+ } __packed;
+ VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
+
+@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 {
+ union {
+ __u64 phys_addr;
+ __u64 linear_addr;
+- } u;
++ } __packed u;
+ } __packed pointer;
+ struct {
+ /** Size of the buffer described by the page list. */
+--
+2.51.0
+
--- /dev/null
+From 0efdf725057a5bb03957b40787c0f3db69ff97ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:34:00 +0100
+Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ]
+
+The gcc-16.0.1 snapshot produces a false-positive warning that turns
+into a build failure with CONFIG_WERROR:
+
+In file included from arch/x86/include/asm/string.h:6,
+ from net/vmw_vsock/vmci_transport.c:10:
+In function 'vmci_transport_packet_init',
+ inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2:
+arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull]
+ 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy'
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+
+This seems relatively harmless, and it so far the only instance of this
+warning I have found. The __vmci_transport_send_control_pkt function
+is called either with wait=NULL or with one of the type values that
+pass 'wait' into memcpy() here, but not from the same caller.
+
+Replacing the memcpy with a struct assignment is otherwise the same
+but avoids the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Bryan Tan <bryan-bt.tan@broadcom.com>
+Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 95f34dffe3c22..607b3dc599a73 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt,
+
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
+- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
++ pkt->u.wait = *wait;
+ break;
+
+ case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
+--
+2.51.0
+
--- /dev/null
+From d3048d8288caf09587172e8dd6048fa1340b417f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 22:24:33 +0200
+Subject: watchdog: imx7ulp_wdt: handle the nowayout option
+
+From: Oleksandr Suvorov <cryosay@gmail.com>
+
+[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ]
+
+The module parameter `nowayout` indicates whether the watchdog should ever
+be allowed to stop, but the driver currently ignores this option.
+
+Pass the `nowayout` parameter to the watchdog core by setting the
+WDOG_NO_WAY_OUT flag accordingly.
+
+Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/imx7ulp_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c
+index 2897902090b39..7ab832b2d9c5a 100644
+--- a/drivers/watchdog/imx7ulp_wdt.c
++++ b/drivers/watchdog/imx7ulp_wdt.c
+@@ -356,6 +356,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev)
+ watchdog_stop_on_reboot(wdog);
+ watchdog_stop_on_unregister(wdog);
+ watchdog_set_drvdata(wdog, imx7ulp_wdt);
++ watchdog_set_nowayout(wdog, nowayout);
+
+ imx7ulp_wdt->hw = of_device_get_match_data(dev);
+ ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate);
+--
+2.51.0
+
--- /dev/null
+From f57f071c222e8f3de99ecdc5ef152c0030e2cb6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:56:11 +0000
+Subject: wifi: ath10k: fix lock protection in
+ ath10k_wmi_event_peer_sta_ps_state_chg()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ]
+
+ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to
+assert that ar->data_lock should be held by the caller, but neither
+ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock
+before calling this function.
+
+The field arsta->peer_ps_state is documented as protected by
+ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable,
+ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock.
+
+Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update,
+and remove the lockdep_assert_held() to be aligned with new locking,
+following the pattern used by other WMI event handlers in the driver.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu
+[removed excess blank line]
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 28bb8e37033f2..e1909e91271ad 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5282,8 +5282,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ struct ath10k_sta *arsta;
+ u8 peer_addr[ETH_ALEN];
+
+- lockdep_assert_held(&ar->data_lock);
+-
+ ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data;
+ ether_addr_copy(peer_addr, ev->peer_macaddr.addr);
+
+@@ -5298,7 +5296,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ }
+
+ arsta = (struct ath10k_sta *)sta->drv_priv;
++ spin_lock_bh(&ar->data_lock);
+ arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state);
++ spin_unlock_bh(&ar->data_lock);
+
+ exit:
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From a0b1439153b0ec508497fa6b12df649c8a4d7f0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:30:05 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il3945_store_measurement()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ]
+
+il3945_store_measurement() calls il3945_get_measurement() which internally
+calls il_send_cmd_sync() without holding il->mutex. However,
+il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that
+callers must hold this lock.
+
+Other sysfs store functions in the same file properly acquire the mutex:
+- il3945_store_flags() acquires mutex at 3945-mac.c:3110
+- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144
+
+Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call
+in the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 9054a910ca357..32dd217529a6c 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3268,7 +3268,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
+
+ D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n",
+ type, params.channel, buf);
++ mutex_lock(&il->mutex);
+ il3945_get_measurement(il, ¶ms, type);
++ mutex_unlock(&il->mutex);
+
+ return count;
+ }
+--
+2.51.0
+
--- /dev/null
+From 30765400545a348e3a2a64510c8f0ecc8c02e947 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:40:39 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il4965_store_tx_power()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ]
+
+il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex.
+However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating
+that callers must hold this lock.
+
+All other callers of il_set_tx_power() properly acquire the mutex:
+- il_bg_scan_completed() acquires mutex at common.c:1683
+- il_mac_config() acquires mutex at common.c:5006
+- il3945_commit_rxon() and il4965_commit_rxon() are called via work
+ queues that hold the mutex (like il4965_bg_alive_start)
+
+Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in
+the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 1c22a29d20d6a..f39c4d5d0a18a 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4612,7 +4612,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr,
+ if (ret)
+ IL_INFO("%s is not in decimal form.\n", buf);
+ else {
++ mutex_lock(&il->mutex);
+ ret = il_set_tx_power(il, val, false);
++ mutex_unlock(&il->mutex);
+ if (ret)
+ IL_ERR("failed setting tx power (0x%08x).\n", ret);
+ else
+--
+2.51.0
+
--- /dev/null
+From 316f26333eaacb8d1b394173115fe2748dc572b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:58:06 +0100
+Subject: wifi: libertas: fix WARNING in usb_tx_block
+
+From: Szymon Wilczek <swilczek.lx@gmail.com>
+
+[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ]
+
+The function usb_tx_block() submits cardp->tx_urb without ensuring that
+any previous transmission on this URB has completed. If a second call
+occurs while the URB is still active (e.g. during rapid firmware loading),
+usb_submit_urb() detects the active state and triggers a warning:
+'URB submitted while active'.
+
+Fix this by enforcing serialization: call usb_kill_urb() before
+submitting the new request. This ensures the URB is idle and safe to reuse.
+
+Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
+Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
+Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index 2240b4db8c036..d98c81539ba53 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb
+ goto tx_ret;
+ }
+
++ usb_kill_urb(cardp->tx_urb);
++
+ usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
+ usb_sndbulkpipe(cardp->udev,
+ cardp->ep_out),
+--
+2.51.0
+
--- /dev/null
+From b9d08ddedb8db123297fa7cdde41f2e993eda5b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Nov 2025 16:50:31 +0200
+Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ]
+
+rtw8822b_set_antenna() can be called from userspace when the chip is
+powered off. In that case a WARNING is triggered in
+rtw8822b_config_trx_mode() because trying to read the RF registers
+when the chip is powered off returns an unexpected value.
+
+Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when
+the chip is powered on.
+
+------------[ cut here ]------------
+write RF mode table fail
+WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1
+Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021
+RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+Call Trace:
+ <TASK>
+ rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]
+ rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]
+ ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]
+ nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? netdev_run_todo+0x63/0x550
+ genl_family_rcv_msg_doit+0xfc/0x160
+ genl_rcv_msg+0x1aa/0x2b0
+ ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_genl_rcv_msg+0x10/0x10
+ netlink_rcv_skb+0x59/0x110
+ genl_rcv+0x28/0x40
+ netlink_unicast+0x285/0x3c0
+ ? __alloc_skb+0xdb/0x1a0
+ netlink_sendmsg+0x20d/0x430
+ ____sys_sendmsg+0x39f/0x3d0
+ ? import_iovec+0x2f/0x40
+ ___sys_sendmsg+0x99/0xe0
+ ? refill_obj_stock+0x12e/0x240
+ __sys_sendmsg+0x8a/0xf0
+ do_syscall_64+0x81/0x970
+ ? do_syscall_64+0x81/0x970
+ ? ksys_read+0x73/0xf0
+ ? do_syscall_64+0x81/0x970
+ ? count_memcg_events+0xc2/0x190
+ ? handle_mm_fault+0x1d7/0x2d0
+ ? do_user_addr_fault+0x21a/0x690
+ ? exc_page_fault+0x7e/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+---[ end trace 0000000000000000 ]---
+
+Link: https://github.com/lwfinger/rtw88/issues/366
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+index 0b071a116c58e..35bab31a81b06 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -1026,7 +1026,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev,
+ hal->antenna_tx = antenna_tx;
+ hal->antenna_rx = antenna_rx;
+
+- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags))
++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 615cefa5fd4b888d9c67895ca9afff805f872680 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 23:09:37 +0500
+Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
+
+From: Roman Peshkichev <roman.peshkichev@gmail.com>
+
+[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ]
+
+The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter,
+while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf.
+In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0.
+
+The driver unconditionally wrote (dtim_period - 1) to
+REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This
+caused delays in broadcast/multicast traffic processing and issues with
+ad-hoc operation.
+
+Convert the function parameter to u8 to match ieee80211_bss_conf and avoid
+the underflow by writing 0 when dtim_period is 0.
+
+Link: https://github.com/lwfinger/rtw88/issues/406
+Signed-off-by: Roman Peshkichev <roman.peshkichev@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 4 ++--
+ drivers/net/wireless/realtek/rtw88/main.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 0a913cf6a615b..8f486152fbd9f 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -684,10 +684,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel)
+ }
+ EXPORT_SYMBOL(rtw_set_rx_freq_band);
+
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period)
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period)
+ {
+ rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE);
+- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1);
++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0);
+ }
+
+ void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel,
+diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h
+index f8714f4492440..2976e3fd72885 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -2150,7 +2150,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band)
+ }
+
+ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel);
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period);
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period);
+ void rtw_get_channel_params(struct cfg80211_chan_def *chandef,
+ struct rtw_channel_params *ch_param);
+ bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target);
+--
+2.51.0
+
--- /dev/null
+From 384417ea1e70c26891472846d697a91e40c61e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 16:50:35 +0800
+Subject: wifi: rtw89: pci: restore LDO setting after device resume
+
+From: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+
+[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ]
+
+The LDO (Low Dropout Regulator) setting is missing after suspend/resume
+in some platforms, and it will cause card loss. Therefore, reconfigure
+this setting to avoid it.
+
+Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index 58b6f7d4cab8b..cc553ca287d62 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -3732,6 +3732,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev)
+ rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1,
+ B_AX_SEL_REQ_ENTR_L1);
+ }
++ rtw89_pci_hci_ldo(rtwdev);
+ rtw89_pci_l2_hci_ldo(rtwdev);
+ rtw89_pci_filter_out(rtwdev);
+ rtw89_pci_link_cfg(rtwdev);
+--
+2.51.0
+
--- /dev/null
+From 7c782c53b63a65190ed4cdd6e9439953f3284ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 12:00:08 +0800
+Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when
+ CONFIG_X86_PAE is set
+
+From: Hou Wenlong <houwenlong.hwl@antgroup.com>
+
+[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ]
+
+The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests
+do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds
+different pagetables depending on whether CONFIG_X86_PAE is set.
+Therefore, enabling PAE mode for 32-bit KVM guests without
+CONFIG_X86_PAE being set would result in a boot failure during CR3
+loading.
+
+Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <d09ce9a134eb9cbc16928a5b316969f8ba606b81.1768017442.git.houwenlong.hwl@antgroup.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/pvh/head.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
+index 9e6a27018d0f6..244275df62c1f 100644
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -70,10 +70,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
+
+ mov $_pa(early_stack_end), %esp
+
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ /* Enable PAE mode. */
+ mov %cr4, %eax
+ orl $X86_CR4_PAE, %eax
+ mov %eax, %cr4
++#endif
+
+ #ifdef CONFIG_X86_64
+ /* Enable Long mode. */
+--
+2.51.0
+
--- /dev/null
+From 369e4a10e6acc8842b537628876c8ce5a4038f3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 17:47:29 -0500
+Subject: xenbus: Use .freeze/.thaw to handle xenbus devices
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ]
+
+The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming
+from s3 or s2idle disconnects its PV devices during resume. The
+backends are not expecting this and do not reconnect.
+
+b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/
+resume/chkpt") changed xen_suspend()/do_suspend() from
+PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the
+suspend/resume callbacks remained.
+
+.freeze/restore are used with hiberation where Linux restarts in a new
+place in the future. .suspend/resume are useful for runtime power
+management for the duration of a boot.
+
+The current behavior of the callbacks works for an xl save/restore or
+live migration where the domain is restored/migrated to a new location
+and connecting to a not-already-connected backend.
+
+Change xenbus_pm_ops to use .freeze/thaw/restore and drop the
+.suspend/resume hook. This matches the use in drivers/xen/manage.c for
+save/restore and live migration. With .suspend/resume empty, PV devices
+are left connected during s2idle and s3, so PV devices are not changed
+and work after resume.
+
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Acked-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index f44d5a64351e4..f07a2063beb1f 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev)
+ }
+
+ static const struct dev_pm_ops xenbus_pm_ops = {
+- .suspend = xenbus_dev_suspend,
+- .resume = xenbus_frontend_dev_resume,
+ .freeze = xenbus_dev_suspend,
+ .thaw = xenbus_dev_cancel,
+- .restore = xenbus_dev_resume,
++ .restore = xenbus_frontend_dev_resume,
+ };
+
+ static struct xen_bus_type xenbus_frontend = {
+--
+2.51.0
+
--- /dev/null
+From 9f71f65ef82607e30b603370357a8752c02e6464 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 15:03:48 -0800
+Subject: 9p/xen: protect xen_9pfs_front_free against concurrent calls
+
+From: Stefano Stabellini <stefano.stabellini@amd.com>
+
+[ Upstream commit ce8ded2e61f47747e31eeefb44dc24a2160a7e32 ]
+
+The xenwatch thread can race with other back-end change notifications
+and call xen_9pfs_front_free() twice, hitting the observed general
+protection fault due to a double-free. Guard the teardown path so only
+one caller can release the front-end state at a time, preventing the
+crash.
+
+This is a fix for the following double-free:
+
+[ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
+[ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none)
+[ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150
+[ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42
+[ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246
+[ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000
+[ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000
+[ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000
+[ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68
+[ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040
+[ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000
+[ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660
+[ 27.052418] Call Trace:
+[ 27.052420] <TASK>
+[ 27.052422] xen_9pfs_front_changed+0x5d5/0x720
+[ 27.052426] ? xenbus_otherend_changed+0x72/0x140
+[ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10
+[ 27.052434] xenwatch_thread+0x94/0x1c0
+[ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10
+[ 27.052442] kthread+0xf8/0x240
+[ 27.052445] ? __pfx_kthread+0x10/0x10
+[ 27.052449] ? __pfx_kthread+0x10/0x10
+[ 27.052452] ret_from_fork+0x16b/0x1a0
+[ 27.052456] ? __pfx_kthread+0x10/0x10
+[ 27.052459] ret_from_fork_asm+0x1a/0x30
+[ 27.052463] </TASK>
+[ 27.052465] Modules linked in:
+[ 27.052471] ---[ end trace 0000000000000000 ]---
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
+Message-ID: <20260129230348.2390470-1-stefano.stabellini@amd.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/9p/trans_xen.c | 85 ++++++++++++++++++++++++----------------------
+ 1 file changed, 44 insertions(+), 41 deletions(-)
+
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index b9ff69c7522a1..068d57515dd58 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -274,45 +274,52 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
+ {
+ int i, j;
+
+- write_lock(&xen_9pfs_lock);
+- list_del(&priv->list);
+- write_unlock(&xen_9pfs_lock);
+-
+- for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
+- struct xen_9pfs_dataring *ring = &priv->rings[i];
+-
+- cancel_work_sync(&ring->work);
+-
+- if (!priv->rings[i].intf)
+- break;
+- if (priv->rings[i].irq > 0)
+- unbind_from_irqhandler(priv->rings[i].irq, ring);
+- if (priv->rings[i].data.in) {
+- for (j = 0;
+- j < (1 << priv->rings[i].intf->ring_order);
+- j++) {
+- grant_ref_t ref;
+-
+- ref = priv->rings[i].intf->ref[j];
+- gnttab_end_foreign_access(ref, NULL);
+- }
+- free_pages_exact(priv->rings[i].data.in,
++ if (priv->rings) {
++ for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
++ struct xen_9pfs_dataring *ring = &priv->rings[i];
++
++ cancel_work_sync(&ring->work);
++
++ if (!priv->rings[i].intf)
++ break;
++ if (priv->rings[i].irq > 0)
++ unbind_from_irqhandler(priv->rings[i].irq, ring);
++ if (priv->rings[i].data.in) {
++ for (j = 0;
++ j < (1 << priv->rings[i].intf->ring_order);
++ j++) {
++ grant_ref_t ref;
++
++ ref = priv->rings[i].intf->ref[j];
++ gnttab_end_foreign_access(ref, NULL);
++ }
++ free_pages_exact(priv->rings[i].data.in,
+ 1UL << (priv->rings[i].intf->ring_order +
+ XEN_PAGE_SHIFT));
++ }
++ gnttab_end_foreign_access(priv->rings[i].ref, NULL);
++ free_page((unsigned long)priv->rings[i].intf);
+ }
+- gnttab_end_foreign_access(priv->rings[i].ref, NULL);
+- free_page((unsigned long)priv->rings[i].intf);
++ kfree(priv->rings);
+ }
+- kfree(priv->rings);
+ kfree(priv->tag);
+ kfree(priv);
+ }
+
+ static void xen_9pfs_front_remove(struct xenbus_device *dev)
+ {
+- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
++ struct xen_9pfs_front_priv *priv;
+
++ write_lock(&xen_9pfs_lock);
++ priv = dev_get_drvdata(&dev->dev);
++ if (priv == NULL) {
++ write_unlock(&xen_9pfs_lock);
++ return;
++ }
+ dev_set_drvdata(&dev->dev, NULL);
++ list_del(&priv->list);
++ write_unlock(&xen_9pfs_lock);
++
+ xen_9pfs_front_free(priv);
+ }
+
+@@ -379,7 +386,7 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ {
+ int ret, i;
+ struct xenbus_transaction xbt;
+- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
++ struct xen_9pfs_front_priv *priv;
+ char *versions, *v;
+ unsigned int max_rings, max_ring_order, len = 0;
+
+@@ -407,6 +414,10 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ if (p9_xen_trans.maxsize > XEN_FLEX_RING_SIZE(max_ring_order))
+ p9_xen_trans.maxsize = XEN_FLEX_RING_SIZE(max_ring_order) / 2;
+
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv)
++ return -ENOMEM;
++ priv->dev = dev;
+ priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings),
+ GFP_KERNEL);
+ if (!priv->rings) {
+@@ -465,6 +476,11 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ goto error;
+ }
+
++ write_lock(&xen_9pfs_lock);
++ dev_set_drvdata(&dev->dev, priv);
++ list_add_tail(&priv->list, &xen_9pfs_devs);
++ write_unlock(&xen_9pfs_lock);
++
+ xenbus_switch_state(dev, XenbusStateInitialised);
+ return 0;
+
+@@ -479,19 +495,6 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ static int xen_9pfs_front_probe(struct xenbus_device *dev,
+ const struct xenbus_device_id *id)
+ {
+- struct xen_9pfs_front_priv *priv = NULL;
+-
+- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv)
+- return -ENOMEM;
+-
+- priv->dev = dev;
+- dev_set_drvdata(&dev->dev, priv);
+-
+- write_lock(&xen_9pfs_lock);
+- list_add_tail(&priv->list, &xen_9pfs_devs);
+- write_unlock(&xen_9pfs_lock);
+-
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2dc1cb8708d3698c198fa5a69bc4369be0617f71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 17:48:56 +0300
+Subject: ACPI: battery: fix incorrect charging status when current is zero
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ata İlhan Köktürk <atailhan2006@gmail.com>
+
+[ Upstream commit bb1256e0ddc7e9e406164319769b9f8d8389f056 ]
+
+On some laptops, such as the Huawei Matebook series, the embedded
+controller continues to report "Charging" status even when the
+charge threshold is reached and no current is being drawn.
+
+This incorrect reporting prevents the system from switching to battery
+power profiles, leading to significantly higher power (e.g., 18W instead
+of 7W during browsing) and missed remaining battery time estimation.
+
+Validate the "Charging" state by checking if rate_now is zero. If the
+hardware reports charging but the current is zero, report "Not Charging"
+to user space.
+
+Signed-off-by: Ata İlhan Köktürk <atailhan2006@gmail.com>
+[ rjw: Whitespace fix, braces added to an inner if (), new comment rewrite ]
+[ rjw: Changelog edits ]
+Link: https://patch.msgid.link/20260129144856.43058-1-atailhan2006@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/battery.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 11c7e35fafa25..a33d60e625f81 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -212,7 +212,14 @@ static int acpi_battery_get_property(struct power_supply *psy,
+ if (battery->state & ACPI_BATTERY_STATE_DISCHARGING)
+ val->intval = acpi_battery_handle_discharging(battery);
+ else if (battery->state & ACPI_BATTERY_STATE_CHARGING)
+- val->intval = POWER_SUPPLY_STATUS_CHARGING;
++ /* Validate the status by checking the current. */
++ if (battery->rate_now != ACPI_BATTERY_VALUE_UNKNOWN &&
++ battery->rate_now == 0) {
++ /* On charge but no current (0W/0mA). */
++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
++ } else {
++ val->intval = POWER_SUPPLY_STATUS_CHARGING;
++ }
+ else if (battery->state & ACPI_BATTERY_STATE_CHARGE_LIMITING)
+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
+ else if (acpi_battery_is_charged(battery))
+--
+2.51.0
+
--- /dev/null
+From 545377dbf6af50ac259fc79ec1882579ad564b5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 00:32:14 +0800
+Subject: ACPI: processor: Fix NULL-pointer dereference in
+ acpi_processor_errata_piix4()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ]
+
+In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
+device and then reassigned an ISA device:
+
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
+
+If the first lookup succeeds but the second fails, dev becomes NULL. This
+leads to a potential null-pointer dereference when dev_dbg() is called:
+
+ if (errata.piix4.bmisx)
+ dev_dbg(&dev->dev, ...);
+
+To prevent this, use two temporary pointers and retrieve each device
+independently, avoiding overwriting dev with a possible NULL value.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+[ rjw: Subject adjustment, added an empty code line ]
+Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_processor.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index 2a99f5eb69629..d8674aee28c2e 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ {
+ u8 value1 = 0;
+ u8 value2 = 0;
++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL;
+
+
+ if (!dev)
+@@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * each IDE controller's DMA status to make sure we catch all
+ * DMA activity.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- errata.piix4.bmisx = pci_resource_start(dev, 4);
+- pci_dev_put(dev);
++ if (ide_dev) {
++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
++ pci_dev_put(ide_dev);
+ }
+
+ /*
+@@ -124,24 +125,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * disable C3 support if this is enabled, as some legacy
+ * devices won't operate well if fast DMA is disabled.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB_0,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- pci_read_config_byte(dev, 0x76, &value1);
+- pci_read_config_byte(dev, 0x77, &value2);
++ if (isa_dev) {
++ pci_read_config_byte(isa_dev, 0x76, &value1);
++ pci_read_config_byte(isa_dev, 0x77, &value2);
+ if ((value1 & 0x80) || (value2 & 0x80))
+ errata.piix4.fdma = 1;
+- pci_dev_put(dev);
++ pci_dev_put(isa_dev);
+ }
+
+ break;
+ }
+
+- if (errata.piix4.bmisx)
+- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
+- if (errata.piix4.fdma)
+- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
++ if (ide_dev)
++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
++
++ if (isa_dev)
++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From c57d3f440a1f110e5db1cb547b517561d0a012b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 15:27:19 +0800
+Subject: ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
+
+From: Ai Chao <aichao@kylinos.cn>
+
+[ Upstream commit ba6ded26dffe511b862a98a25955955e7154bfa8 ]
+
+Like the JWIPC JVC9100 has its serial IRQ (10 and 11) described
+as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which
+breaks the serial.
+
+irq 10, level, active-low, shared, skip-override
+irq 11, level, active-low, shared, skip-override
+
+Add the JVC9100 to the irq1_level_low_skip_override[] quirk table to fix
+this.
+
+Signed-off-by: Ai Chao <aichao@kylinos.cn>
+Link: https://patch.msgid.link/20260113072719.4154485-1-aichao@kylinos.cn
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 4937032490689..8a01a3718aa94 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -531,6 +531,12 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "16T90SP"),
+ },
+ },
++ {
++ /* JWIPC JVC9100 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "JVC9100"),
++ },
++ },
+ { }
+ };
+
+@@ -698,6 +704,8 @@ struct irq_override_cmp {
+
+ static const struct irq_override_cmp override_table[] = {
+ { irq1_level_low_skip_override, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false },
++ { irq1_level_low_skip_override, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false },
++ { irq1_level_low_skip_override, 11, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false },
+ { irq1_edge_low_force_override, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From c38941e12074d8aa2c713d2ea3c3548cd5795790 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Feb 2026 00:22:42 +0200
+Subject: ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
+
+From: Yauhen Kharuzhy <jekhor@gmail.com>
+
+[ Upstream commit a8c975302868c716afef0f50467bebbd069a35b8 ]
+
+The PWM2 on YB1-X90 tablets is used for keyboard backlight control but
+it is disabled in the ACPI DSDT table. Add it to the override_status_ids
+list to allow keyboard function control driver
+(drivers/platform/x86/lenovo/yogabook.c) to use it.
+
+Signed-off-by: Yauhen Kharuzhy <jekhor@gmail.com>
+Link: https://patch.msgid.link/20260211222242.4101162-1-jekhor@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index 4ee30c2897a2b..418951639f511 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -81,6 +81,18 @@ static const struct override_status_id override_status_ids[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"),
+ }),
+
++ /*
++ * Lenovo Yoga Book uses PWM2 for touch keyboard backlight control.
++ * It needs to be enabled only for the Android device version (YB1-X90*
++ * aka YETI-11); the Windows version (YB1-X91*) uses ACPI control
++ * methods.
++ */
++ PRESENT_ENTRY_HID("80862289", "2", INTEL_ATOM_AIRMONT, {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"),
++ }),
++
+ /*
+ * The INT0002 device is necessary to clear wakeup interrupt sources
+ * on Cherry Trail devices, without it we get nobody cared IRQ msgs.
+--
+2.51.0
+
--- /dev/null
+From 8270311389ab48b53260387867e12c8c22a80f23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 21:01:21 +0100
+Subject: ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
+
+From: Jakob Riemenschneider <riemenschneiderjakob@gmail.com>
+
+[ Upstream commit 229ecbaac6b31f89c554b77eb407377a5eade7d4 ]
+
+Windows 11, version 22H2 introduced a new function index (Function 9) to
+the Microsoft LPS0 _DSM, titled "Turn On Display Notification".
+
+According to Microsoft documentation, this function signals to the system
+firmware that the OS intends to turn on the display when exiting Modern
+Standby. This allows the firmware to release Power Limits (PLx) earlier.
+
+Crucially, this patch fixes a functional issue observed on the Lenovo Yoga
+Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to
+resume after suspend. Investigation linked shows the EC on this device
+turns off these components during sleep but requires the Function 9
+notification to wake them up again.
+
+This patch defines the new function index (ACPI_MS_TURN_ON_DISPLAY) and
+invokes it in acpi_s2idle_restore_early_lps0(). The execution order is
+updated to match the logic of an "intent" signal:
+
+ 1. LPS0 Exit (Function 6)
+ 2. Turn On Display Intent (Function 9)
+ 3. Modern Standby Exit (Function 8)
+ 4. Screen On (Function 4)
+
+Invoking Function 9 before the Modern Standby Exit ensures the firmware
+has time to restore power rails and functionality (like fans) before the
+software fully exits the sleep state.
+
+Link: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications#turn-on-display-notification-function-9
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220505
+Suggested-by: Antheas Kapenekakis <antheas@antheas.dev>
+Signed-off-by: Jakob Riemenschneider <riemenschneiderjakob@gmail.com>
+Link: https://patch.msgid.link/20260127200121.1292216-1-riemenschneiderjakob@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/s2idle.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c
+index dd0b40b9bbe8b..377a268867c21 100644
+--- a/drivers/acpi/x86/s2idle.c
++++ b/drivers/acpi/x86/s2idle.c
+@@ -45,6 +45,7 @@ static const struct acpi_device_id lps0_device_ids[] = {
+ #define ACPI_LPS0_EXIT 6
+ #define ACPI_LPS0_MS_ENTRY 7
+ #define ACPI_LPS0_MS_EXIT 8
++#define ACPI_MS_TURN_ON_DISPLAY 9
+
+ /* AMD */
+ #define ACPI_LPS0_DSM_UUID_AMD "e3f32452-febc-43ce-9039-932122d37721"
+@@ -373,6 +374,8 @@ static const char *acpi_sleep_dsm_state_to_str(unsigned int state)
+ return "lps0 ms entry";
+ case ACPI_LPS0_MS_EXIT:
+ return "lps0 ms exit";
++ case ACPI_MS_TURN_ON_DISPLAY:
++ return "lps0 ms turn on display";
+ }
+ } else {
+ switch (state) {
+@@ -619,6 +622,9 @@ void acpi_s2idle_restore_early(void)
+ if (lps0_dsm_func_mask_microsoft > 0) {
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT,
+ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
++ /* Intent to turn on display */
++ acpi_sleep_run_lps0_dsm(ACPI_MS_TURN_ON_DISPLAY,
++ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
+ /* Modern Standby exit */
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_EXIT,
+ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
+--
+2.51.0
+
--- /dev/null
+From a4099df580e7aab28e1aeed0adcd9485db55f14c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 13:25:33 +0100
+Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ]
+
+The ACPI specification states that when executing AML_FATAL_OP,
+the OS should log the fatal error event and shutdown in a timely
+fashion.
+
+Windows complies with this requirement by immediatly entering a
+Bso_d, effectively aborting the execution of the AML bytecode in
+question.
+
+ACPICA however might continue with the AML bytecode execution
+should acpi_os_signal() simply return AE_OK. This will cause issues
+because ACPI BIOS implementations might assume that the Fatal()
+operator does not return.
+
+Fix this by aborting the AML bytecode execution in such a case
+by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a
+local variable because of its small size (12 bytes) and to ensure
+that acpi_os_signal() always receives valid information about the
+fatal ACPI BIOS error.
+
+Link: https://github.com/acpica/acpica/commit/d516c7758ba6
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++---------------------
+ 1 file changed, 18 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
+index d3091f619909e..41758343657dd 100644
+--- a/drivers/acpi/acpica/exoparg3.c
++++ b/drivers/acpi/acpica/exoparg3.c
+@@ -10,6 +10,7 @@
+ #include <acpi/acpi.h>
+ #include "accommon.h"
+ #include "acinterp.h"
++#include <acpi/acoutput.h>
+ #include "acparser.h"
+ #include "amlcode.h"
+
+@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3")
+ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ {
+ union acpi_operand_object **operand = &walk_state->operands[0];
+- struct acpi_signal_fatal_info *fatal;
+- acpi_status status = AE_OK;
++ struct acpi_signal_fatal_info fatal;
+
+ ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R,
+ acpi_ps_get_opcode_name(walk_state->opcode));
+@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ switch (walk_state->opcode) {
+ case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */
+
+- ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+- "FatalOp: Type %X Code %X Arg %X "
+- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
+- (u32)operand[0]->integer.value,
+- (u32)operand[1]->integer.value,
+- (u32)operand[2]->integer.value));
+-
+- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info));
+- if (fatal) {
+- fatal->type = (u32) operand[0]->integer.value;
+- fatal->code = (u32) operand[1]->integer.value;
+- fatal->argument = (u32) operand[2]->integer.value;
+- }
++ fatal.type = (u32)operand[0]->integer.value;
++ fatal.code = (u32)operand[1]->integer.value;
++ fatal.argument = (u32)operand[2]->integer.value;
+
+- /* Always signal the OS! */
++ ACPI_BIOS_ERROR((AE_INFO,
++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n",
++ fatal.type, fatal.code, fatal.argument));
+
+- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal);
++ /* Always signal the OS! */
+
+- /* Might return while OS is shutting down, just continue */
++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal);
+
+- ACPI_FREE(fatal);
+- goto cleanup;
++ /*
++ * Might return while OS is shutting down, so abort the AML execution
++ * by returning an error.
++ */
++ return_ACPI_STATUS(AE_ERROR);
+
+ case AML_EXTERNAL_OP:
+ /*
+@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ * wrong if an external opcode ever gets here.
+ */
+ ACPI_ERROR((AE_INFO, "Executed External Op"));
+- status = AE_OK;
+- goto cleanup;
++
++ return_ACPI_STATUS(AE_OK);
+
+ default:
+
+ ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X",
+ walk_state->opcode));
+
+- status = AE_AML_BAD_OPCODE;
+- goto cleanup;
++ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
+ }
+-
+-cleanup:
+-
+- return_ACPI_STATUS(status);
+ }
+
+ /*******************************************************************************
+--
+2.51.0
+
--- /dev/null
+From 51882d007ede18ae2306df82a22c6dfe1b0bcd12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 18:30:43 +0100
+Subject: alpha: fix user-space corruption during memory compaction
+
+From: Magnus Lindholm <linmag7@gmail.com>
+
+[ Upstream commit dd5712f3379cfe760267cdd28ff957d9ab4e51c7 ]
+
+Alpha systems can suffer sporadic user-space crashes and heap
+corruption when memory compaction is enabled.
+
+Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned
+tcache chunk"), and compiler internal errors. The failures disappear
+when compaction is disabled or when using global TLB invalidation.
+
+The root cause is insufficient TLB shootdown during page migration.
+Alpha relies on ASN-based MM context rollover for instruction cache
+coherency, but this alone is not sufficient to prevent stale data or
+instruction translations from surviving migration.
+
+Fix this by introducing a migration-specific helper that combines:
+ - MM context invalidation (ASN rollover),
+ - immediate per-CPU TLB invalidation (TBI),
+ - synchronous cross-CPU shootdown when required.
+
+The helper is used only by migration/compaction paths to avoid changing
+global TLB semantics.
+
+Additionally, update flush_tlb_other(), pte_clear(), to use
+READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering.
+
+This fixes observed crashes on both UP and SMP Alpha systems.
+
+Reviewed-by: Ivan Kokshaysky <ink@unseen.parts>
+Tested-by: Matoro Mahri <matoro_mailinglist_kernel@matoro.tk>
+Tested-by: Michael Cree <mcree@orcon.net.nz>
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/20260102173603.18247-2-linmag7@gmail.com
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/asm/pgtable.h | 33 ++++++++-
+ arch/alpha/include/asm/tlbflush.h | 4 +-
+ arch/alpha/mm/Makefile | 2 +-
+ arch/alpha/mm/tlbflush.c | 112 ++++++++++++++++++++++++++++++
+ 4 files changed, 148 insertions(+), 3 deletions(-)
+ create mode 100644 arch/alpha/mm/tlbflush.c
+
+diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
+index 02e8817a89212..8b620551304e9 100644
+--- a/arch/alpha/include/asm/pgtable.h
++++ b/arch/alpha/include/asm/pgtable.h
+@@ -17,6 +17,7 @@
+ #include <asm/processor.h> /* For TASK_SIZE */
+ #include <asm/machvec.h>
+ #include <asm/setup.h>
++#include <linux/page_table_check.h>
+
+ struct mm_struct;
+ struct vm_area_struct;
+@@ -213,6 +214,9 @@ extern inline void pud_set(pud_t * pudp, pmd_t * pmdp)
+ { pud_val(*pudp) = _PAGE_TABLE | ((((unsigned long) pmdp) - PAGE_OFFSET) << (32-PAGE_SHIFT)); }
+
+
++extern void migrate_flush_tlb_page(struct vm_area_struct *vma,
++ unsigned long addr);
++
+ extern inline unsigned long
+ pmd_page_vaddr(pmd_t pmd)
+ {
+@@ -232,7 +236,7 @@ extern inline int pte_none(pte_t pte) { return !pte_val(pte); }
+ extern inline int pte_present(pte_t pte) { return pte_val(pte) & _PAGE_VALID; }
+ extern inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+- pte_val(*ptep) = 0;
++ WRITE_ONCE(pte_val(*ptep), 0);
+ }
+
+ extern inline int pmd_none(pmd_t pmd) { return !pmd_val(pmd); }
+@@ -294,6 +298,33 @@ extern inline pte_t * pte_offset_kernel(pmd_t * dir, unsigned long address)
+
+ extern pgd_t swapper_pg_dir[1024];
+
++#ifdef CONFIG_COMPACTION
++#define __HAVE_ARCH_PTEP_GET_AND_CLEAR
++
++static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
++ unsigned long address,
++ pte_t *ptep)
++{
++ pte_t pte = READ_ONCE(*ptep);
++
++ pte_clear(mm, address, ptep);
++ return pte;
++}
++
++#define __HAVE_ARCH_PTEP_CLEAR_FLUSH
++
++static inline pte_t ptep_clear_flush(struct vm_area_struct *vma,
++ unsigned long addr, pte_t *ptep)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ pte_t pte = ptep_get_and_clear(mm, addr, ptep);
++
++ page_table_check_pte_clear(mm, pte);
++ migrate_flush_tlb_page(vma, addr);
++ return pte;
++}
++
++#endif
+ /*
+ * The Alpha doesn't have any external MMU info: the kernel page
+ * tables contain all the necessary information.
+diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h
+index ba4b359d6c395..0c8529997f54e 100644
+--- a/arch/alpha/include/asm/tlbflush.h
++++ b/arch/alpha/include/asm/tlbflush.h
+@@ -58,7 +58,9 @@ flush_tlb_other(struct mm_struct *mm)
+ unsigned long *mmc = &mm->context[smp_processor_id()];
+ /* Check it's not zero first to avoid cacheline ping pong
+ when possible. */
+- if (*mmc) *mmc = 0;
++
++ if (READ_ONCE(*mmc))
++ WRITE_ONCE(*mmc, 0);
+ }
+
+ #ifndef CONFIG_SMP
+diff --git a/arch/alpha/mm/Makefile b/arch/alpha/mm/Makefile
+index 101dbd06b4ceb..2d05664058f64 100644
+--- a/arch/alpha/mm/Makefile
++++ b/arch/alpha/mm/Makefile
+@@ -3,4 +3,4 @@
+ # Makefile for the linux alpha-specific parts of the memory manager.
+ #
+
+-obj-y := init.o fault.o
++obj-y := init.o fault.o tlbflush.o
+diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
+new file mode 100644
+index 0000000000000..ccbc317b9a348
+--- /dev/null
++++ b/arch/alpha/mm/tlbflush.c
+@@ -0,0 +1,112 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Alpha TLB shootdown helpers
++ *
++ * Copyright (C) 2025 Magnus Lindholm <linmag7@gmail.com>
++ *
++ * Alpha-specific TLB flush helpers that cannot be expressed purely
++ * as inline functions.
++ *
++ * These helpers provide combined MM context handling (ASN rollover)
++ * and immediate TLB invalidation for page migration and memory
++ * compaction paths, where lazy shootdowns are insufficient.
++ */
++
++#include <linux/mm.h>
++#include <linux/smp.h>
++#include <linux/sched.h>
++#include <asm/tlbflush.h>
++#include <asm/pal.h>
++#include <asm/mmu_context.h>
++
++#define asn_locked() (cpu_data[smp_processor_id()].asn_lock)
++
++/*
++ * Migration/compaction helper: combine mm context (ASN) handling with an
++ * immediate per-page TLB invalidate and (for exec) an instruction barrier.
++ *
++ * This mirrors the SMP combined IPI handler semantics, but runs locally on UP.
++ */
++#ifndef CONFIG_SMP
++void migrate_flush_tlb_page(struct vm_area_struct *vma,
++ unsigned long addr)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ int tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2;
++
++ /*
++ * First do the mm-context side:
++ * If we're currently running this mm, reload a fresh context ASN.
++ * Otherwise, mark context invalid.
++ *
++ * On UP, this is mostly about matching the SMP semantics and ensuring
++ * exec/i-cache tagging assumptions hold when compaction migrates pages.
++ */
++ if (mm == current->active_mm)
++ flush_tlb_current(mm);
++ else
++ flush_tlb_other(mm);
++
++ /*
++ * Then do the immediate translation kill for this VA.
++ * For exec mappings, order instruction fetch after invalidation.
++ */
++ tbi(tbi_type, addr);
++}
++
++#else
++struct tlb_mm_and_addr {
++ struct mm_struct *mm;
++ unsigned long addr;
++ int tbi_type; /* 2 = DTB, 3 = ITB+DTB */
++};
++
++static void ipi_flush_mm_and_page(void *x)
++{
++ struct tlb_mm_and_addr *d = x;
++
++ /* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */
++ if (d->mm == current->active_mm && !asn_locked())
++ __load_new_mm_context(d->mm);
++ else
++ flush_tlb_other(d->mm);
++
++ /* Part 2: immediate per-VA invalidation on this CPU. */
++ tbi(d->tbi_type, d->addr);
++}
++
++void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ struct tlb_mm_and_addr d = {
++ .mm = mm,
++ .addr = addr,
++ .tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2,
++ };
++
++ /*
++ * One synchronous rendezvous: every CPU runs ipi_flush_mm_and_page().
++ * This is the "combined" version of flush_tlb_mm + per-page invalidate.
++ */
++ preempt_disable();
++ on_each_cpu(ipi_flush_mm_and_page, &d, 1);
++
++ /*
++ * mimic flush_tlb_mm()'s mm_users<=1 optimization.
++ */
++ if (atomic_read(&mm->mm_users) <= 1) {
++
++ int cpu, this_cpu;
++ this_cpu = smp_processor_id();
++
++ for (cpu = 0; cpu < NR_CPUS; cpu++) {
++ if (!cpu_online(cpu) || cpu == this_cpu)
++ continue;
++ if (READ_ONCE(mm->context[cpu]))
++ WRITE_ONCE(mm->context[cpu], 0);
++ }
++ }
++ preempt_enable();
++}
++
++#endif
+--
+2.51.0
+
--- /dev/null
+From 5027e7d1e41cdae71b6e493b0235bb69cdc32c4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 23:55:01 +0800
+Subject: ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
+
+From: gongqi <550230171hxy@gmail.com>
+
+[ Upstream commit f2581ea2d9f30844c437e348a462027ea25c12e9 ]
+
+The headset microphone on the MECHREVO Wujie 15X Pro requires the
+CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID
+(0x1d05:0x3012) to the quirk table.
+
+Signed-off-by: gongqi <550230171hxy@gmail.com>
+Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 84ab357b840d6..482e801a496a1 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1123,6 +1123,7 @@ static const struct hda_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
+ SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
++ SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC),
+ HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER),
+ HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER),
+ {}
+--
+2.51.0
+
--- /dev/null
+From 54bd2c487e061072c74648b83c52b1367bca691a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 00:12:40 +0530
+Subject: ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
+
+From: Bharat Dev Burman <bharat.singh7924@gmail.com>
+
+[ Upstream commit 72919c57a055f6d7b79d66731dc398e9b433f47c ]
+
+HP Victus 16-e0xxx with ALC245 codec does not handle the toggling of
+the mute LED.
+This patch adds a quirk entry for subsystem ID 0x88eb using a new
+ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT fixup, enabling correct mute LED
+behavior.
+
+Signed-off-by: Bharat Dev Burman <bharat.singh7924@gmail.com>
+Link: https://patch.msgid.link/20260112184253.33376-1-bharat.singh7924@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 5c2f442fca79a..b680646643b97 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4763,6 +4763,22 @@ static void alc245_fixup_hp_mute_led_v1_coefbit(struct hda_codec *codec,
+ }
+ }
+
++static void alc245_fixup_hp_mute_led_v2_coefbit(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->mute_led_polarity = 0;
++ spec->mute_led_coef.idx = 0x0b;
++ spec->mute_led_coef.mask = 1 << 3;
++ spec->mute_led_coef.on = 1 << 3;
++ spec->mute_led_coef.off = 0;
++ snd_hda_gen_add_mute_led_cdev(codec, coef_mute_led_set);
++ }
++}
++
+ /* turn on/off mic-mute LED per capture hook by coef bit */
+ static int coef_micmute_led_set(struct led_classdev *led_cdev,
+ enum led_brightness brightness)
+@@ -7992,6 +8008,7 @@ enum {
+ ALC287_FIXUP_YOGA7_14ARB7_I2C,
+ ALC245_FIXUP_HP_MUTE_LED_COEFBIT,
+ ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT,
++ ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT,
+ ALC245_FIXUP_HP_X360_MUTE_LEDS,
+ ALC287_FIXUP_THINKPAD_I2S_SPK,
+ ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD,
+@@ -10268,6 +10285,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc245_fixup_hp_mute_led_v1_coefbit,
+ },
++ [ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc245_fixup_hp_mute_led_v2_coefbit,
++ },
+ [ALC245_FIXUP_HP_X360_MUTE_LEDS] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc245_fixup_hp_mute_led_coefbit,
+@@ -10694,6 +10715,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
++ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT),
+ SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+ SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),
+--
+2.51.0
+
--- /dev/null
+From 8e1b4a0924cb9bcd05bd05fedf71fa603d7d5d06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Feb 2026 23:19:37 +0100
+Subject: ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
+
+From: Illia Barbashyn <04baril@gmail.com>
+
+[ Upstream commit ac1ff574bbc09a6c90f4fe8f9e6b8d66c983064c ]
+
+The mute and mic-mute LEDs on HP ENVY x360 Convertible 15-es0xxx
+(PCI SSID 103c:88b3) do not work with the current driver.
+
+This model requires a combination of COEFBIT and GPIO fixups to
+correctly control the LEDs. Introduce a new fixup function
+alc245_fixup_hp_envy_x360_mute_led and add a quirk to apply it.
+
+Signed-off-by: Illia Barbashyn <04baril@gmail.com>
+Link: https://patch.msgid.link/20260207221955.24132-1-04baril@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 371538937434c..85178a0303a57 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4858,6 +4858,13 @@ static void alc285_fixup_hp_spectre_x360_mute_led(struct hda_codec *codec,
+ alc285_fixup_hp_gpio_micmute_led(codec, fix, action);
+ }
+
++static void alc245_fixup_hp_envy_x360_mute_led(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ alc245_fixup_hp_mute_led_v1_coefbit(codec, fix, action);
++ alc245_fixup_hp_gpio_led(codec, fix, action);
++}
++
+ static void alc236_fixup_hp_mute_led(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -8087,6 +8094,7 @@ enum {
+ ALC285_FIXUP_HP_GPIO_LED,
+ ALC285_FIXUP_HP_MUTE_LED,
+ ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED,
++ ALC245_FIXUP_HP_ENVY_X360_MUTE_LED,
+ ALC285_FIXUP_HP_BEEP_MICMUTE_LED,
+ ALC236_FIXUP_HP_MUTE_LED_COEFBIT2,
+ ALC236_FIXUP_HP_GPIO_LED,
+@@ -9699,6 +9707,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_spectre_x360_mute_led,
+ },
++ [ALC245_FIXUP_HP_ENVY_X360_MUTE_LED] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc245_fixup_hp_envy_x360_mute_led,
++ },
+ [ALC285_FIXUP_HP_BEEP_MICMUTE_LED] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_beep,
+@@ -10882,6 +10894,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8895, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x103c, 0x88b3, "HP ENVY x360 Convertible 15-es0xxx", ALC245_FIXUP_HP_ENVY_X360_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT),
+--
+2.51.0
+
--- /dev/null
+From a7862ad178676b7b11b45e55c04ba426bad28ea3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 18:14:52 +0100
+Subject: ALSA: hda/realtek: fix LG Gram Style 14 speakers
+
+From: Damien Dagorn <damien.dagorn29@gmail.com>
+
+[ Upstream commit cc051fbd7f40226cc407558bc97c5099513e8657 ]
+
+The LG Gram Style 14 (14Z90RS-G.AD77F, SSID 1854:0490) with Realtek ALC298
+shows normal routing and volume changes, but internal speakers stay silent
+unless a userland HDA-verb workaround is applied.
+
+Add a dedicated quirk for the LG Gram Style 14 that programs the codec
+coefficient sequence used by the known workaround and enables the speaker
+amps only during playback.
+
+Tested-by: Damien Dagorn <damien.dagorn29@gmail.com>
+Signed-off-by: Damien Dagorn <damien.dagorn29@gmail.com>
+Link: https://lore.kernel.org/CAN59QMUhd4kHrkRoJA6VzEr2VKezN2yjHnANaQoZn2-Bnwe3bQ@mail.gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 170 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 170 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b680646643b97..371538937434c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5040,6 +5040,163 @@ static void alc298_samsung_v2_init_amps(struct hda_codec *codec,
+ spec->gen.pcm_playback_hook = alc298_samsung_v2_playback_hook;
+ }
+
++/* LG Gram Style 14: program vendor coef sequence used by HDA-verb workaround */
++struct alc298_lg_gram_style_seq {
++ unsigned short verb;
++ unsigned short idx;
++ unsigned short val;
++};
++
++static void alc298_lg_gram_style_coef_write(struct hda_codec *codec,
++ unsigned int verb,
++ unsigned int idx,
++ unsigned int val)
++{
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_COEF_INDEX, 0x23);
++ snd_hda_codec_write(codec, 0x20, 0, verb, idx);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0x00);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, val);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0xb011);
++}
++
++static void alc298_lg_gram_style_run_seq(struct hda_codec *codec,
++ const struct alc298_lg_gram_style_seq *seq,
++ int seq_size)
++{
++ int i;
++
++ for (i = 0; i < seq_size; i++)
++ alc298_lg_gram_style_coef_write(codec, seq[i].verb,
++ seq[i].idx, seq[i].val);
++}
++
++/* Coef sequences derived from the HDA-verb workaround for this model. */
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_preinit_seq[] = {
++ { 0x420, 0x00, 0x01 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_disable_seq[] = {
++ { 0x423, 0xff, 0x00 },
++ { 0x420, 0x3a, 0x80 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_enable_seq[] = {
++ { 0x420, 0x3a, 0x81 },
++ { 0x423, 0xff, 0x01 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_38[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe },
++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 },
++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_39[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd },
++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 },
++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3c[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe },
++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3d[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd },
++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d },
++};
++
++struct alc298_lg_gram_style_amp_desc {
++ unsigned char nid;
++ const struct alc298_lg_gram_style_seq *init_seq;
++ int init_seq_size;
++};
++
++static const struct alc298_lg_gram_style_amp_desc alc298_lg_gram_style_amps[] = {
++ { 0x38, alc298_lg_gram_style_init_seq_38,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_38) },
++ { 0x39, alc298_lg_gram_style_init_seq_39,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_39) },
++ { 0x3c, alc298_lg_gram_style_init_seq_3c,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3c) },
++ { 0x3d, alc298_lg_gram_style_init_seq_3d,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3d) },
++};
++
++static void alc298_lg_gram_style_enable_amps(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ int i;
++
++ for (i = 0; i < spec->num_speaker_amps; i++) {
++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_enable_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_enable_seq));
++ }
++}
++
++static void alc298_lg_gram_style_disable_amps(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ int i;
++
++ for (i = 0; i < spec->num_speaker_amps; i++) {
++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_disable_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq));
++ }
++}
++
++static void alc298_lg_gram_style_playback_hook(struct hda_pcm_stream *hinfo,
++ struct hda_codec *codec,
++ struct snd_pcm_substream *substream,
++ int action)
++{
++ if (action == HDA_GEN_PCM_ACT_OPEN)
++ alc298_lg_gram_style_enable_amps(codec);
++ if (action == HDA_GEN_PCM_ACT_CLOSE)
++ alc298_lg_gram_style_disable_amps(codec);
++}
++
++static void alc298_lg_gram_style_init_amps(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ int i;
++
++ spec->num_speaker_amps = ARRAY_SIZE(alc298_lg_gram_style_amps);
++
++ for (i = 0; i < spec->num_speaker_amps; i++) {
++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_preinit_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_preinit_seq));
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_disable_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq));
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_amps[i].init_seq,
++ alc298_lg_gram_style_amps[i].init_seq_size);
++ alc_write_coef_idx(codec, 0x89, 0x0);
++ }
++
++ spec->gen.pcm_playback_hook = alc298_lg_gram_style_playback_hook;
++}
++
+ static void alc298_fixup_samsung_amp_v2_2_amps(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -5054,6 +5211,13 @@ static void alc298_fixup_samsung_amp_v2_4_amps(struct hda_codec *codec,
+ alc298_samsung_v2_init_amps(codec, 4);
+ }
+
++static void alc298_fixup_lg_gram_style_14(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PROBE)
++ alc298_lg_gram_style_init_amps(codec);
++}
++
+ static void gpio2_mic_hotkey_event(struct hda_codec *codec,
+ struct hda_jack_callback *event)
+ {
+@@ -7932,6 +8096,7 @@ enum {
+ ALC298_FIXUP_SAMSUNG_AMP,
+ ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS,
+ ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS,
++ ALC298_FIXUP_LG_GRAM_STYLE_14,
+ ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ ALC295_FIXUP_ASUS_MIC_NO_PRESENCE,
+@@ -9580,6 +9745,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc298_fixup_samsung_amp_v2_4_amps
+ },
++ [ALC298_FIXUP_LG_GRAM_STYLE_14] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc298_fixup_lg_gram_style_14
++ },
+ [ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -11378,6 +11547,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1854, 0x0488, "LG gram 16 (16Z90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
+ SND_PCI_QUIRK(0x1854, 0x0489, "LG gram 16 (16Z90R-A)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
+ SND_PCI_QUIRK(0x1854, 0x048a, "LG gram 17 (17ZD90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
++ SND_PCI_QUIRK(0x1854, 0x0490, "LG Gram Style 14 (14Z90RS)", ALC298_FIXUP_LG_GRAM_STYLE_14),
+ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
+ SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x19e5, 0x3212, "Huawei KLV-WX9 ", ALC256_FIXUP_ACER_HEADSET_MIC),
+--
+2.51.0
+
--- /dev/null
+From e7789b495edb2992e02ca5908ae90275177e54bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 13:12:11 +0100
+Subject: ALSA: mixer: oss: Add card disconnect checkpoints
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 084d5d44418148662365eced3e126ad1a81ee3e2 ]
+
+ALSA OSS mixer layer calls the kcontrol ops rather individually, and
+pending calls might be not always caught at disconnecting the device.
+
+For avoiding the potential UAF scenarios, add sanity checks of the
+card disconnection at each entry point of OSS mixer accesses. The
+rwsem is taken just before that check, hence the rest context should
+be covered by that properly.
+
+Link: https://patch.msgid.link/20260209121212.171430-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/oss/mixer_oss.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
+index 05fc8911479c1..a6cc74bb25fd4 100644
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -525,6 +525,8 @@ static void snd_mixer_oss_get_volume1_vol(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -558,6 +560,8 @@ static void snd_mixer_oss_get_volume1_sw(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -618,6 +622,8 @@ static void snd_mixer_oss_put_volume1_vol(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -655,6 +661,8 @@ static void snd_mixer_oss_put_volume1_sw(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -792,6 +800,8 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
+ if (uinfo == NULL || uctl == NULL)
+ return -ENOMEM;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return -ENODEV;
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+ if (!kctl)
+ return -ENOENT;
+@@ -835,6 +845,8 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
+ if (uinfo == NULL || uctl == NULL)
+ return -ENOMEM;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return -ENODEV;
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+ if (!kctl)
+ return -ENOENT;
+@@ -878,6 +890,8 @@ static int snd_mixer_oss_build_test(struct snd_mixer_oss *mixer, struct slot *sl
+ int err;
+
+ scoped_guard(rwsem_read, &card->controls_rwsem) {
++ if (card->shutdown)
++ return -ENODEV;
+ kcontrol = snd_mixer_oss_test_id(mixer, name, index);
+ if (kcontrol == NULL)
+ return 0;
+@@ -1002,6 +1016,8 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer,
+ if (snd_mixer_oss_build_test_all(mixer, ptr, &slot))
+ return 0;
+ guard(rwsem_read)(&mixer->card->controls_rwsem);
++ if (mixer->card->shutdown)
++ return -ENODEV;
+ kctl = NULL;
+ if (!ptr->index)
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+--
+2.51.0
+
--- /dev/null
+From aaf124e358927b5afe6f8d4fdfff0cbd2e29f377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 08:38:29 +0000
+Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
+
+From: Lianqin Hu <hulianqin@vivo.com>
+
+[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ]
+
+Setting up the interface when suspended/resumeing fail on this card.
+Adding a reset and delay quirk will eliminate this problem.
+
+usb 1-1: New USB device found, idVendor=001f, idProduct=0b21
+usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+usb 1-1: Product: AB13X USB Audio
+usb 1-1: Manufacturer: Generic
+usb 1-1: SerialNumber: 20210926172016
+
+Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
+Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 8fa840df46210..947467112409a 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2147,6 +2147,8 @@ struct usb_audio_quirk_flags_table {
+
+ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ /* Device matches */
++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */
++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
+ DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
+ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
+ DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
+--
+2.51.0
+
--- /dev/null
+From 25822c656ddeb8d19a5cbeeb7bafd776e4f15efb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:07 +0100
+Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ]
+
+At silencing the playback URB packets in the implicit fb mode before
+the actual playback, we blindly assume that the received packets fit
+with the buffer size. But when the setup in the capture stream
+differs from the playback stream (e.g. due to the USB core limitation
+of max packet size), such an inconsistency may lead to OOB writes to
+the buffer, resulting in a crash.
+
+For addressing it, add a sanity check of the transfer buffer size at
+prepare_silent_urb(), and stop the data copy if the received data
+overflows. Also, report back the transfer error properly from there,
+too.
+
+Note that this doesn't fix the root cause of the playback error
+itself, but this merely covers the kernel Oops.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
+Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 39 ++++++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 17 deletions(-)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 35165f7865673..cb94c2cad2213 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -278,8 +278,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip)
+ return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH;
+ }
+
+-static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+- struct snd_urb_ctx *ctx)
++static int prepare_silent_urb(struct snd_usb_endpoint *ep,
++ struct snd_urb_ctx *ctx)
+ {
+ struct urb *urb = ctx->urb;
+ unsigned int offs = 0;
+@@ -292,28 +292,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+ extra = sizeof(packet_length);
+
+ for (i = 0; i < ctx->packets; ++i) {
+- unsigned int offset;
+- unsigned int length;
+- int counts;
+-
+- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
+- length = counts * ep->stride; /* number of silent bytes */
+- offset = offs * ep->stride + extra * i;
+- urb->iso_frame_desc[i].offset = offset;
++ int length;
++
++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
++ if (length < 0)
++ return length;
++ length *= ep->stride; /* number of silent bytes */
++ if (offs + length + extra > ctx->buffer_size)
++ break;
++ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = length + extra;
+ if (extra) {
+ packet_length = cpu_to_le32(length);
+- memcpy(urb->transfer_buffer + offset,
++ memcpy(urb->transfer_buffer + offs,
+ &packet_length, sizeof(packet_length));
++ offs += extra;
+ }
+- memset(urb->transfer_buffer + offset + extra,
++ memset(urb->transfer_buffer + offs,
+ ep->silence_value, length);
+- offs += counts;
++ offs += length;
+ }
+
+- urb->number_of_packets = ctx->packets;
+- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra;
++ if (!offs)
++ return -EPIPE;
++
++ urb->number_of_packets = i;
++ urb->transfer_buffer_length = offs;
+ ctx->queued = 0;
++ return 0;
+ }
+
+ /*
+@@ -335,8 +341,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep,
+ if (data_subs && ep->prepare_data_urb)
+ return ep->prepare_data_urb(data_subs, urb, in_stream_lock);
+ /* no data provider, so send silence */
+- prepare_silent_urb(ep, ctx);
+- break;
++ return prepare_silent_urb(ep, ctx);
+
+ case SND_USB_ENDPOINT_TYPE_SYNC:
+ if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) {
+--
+2.51.0
+
--- /dev/null
+From ac7eaf59d6acf8b77f12e5610e1a7781046b93ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:05 +0100
+Subject: ALSA: usb-audio: Update the number of packets properly at receiving
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ]
+
+At receiving the packets from the implicit feedback source, we didn't
+update ctx->packets field but only the ctx->packet_size[] data.
+In exceptional cases, this might lead to unexpectedly superfluous data
+transfer (although this won't happen usually due to the nature of USB
+isochronous transfer). Fix it to update the field properly.
+
+Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index aa201e4744bf6..35165f7865673 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -489,6 +489,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+
+ /* copy over the length information */
+ if (implicit_fb) {
++ ctx->packets = packet->packets;
+ for (i = 0; i < packet->packets; i++)
+ ctx->packet_size[i] = packet->packet_size[i];
+ }
+--
+2.51.0
+
--- /dev/null
+From b9865d5b50a28ec18f492a07d2e3ca63a767e37a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:03 +0100
+Subject: APEI/GHES: ARM processor Error: don't go past allocated memory
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 87880af2d24e62a84ed19943dbdd524f097172f2 ]
+
+If the BIOS generates a very small ARM Processor Error, or
+an incomplete one, the current logic will fail to deferrence
+
+ err->section_length
+and
+ ctx_info->size
+
+Add checks to avoid that. With such changes, such GHESv2
+records won't cause OOPSes like this:
+
+[ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP
+[ 1.495449] Modules linked in:
+[ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT
+[ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+[ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred
+[ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+[ 1.497199] pc : log_arm_hw_error+0x5c/0x200
+[ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220
+
+0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75).
+70 err_info = (struct cper_arm_err_info *)(err + 1);
+71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num);
+72 ctx_err = (u8 *)ctx_info;
+73
+74 for (n = 0; n < err->context_info_num; n++) {
+75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
+76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
+77 ctx_len += sz;
+78 }
+79
+
+and similar ones while trying to access section_length on an
+error dump with too small size.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 32 ++++++++++++++++++++++++++++----
+ drivers/ras/ras.c | 6 +++++-
+ 2 files changed, 33 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index cefa2ae4fa246..98901fbe2f7b7 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -536,21 +536,45 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
+ {
+ struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata);
+ int flags = sync ? MF_ACTION_REQUIRED : 0;
++ int length = gdata->error_data_length;
+ char error_type[120];
+ bool queued = false;
+ int sec_sev, i;
+ char *p;
+
+ sec_sev = ghes_severity(gdata->error_severity);
+- log_arm_hw_error(err, sec_sev);
++ if (length >= sizeof(*err)) {
++ log_arm_hw_error(err, sec_sev);
++ } else {
++ pr_warn(FW_BUG "arm error length: %d\n", length);
++ pr_warn(FW_BUG "length is too small\n");
++ pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
++ return false;
++ }
++
+ if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE)
+ return false;
+
+ p = (char *)(err + 1);
++ length -= sizeof(err);
++
+ for (i = 0; i < err->err_info_num; i++) {
+- struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p;
+- bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR;
+- bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR);
++ struct cper_arm_err_info *err_info;
++ bool is_cache, has_pa;
++
++ /* Ensure we have enough data for the error info header */
++ if (length < sizeof(*err_info))
++ break;
++
++ err_info = (struct cper_arm_err_info *)p;
++
++ /* Validate the claimed length before using it */
++ length -= err_info->length;
++ if (length < 0)
++ break;
++
++ is_cache = err_info->type & CPER_ARM_CACHE_ERROR;
++ has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR);
+
+ /*
+ * The field (err_info->error_info & BIT(26)) is fixed to set to
+diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
+index c1b36a5601c4b..ae993db1f9c16 100644
+--- a/drivers/ras/ras.c
++++ b/drivers/ras/ras.c
+@@ -71,7 +71,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
+ ctx_err = (u8 *)ctx_info;
+
+ for (n = 0; n < err->context_info_num; n++) {
+- sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
++ sz = sizeof(struct cper_arm_ctx_info);
++
++ if (sz + (long)ctx_info - (long)err >= err->section_length)
++ sz += ctx_info->size;
++
+ ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
+ ctx_len += sz;
+ }
+--
+2.51.0
+
--- /dev/null
+From 9a6b8e3294aba80ad18495c477b834f9a56b3b6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:05 +0100
+Subject: APEI/GHES: ensure that won't go past CPER allocated record
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ]
+
+The logic at ghes_new() prevents allocating too large records, by
+checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
+Yet, the allocation is done with the actual number of pages from the
+CPER bios table location, which can be smaller.
+
+Yet, a bad firmware could send data with a different size, which might
+be bigger than the allocated memory, causing an OOPS:
+
+ Unable to handle kernel paging request at virtual address fff00000f9b40000
+ Mem abort info:
+ ESR = 0x0000000096000007
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x07: level 3 translation fault
+ Data abort info:
+ ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+ swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
+ [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
+ Internal error: Oops: 0000000096000007 [#1] SMP
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
+ Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+ Workqueue: kacpi_notify acpi_os_execute_deferred
+ pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+ pc : hex_dump_to_buffer+0x30c/0x4a0
+ lr : hex_dump_to_buffer+0x328/0x4a0
+ sp : ffff800080e13880
+ x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
+ x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
+ x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
+ x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
+ x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
+ x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
+ x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
+ x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
+ x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
+ x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
+ Call trace:
+ hex_dump_to_buffer+0x30c/0x4a0 (P)
+ print_hex_dump+0xac/0x170
+ cper_estatus_print_section+0x90c/0x968
+ cper_estatus_print+0xf0/0x158
+ __ghes_print_estatus+0xa0/0x148
+ ghes_proc+0x1bc/0x220
+ ghes_notify_hed+0x5c/0xb8
+ notifier_call_chain+0x78/0x148
+ blocking_notifier_call_chain+0x4c/0x80
+ acpi_hed_notify+0x28/0x40
+ acpi_ev_notify_dispatch+0x50/0x80
+ acpi_os_execute_deferred+0x24/0x48
+ process_one_work+0x15c/0x3b0
+ worker_thread+0x2d0/0x400
+ kthread+0x148/0x228
+ ret_from_fork+0x10/0x20
+ Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
+ ---[ end trace 0000000000000000 ]---
+
+Prevent that by taking the actual allocated are into account when
+checking for CPER length.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 6 +++++-
+ include/acpi/ghes.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 45fa2510e4cf5..cefa2ae4fa246 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -29,6 +29,7 @@
+ #include <linux/cper.h>
+ #include <linux/cleanup.h>
+ #include <linux/platform_device.h>
++#include <linux/minmax.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+ #include <linux/vmalloc.h>
+@@ -293,6 +294,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
+ error_block_length = GHES_ESTATUS_MAX_SIZE;
+ }
+ ghes->estatus = kmalloc(error_block_length, GFP_KERNEL);
++ ghes->estatus_length = error_block_length;
+ if (!ghes->estatus) {
+ rc = -ENOMEM;
+ goto err_unmap_status_addr;
+@@ -364,13 +366,15 @@ static int __ghes_check_estatus(struct ghes *ghes,
+ struct acpi_hest_generic_status *estatus)
+ {
+ u32 len = cper_estatus_len(estatus);
++ u32 max_len = min(ghes->generic->error_block_length,
++ ghes->estatus_length);
+
+ if (len < sizeof(*estatus)) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n");
+ return -EIO;
+ }
+
+- if (len > ghes->generic->error_block_length) {
++ if (!len || len > max_len) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n");
+ return -EIO;
+ }
+diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
+index be1dd4c1a9174..16646fdd1f841 100644
+--- a/include/acpi/ghes.h
++++ b/include/acpi/ghes.h
+@@ -21,6 +21,7 @@ struct ghes {
+ struct acpi_hest_generic_v2 *generic_v2;
+ };
+ struct acpi_hest_generic_status *estatus;
++ unsigned int estatus_length;
+ unsigned long flags;
+ union {
+ struct list_head list;
+--
+2.51.0
+
--- /dev/null
+From 672246fbcdd53347df176a5ca62533dac2a866dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 10:56:33 +0100
+Subject: ARM: 9467/1: mm: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weissschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ]
+
+Restricted pointers ("%pK") were never meant to be used
+through printk(). They can acquire sleeping locks in atomic contexts.
+
+Switch to %px over the more secure %p as this usage is a debugging aid,
+gated behind CONFIG_DEBUG_VIRTUAL and used by WARN().
+
+Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/physaddr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c
+index 3f263c840ebc4..1a37ebfacbba9 100644
+--- a/arch/arm/mm/physaddr.c
++++ b/arch/arm/mm/physaddr.c
+@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x)
+ phys_addr_t __virt_to_phys(unsigned long x)
+ {
+ WARN(!__virt_addr_valid(x),
+- "virt_to_phys used for non-linear address: %pK (%pS)\n",
++ "virt_to_phys used for non-linear address: %px (%pS)\n",
+ (void *)x, (void *)x);
+
+ return __virt_to_phys_nodebug(x);
+--
+2.51.0
+
--- /dev/null
+From 237b45b3598bced3dd3e3d4047a0c73ce938cded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 17:24:48 +0800
+Subject: arm64: Add support for TSV110 Spectre-BHB mitigation
+
+From: Jinqian Yang <yangjinqian1@huawei.com>
+
+[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ]
+
+The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
+Buffer) attack, which can be exploited to leak information through
+branch prediction side channels. This commit adds the MIDR of TSV110
+to the list for software mitigation.
+
+Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
+Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/proton-pack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
+index 31eaf15d2079a..ea8ca0714156b 100644
+--- a/arch/arm64/kernel/proton-pack.c
++++ b/arch/arm64/kernel/proton-pack.c
+@@ -896,6 +896,7 @@ static u8 spectre_bhb_loop_affected(void)
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ {},
+ };
+ static const struct midr_range spectre_bhb_k24_list[] = {
+--
+2.51.0
+
--- /dev/null
+From cceacaa6ccddc25230d8f61facf08b41b2f6db25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 11:54:21 +0100
+Subject: arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 729a2e8e9ac47099a967567389cc9d73ef4194ca ]
+
+gcc-16 warns about an instance that older compilers did not:
+
+arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_clear':
+arch/arm64/mm/hugetlbpage.c:369:57: error: parameter 'addr' set but not used [-Werror=unused-but-set-parameter=]
+
+The issue here is that __pte_clear() does not actually use its second
+argument, but when CONFIG_ARM64_CONTPTE is enabled it still gets
+updated.
+
+Replace the macro with an inline function to let the compiler see
+the argument getting passed down.
+
+Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Dev Jain <dev.jain@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/pgtable.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index eb57ddb5ecc53..2de5a70a47ce3 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -93,8 +93,6 @@ static inline pteval_t __phys_to_pte_val(phys_addr_t phys)
+ __pte(__phys_to_pte_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))
+
+ #define pte_none(pte) (!pte_val(pte))
+-#define __pte_clear(mm, addr, ptep) \
+- __set_pte(ptep, __pte(0))
+ #define pte_page(pte) (pfn_to_page(pte_pfn(pte)))
+
+ /*
+@@ -1224,6 +1222,13 @@ static inline bool pud_user_accessible_page(pud_t pud)
+ /*
+ * Atomic pte/pmd modifications.
+ */
++
++static inline void __pte_clear(struct mm_struct *mm,
++ unsigned long addr, pte_t *ptep)
++{
++ __set_pte(ptep, __pte(0));
++}
++
+ static inline int __ptep_test_and_clear_young(struct vm_area_struct *vma,
+ unsigned long address,
+ pte_t *ptep)
+--
+2.51.0
+
--- /dev/null
+From e0a0d03b8fbd907e11ffe6c2e8958b7fdf434176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 21:27:21 +0000
+Subject: arm64: tegra: smaug: Add usb-role-switch support
+
+From: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+
+[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ]
+
+The USB2 port on Smaug is configured for OTG operation but lacked the
+required 'usb-role-switch' property, leading to a failed probe and a
+non-functioning USB port. Add the property along with setting the default
+role to host.
+
+Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+index 2e5b6b2c1f56b..ff2952fae35c9 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+@@ -1782,6 +1782,8 @@ usb2-0 {
+ status = "okay";
+ vbus-supply = <&usbc_vbus>;
+ mode = "otg";
++ usb-role-switch;
++ role-switch-default-mode = "host";
+ };
+
+ usb3-0 {
+--
+2.51.0
+
--- /dev/null
+From d086f4818065dfc29d22466888d02a48a424e7f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 17:19:04 +0800
+Subject: ASoC: codecs: max98390: Check return value of
+ devm_gpiod_get_optional() in max98390_i2c_probe()
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ]
+
+The devm_gpiod_get_optional() function may return an error pointer
+(ERR_PTR) in case of a genuine failure during GPIO acquisition,
+not just NULL which indicates the legitimate absence of an optional
+GPIO.
+
+Add an IS_ERR() check after the function call to catch such errors and
+propagate them to the probe function, ensuring the driver fails to load
+safely rather than proceeding with an invalid pointer.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98390.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c
+index 1bae253618fd0..3a2befb3fab39 100644
+--- a/sound/soc/codecs/max98390.c
++++ b/sound/soc/codecs/max98390.c
+@@ -1075,6 +1075,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c)
+
+ reset_gpio = devm_gpiod_get_optional(&i2c->dev,
+ "reset", GPIOD_OUT_HIGH);
++ if (IS_ERR(reset_gpio))
++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio),
++ "Failed to get reset gpio\n");
+
+ /* Power on device */
+ if (reset_gpio) {
+--
+2.51.0
+
--- /dev/null
+From cd6197f38d1b8938ae187429ee033cbc4ebc7768 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jan 2026 00:00:17 +0800
+Subject: ASoC: es8328: Add error unwind in resume
+
+From: Hsieh Hung-En <hungen3108@gmail.com>
+
+[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ]
+
+Handle failures in the resume path by unwinding previously enabled
+resources.
+
+If enabling regulators or syncing the regcache fails, disable regulators
+and unprepare the clock to avoid leaking resources and leaving the device
+in a partially resumed state.
+
+Signed-off-by: Hsieh Hung-En <hungen3108@gmail.com>
+Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index 76159c45e6b52..c0d7ce64b2d96 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -756,17 +756,23 @@ static int es8328_resume(struct snd_soc_component *component)
+ es8328->supplies);
+ if (ret) {
+ dev_err(component->dev, "unable to enable regulators\n");
+- return ret;
++ goto err_clk;
+ }
+
+ regcache_mark_dirty(regmap);
+ ret = regcache_sync(regmap);
+ if (ret) {
+ dev_err(component->dev, "unable to sync regcache\n");
+- return ret;
++ goto err_regulators;
+ }
+
+ return 0;
++
++err_regulators:
++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies);
++err_clk:
++ clk_disable_unprepare(es8328->clk);
++ return ret;
+ }
+
+ static int es8328_component_probe(struct snd_soc_component *component)
+--
+2.51.0
+
--- /dev/null
+From 0032df2633b8be033bae6b1dfefb5bff2086f1d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 05:24:29 +0000
+Subject: ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 84faa91585fa22a161763f2fe8f84a602a196c87 ]
+
+imx_rpmsg_probe() calls snd_soc_find_dai() without holding client_mutex.
+However, snd_soc_find_dai() has lockdep_assert_held(&client_mutex)
+indicating callers must hold this lock, as the function iterates over the
+global component list.
+
+All other callers of snd_soc_find_dai() either hold client_mutex via the
+snd_soc_bind_card() path or use the snd_soc_find_dai_with_mutex() wrapper.
+
+Use snd_soc_find_dai_with_mutex() instead to fix the missing lock
+protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260205052429.4046903-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-rpmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/fsl/imx-rpmsg.c b/sound/soc/fsl/imx-rpmsg.c
+index ce98d2288193b..b4d6ad563445f 100644
+--- a/sound/soc/fsl/imx-rpmsg.c
++++ b/sound/soc/fsl/imx-rpmsg.c
+@@ -145,7 +145,7 @@ static int imx_rpmsg_probe(struct platform_device *pdev)
+ data->dai.ignore_pmdown_time = 1;
+
+ data->dai.cpus->dai_name = pdev->dev.platform_data;
+- cpu_dai = snd_soc_find_dai(data->dai.cpus);
++ cpu_dai = snd_soc_find_dai_with_mutex(data->dai.cpus);
+ if (!cpu_dai) {
+ ret = -EPROBE_DEFER;
+ goto fail;
+--
+2.51.0
+
--- /dev/null
+From db6da7beca9a5f57b9aad6eddf47c86effda7600 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 17:17:48 +0800
+Subject: ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
+ aggregated
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 08c09899960118ffb01417242e659eb6cc067d6a ]
+
+rt722 is aggregated with rt1320 amp in arl_rt722_l0_rt1320_l2 and it is
+the only audio configuration in the ARL platform. Set .aggregated = 1 to
+represent the fact and avoid unexpected issue.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://patch.msgid.link/20260119091749.1752088-2-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../intel/common/soc-acpi-intel-arl-match.c | 23 +++++++++----------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-arl-match.c b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
+index 1ad704ca2c5f2..36d73623fb161 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-arl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
+@@ -45,23 +45,22 @@ static const struct snd_soc_acpi_endpoint spk_3_endpoint = {
+ .group_id = 1,
+ };
+
+-/*
+- * RT722 is a multi-function codec, three endpoints are created for
+- * its headset, amp and dmic functions.
+- */
+-static const struct snd_soc_acpi_endpoint rt722_endpoints[] = {
++static const struct snd_soc_acpi_endpoint jack_amp_g1_dmic_endpoints[] = {
++ /* Jack Endpoint */
+ {
+ .num = 0,
+ .aggregated = 0,
+ .group_position = 0,
+ .group_id = 0,
+ },
++ /* Amp Endpoint, work as spk_l_endpoint */
+ {
+ .num = 1,
+- .aggregated = 0,
++ .aggregated = 1,
+ .group_position = 0,
+- .group_id = 0,
++ .group_id = 1,
+ },
++ /* DMIC Endpoint */
+ {
+ .num = 2,
+ .aggregated = 0,
+@@ -229,11 +228,11 @@ static const struct snd_soc_acpi_adr_device rt711_sdca_0_adr[] = {
+ }
+ };
+
+-static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = {
++static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = {
+ {
+ .adr = 0x000030025D072201ull,
+- .num_endpoints = ARRAY_SIZE(rt722_endpoints),
+- .endpoints = rt722_endpoints,
++ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints),
++ .endpoints = jack_amp_g1_dmic_endpoints,
+ .name_prefix = "rt722"
+ }
+ };
+@@ -371,8 +370,8 @@ static const struct snd_soc_acpi_link_adr arl_sdca_rvp[] = {
+ static const struct snd_soc_acpi_link_adr arl_rt722_l0_rt1320_l2[] = {
+ {
+ .mask = BIT(0),
+- .num_adr = ARRAY_SIZE(rt722_0_single_adr),
+- .adr_d = rt722_0_single_adr,
++ .num_adr = ARRAY_SIZE(rt722_0_agg_adr),
++ .adr_d = rt722_0_agg_adr,
+ },
+ {
+ .mask = BIT(2),
+--
+2.51.0
+
--- /dev/null
+From 3736fb21b1b9b07e723fff4b7db0fb2d6f6c3cd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 10:18:32 +0200
+Subject: ASoC: SOF: Intel: hda: Fix NULL pointer dereference
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit 16c589567a956d46a7c1363af3f64de3d420af20 ]
+
+If there's a mismatch between the DAI links in the machine driver and
+the topology, it is possible that the playback/capture widget is not
+set, especially in the case of loopback capture for echo reference
+where we use the dummy DAI link. Return the error when the widget is not
+set to avoid a null pointer dereference like below when the topology is
+broken.
+
+RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]
+
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Mateusz Redzynia <mateuszx.redzynia@intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
+index 2e58a264da556..169bfd23f1b93 100644
+--- a/sound/soc/sof/intel/hda-dai.c
++++ b/sound/soc/sof/intel/hda-dai.c
+@@ -70,12 +70,22 @@ static const struct hda_dai_widget_dma_ops *
+ hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai)
+ {
+ struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream);
+- struct snd_sof_widget *swidget = w->dobj.private;
++ struct snd_sof_widget *swidget;
+ struct snd_sof_dev *sdev;
+ struct snd_sof_dai *sdai;
+
+- sdev = widget_to_sdev(w);
++ /*
++ * this is unlikely if the topology and the machine driver DAI links match.
++ * But if there's a missing DAI link in topology, this will prevent a NULL pointer
++ * dereference later on.
++ */
++ if (!w) {
++ dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__);
++ return NULL;
++ }
+
++ sdev = widget_to_sdev(w);
++ swidget = w->dobj.private;
+ if (!swidget) {
+ dev_err(sdev->dev, "%s: swidget is NULL\n", __func__);
+ return NULL;
+--
+2.51.0
+
--- /dev/null
+From f43d54536c8f0e3c2ceafd36338f99e52065b048 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 16:39:43 +0200
+Subject: ASoC: SOF: ipc4: Support for sending payload along with
+ LARGE_CONFIG_GET
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit d96cb0b86d6e8bbbbfa425771606f6c1aebc318e ]
+
+There are message types when we would need to send a payload along with
+the LARGE_CONFIG_GET message to provide information to the firmware on
+what data is requested.
+Such cases are the ALSA Kcontrol related messages when the high level
+param_id tells only the type of the control, but the ID/index of the exact
+control is specified in the payload area.
+
+The caller must place the payload for TX before calling the set_get_data()
+and this payload will be sent alongside with the message to the firmware.
+
+The data area will be overwritten by the received data from firmware.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://patch.msgid.link/20251217143945.2667-7-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4.c | 44 ++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 42 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4.c b/sound/soc/sof/ipc4.c
+index 4386cbae16d4e..e4eb8e004885e 100644
+--- a/sound/soc/sof/ipc4.c
++++ b/sound/soc/sof/ipc4.c
+@@ -15,6 +15,7 @@
+ #include "sof-audio.h"
+ #include "ipc4-fw-reg.h"
+ #include "ipc4-priv.h"
++#include "ipc4-topology.h"
+ #include "ipc4-telemetry.h"
+ #include "ops.h"
+
+@@ -408,6 +409,23 @@ static int sof_ipc4_tx_msg(struct snd_sof_dev *sdev, void *msg_data, size_t msg_
+ return ret;
+ }
+
++static bool sof_ipc4_tx_payload_for_get_data(struct sof_ipc4_msg *tx)
++{
++ /*
++ * Messages that require TX payload with LARGE_CONFIG_GET.
++ * The TX payload is placed into the IPC message data section by caller,
++ * which needs to be copied to temporary buffer since the received data
++ * will overwrite it.
++ */
++ switch (tx->extension & SOF_IPC4_MOD_EXT_MSG_PARAM_ID_MASK) {
++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_SWITCH_CONTROL_PARAM_ID):
++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_ENUM_CONTROL_PARAM_ID):
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+ size_t payload_bytes, bool set)
+ {
+@@ -419,6 +437,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+ struct sof_ipc4_msg tx = {{ 0 }};
+ struct sof_ipc4_msg rx = {{ 0 }};
+ size_t remaining = payload_bytes;
++ void *tx_payload_for_get = NULL;
++ size_t tx_data_size = 0;
+ size_t offset = 0;
+ size_t chunk_size;
+ int ret;
+@@ -444,10 +464,20 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+
+ tx.extension |= SOF_IPC4_MOD_EXT_MSG_FIRST_BLOCK(1);
+
++ if (sof_ipc4_tx_payload_for_get_data(&tx)) {
++ tx_data_size = min(ipc4_msg->data_size, payload_limit);
++ tx_payload_for_get = kmemdup(ipc4_msg->data_ptr, tx_data_size,
++ GFP_KERNEL);
++ if (!tx_payload_for_get)
++ return -ENOMEM;
++ }
++
+ /* ensure the DSP is in D0i0 before sending IPC */
+ ret = snd_sof_dsp_set_power_state(sdev, &target_state);
+- if (ret < 0)
++ if (ret < 0) {
++ kfree(tx_payload_for_get);
+ return ret;
++ }
+
+ /* Serialise IPC TX */
+ mutex_lock(&sdev->ipc->tx_mutex);
+@@ -481,7 +511,15 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+ rx.data_size = chunk_size;
+ rx.data_ptr = ipc4_msg->data_ptr + offset;
+
+- tx_size = 0;
++ if (tx_payload_for_get) {
++ tx_size = tx_data_size;
++ tx.data_size = tx_size;
++ tx.data_ptr = tx_payload_for_get;
++ } else {
++ tx_size = 0;
++ tx.data_size = 0;
++ tx.data_ptr = NULL;
++ }
+ rx_size = chunk_size;
+ }
+
+@@ -528,6 +566,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+
+ mutex_unlock(&sdev->ipc->tx_mutex);
+
++ kfree(tx_payload_for_get);
++
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 643a4f6ec1786590e81d0ca226f68147b7002f19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 11:32:50 +0800
+Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ]
+
+Add check for the return value of devm_regmap_init_mmio() and return the
+error if it fails in order to catch the error.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun50i-dmic.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c
+index 3e751b5694fe3..e8e03a5e35bc7 100644
+--- a/sound/soc/sunxi/sun50i-dmic.c
++++ b/sound/soc/sunxi/sun50i-dmic.c
+@@ -358,6 +358,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev)
+
+ host->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+ &sun50i_dmic_regmap_config);
++ if (IS_ERR(host->regmap))
++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap),
++ "failed to initialise regmap\n");
+
+ /* Clocks */
+ host->bus_clk = devm_clk_get(&pdev->dev, "bus");
+--
+2.51.0
+
--- /dev/null
+From 4c70e75e3752ba7b67792bdd465696a14505bdf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:08 +0100
+Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ]
+
+This bit is handled by a separate control.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 08d164ce3e49c..a19ee5ad5d35a 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18),
+
+
+ SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0),
+-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA),
++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX),
+
+ SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0),
+ SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA),
+--
+2.51.0
+
--- /dev/null
+From b85dbdd073b9972d8b4bd4a9c5f6ebf3ca592800 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:10 +0100
+Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on
+ plug
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ]
+
+This usually means that a TRS plug with no microphone pin has been plugged
+into a TRRS socket. Cases where a user is plugging in a microphone while
+pressing a button will be handled via incoming interrupt after the user
+releases the button, so the microphone will still be detected once it
+becomes usable.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index a19ee5ad5d35a..95143472c9e4f 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -67,6 +67,8 @@ struct wm8962_priv {
+ struct mutex dsp2_ena_lock;
+ u16 dsp2_ena;
+
++ int mic_status;
++
+ struct delayed_work mic_work;
+ struct snd_soc_jack *jack;
+
+@@ -3073,8 +3075,16 @@ static void wm8962_mic_work(struct work_struct *work)
+ if (reg & WM8962_MICSHORT_STS) {
+ status |= SND_JACK_BTN_0;
+ irq_pol |= WM8962_MICSCD_IRQ_POL;
++
++ /* Don't report a microphone if it's shorted right after
++ * plugging in, as this may be a TRS plug in a TRRS socket.
++ */
++ if (!(wm8962->mic_status & WM8962_MICDET_STS))
++ status = 0;
+ }
+
++ wm8962->mic_status = status;
++
+ snd_soc_jack_report(wm8962->jack, status,
+ SND_JACK_MICROPHONE | SND_JACK_BTN_0);
+
+--
+2.51.0
+
--- /dev/null
+From 88cfada8d0f1be03373020a1100ab3ed22714e64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:46:22 +0800
+Subject: ata: libata: avoid long timeouts on hot-unplugged SATA DAS
+
+From: Henry Tseng <henrytseng@qnap.com>
+
+[ Upstream commit 151cabd140322205e27dae5c4bbf261ede0056e3 ]
+
+When a SATA DAS enclosure is connected behind a Thunderbolt PCIe
+switch, hot-unplugging the whole enclosure causes pciehp to tear down
+the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and
+START STOP UNIT for the disks.
+
+libata still queues these commands and the AHCI driver tries to access
+the HBA registers even though the PCI channel is already offline. This
+results in a series of timeouts and error recovery attempts, e.g.:
+
+ [ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
+ [ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec)
+ [ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec)
+ [ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec)
+ [ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+ ...
+ [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec)
+ [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec)
+ [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec)
+ [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+
+With this patch applied, the same hot-unplug looks like:
+
+ [ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
+ [ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+ ...
+ [ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+
+In this test setup with two disks, the hot-unplug sequence shrinks from
+about 226 seconds (~3.8 minutes) between the Link Down event and the
+last SYNCHRONIZE CACHE failure to under a second. Without this patch the
+total delay grows roughly with the number of disks, because each disk
+gets its own SYNCHRONIZE CACHE and qc timeout series.
+
+If the underlying PCI device is already gone, these commands cannot
+succeed anyway. Avoid issuing them by introducing
+ata_adapter_is_online(), which checks pci_channel_offline() for
+PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL,
+causing the SCSI layer to fail new commands with DID_BAD_TARGET
+immediately, and from ata_qc_issue() to bail out before touching the
+HBA registers.
+
+Since such failures would otherwise trigger libata error handling,
+ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler().
+When the adapter is offline, libata skips ap->ops->error_handler(ap) and
+completes error handling using the existing path, rather than running
+a full EH sequence against a dead adapter.
+
+With this change, SYNCHRONIZE CACHE and START STOP UNIT commands
+issued during hot-unplug fail quickly once the PCI channel is offline,
+without qc timeout spam or long libata EH delays.
+
+Suggested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Henry Tseng <henrytseng@qnap.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 24 ++++++++++++++++++++++++
+ drivers/ata/libata-eh.c | 3 ++-
+ drivers/ata/libata-scsi.c | 3 +++
+ drivers/ata/libata.h | 1 +
+ 4 files changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 33454d01c2044..39dcefb1fdd54 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2329,6 +2329,24 @@ static bool ata_dev_check_adapter(struct ata_device *dev,
+ return false;
+ }
+
++bool ata_adapter_is_online(struct ata_port *ap)
++{
++ struct device *dev;
++
++ if (!ap || !ap->host)
++ return false;
++
++ dev = ap->host->dev;
++ if (!dev)
++ return false;
++
++ if (dev_is_pci(dev) &&
++ pci_channel_offline(to_pci_dev(dev)))
++ return false;
++
++ return true;
++}
++
+ static int ata_dev_config_ncq(struct ata_device *dev,
+ char *desc, size_t desc_sz)
+ {
+@@ -5023,6 +5041,12 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
+ qc->flags |= ATA_QCFLAG_ACTIVE;
+ ap->qc_active |= 1ULL << qc->tag;
+
++ /* Make sure the device is still accessible. */
++ if (!ata_adapter_is_online(ap)) {
++ qc->err_mask |= AC_ERR_HOST_BUS;
++ goto sys_err;
++ }
++
+ /*
+ * We guarantee to LLDs that they will have at least one
+ * non-zero sg if the command is a data command.
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 16cd676eae1f9..205c62cf9e32d 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -738,7 +738,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap)
+ spin_unlock_irqrestore(ap->lock, flags);
+
+ /* invoke EH, skip if unloading or suspended */
+- if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)))
++ if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)) &&
++ ata_adapter_is_online(ap))
+ ap->ops->error_handler(ap);
+ else {
+ /* if unloading, commence suicide */
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 74842750b2ed4..e39f1b3f6cb4e 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2838,6 +2838,9 @@ ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev)
+ {
+ struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev);
+
++ if (!ata_adapter_is_online(ap))
++ return NULL;
++
+ if (unlikely(!dev || !ata_dev_enabled(dev)))
+ return NULL;
+
+diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
+index 0337be4faec7c..d07693bd054eb 100644
+--- a/drivers/ata/libata.h
++++ b/drivers/ata/libata.h
+@@ -82,6 +82,7 @@ extern int atapi_check_dma(struct ata_queued_cmd *qc);
+ extern void swap_buf_le16(u16 *buf, unsigned int buf_words);
+ extern bool ata_phys_link_online(struct ata_link *link);
+ extern bool ata_phys_link_offline(struct ata_link *link);
++bool ata_adapter_is_online(struct ata_port *ap);
+ extern void ata_dev_init(struct ata_device *dev);
+ extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp);
+ extern int sata_link_init_spd(struct ata_link *link);
+--
+2.51.0
+
--- /dev/null
+From 4d9d29f2b3cbe1ce60bf2b76634ccfa72fb7af4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 20:49:30 +0100
+Subject: audit: add fchmodat2() to change attributes class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ]
+
+fchmodat2(), introduced in version 6.6 is currently not in the change
+attribute class of audit. Calling fchmodat2() to change a file
+attribute in the same fashion than chmod() or fchmodat() will bypass
+audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds fchmodat2() to the change attributes class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_change_attr.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h
+index 331670807cf01..6c311d4d37f4e 100644
+--- a/include/asm-generic/audit_change_attr.h
++++ b/include/asm-generic/audit_change_attr.h
+@@ -20,6 +20,9 @@ __NR_fremovexattr,
+ __NR_fchownat,
+ __NR_fchmodat,
+ #endif
++#ifdef __NR_fchmodat2
++__NR_fchmodat2,
++#endif
+ #ifdef __NR_chown32
+ __NR_chown32,
+ __NR_fchown32,
+--
+2.51.0
+
--- /dev/null
+From 0607c835ac439b6d7da1ea340a5693946b3ce4ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 09:39:24 +0100
+Subject: audit: add missing syscalls to read class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ]
+
+The "at" variant of getxattr() and listxattr() are missing from the
+audit read class. Calling getxattrat() or listxattrat() on a file to
+read its extended attributes will bypass audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds missing syscalls to the audit read class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_read.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h
+index 7bb7b5a83ae2e..fb9991f53fb6f 100644
+--- a/include/asm-generic/audit_read.h
++++ b/include/asm-generic/audit_read.h
+@@ -4,9 +4,15 @@ __NR_readlink,
+ #endif
+ __NR_quotactl,
+ __NR_listxattr,
++#ifdef __NR_listxattrat
++__NR_listxattrat,
++#endif
+ __NR_llistxattr,
+ __NR_flistxattr,
+ __NR_getxattr,
++#ifdef __NR_getxattrat
++__NR_getxattrat,
++#endif
+ __NR_lgetxattr,
+ __NR_fgetxattr,
+ #ifdef __NR_readlinkat
+--
+2.51.0
+
--- /dev/null
+From afb67af1336fc103f6e1b8091bdc6551f7753830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 15:29:50 +0100
+Subject: binder: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log. Since commit ad67b74d2469 ("printk: hash
+addresses printed with %p") the regular %p has been improved to avoid
+this issue. Furthermore, restricted pointers ("%pK") were never meant
+to be used through printk(). They can still unintentionally leak raw
+pointers or acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+There are still a few users of %pK left, but these use it through
+seq_file, for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Carlos Llamas <cmllamas@google.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binder.c | 2 +-
+ drivers/android/binder_alloc.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 9a6d1822dc3be..c470f5cce9911 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4444,7 +4444,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ }
+ }
+ binder_debug(BINDER_DEBUG_DEAD_BINDER,
+- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+ proc->pid, thread->pid, (u64)cookie,
+ death);
+ if (death == NULL) {
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index b3acbc4174fb1..7556f470f921b 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc,
+ new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: add free buffer, size %zd, at %pK\n",
++ "%d: add free buffer, size %zd, at %p\n",
+ alloc->pid, new_buffer_size, new_buffer);
+
+ while (*p) {
+@@ -493,7 +493,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
+ }
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
+ alloc->pid, size, buffer, buffer_size);
+
+ /*
+@@ -668,7 +668,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
+ ALIGN(buffer->extra_buffers_size, sizeof(void *));
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
++ "%d: binder_free_buf %p size %zd buffer_size %zd\n",
+ alloc->pid, buffer, size, buffer_size);
+
+ BUG_ON(buffer->free);
+--
+2.51.0
+
--- /dev/null
+From e203661dc6a79e94771b43707a0ae35bfa9d1cda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 16:05:22 +0800
+Subject: blk-mq-debugfs: add missing debugfs_mutex in
+ blk_mq_debugfs_register_hctxs()
+
+From: Yu Kuai <yukuai@fnnas.com>
+
+[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ]
+
+In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while
+creating debugfs entries for hctxs. Hence add debugfs_mutex there,
+it's safe because queue is not frozen.
+
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index 5463697a84428..cbc8bbde3a2bb 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -713,8 +713,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ unsigned long i;
+
++ mutex_lock(&q->debugfs_mutex);
+ queue_for_each_hw_ctx(q, hctx, i)
+ blk_mq_debugfs_register_hctx(q, hctx);
++ mutex_unlock(&q->debugfs_mutex);
+ }
+
+ void blk_mq_debugfs_unregister_hctxs(struct request_queue *q)
+--
+2.51.0
+
--- /dev/null
+From acfaa9f648652ab57a1f429c783a1f720a803336 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 11:40:02 +0800
+Subject: block: decouple secure erase size limit from discard size limit
+
+From: Luke Wang <ziniu.wang_1@nxp.com>
+
+[ Upstream commit ee81212f74a57c5d2b56cf504f40d528dac6faaf ]
+
+Secure erase should use max_secure_erase_sectors instead of being limited
+by max_discard_sectors. Separate the handling of REQ_OP_SECURE_ERASE from
+REQ_OP_DISCARD to allow each operation to use its own size limit.
+
+Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 21 +++++++++++++++++----
+ block/blk.h | 6 +++++-
+ 2 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 7ddd7dd23dda8..68dc8076d8cbc 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -130,8 +130,9 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors)
+ return bio;
+ }
+
+-struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+- unsigned *nsegs)
++static struct bio *__bio_split_discard(struct bio *bio,
++ const struct queue_limits *lim, unsigned *nsegs,
++ unsigned int max_sectors)
+ {
+ unsigned int max_discard_sectors, granularity;
+ sector_t tmp;
+@@ -141,8 +142,7 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+
+ granularity = max(lim->discard_granularity >> 9, 1U);
+
+- max_discard_sectors =
+- min(lim->max_discard_sectors, bio_allowed_max_sectors(lim));
++ max_discard_sectors = min(max_sectors, bio_allowed_max_sectors(lim));
+ max_discard_sectors -= max_discard_sectors % granularity;
+ if (unlikely(!max_discard_sectors))
+ return bio;
+@@ -166,6 +166,19 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+ return bio_submit_split(bio, split_sectors);
+ }
+
++struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
++ unsigned *nsegs)
++{
++ unsigned int max_sectors;
++
++ if (bio_op(bio) == REQ_OP_SECURE_ERASE)
++ max_sectors = lim->max_secure_erase_sectors;
++ else
++ max_sectors = lim->max_discard_sectors;
++
++ return __bio_split_discard(bio, lim, nsegs, max_sectors);
++}
++
+ static inline unsigned int blk_boundary_sectors(const struct queue_limits *lim,
+ bool is_atomic)
+ {
+diff --git a/block/blk.h b/block/blk.h
+index 63c92db0a5079..e7d7c5c636524 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -193,10 +193,14 @@ static inline unsigned int blk_queue_get_max_sectors(struct request *rq)
+ struct request_queue *q = rq->q;
+ enum req_op op = req_op(rq);
+
+- if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE))
++ if (unlikely(op == REQ_OP_DISCARD))
+ return min(q->limits.max_discard_sectors,
+ UINT_MAX >> SECTOR_SHIFT);
+
++ if (unlikely(op == REQ_OP_SECURE_ERASE))
++ return min(q->limits.max_secure_erase_sectors,
++ UINT_MAX >> SECTOR_SHIFT);
++
+ if (unlikely(op == REQ_OP_WRITE_ZEROES))
+ return q->limits.max_write_zeroes_sectors;
+
+--
+2.51.0
+
--- /dev/null
+From 9fd53e10f9914f3e3f1c4b4ad4fa54edfdb9c19e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:13:04 +0100
+Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU
+
+From: Jacopo Scannella <code@charlie.cat>
+
+[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ]
+
+Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek
+RTL8761BU Bluetooth adapter.
+
+Reference:
+https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth
+
+Signed-off-by: Jacopo Scannella <code@charlie.cat>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 147d4fcdea3c0..9d3236321056b 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -757,6 +757,7 @@ static const struct usb_device_id quirks_table[] = {
+
+ /* Additional Realtek 8723BU Bluetooth devices */
+ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK },
+
+ /* Additional Realtek 8723DE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
+--
+2.51.0
+
--- /dev/null
+From 998b87f9b4d97781a298a914b1210993c61628bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 15:03:35 +1100
+Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE
+
+From: Shell Chen <w27@sorz.org>
+
+[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ]
+
+Add VID:PID 13d3:3612 to the quirks_table.
+
+This ID pair is found in the Realtek RTL8852CE PCIe module
+in an ASUS TUF A14 2025 (FA401KM) laptop.
+
+Tested on aforementioned laptop.
+
+The device info from /sys/kernel/debug/usb/devices is listed as below.
+
+T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3612 Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=Bluetooth Radio
+S: SerialNumber=00e04c000001
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+
+Signed-off-by: Shell Chen <w27@sorz.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 4a12332917c5c..147d4fcdea3c0 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -551,6 +551,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
+--
+2.51.0
+
--- /dev/null
+From 1b49f234a966881c56e2e5b78b514fe7b85d4a78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 23:22:25 +0300
+Subject: Bluetooth: btusb: Add support for MediaTek7920 0489:e158
+
+From: Bluecross <elantsew.andrew@gmail.com>
+
+[ Upstream commit 2630bcc8343a9d2a38dc1793068e6754b3156811 ]
+
+Add support for MediaTek7920 0489:e158
+
+/sys/kernel/debug/usb/devices reports for that device:
+
+T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 5 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0489 ProdID=e158 Rev= 1.00
+S: Manufacturer=MediaTek Inc.
+S: Product=Wireless_Device
+S: SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
+I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Andrew Elatsev <elantsew.andrew@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 490efe4d67a97..4a12332917c5c 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -625,6 +625,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x0489, 0xe158), .driver_info = BTUSB_MEDIATEK |
++ BTUSB_WIDEBAND_SPEECH },
+
+ /* Additional MediaTek MT7921 Bluetooth devices */
+ { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
+--
+2.51.0
+
--- /dev/null
+From 9469b3b5757c702e54bb446a4cfa38148067f78b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:10 +0100
+Subject: Bluetooth: hci_conn: Set link_policy on incoming ACL connections
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d ]
+
+The connection link policy is only set when establishing an outgoing
+ACL connection causing connection idle modes not to be available on
+incoming connections. Move the setting of the link policy to the
+creation of the connection so all ACL connection will use the link
+policy set on the HCI device.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 1 +
+ net/bluetooth/hci_sync.c | 2 --
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index dad9020474149..9d735f54f19ca 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -967,6 +967,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t
+ switch (type) {
+ case ACL_LINK:
+ conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
++ conn->link_policy = hdev->link_policy;
+ conn->mtu = hdev->acl_mtu;
+ break;
+ case LE_LINK:
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index f79b38603205c..00de90fee44a7 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -6853,8 +6853,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
+
+ conn->attempt++;
+
+- conn->link_policy = hdev->link_policy;
+-
+ memset(&cp, 0, sizeof(cp));
+ bacpy(&cp.bdaddr, &conn->dst);
+ cp.pscan_rep_mode = 0x02;
+--
+2.51.0
+
--- /dev/null
+From 7ace02daa1c48d3303551b63386fbd091513209e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:09 +0100
+Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ]
+
+hci_conn_enter_active_mode() uses queue_delayed_work() with the
+intention that the work will run after the given timeout. However,
+queue_delayed_work() does nothing if the work is already queued, so
+depending on the link policy we may end up putting the connection
+into idle mode every hdev->idle_timeout ms.
+
+Use mod_delayed_work() instead so the work is queued if not already
+queued, and the timeout is updated otherwise.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 9d735f54f19ca..fa74fac5af778 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2512,8 +2512,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
+
+ timer:
+ if (hdev->idle_timeout > 0)
+- queue_delayed_work(hdev->workqueue, &conn->idle_work,
+- msecs_to_jiffies(hdev->idle_timeout));
++ mod_delayed_work(hdev->workqueue, &conn->idle_work,
++ msecs_to_jiffies(hdev->idle_timeout));
+ }
+
+ /* Drop all connection on the device */
+--
+2.51.0
+
--- /dev/null
+From acd2aa398d827fd2c38558371cc09d2ebcb58ca7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 16:30:41 -0800
+Subject: bnxt_en: Allow ntuple filters for drops
+
+From: Joe Damato <joe@dama.to>
+
+[ Upstream commit 61cef6454cfbb9fcdbe41401fb53895f86603081 ]
+
+It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action
+support for ntuple"), bnxt gained support for ntuple filters for packet
+drops.
+
+However, support for this does not seem to work in recent kernels or
+against net-next:
+
+ % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1
+ rmgr: Cannot insert RX class rule: Operation not supported
+ Cannot insert classification rule
+
+The issue is that the existing code uses ethtool_get_flow_spec_ring_vf,
+which will return a non-zero value if the ring_cookie is set to
+RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return
+-EOPNOTSUPP because it thinks the user is trying to set an ntuple filter
+for a vf.
+
+Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC.
+
+After this patch, ntuple filters for drops can be added:
+
+ % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1
+ Added rule with ID 0
+
+ % ethtool -n eth0
+ 44 RX rings available
+ Total 1 rules
+
+ Filter: 0
+ Rule Type: UDP over IPv4
+ Src IP addr: 1.1.1.1 mask: 0.0.0.0
+ Dest IP addr: 0.0.0.0 mask: 255.255.255.255
+ TOS: 0x0 mask: 0xff
+ Src port: 0 mask: 0xffff
+ Dest port: 0 mask: 0xffff
+ Action: Drop
+
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Joe Damato <joe@dama.to>
+Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 54ae90526d8ff..0a8f3dc3c2f01 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1321,16 +1321,17 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp,
+ struct bnxt_l2_filter *l2_fltr;
+ struct bnxt_flow_masks *fmasks;
+ struct flow_keys *fkeys;
+- u32 idx, ring;
++ u32 idx;
+ int rc;
+- u8 vf;
+
+ if (!bp->vnic_info)
+ return -EAGAIN;
+
+- vf = ethtool_get_flow_spec_ring_vf(fs->ring_cookie);
+- ring = ethtool_get_flow_spec_ring(fs->ring_cookie);
+- if ((fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) || vf)
++ if (fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT))
++ return -EOPNOTSUPP;
++
++ if (fs->ring_cookie != RX_CLS_FLOW_DISC &&
++ ethtool_get_flow_spec_ring_vf(fs->ring_cookie))
+ return -EOPNOTSUPP;
+
+ if (flow_type == IP_USER_FLOW) {
+@@ -1454,7 +1455,7 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp,
+ if (fs->ring_cookie == RX_CLS_FLOW_DISC)
+ new_fltr->base.flags |= BNXT_ACT_DROP;
+ else
+- new_fltr->base.rxq = ring;
++ new_fltr->base.rxq = ethtool_get_flow_spec_ring(fs->ring_cookie);
+ __set_bit(BNXT_FLTR_VALID, &new_fltr->base.state);
+ rc = bnxt_insert_ntp_filter(bp, new_fltr, idx);
+ if (!rc) {
+--
+2.51.0
+
--- /dev/null
+From 773f7a7d3ec7b32c9436ba6fe017bbb9a1f3447b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 08:25:50 +0000
+Subject: bpf: crypto: Use the correct destructor kfunc type
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit b40a5d724f29fc2eed23ff353808a9aae616b48a ]
+
+With CONFIG_CFI enabled, the kernel strictly enforces that indirect
+function calls use a function pointer type that matches the target
+function. I ran into the following type mismatch when running BPF
+self-tests:
+
+ CFI failure at bpf_obj_free_fields+0x190/0x238 (target:
+ bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc)
+ Internal error: Oops - CFI: 00000000f2008228 [#1] SMP
+ ...
+
+As bpf_crypto_ctx_release() is also used in BPF programs and using
+a void pointer as the argument would make the verifier unhappy, add
+a simple stub function with the correct type and register it as the
+destructor kfunc instead.
+
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Tested-by: Viktor Malik <vmalik@redhat.com>
+Link: https://lore.kernel.org/r/20260110082548.113748-7-samitolvanen@google.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/crypto.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/crypto.c b/kernel/bpf/crypto.c
+index 83c4d9943084b..1d024fe7248ac 100644
+--- a/kernel/bpf/crypto.c
++++ b/kernel/bpf/crypto.c
+@@ -261,6 +261,12 @@ __bpf_kfunc void bpf_crypto_ctx_release(struct bpf_crypto_ctx *ctx)
+ call_rcu(&ctx->rcu, crypto_free_cb);
+ }
+
++__bpf_kfunc void bpf_crypto_ctx_release_dtor(void *ctx)
++{
++ bpf_crypto_ctx_release(ctx);
++}
++CFI_NOSEAL(bpf_crypto_ctx_release_dtor);
++
+ static int bpf_crypto_crypt(const struct bpf_crypto_ctx *ctx,
+ const struct bpf_dynptr_kern *src,
+ const struct bpf_dynptr_kern *dst,
+@@ -368,7 +374,7 @@ static const struct btf_kfunc_id_set crypt_kfunc_set = {
+
+ BTF_ID_LIST(bpf_crypto_dtor_ids)
+ BTF_ID(struct, bpf_crypto_ctx)
+-BTF_ID(func, bpf_crypto_ctx_release)
++BTF_ID(func, bpf_crypto_ctx_release_dtor)
+
+ static int __init crypto_kfunc_init(void)
+ {
+--
+2.51.0
+
--- /dev/null
+From 034c59a3559f8045b49b94477d596c9259b4631c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 12:13:57 -0800
+Subject: bpf: Recognize special arithmetic shift in the verifier
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7 ]
+
+cilium bpf_wiregard.bpf.c when compiled with -O1 fails to load
+with the following verifier log:
+
+192: (79) r2 = *(u64 *)(r10 -304) ; R2=pkt(r=40) R10=fp0 fp-304=pkt(r=40)
+...
+227: (85) call bpf_skb_store_bytes#9 ; R0=scalar()
+228: (bc) w2 = w0 ; R0=scalar() R2=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
+229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
+230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
+...
+232: (66) if w2 s> 0xffffffff goto pc+125 ; R2=scalar(smin=umin=umin32=0x80000000,smax=umax=umax32=0xffffff7a,smax32=-134,var_off=(0x80000000; 0x7fffff7a))
+...
+238: (79) r4 = *(u64 *)(r10 -304) ; R4=scalar() R10=fp0 fp-304=scalar()
+239: (56) if w2 != 0xffffff78 goto pc+210 ; R2=0xffffff78 // -136
+...
+258: (71) r1 = *(u8 *)(r4 +0)
+R4 invalid mem access 'scalar'
+
+The error might confuse most bpf authors, since fp-304 slot had 'pkt'
+pointer at insn 192 and became 'scalar' at 238. That happened because
+bpf_skb_store_bytes() clears all packet pointers including those in
+the stack. On the first glance it might look like a bug in the source
+code, since ctx->data pointer should have been reloaded after the call
+to bpf_skb_store_bytes().
+
+The relevant part of cilium source code looks like this:
+
+// bpf/lib/nodeport.h
+int dsr_set_ipip6()
+{
+ if (ctx_adjust_hroom(...))
+ return DROP_INVALID; // -134
+ if (ctx_store_bytes(...))
+ return DROP_WRITE_ERROR; // -141
+ return 0;
+}
+
+bool dsr_fail_needs_reply(int code)
+{
+ if (code == DROP_FRAG_NEEDED) // -136
+ return true;
+ return false;
+}
+
+tail_nodeport_ipv6_dsr()
+{
+ ret = dsr_set_ipip6(...);
+ if (!IS_ERR(ret)) {
+ ...
+ } else {
+ if (dsr_fail_needs_reply(ret))
+ return dsr_reply_icmp6(...);
+ }
+}
+
+The code doesn't have arithmetic shift by 31 and it reloads ctx->data
+every time it needs to access it. So it's not a bug in the source code.
+
+The reason is DAGCombiner::foldSelectCCToShiftAnd() LLVM transformation:
+
+ // If this is a select where the false operand is zero and the compare is a
+ // check of the sign bit, see if we can perform the "gzip trick":
+ // select_cc setlt X, 0, A, 0 -> and (sra X, size(X)-1), A
+ // select_cc setgt X, 0, A, 0 -> and (not (sra X, size(X)-1)), A
+
+The conditional branch in dsr_set_ipip6() and its return values
+are optimized into BPF_ARSH plus BPF_AND:
+
+227: (85) call bpf_skb_store_bytes#9
+228: (bc) w2 = w0
+229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
+230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
+
+after insn 230 the register w2 can only be 0 or -134,
+but the verifier approximates it, since there is no way to
+represent two scalars in bpf_reg_state.
+After fallthough at insn 232 the w2 can only be -134,
+hence the branch at insn
+239: (56) if w2 != -136 goto pc+210
+should be always taken, and trapping insn 258 should never execute.
+LLVM generated correct code, but the verifier follows impossible
+path and rejects valid program. To fix this issue recognize this
+special LLVM optimization and fork the verifier state.
+So after insn 229: (c4) w2 s>>= 31
+the verifier has two states to explore:
+one with w2 = 0 and another with w2 = 0xffffffff
+which makes the verifier accept bpf_wiregard.c
+
+A similar pattern exists were OR operation is used in place of the AND
+operation, the verifier detects that pattern as well by forking the
+state before the OR operation with a scalar in range [-1,0].
+
+Note there are 20+ such patterns in bpf_wiregard.o compiled
+with -O1 and -O2, but they're rarely seen in other production
+bpf programs, so push_stack() approach is not a concern.
+
+Reported-by: Hao Sun <sunhao.th@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Co-developed-by: Puranjay Mohan <puranjay@kernel.org>
+Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
+Link: https://lore.kernel.org/r/20260112201424.816836-2-puranjay@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index aa6f536355767..a9e2380327b45 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -14192,6 +14192,35 @@ static bool is_safe_to_compute_dst_reg_range(struct bpf_insn *insn,
+ }
+ }
+
++static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *insn,
++ struct bpf_reg_state *dst_reg)
++{
++ struct bpf_verifier_state *branch;
++ struct bpf_reg_state *regs;
++ bool alu32;
++
++ if (dst_reg->smin_value == -1 && dst_reg->smax_value == 0)
++ alu32 = false;
++ else if (dst_reg->s32_min_value == -1 && dst_reg->s32_max_value == 0)
++ alu32 = true;
++ else
++ return 0;
++
++ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
++ if (IS_ERR(branch))
++ return PTR_ERR(branch);
++
++ regs = branch->frame[branch->curframe]->regs;
++ if (alu32) {
++ __mark_reg32_known(®s[insn->dst_reg], 0);
++ __mark_reg32_known(dst_reg, -1ull);
++ } else {
++ __mark_reg_known(®s[insn->dst_reg], 0);
++ __mark_reg_known(dst_reg, -1ull);
++ }
++ return 0;
++}
++
+ /* WARNING: This function does calculations on 64-bit values, but the actual
+ * execution may occur on 32-bit values. Therefore, things like bitshifts
+ * need extra checks in the 32-bit case.
+@@ -14247,11 +14276,21 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ scalar_min_max_mul(dst_reg, &src_reg);
+ break;
+ case BPF_AND:
++ if (tnum_is_const(src_reg.var_off)) {
++ ret = maybe_fork_scalars(env, insn, dst_reg);
++ if (ret)
++ return ret;
++ }
+ dst_reg->var_off = tnum_and(dst_reg->var_off, src_reg.var_off);
+ scalar32_min_max_and(dst_reg, &src_reg);
+ scalar_min_max_and(dst_reg, &src_reg);
+ break;
+ case BPF_OR:
++ if (tnum_is_const(src_reg.var_off)) {
++ ret = maybe_fork_scalars(env, insn, dst_reg);
++ if (ret)
++ return ret;
++ }
+ dst_reg->var_off = tnum_or(dst_reg->var_off, src_reg.var_off);
+ scalar32_min_max_or(dst_reg, &src_reg);
+ scalar_min_max_or(dst_reg, &src_reg);
+--
+2.51.0
+
--- /dev/null
+From 7ae43d968cda2ce933e72c728b8a732588d53e61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 18:02:19 +0000
+Subject: bpf: verifier improvement in 32bit shift sign extension pattern
+
+From: Cupertino Miranda <cupertino.miranda@oracle.com>
+
+[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ]
+
+This patch improves the verifier to correctly compute bounds for
+sign extension compiler pattern composed of left shift by 32bits
+followed by a sign right shift by 32bits. Pattern in the verifier was
+limitted to positive value bounds and would reset bound computation for
+negative values. New code allows both positive and negative values for
+sign extension without compromising bound computation and verifier to
+pass.
+
+This change is required by GCC which generate such pattern, and was
+detected in the context of systemd, as described in the following GCC
+bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731
+
+Three new tests were added in verifier_subreg.c.
+
+Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com>
+Signed-off-by: Andrew Pinski <andrew.pinski@oss.qualcomm.com>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Cc: David Faust <david.faust@oracle.com>
+Cc: Jose Marchesi <jose.marchesi@oracle.com>
+Cc: Elena Zannoni <elena.zannoni@oracle.com>
+Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 08cdf6ace02ac..aa6f536355767 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -13999,21 +13999,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg,
+ u64 umin_val, u64 umax_val)
+ {
+ /* Special case <<32 because it is a common compiler pattern to sign
+- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are
+- * positive we know this shift will also be positive so we can track
+- * bounds correctly. Otherwise we lose all sign bit information except
+- * what we can pick up from var_off. Perhaps we can generalize this
+- * later to shifts of any length.
++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct
++ * because s32 bounds don't flip sign when shifting to the left by
++ * 32bits.
+ */
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0)
++ if (umin_val == 32 && umax_val == 32) {
+ dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32;
+- else
+- dst_reg->smax_value = S64_MAX;
+-
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0)
+ dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32;
+- else
++ } else {
++ dst_reg->smax_value = S64_MAX;
+ dst_reg->smin_value = S64_MIN;
++ }
+
+ /* If we might shift our top bit out, then we know nothing */
+ if (dst_reg->umax_value > 1ULL << (63 - umax_val)) {
+--
+2.51.0
+
--- /dev/null
+From be329b44dc345c110279260701df0facbf5baed0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Nov 2025 10:22:16 +1030
+Subject: btrfs: fallback to buffered IO if the data profile has duplication
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 7c2830f00c3e086292c1ee9f27b61efaf8e76c9a ]
+
+[BACKGROUND]
+Inspired by a recent kernel bug report, which is related to direct IO
+buffer modification during writeback, that leads to contents mismatch of
+different RAID1 mirrors.
+
+[CAUSE AND PROBLEMS]
+The root cause is exactly the same explained in commit 968f19c5b1b7
+("btrfs: always fallback to buffered write if the inode requires
+checksum"), that we can not trust direct IO buffer which can be modified
+halfway during writeback.
+
+Unlike data checksum verification, if this happened on inodes without
+data checksum but has the data has extra mirrors, it will lead to
+stealth data mismatch on different mirrors.
+
+This will be way harder to detect without data checksum.
+
+Furthermore for RAID56, we can even have data without checksum and data
+with checksum mixed inside the same full stripe.
+
+In that case if the direct IO buffer got changed halfway for the
+nodatasum part, the data with checksum immediately lost its ability to
+recover, e.g.:
+
+" " = Good old data or parity calculated using good old data
+"X" = Data modified during writeback
+
+ 0 32K 64K
+ Data 1 | | Has csum
+ Data 2 |XXXXXXXXXXXXXXXX | No csum
+ Parity | |
+
+In above case, the parity is calculated using data 1 (has csum, from
+page cache, won't change during writeback), and old data 2 (has no csum,
+direct IO write).
+
+After parity is calculated, but before submission to the storage, direct
+IO buffer of data 2 is modified, causing the range [0, 32K) of data 2
+has a different content.
+
+Now all data is submitted to the storage, and the fs got fully synced.
+
+Then the device of data 1 is lost, has to be rebuilt from data 2 and
+parity. But since the data 2 has some modified data, and the parity is
+calculated using old data, the recovered data is no the same for data 1,
+causing data checksum mismatch.
+
+[FIX]
+Fix the problem by checking the data allocation profile.
+If our data allocation profile is either RAID0 or SINGLE, we can allow
+true zero-copy direct IO and the end user is fully responsible for any
+race.
+
+However this is not going to fix all situations, as it's still possible
+to race with balance where the fs got a new data profile after the data
+allocation profile check.
+But this fix should still greatly reduce the window of the original bug.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=99171
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/direct-io.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/fs/btrfs/direct-io.c b/fs/btrfs/direct-io.c
+index 71984d7db839b..fb414643f223d 100644
+--- a/fs/btrfs/direct-io.c
++++ b/fs/btrfs/direct-io.c
+@@ -803,6 +803,8 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from)
+ ssize_t ret;
+ unsigned int ilock_flags = 0;
+ struct iomap_dio *dio;
++ const u64 data_profile = btrfs_data_alloc_profile(fs_info) &
++ BTRFS_BLOCK_GROUP_PROFILE_MASK;
+
+ if (iocb->ki_flags & IOCB_NOWAIT)
+ ilock_flags |= BTRFS_ILOCK_TRY;
+@@ -816,6 +818,16 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from)
+ if (iocb->ki_pos + iov_iter_count(from) <= i_size_read(inode) && IS_NOSEC(inode))
+ ilock_flags |= BTRFS_ILOCK_SHARED;
+
++ /*
++ * If our data profile has duplication (either extra mirrors or RAID56),
++ * we can not trust the direct IO buffer, the content may change during
++ * writeback and cause different contents written to different mirrors.
++ *
++ * Thus only RAID0 and SINGLE can go true zero-copy direct IO.
++ */
++ if (data_profile != BTRFS_BLOCK_GROUP_RAID0 && data_profile != 0)
++ goto buffered;
++
+ relock:
+ ret = btrfs_inode_lock(BTRFS_I(inode), ilock_flags);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From c866003182c8559dffee1726f7c6150cae1b24d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 07:06:40 +0000
+Subject: btrfs: handle user interrupt properly in btrfs_trim_fs()
+
+From: jinbaohong <jinbaohong@synology.com>
+
+[ Upstream commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 ]
+
+When a fatal signal is pending or the process is freezing,
+btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS.
+Currently this is treated as a regular error: the loops continue to the
+next iteration and count it as a block group or device failure.
+
+Instead, break out of the loops immediately and return -ERESTARTSYS to
+userspace without counting it as a failure. Also skip the device loop
+entirely if the block group loop was interrupted.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Robbie Ko <robbieko@synology.com>
+Signed-off-by: jinbaohong <jinbaohong@synology.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 7bab2512468d5..5dd7ac7cbb0b4 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6559,6 +6559,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ range->minlen);
+
+ trimmed += group_trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR) {
++ btrfs_put_block_group(cache);
++ break;
++ }
+ if (ret) {
+ bg_failed++;
+ bg_ret = ret;
+@@ -6572,6 +6576,9 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ "failed to trim %llu block group(s), last error %d",
+ bg_failed, bg_ret);
+
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ return ret;
++
+ mutex_lock(&fs_devices->device_list_mutex);
+ list_for_each_entry(device, &fs_devices->devices, dev_list) {
+ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
+@@ -6580,6 +6587,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ ret = btrfs_trim_free_extents(device, &group_trimmed);
+
+ trimmed += group_trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ break;
+ if (ret) {
+ dev_failed++;
+ dev_ret = ret;
+@@ -6593,6 +6602,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ "failed to trim %llu device(s), last error %d",
+ dev_failed, dev_ret);
+ range->len = trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ return ret;
+ if (bg_ret)
+ return bg_ret;
+ return dev_ret;
+--
+2.51.0
+
--- /dev/null
+From f11af4bdf73b075dca1304afe9344f448f4f0006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 22:53:57 +0530
+Subject: btrfs: replace BUG() with error handling in __btrfs_balance()
+
+From: Adarsh Das <adarshdas950@gmail.com>
+
+[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ]
+
+We search with offset (u64)-1 which should never match exactly.
+Previously this was handled with BUG(). Now logs an error
+and return -EUCLEAN.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 9c6e96f630132..24b6a7f83f935 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4117,8 +4117,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info)
+ * this shouldn't happen, it means the last relocate
+ * failed
+ */
+- if (ret == 0)
+- BUG(); /* FIXME break ? */
++ if (unlikely(ret == 0)) {
++ btrfs_err(fs_info,
++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx",
++ key.offset);
++ mutex_unlock(&fs_info->reclaim_bgs_lock);
++ ret = -EUCLEAN;
++ goto error;
++ }
+
+ ret = btrfs_previous_item(chunk_root, path, 0,
+ BTRFS_CHUNK_ITEM_KEY);
+--
+2.51.0
+
--- /dev/null
+From 0229458dcb21024887adb01ec6d8b1bb46a52f05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 18:42:06 +0800
+Subject: ceph: supply snapshot context in ceph_uninline_data()
+
+From: ethanwu <ethanwu@synology.com>
+
+[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ]
+
+The ceph_uninline_data function was missing proper snapshot context
+handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and
+CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate
+snapshot context, which could lead to unnecessary object clone.
+
+Reproducer:
+../src/vstart.sh --new -x --localhost --bluestore
+// turn on cephfs inline data
+./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it
+// allow fs_a client to take snapshot
+./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a'
+// mount cephfs with fuse, since kernel cephfs doesn't support inline write
+ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/
+// bump snapshot seq
+mkdir /mnt/mycephfs/.snap/snap1
+echo "foo" > /mnt/mycephfs/test
+// umount and mount it again using kernel cephfs client
+umount /mnt/mycephfs
+mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf
+echo "bar" >> /mnt/mycephfs/test
+./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000
+
+will see this object does unnecessary clone
+1000000000a.00000000 (seq:2):
+cloneid snaps size overlap
+2 2 4 []
+head - 8
+
+but it's expected to see
+10000000000.00000000 (seq:2):
+cloneid snaps size overlap
+head - 8
+
+since there's no snapshot between these 2 writes
+
+clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't
+pass snap context so object is created with snap seq 0, but later data
+writeback is equipped with snapshot context.
+snap.seq(1) > object snap seq(0), so osd does object clone.
+
+This fix properly acquiring the snapshot context before performing
+write operations.
+
+Signed-off-by: ethanwu <ethanwu@synology.com>
+Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/addr.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index 6828a2cff02c8..5addf09cb6e6e 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -1867,6 +1867,7 @@ int ceph_uninline_data(struct file *file)
+ struct ceph_osd_request *req = NULL;
+ struct ceph_cap_flush *prealloc_cf = NULL;
+ struct folio *folio = NULL;
++ struct ceph_snap_context *snapc = NULL;
+ u64 inline_version = CEPH_INLINE_NONE;
+ struct page *pages[1];
+ int err = 0;
+@@ -1894,6 +1895,24 @@ int ceph_uninline_data(struct file *file)
+ if (inline_version == 1) /* initial version, no data */
+ goto out_uninline;
+
++ down_read(&fsc->mdsc->snap_rwsem);
++ spin_lock(&ci->i_ceph_lock);
++ if (__ceph_have_pending_cap_snap(ci)) {
++ struct ceph_cap_snap *capsnap =
++ list_last_entry(&ci->i_cap_snaps,
++ struct ceph_cap_snap,
++ ci_item);
++ snapc = ceph_get_snap_context(capsnap->context);
++ } else {
++ if (!ci->i_head_snapc) {
++ ci->i_head_snapc = ceph_get_snap_context(
++ ci->i_snap_realm->cached_context);
++ }
++ snapc = ceph_get_snap_context(ci->i_head_snapc);
++ }
++ spin_unlock(&ci->i_ceph_lock);
++ up_read(&fsc->mdsc->snap_rwsem);
++
+ folio = read_mapping_folio(inode->i_mapping, 0, file);
+ if (IS_ERR(folio)) {
+ err = PTR_ERR(folio);
+@@ -1909,7 +1928,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 0, 1,
+ CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE,
+- NULL, 0, 0, false);
++ snapc, 0, 0, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+ goto out_unlock;
+@@ -1925,7 +1944,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 1, 3,
+ CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE,
+- NULL, ci->i_truncate_seq,
++ snapc, ci->i_truncate_seq,
+ ci->i_truncate_size, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+@@ -1988,6 +2007,7 @@ int ceph_uninline_data(struct file *file)
+ folio_put(folio);
+ }
+ out:
++ ceph_put_snap_context(snapc);
+ ceph_free_cap_flush(prealloc_cf);
+ doutc(cl, "%llx.%llx inline_version %llu = %d\n",
+ ceph_vinop(inode), inline_version, err);
+--
+2.51.0
+
--- /dev/null
+From 75b918b4e6025e852f57f376ad7a8a40d1acf8b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:29 +0100
+Subject: char: tpm: cr50: Remove IRQF_ONESHOT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+
+The flag also prevents force-threading of the primary handler and the
+irq-core will warn about this.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +--
+ drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+index adf22992138e5..d51ef9c880832 100644
+--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c
++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+@@ -712,8 +712,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client)
+
+ if (client->irq > 0) {
+ rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler,
+- IRQF_TRIGGER_FALLING | IRQF_ONESHOT |
+- IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
+ dev->driver->name, chip);
+ if (rc < 0) {
+ dev_err(dev, "Failed to probe IRQ %d\n", client->irq);
+diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c
+index f4937280e9406..32920b4cecfb4 100644
+--- a/drivers/char/tpm/tpm_tis_spi_cr50.c
++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c
+@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi)
+ if (spi->irq > 0) {
+ ret = devm_request_irq(&spi->dev, spi->irq,
+ cr50_spi_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ "cr50_spi", cr50_phy);
+ if (ret < 0) {
+ if (ret == -EPROBE_DEFER)
+--
+2.51.0
+
--- /dev/null
+From c46a3e00139607f9574b33eb01b716f7dfeab791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 14:46:28 -0500
+Subject: clk: microchip: core: correct return value on *_get_parent()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ]
+
+roclk_get_parent() and sclk_get_parent() has the possibility of
+returning -EINVAL, however the framework expects this call to always
+succeed since the return value is unsigned.
+
+If there is no parent map defined, then the current value programmed in
+the hardware is used. Let's use that same value in the case where
+-EINVAL is currently returned.
+
+This index is only used by clk_core_get_parent_by_index(), and it
+validates that it doesn't overflow the number of available parents.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/microchip/clk-core.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c
+index 1b4f023cdc8be..71fbaf8318f22 100644
+--- a/drivers/clk/microchip/clk-core.c
++++ b/drivers/clk/microchip/clk-core.c
+@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK;
+
+- if (!refo->parent_map)
+- return v;
+-
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (refo->parent_map[i] == v)
+- return i;
++ if (refo->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (refo->parent_map[i] == v)
++ return i;
++ }
+
+- return -EINVAL;
++ return v;
+ }
+
+ static unsigned long roclk_calc_rate(unsigned long parent_rate,
+@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK;
+
+- if (!sclk->parent_map)
+- return v;
++ if (sclk->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (sclk->parent_map[i] == v)
++ return i;
++ }
+
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (sclk->parent_map[i] == v)
+- return i;
+- return -EINVAL;
++ return v;
+ }
+
+ static int sclk_set_parent(struct clk_hw *hw, u8 index)
+--
+2.51.0
+
--- /dev/null
+From 8b348070220ce4527f7e0927602c06e0fb1435a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 23:13:41 +0100
+Subject: clocksource/drivers/sh_tmu: Always leave device running after probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ]
+
+The TMU device can be used as both a clocksource and a clockevent
+provider. The driver tries to be smart and power itself on and off, as
+well as enabling and disabling its clock when it's not in operation.
+This behavior is slightly altered if the TMU is used as an early
+platform device in which case the device is left powered on after probe,
+but the clock is still enabled and disabled at runtime.
+
+This has worked for a long time, but recent improvements in PREEMPT_RT
+and PROVE_LOCKING have highlighted an issue. As the TMU registers itself
+as a clockevent provider, clockevents_register_device(), it needs to use
+raw spinlocks internally as this is the context of which the clockevent
+framework interacts with the TMU driver. However in the context of
+holding a raw spinlock the TMU driver can't really manage its power
+state or clock with calls to pm_runtime_*() and clk_*() as these calls
+end up in other platform drivers using regular spinlocks to control
+power and clocks.
+
+This mix of spinlock contexts trips a lockdep warning.
+
+ =============================
+ [ BUG: Invalid wait context ]
+ 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted
+ -----------------------------
+ swapper/0/0 is trying to lock:
+ ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88
+ other info that might help us debug this:
+ context-{5:5}
+ 1 lock held by swapper/0/0:
+ ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0
+ #0: ffff8000817ec298
+ ccree e6601000.crypto: ARM ccree device initialized
+ (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT
+ Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
+ Call trace:
+ show_stack+0x14/0x1c (C)
+ dump_stack_lvl+0x6c/0x90
+ dump_stack+0x14/0x1c
+ __lock_acquire+0x904/0x1584
+ lock_acquire+0x220/0x34c
+ _raw_spin_lock_irqsave+0x58/0x80
+ __pm_runtime_resume+0x38/0x88
+ sh_tmu_clock_event_set_oneshot+0x84/0xd4
+ clockevents_switch_state+0xfc/0x13c
+ tick_broadcast_set_event+0x30/0xa4
+ __tick_broadcast_oneshot_control+0x1e0/0x3a8
+ tick_broadcast_oneshot_control+0x30/0x40
+ cpuidle_enter_state+0x40c/0x680
+ cpuidle_enter+0x30/0x40
+ do_idle+0x1f4/0x280
+ cpu_startup_entry+0x34/0x40
+ kernel_init+0x0/0x130
+ do_one_initcall+0x0/0x230
+ __primary_switched+0x88/0x90
+
+For non-PREEMPT_RT builds this is not really an issue, but for
+PREEMPT_RT builds where normal spinlocks can sleep this might be an
+issue. Be cautious and always leave the power and clock running after
+probe.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/sh_tmu.c | 18 ------------------
+ 1 file changed, 18 deletions(-)
+
+diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
+index beffff81c00f3..3fc6ed9b56300 100644
+--- a/drivers/clocksource/sh_tmu.c
++++ b/drivers/clocksource/sh_tmu.c
+@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start)
+
+ static int __sh_tmu_enable(struct sh_tmu_channel *ch)
+ {
+- int ret;
+-
+- /* enable clock */
+- ret = clk_enable(ch->tmu->clk);
+- if (ret) {
+- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n",
+- ch->index);
+- return ret;
+- }
+-
+ /* make sure channel is disabled */
+ sh_tmu_start_stop_ch(ch, 0);
+
+@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch)
+ if (ch->enable_count++ > 0)
+ return 0;
+
+- pm_runtime_get_sync(&ch->tmu->pdev->dev);
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, true);
+
+ return __sh_tmu_enable(ch);
+@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch)
+
+ /* disable interrupts in TMU block */
+ sh_tmu_write(ch, TCR, TCR_TPSC_CLK4);
+-
+- /* stop clock */
+- clk_disable(ch->tmu->clk);
+ }
+
+ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+ __sh_tmu_disable(ch);
+
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, false);
+- pm_runtime_put(&ch->tmu->pdev->dev);
+ }
+
+ static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta,
+@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
+ goto err_clk_unprepare;
+
+ tmu->rate = clk_get_rate(tmu->clk) / 4;
+- clk_disable(tmu->clk);
+
+ /* Map the memory resource. */
+ ret = sh_tmu_map_memory(tmu);
+@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev)
+ out:
+ if (tmu->has_clockevent || tmu->has_clocksource)
+ pm_runtime_irq_safe(&pdev->dev);
+- else
+- pm_runtime_idle(&pdev->dev);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From ec27826b6b98ab3655b79ed8b4bdf625639f14c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 12:17:23 +0100
+Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig
+ dependency on OF
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ]
+
+This driver accesses the of_aliases global variable declared in
+linux/of.h and defined in drivers/base/of.c. It requires OF support or
+will cause a link failure. Add the missing Kconfig dependency.
+
+Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index d546903dba4f3..abfc2aa857678 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -246,6 +246,7 @@ config KEYSTONE_TIMER
+
+ config INTEGRATOR_AP_TIMER
+ bool "Integrator-AP timer driver" if COMPILE_TEST
++ depends on OF
+ select CLKSRC_MMIO
+ help
+ Enables support for the Integrator-AP timer.
+--
+2.51.0
+
--- /dev/null
+From 51fb74525d18e27a490e61c1d7477eeb7b1c457e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 16:25:35 +0100
+Subject: cpufreq: dt-platdev: Block the driver from probing on more QC
+ platforms
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+[ Upstream commit 7b781899072c5701ef9538c365757ee9ab9c00bd ]
+
+Add a number of QC platforms to the blocklist, they all use either the
+qcom-cpufreq-hw driver.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq-dt-platdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index dbd73cd0cf535..9e86a0e8b9e86 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -164,8 +164,11 @@ static const struct of_device_id blocklist[] __initconst = {
+ { .compatible = "qcom,sdm845", },
+ { .compatible = "qcom,sdx75", },
+ { .compatible = "qcom,sm6115", },
++ { .compatible = "qcom,sm6125", },
++ { .compatible = "qcom,sm6150", },
+ { .compatible = "qcom,sm6350", },
+ { .compatible = "qcom,sm6375", },
++ { .compatible = "qcom,sm7125", },
+ { .compatible = "qcom,sm7225", },
+ { .compatible = "qcom,sm7325", },
+ { .compatible = "qcom,sm8150", },
+--
+2.51.0
+
--- /dev/null
+From c7d696cef7fec98e80c39b494695d4cbe988a498 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 18:18:03 +0800
+Subject: crypto: hisilicon/qm - move the barrier before writing to the mailbox
+ register
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit ebf35d8f9368816c930f5d70783a72716fab5e19 ]
+
+Before sending the data via the mailbox to the hardware, to ensure
+that the data accessed by the hardware is the most up-to-date,
+a write barrier should be added before writing to the mailbox register.
+The current memory barrier is placed after writing to the register,
+the barrier order should be modified to be before writing to the register.
+
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index d0b154d13f445..2c64bf4cdf0dc 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -551,9 +551,13 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src)
+ }
+
+ #if IS_ENABLED(CONFIG_ARM64)
++ /*
++ * The dmb oshst instruction ensures that the data in the
++ * mailbox is written before it is sent to the hardware.
++ */
+ asm volatile("ldp %0, %1, %3\n"
+- "stp %0, %1, %2\n"
+ "dmb oshst\n"
++ "stp %0, %1, %2\n"
+ : "=&r" (tmp0),
+ "=&r" (tmp1),
+ "+Q" (*((char __iomem *)fun_base))
+--
+2.51.0
+
--- /dev/null
+From a608ee069873e26643d900743c24cecdf4d22ca6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:35:06 -0500
+Subject: dlm: validate length in dlm_search_rsb_tree
+
+From: Ezrak1e <ezrakiez@gmail.com>
+
+[ Upstream commit 080e5563f878c64e697b89e7439d730d0daad882 ]
+
+The len parameter in dlm_dump_rsb_name() is not validated and comes
+from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can
+cause out-of-bounds write in dlm_search_rsb_tree().
+
+Add length validation to prevent potential buffer overflow.
+
+Signed-off-by: Ezrak1e <ezrakiez@gmail.com>
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lock.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index 0ad496ceb638d..195e4ce22a824 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -626,7 +626,8 @@ int dlm_search_rsb_tree(struct rhashtable *rhash, const void *name, int len,
+ struct dlm_rsb **r_ret)
+ {
+ char key[DLM_RESNAME_MAXLEN] = {};
+-
++ if (len > DLM_RESNAME_MAXLEN)
++ return -EINVAL;
+ memcpy(key, name, len);
+ *r_ret = rhashtable_lookup_fast(rhash, &key, dlm_rhash_rsb_params);
+ if (*r_ret)
+--
+2.51.0
+
--- /dev/null
+From 5607159248a85137813a6e6afaa3601e18d602ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 20:03:50 +0800
+Subject: dm: remove fake timeout to avoid leak request
+
+From: Ding Hui <dinghui@sangfor.com.cn>
+
+[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ]
+
+Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
+blk_mq_complete_request"), drivers are responsible for calling
+blk_should_fake_timeout() at appropriate code paths and opportunities.
+
+However, the dm driver does not implement its own timeout handler and
+relies on the timeout handling of its slave devices.
+
+If an io-timeout-fail error is injected to a dm device, the request
+will be leaked and never completed, causing tasks to hang indefinitely.
+
+Reproduce:
+1. prepare dm which has iscsi slave device
+2. inject io-timeout-fail to dm
+ echo 1 >/sys/class/block/dm-0/io-timeout-fail
+ echo 100 >/sys/kernel/debug/fail_io_timeout/probability
+ echo 10 >/sys/kernel/debug/fail_io_timeout/times
+3. read/write dm
+4. iscsiadm -m node -u
+
+Result: hang task like below
+[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
+[ 862.244133] Tainted: G E 6.19.0-rc1+ #51
+[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000
+[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
+[ 862.245264] Call Trace:
+[ 862.245587] <TASK>
+[ 862.245814] __schedule+0x810/0x15c0
+[ 862.246557] schedule+0x69/0x180
+[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120
+[ 862.247688] elevator_change+0x16d/0x460
+[ 862.247893] elevator_set_none+0x87/0xf0
+[ 862.248798] blk_unregister_queue+0x12e/0x2a0
+[ 862.248995] __del_gendisk+0x231/0x7e0
+[ 862.250143] del_gendisk+0x12f/0x1d0
+[ 862.250339] sd_remove+0x85/0x130 [sd_mod]
+[ 862.250650] device_release_driver_internal+0x36d/0x530
+[ 862.250849] bus_remove_device+0x1dd/0x3f0
+[ 862.251042] device_del+0x38a/0x930
+[ 862.252095] __scsi_remove_device+0x293/0x360
+[ 862.252291] scsi_remove_target+0x486/0x760
+[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
+[ 862.252886] process_one_work+0x633/0xe50
+[ 862.253101] worker_thread+0x6df/0xf10
+[ 862.253647] kthread+0x36d/0x720
+[ 862.254533] ret_from_fork+0x2a6/0x470
+[ 862.255852] ret_from_fork_asm+0x1a/0x30
+[ 862.256037] </TASK>
+
+Remove the blk_should_fake_timeout() check from dm, as dm has no
+native timeout handling and should not attempt to fake timeouts.
+
+Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 499f8cc8a39fb..92d3d3de37ca6 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -278,8 +278,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error)
+ struct dm_rq_target_io *tio = tio_from_request(rq);
+
+ tio->error = error;
+- if (likely(!blk_should_fake_timeout(rq->q)))
+- blk_mq_complete_request(rq);
++ blk_mq_complete_request(rq);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 1cba2f1fd95340d29cc0c09ec729f85668419e89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 04:49:37 +0100
+Subject: dm: replace -EEXIST with -EBUSY
+
+From: Daniel Gomez <da.gomez@samsung.com>
+
+[ Upstream commit b13ef361d47f09b7aecd18e0383ecc83ff61057e ]
+
+The -EEXIST error code is reserved by the module loading infrastructure
+to indicate that a module is already loaded. When a module's init
+function returns -EEXIST, userspace tools like kmod interpret this as
+"module already loaded" and treat the operation as successful, returning
+0 to the user even though the module initialization actually failed.
+
+This follows the precedent set by commit 54416fd76770 ("netfilter:
+conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
+issue in nf_conntrack_helper_register().
+
+Affected modules:
+ * dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache
+ * dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity
+ * dm_queue_length dm_service_time dm_snapshot
+
+Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-exception-store.c | 2 +-
+ drivers/md/dm-log.c | 2 +-
+ drivers/md/dm-path-selector.c | 2 +-
+ drivers/md/dm-target.c | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
+index c3799757bf4a0..88f119a0a2ae0 100644
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -116,7 +116,7 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type)
+ if (!__find_exception_store_type(type->name))
+ list_add(&type->list, &_exception_store_types);
+ else
+- r = -EEXIST;
++ r = -EBUSY;
+ spin_unlock(&_lock);
+
+ return r;
+diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
+index 9d85d045f9d9d..bced5a783ee33 100644
+--- a/drivers/md/dm-log.c
++++ b/drivers/md/dm-log.c
+@@ -121,7 +121,7 @@ int dm_dirty_log_type_register(struct dm_dirty_log_type *type)
+ if (!__find_dirty_log_type(type->name))
+ list_add(&type->list, &_log_types);
+ else
+- r = -EEXIST;
++ r = -EBUSY;
+ spin_unlock(&_lock);
+
+ return r;
+diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c
+index 3e4cb81ce512c..78f98545ca72d 100644
+--- a/drivers/md/dm-path-selector.c
++++ b/drivers/md/dm-path-selector.c
+@@ -107,7 +107,7 @@ int dm_register_path_selector(struct path_selector_type *pst)
+
+ if (__find_path_selector_type(pst->name)) {
+ kfree(psi);
+- r = -EEXIST;
++ r = -EBUSY;
+ } else
+ list_add(&psi->list, &_path_selectors);
+
+diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
+index b676fd01a0227..33f81611bdefd 100644
+--- a/drivers/md/dm-target.c
++++ b/drivers/md/dm-target.c
+@@ -88,7 +88,7 @@ int dm_register_target(struct target_type *tt)
+ if (__find_target_type(tt->name)) {
+ DMERR("%s: '%s' target already registered",
+ __func__, tt->name);
+- rv = -EEXIST;
++ rv = -EBUSY;
+ } else {
+ list_add(&tt->list, &_targets);
+ }
+--
+2.51.0
+
--- /dev/null
+From 04860b703e1fd7189d071166c0bf492a2b176a07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 14:36:56 +0100
+Subject: dmaengine: stm32-dma3: use module_platform_driver
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit 0d41ed4ea496fabbb4dc21171e32d9a924c2a661 ]
+
+Without module_platform_driver(), stm32-dma3 doesn't have a
+module_exit procedure. Once stm32-dma3 module is inserted, it
+can't be removed, marked busy.
+Use module_platform_driver() instead of subsys_initcall() to register
+(insmod) and unregister (rmmod) stm32-dma3 driver.
+
+Reviewed-by: Eugen Hristev <eugen.hristev@linaro.org>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251121-dma3_improv-v2-1-76a207b13ea6@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32/stm32-dma3.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/dma/stm32/stm32-dma3.c b/drivers/dma/stm32/stm32-dma3.c
+index 0be6e944df6fd..fde1b10d3532c 100644
+--- a/drivers/dma/stm32/stm32-dma3.c
++++ b/drivers/dma/stm32/stm32-dma3.c
+@@ -1835,12 +1835,7 @@ static struct platform_driver stm32_dma3_driver = {
+ },
+ };
+
+-static int __init stm32_dma3_init(void)
+-{
+- return platform_driver_register(&stm32_dma3_driver);
+-}
+-
+-subsys_initcall(stm32_dma3_init);
++module_platform_driver(stm32_dma3_driver);
+
+ MODULE_DESCRIPTION("STM32 DMA3 controller driver");
+ MODULE_AUTHOR("Amelie Delaunay <amelie.delaunay@foss.st.com>");
+--
+2.51.0
+
--- /dev/null
+From bfb6b0844ab83aab4f79937bc865e5f0984ee1ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 09:15:03 +0100
+Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix
+ warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ]
+
+m2m_hw_period is initialized only when chan_config->m2m_hw is true. This
+triggers a warning:
+‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized]
+Although m2m_hw_period is only used when chan_config->m2m_hw is true and
+ignored otherwise, initialize it unconditionally to 0.
+
+ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not
+empty. This triggers a warning:
+‘ccr’ may be used uninitialized [-Wmaybe-uninitialized]
+Indeed, it could be used uninitialized if the sg list is empty. Initialize
+it to 0.
+
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Reviewed-by: Clément Le Goffic <legoffic.clement@gmail.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32/stm32-mdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/stm32/stm32-mdma.c b/drivers/dma/stm32/stm32-mdma.c
+index e6d525901de7e..3560a6945fbfc 100644
+--- a/drivers/dma/stm32/stm32-mdma.c
++++ b/drivers/dma/stm32/stm32-mdma.c
+@@ -731,7 +731,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan,
+ struct stm32_mdma_chan_config *chan_config = &chan->chan_config;
+ struct scatterlist *sg;
+ dma_addr_t src_addr, dst_addr;
+- u32 m2m_hw_period, ccr, ctcr, ctbr;
++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr;
+ int i, ret = 0;
+
+ if (chan_config->m2m_hw)
+--
+2.51.0
+
--- /dev/null
+From f076b1d1da78c879f680de487603e44f2e79b80e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:04:48 +0800
+Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst
+
+From: Chen-Yu Tsai <wens@kernel.org>
+
+[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ]
+
+maxburst, as provided by the client, specifies the largest amount of
+data that is allowed to be transferred in one burst. This limit is
+normally provided to avoid a data burst overflowing the target FIFO.
+It does not mean that the DMA engine can only do bursts in that size.
+
+Let the driver pick the largest supported burst length within the
+given limit. This lets the driver work correctly with some clients that
+give a large maxburst value. In particular, the 8250_dw driver will give
+a quarter of the UART's FIFO size as maxburst. On some systems the FIFO
+size is 256 bytes, giving a maxburst of 64 bytes, while the hardware
+only supports bursts of up to 16 bytes.
+
+Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
+index 583bf49031cf2..c97027379263d 100644
+--- a/drivers/dma/sun6i-dma.c
++++ b/drivers/dma/sun6i-dma.c
+@@ -582,6 +582,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id)
+ return ret;
+ }
+
++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst)
++{
++ if (!maxburst)
++ return 1;
++
++ if (BIT(maxburst) & burst_lengths)
++ return maxburst;
++
++ /* Hardware only does power-of-two bursts. */
++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2)
++ if (BIT(burst) & burst_lengths)
++ return burst;
++
++ return 1;
++}
++
+ static int set_config(struct sun6i_dma_dev *sdev,
+ struct dma_slave_config *sconfig,
+ enum dma_transfer_direction direction,
+@@ -615,15 +631,13 @@ static int set_config(struct sun6i_dma_dev *sdev,
+ return -EINVAL;
+ if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths))
+ return -EINVAL;
+- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths))
+- return -EINVAL;
+- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths))
+- return -EINVAL;
+
+ src_width = convert_buswidth(src_addr_width);
+ dst_width = convert_buswidth(dst_addr_width);
+- dst_burst = convert_burst(dst_maxburst);
+- src_burst = convert_burst(src_maxburst);
++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst);
++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst);
++ dst_burst = convert_burst(dst_burst);
++ src_burst = convert_burst(src_burst);
+
+ *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) |
+ DMA_CHAN_CFG_DST_WIDTH(dst_width);
+--
+2.51.0
+
--- /dev/null
+From ce1bc907f6a63f4de0fbdf9f0d4a88817c9d2959 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 08:22:26 -0500
+Subject: drm: Account property blob allocations to memcg
+
+From: Xiao Kan <814091656@qq.com>
+
+[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ]
+
+DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
+property blobs backed by kernel memory.
+
+Currently, the blob data allocation is not accounted to the allocating
+process's memory cgroup, allowing unprivileged users to trigger unbounded
+kernel memory consumption and potentially cause system-wide OOM.
+
+Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
+is properly charged to the caller's memcg. This ensures existing cgroup
+memory limits apply and prevents uncontrolled kernel memory growth without
+introducing additional policy or per-file limits.
+
+Signed-off-by: Xiao Kan <814091656@qq.com>
+Signed-off-by: Xiao Kan <xiao.kan@samsung.com>
+Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
+index 596272149a359..3c88b5fbdf28c 100644
+--- a/drivers/gpu/drm/drm_property.c
++++ b/drivers/gpu/drm/drm_property.c
+@@ -562,7 +562,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
+ if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
+ return ERR_PTR(-EINVAL);
+
+- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT);
+ if (!blob)
+ return ERR_PTR(-ENOMEM);
+
+--
+2.51.0
+
--- /dev/null
+From 6d13eed67fe5e86c8cf088679a95cd9ab8e5bb93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 15:52:39 -0500
+Subject: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
+
+From: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+
+[ Upstream commit c979d8db7b0f293111f2e83795ea353c8ed75de9 ]
+
+Trying to access link enc on a dpia link will cause a crash otherwise
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index f805803be55e4..bf2a9d8d3bd2d 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -965,10 +965,10 @@ static void dcn401_enable_stream_calc(
+ pipe_ctx->stream->link->cur_link_settings.lane_count;
+ uint32_t active_total_with_borders;
+
+- if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx))
++ if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) {
+ *dp_hpo_inst = pipe_ctx->stream_res.hpo_dp_stream_enc->inst;
+-
+- *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link);
++ *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link);
++ }
+
+ if (dc_is_tmds_signal(pipe_ctx->stream->signal))
+ dcn401_calculate_dccg_tmds_div_value(pipe_ctx, tmds_div);
+--
+2.51.0
+
--- /dev/null
+From 9b22bd4823d26ec1fc0fe1c4a7972c218ceaebc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 10:18:16 +0800
+Subject: drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
+
+From: LinCheng Ku <lincheng.ku@amd.com>
+
+[ Upstream commit cea573a8e1ed83840a2173d153dd68e172849d44 ]
+
+[Why]
+USB-C DisplayPort Alt Mode with concurrent USB data needs lane count
+limitation to prevent incorrect 4-lane DP configuration when only 2 lanes
+are available due to hardware lane sharing between DP and USB3.
+
+[How]
+Query DMUB for Alt Mode status (is_dp_alt_disable, is_usb, is_dp4) in
+dcn32_link_encoder_get_max_link_cap() and cap DP to 2 lanes when USB is
+active on USB-C port. Added inline documentation explaining the USB-C
+lane sharing constraint.
+
+Reviewed-by: PeiChen Huang <peichen.huang@amd.com>
+Signed-off-by: LinCheng Ku <lincheng.ku@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/dc/dio/dcn32/dcn32_dio_link_encoder.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
+index 06907e8a4eda1..ddc736af776c9 100644
+--- a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
+@@ -188,9 +188,18 @@ void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc,
+ if (!query_dp_alt_from_dmub(enc, &cmd))
+ return;
+
+- if (cmd.query_dp_alt.data.is_usb &&
+- cmd.query_dp_alt.data.is_dp4 == 0)
+- link_settings->lane_count = MIN(LANE_COUNT_TWO, link_settings->lane_count);
++ /*
++ * USB-C DisplayPort Alt Mode lane count limitation logic:
++ * When USB and DP share the same USB-C connector, hardware must allocate
++ * some lanes for USB data, limiting DP to maximum 2 lanes instead of 4.
++ * This ensures USB functionality remains available while DP is active.
++ */
++ if (cmd.query_dp_alt.data.is_dp_alt_disable == 0 &&
++ cmd.query_dp_alt.data.is_usb &&
++ cmd.query_dp_alt.data.is_dp4 == 0) {
++ link_settings->lane_count =
++ MIN(LANE_COUNT_TWO, link_settings->lane_count);
++ }
+ }
+
+
+--
+2.51.0
+
--- /dev/null
+From d63af7f0710e24b0ce69fe1c6401121b55e538fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 15:51:42 +0800
+Subject: drm/amd/display: avoid dig reg access timeout on usb4 link training
+ fail
+
+From: Zhongwei <Zhongwei.Zhang@amd.com>
+
+[ Upstream commit 15b1d7b77e9836ff4184093163174a1ef28bbdd7 ]
+
+[Why]
+When usb4 link training fails, the dpia sym clock will be disabled and SYMCLK
+source should be changed back to phy clock. In enable_streams, it is
+assumed that link training succeeded and will switch from refclk to
+phy clock. But phy clk here might not be on. Dig reg access timeout
+will occur.
+
+[How]
+When enable_stream is hit, check if link training failed for usb4.
+If it did, fall back to the ref clock to avoid reg access timeout.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Zhongwei <Zhongwei.Zhang@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+index b94fe14f4b935..a113085385d15 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -3012,9 +3012,17 @@ void dcn20_enable_stream(struct pipe_ctx *pipe_ctx)
+ dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk);
+ }
+ } else {
+- if (dccg->funcs->enable_symclk_se)
+- dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst,
++ if (dccg->funcs->enable_symclk_se && link_enc) {
++ if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA
++ && link->cur_link_settings.link_rate == LINK_RATE_UNKNOWN
++ && !link->link_status.link_active) {
++ if (dccg->funcs->disable_symclk_se)
++ dccg->funcs->disable_symclk_se(dccg, stream_enc->stream_enc_inst,
+ link_enc->transmitter - TRANSMITTER_UNIPHY_A);
++ } else
++ dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst,
++ link_enc->transmitter - TRANSMITTER_UNIPHY_A);
++ }
+ }
+
+ if (dc->res_pool->dccg->funcs->set_pixel_rate_div)
+--
+2.51.0
+
--- /dev/null
+From 72649e13b0b0c00f95d3d6616c7312d3d091189d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 14:47:01 +0800
+Subject: drm/amd/display: Avoid updating surface with the same surface under
+ MPO
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ]
+
+[Why & How]
+Although it's dummy updates of surface update for committing stream
+updates, we should not have dummy_updates[j].surface all indicating
+to the same surface under multiple surfaces case. Otherwise,
+copy_surface_update_to_plane() in update_planes_and_stream_state()
+will update to the same surface only.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index f4693136a2ebf..9181a97fdb1b8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10195,7 +10195,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
+ continue;
+ }
+ for (j = 0; j < status->plane_count; j++)
+- dummy_updates[j].surface = status->plane_states[0];
++ dummy_updates[j].surface = status->plane_states[j];
+
+ sort(dummy_updates, status->plane_count,
+ sizeof(*dummy_updates), dm_plane_layer_index_cmp, NULL);
+--
+2.51.0
+
--- /dev/null
+From 20922e2aa4b6d6dd4fc8945073a8f566c3c8d713 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 11:40:06 -0500
+Subject: drm/amd/display: bypass post csc for additional color spaces in dal
+
+From: Clay King <clayking@amd.com>
+
+[ Upstream commit 7d9ec9dc20ecdb1661f4538cd9112cd3d6a5f15a ]
+
+[Why]
+For RGB BT2020 full and limited color spaces, overlay adjustments were
+applied twice (once by MM and once by DAL). This results in incorrect
+colours and a noticeable difference between mpo and non-mpo cases.
+
+[How]
+Add RGB BT2020 full and limited color spaces to list that bypasses post
+csc adjustment.
+
+Reviewed-by: Aric Cyr <aric.cyr@amd.com>
+Signed-off-by: Clay King <clayking@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 21 ++++++++++++++++---
+ .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h | 4 ++++
+ .../amd/display/dc/dpp/dcn401/dcn401_dpp.c | 6 +++---
+ 3 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
+index 6c3cae593ad54..ba12c294f971a 100644
+--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
+@@ -360,10 +360,10 @@ void dpp3_cnv_setup (
+
+ tbl_entry.color_space = input_color_space;
+
+- if (color_space >= COLOR_SPACE_YCBCR601)
+- select = INPUT_CSC_SELECT_ICSC;
+- else
++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space))
+ select = INPUT_CSC_SELECT_BYPASS;
++ else
++ select = INPUT_CSC_SELECT_ICSC;
+
+ dpp3_program_post_csc(dpp_base, color_space, select,
+ &tbl_entry);
+@@ -1527,3 +1527,18 @@ bool dpp3_construct(
+ return true;
+ }
+
++bool dpp3_should_bypass_post_csc_for_colorspace(enum dc_color_space dc_color_space)
++{
++ switch (dc_color_space) {
++ case COLOR_SPACE_UNKNOWN:
++ case COLOR_SPACE_SRGB:
++ case COLOR_SPACE_XR_RGB:
++ case COLOR_SPACE_SRGB_LIMITED:
++ case COLOR_SPACE_MSREF_SCRGB:
++ case COLOR_SPACE_2020_RGB_FULLRANGE:
++ case COLOR_SPACE_2020_RGB_LIMITEDRANGE:
++ return true;
++ default:
++ return false;
++ }
++}
+diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
+index b110f35ef66bd..d183875b13302 100644
+--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
+@@ -641,4 +641,8 @@ void dpp3_program_cm_dealpha(
+
+ void dpp3_cm_get_gamut_remap(struct dpp *dpp_base,
+ struct dpp_grph_csc_adjustment *adjust);
++
++bool dpp3_should_bypass_post_csc_for_colorspace(
++ enum dc_color_space dc_color_space);
++
+ #endif /* __DC_HWSS_DCN30_H__ */
+diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
+index 97bf26fa35738..3e24ac07eebd9 100644
+--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
+@@ -206,10 +206,10 @@ void dpp401_dpp_setup(
+
+ tbl_entry.color_space = input_color_space;
+
+- if (color_space >= COLOR_SPACE_YCBCR601)
+- select = INPUT_CSC_SELECT_ICSC;
+- else
++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space))
+ select = INPUT_CSC_SELECT_BYPASS;
++ else
++ select = INPUT_CSC_SELECT_ICSC;
+
+ dpp3_program_post_csc(dpp_base, color_space, select,
+ &tbl_entry);
+--
+2.51.0
+
--- /dev/null
+From 943309e16fd5d4e0dd0a15bd6e9fe5eeddb733cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 17:48:59 -0500
+Subject: drm/amd/display: Disable FEC when powering down encoders
+
+From: Ovidiu Bunea <ovidiu.bunea@amd.com>
+
+[ Upstream commit 8cee62904caf95e5698fa0f2d420f5f22b4dea15 ]
+
+[why & how]
+VBIOS DMCUB FW can enable FEC for capable eDPs, but S/W DC state is
+only updated for link0 when transitioning into OS with driver loaded.
+This causes issues when the eDP is immediately hidden and DIG0 is
+assigned to another link that does not support FEC. Driver will
+attempt to disable FEC but FEC enablement occurs based on the link
+state, which does not have fec_state updated since it is a different
+link. Thus, FEC disablement on DIG0 will get skipped and cause no
+light up.
+
+Reviewed-by: Karen Chen <karen.chen@amd.com>
+Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 924a425a1b76d..df69e0cebf785 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -58,6 +58,7 @@
+ #include "dc_state_priv.h"
+ #include "dpcd_defs.h"
+ #include "dsc.h"
++#include "dc_dp_types.h"
+ /* include DCE11 register header files */
+ #include "dce/dce_11_0_d.h"
+ #include "dce/dce_11_0_sh_mask.h"
+@@ -1706,20 +1707,25 @@ static void power_down_encoders(struct dc *dc)
+ int i;
+
+ for (i = 0; i < dc->link_count; i++) {
+- enum signal_type signal = dc->links[i]->connector_signal;
+-
+- dc->link_srv->blank_dp_stream(dc->links[i], false);
++ struct dc_link *link = dc->links[i];
++ struct link_encoder *link_enc = link->link_enc;
++ enum signal_type signal = link->connector_signal;
+
++ dc->link_srv->blank_dp_stream(link, false);
+ if (signal != SIGNAL_TYPE_EDP)
+ signal = SIGNAL_TYPE_NONE;
+
+- if (dc->links[i]->ep_type == DISPLAY_ENDPOINT_PHY)
+- dc->links[i]->link_enc->funcs->disable_output(
+- dc->links[i]->link_enc, signal);
++ if (link->ep_type == DISPLAY_ENDPOINT_PHY)
++ link_enc->funcs->disable_output(link_enc, signal);
++
++ if (link->fec_state == dc_link_fec_enabled) {
++ link_enc->funcs->fec_set_enable(link_enc, false);
++ link_enc->funcs->fec_set_ready(link_enc, false);
++ link->fec_state = dc_link_fec_not_ready;
++ }
+
+- dc->links[i]->link_status.link_active = false;
+- memset(&dc->links[i]->cur_link_settings, 0,
+- sizeof(dc->links[i]->cur_link_settings));
++ link->link_status.link_active = false;
++ memset(&link->cur_link_settings, 0, sizeof(link->cur_link_settings));
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a3efb7fb7ef93daa2e902171958ef6c9a7df1616 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 11:11:19 -0500
+Subject: drm/amd/display: Ensure link output is disabled in backend reset for
+ PLL_ON
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 4589712e0111352973131bad975023b25569287c ]
+
+[Why]
+We're missing the code to actually disable the link output when we have
+to leave the SYMCLK_ON but the TX remains OFF.
+
+[How]
+Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable
+the link output when the backend is reset.
+
+Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
+index 9aa925a0b3b43..322515aee728e 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
+@@ -525,8 +525,22 @@ static void dcn31_reset_back_end_for_pipe(
+ if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass)
+ pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
+ pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
++ /*
++ * TODO - convert symclk_ref_cnts for otg to a bit map to solve
++ * the case where the same symclk is shared across multiple otg
++ * instances
++ */
+ if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal))
+- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0;
++ link->phy_state.symclk_ref_cnts.otg = 0;
++
++ if (pipe_ctx->top_pipe == NULL) {
++ if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) {
++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res);
++
++ link_hwss->disable_link_output(link, &pipe_ctx->link_res, pipe_ctx->stream->signal);
++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF;
++ }
++ }
+
+ set_drr_and_clear_adjust_pending(pipe_ctx, pipe_ctx->stream, NULL);
+
+--
+2.51.0
+
--- /dev/null
+From fa17121e3794a914246b0ce0ee313a987310c894 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 17:01:17 -0500
+Subject: drm/amd/display: Fix dsc eDP issue
+
+From: Charlene Liu <Charlene.Liu@amd.com>
+
+[ Upstream commit 878a4b73c11111ff5f820730f59a7f8c6fd59374 ]
+
+[why]
+Need to add function hook check before use
+
+Reviewed-by: Mohit Bawa <mohit.bawa@amd.com>
+Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 31c7dfff27cbb..924a425a1b76d 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1767,6 +1767,9 @@ static void disable_vga_and_power_gate_all_controllers(
+ struct timing_generator *tg;
+ struct dc_context *ctx = dc->ctx;
+
++ if (dc->caps.ips_support)
++ return;
++
+ for (i = 0; i < dc->res_pool->timing_generator_count; i++) {
+ tg = dc->res_pool->timing_generators[i];
+
+@@ -1843,13 +1846,16 @@ static void clean_up_dsc_blocks(struct dc *dc)
+ /* disable DSC in OPTC */
+ if (i < dc->res_pool->timing_generator_count) {
+ tg = dc->res_pool->timing_generators[i];
+- tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0);
++ if (tg->funcs->set_dsc_config)
++ tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0);
+ }
+ /* disable DSC in stream encoder */
+ if (i < dc->res_pool->stream_enc_count) {
+ se = dc->res_pool->stream_enc[i];
+- se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0);
+- se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true);
++ if (se->funcs->dp_set_dsc_config)
++ se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0);
++ if (se->funcs->dp_set_dsc_pps_info_packet)
++ se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true);
+ }
+ /* disable DSC block */
+ if (dccg->funcs->set_ref_dscclk)
+--
+2.51.0
+
--- /dev/null
+From a38a0bb9011ff7c8c645b889a075dd33b5af3fe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:32:42 -0500
+Subject: drm/amd/display: Fix GFX12 family constant checks
+
+From: Matthew Stewart <Matthew.Stewart2@amd.com>
+
+[ Upstream commit bdad08670278829771626ea7b57c4db531e2544f ]
+
+Using >=, <= for checking the family is not always correct.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index b146b0529ae7f..87ecab0298aa1 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -11070,7 +11070,7 @@ static int dm_check_cursor_fb(struct amdgpu_crtc *new_acrtc,
+ * check tiling flags when the FB doesn't have a modifier.
+ */
+ if (!(fb->flags & DRM_MODE_FB_MODIFIERS)) {
+- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) {
++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) {
+ linear = AMDGPU_TILING_GET(afb->tiling_flags, GFX12_SWIZZLE_MODE) == 0;
+ } else if (adev->family >= AMDGPU_FAMILY_AI) {
+ linear = AMDGPU_TILING_GET(afb->tiling_flags, SWIZZLE_MODE) == 0;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+index 62e30942f735d..a283f34523ed0 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+@@ -275,7 +275,7 @@ static int amdgpu_dm_plane_validate_dcc(struct amdgpu_device *adev,
+ if (!dcc->enable)
+ return 0;
+
+- if (adev->family < AMDGPU_FAMILY_GC_12_0_0 &&
++ if (adev->family != AMDGPU_FAMILY_GC_12_0_0 &&
+ format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN)
+ return -EINVAL;
+
+@@ -896,7 +896,7 @@ int amdgpu_dm_plane_fill_plane_buffer_attributes(struct amdgpu_device *adev,
+ upper_32_bits(chroma_addr);
+ }
+
+- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) {
++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) {
+ ret = amdgpu_dm_plane_fill_gfx12_plane_attributes_from_modifiers(adev, afb, format,
+ rotation, plane_size,
+ tiling_info, dcc,
+--
+2.51.0
+
--- /dev/null
+From ff60ad02fdd8c2c84917214e2399707e07c9e1e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 18:10:31 +0800
+Subject: drm/amd/display: Fix system resume lag issue
+
+From: Tom Chung <chiahsuan.chung@amd.com>
+
+[ Upstream commit 64c94cd9be2e188ed07efeafa6a109bce638c967 ]
+
+[Why]
+System will try to apply idle power optimizations setting during
+system resume. But system power state is still in D3 state, and
+it will cause the idle power optimizations command not actually
+to be sent to DMUB and cause some platforms to go into IPS.
+
+[How]
+Set power state to D0 first before calling the
+dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false)
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index de91fed0e850d..f4693136a2ebf 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3243,7 +3243,17 @@ static int dm_resume(void *handle)
+ struct dc_commit_streams_params commit_params = {};
+
+ if (dm->dc->caps.ips_support) {
++ if (!amdgpu_in_reset(adev))
++ mutex_lock(&dm->dc_lock);
++
++ /* Need to set POWER_STATE_D0 first or it will not execute
++ * idle_power_optimizations command to DMUB.
++ */
++ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0);
+ dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false);
++
++ if (!amdgpu_in_reset(adev))
++ mutex_unlock(&dm->dc_lock);
+ }
+
+ if (amdgpu_in_reset(adev)) {
+--
+2.51.0
+
--- /dev/null
+From ca55474c4e6c60156a2572c05f7bd9e68ddcdeda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 17:20:31 -0700
+Subject: drm/amd/display: Fix writeback on DCN 3.2+
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit 9ef84a307582a92ef055ef0bd3db10fd8ac75960 ]
+
+[WHAT]
+1. Set no scaling for writeback as they are hardcoded in DCN3.2+.
+2. Set no fast plane update for writeback commits.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 87ecab0298aa1..de91fed0e850d 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9888,10 +9888,10 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm,
+
+ wb_info->dwb_params.capture_rate = dwb_capture_rate_0;
+
+- wb_info->dwb_params.scaler_taps.h_taps = 4;
+- wb_info->dwb_params.scaler_taps.v_taps = 4;
+- wb_info->dwb_params.scaler_taps.h_taps_c = 2;
+- wb_info->dwb_params.scaler_taps.v_taps_c = 2;
++ wb_info->dwb_params.scaler_taps.h_taps = 1;
++ wb_info->dwb_params.scaler_taps.v_taps = 1;
++ wb_info->dwb_params.scaler_taps.h_taps_c = 1;
++ wb_info->dwb_params.scaler_taps.v_taps_c = 1;
+ wb_info->dwb_params.subsample_position = DWB_INTERSTITIAL_SUBSAMPLING;
+
+ wb_info->mcif_buf_params.luma_pitch = afb->base.pitches[0];
+@@ -10884,6 +10884,8 @@ static bool should_reset_plane(struct drm_atomic_state *state,
+ struct drm_crtc_state *old_crtc_state, *new_crtc_state;
+ struct dm_crtc_state *old_dm_crtc_state, *new_dm_crtc_state;
+ struct amdgpu_device *adev = drm_to_adev(plane->dev);
++ struct drm_connector_state *new_con_state;
++ struct drm_connector *connector;
+ int i;
+
+ /*
+@@ -10894,6 +10896,15 @@ static bool should_reset_plane(struct drm_atomic_state *state,
+ state->allow_modeset)
+ return true;
+
++ /* Check for writeback commit */
++ for_each_new_connector_in_state(state, connector, new_con_state, i) {
++ if (connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK)
++ continue;
++
++ if (new_con_state->writeback_job)
++ return true;
++ }
++
+ if (amdgpu_in_reset(adev) && state->allow_modeset)
+ return true;
+
+--
+2.51.0
+
--- /dev/null
+From d8f237f4f325d0ad0478f0ba173f7d7114dca3ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 16:38:50 -0500
+Subject: drm/amd/display: only power down dig on phy endpoints
+
+From: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+
+[ Upstream commit 0839d8d24e6f1fc2587c4a976f44da9fa69ae3d0 ]
+
+This avoids any issues with dpia endpoints
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index bf2a9d8d3bd2d..e62d415b16004 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -371,6 +371,8 @@ void dcn401_init_hw(struct dc *dc)
+ for (i = 0; i < dc->link_count; i++) {
+ struct dc_link *link = dc->links[i];
+
++ if (link->ep_type != DISPLAY_ENDPOINT_PHY)
++ continue;
+ if (link->link_enc->funcs->is_dig_enabled &&
+ link->link_enc->funcs->is_dig_enabled(link->link_enc) &&
+ hws->funcs.power_down) {
+--
+2.51.0
+
--- /dev/null
+From cf8abe60208fa207c452bf66c7d7c4cf424c06bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 22:05:16 -0700
+Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ]
+
+[Why]
+Shaper programming has high chance to fail on first time after
+power-on or reboot. This can be verified by running IGT's kms_colorop.
+
+[How]
+Always power on the shaper and 3DLUT before programming by
+removing the debug flag of low power mode.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
+index a0e9e9f0441a4..acf726137488d 100644
+--- a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
+@@ -721,8 +721,7 @@ bool mpc32_program_shaper(
+ return false;
+ }
+
+- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc)
+- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
+
+ current_mode = mpc32_get_shaper_current(mpc, mpcc_id);
+
+--
+2.51.0
+
--- /dev/null
+From ec96d731f9242ea677e1392c3a2adddb70f67a72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:24:01 +0000
+Subject: drm/amdgpu: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for amdgpu.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 29cecfab07042..37a91a76208e5 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3449,6 +3449,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((adev->pdev->device == 0x666f) &&
++ (adev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (adev->asic_type == CHIP_OLAND) {
+ if ((adev->pdev->revision == 0xC7) ||
+ (adev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From c59acc064275e085fe086953fdc4e661d208f709 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 10:46:47 +0800
+Subject: drm/amdgpu: add support for HDP IP version 6.1.1
+
+From: Tim Huang <tim.huang@amd.com>
+
+[ Upstream commit e2fd14f579b841f54a9b7162fef15234d8c0627a ]
+
+This initializes HDP IP version 6.1.1.
+
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Tim Huang <tim.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index e09db65880e1a..f62ac736ed76c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -2895,6 +2895,7 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ case IP_VERSION(6, 0, 0):
+ case IP_VERSION(6, 0, 1):
+ case IP_VERSION(6, 1, 0):
++ case IP_VERSION(6, 1, 1):
+ adev->hdp.funcs = &hdp_v6_0_funcs;
+ break;
+ case IP_VERSION(7, 0, 0):
+--
+2.51.0
+
--- /dev/null
+From 226409cd7945fce458eb7c64bf1e087f1257d006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 15:32:01 +0800
+Subject: drm/amdgpu: Adjust usleep_range in fence wait
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ]
+
+Tune the sleep interval in the PSP fence wait loop from 10-100us to
+60-100us.This adjustment results in an overall wait window of 1.2s
+(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations),
+which guarantees that we can retrieve the correct fence value
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index fa84208eed18e..26260873f6a15 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -694,7 +694,7 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ ras_intr = amdgpu_ras_intr_triggered();
+ if (ras_intr)
+ break;
+- usleep_range(10, 100);
++ usleep_range(60, 100);
+ amdgpu_device_invalidate_hdp(psp->adev, NULL);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 13c8cbc93c4eccfa005b2374eb97ea723be2304b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 11:46:48 -0500
+Subject: drm/amdgpu: avoid a warning in timedout job handler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74 ]
+
+Only set an error on the fence if the fence is not
+signalled. We can end up with a warning if the
+per queue reset path signals the fence and sets an error
+as part of the reset, but fails to recover.
+
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+index 7e6057a6e7f17..ba9a9adca0bff 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -132,7 +132,8 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job)
+ amdgpu_vm_put_task_info(ti);
+ }
+
+- dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
++ if (dma_fence_get_status(&s_job->s_fence->finished) == 0)
++ dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
+
+ /* attempt a per ring reset */
+ if (amdgpu_gpu_recovery &&
+--
+2.51.0
+
--- /dev/null
+From 04caaa9c34ae11eac4e15fe11f1b1e76275cb570 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2024 11:07:40 +0800
+Subject: drm/amdgpu: fix NULL pointer issue buffer funcs
+
+From: Likun Gao <Likun.Gao@amd.com>
+
+[ Upstream commit 9877a865d62c9c3e0f4cc369dc9ca9f7f24f5ee9 ]
+
+If SDMA block not enabled, buffer_funcs will not initialize,
+fix the null pointer issue if buffer_funcs not initialized.
+
+Signed-off-by: Likun Gao <Likun.Gao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 1cf90557b310b..cab75f5c9f2fd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2963,7 +2963,8 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
+ if (r)
+ goto init_failed;
+
+- if (adev->mman.buffer_funcs_ring->sched.ready)
++ if (adev->mman.buffer_funcs_ring &&
++ adev->mman.buffer_funcs_ring->sched.ready)
+ amdgpu_ttm_set_buffer_funcs_status(adev, true);
+
+ /* Don't init kfd if whole hive need to be reset during init */
+--
+2.51.0
+
--- /dev/null
+From d84f10ad344b5c0994a73f89cf221977ea0321c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 15:16:27 +0800
+Subject: drm/amdgpu: Skip loading SDMA_RS64 in VF
+
+From: YuBiao Wang <YuBiao.Wang@amd.com>
+
+[ Upstream commit 39c21b81112321cbe1267b02c77ecd2161ce19aa ]
+
+VFs use the PF SDMA ucode and are unable to load SDMA_RS64.
+
+Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com>
+Signed-off-by: Victor Skvortsov <Victor.Skvortsov@amd.com>
+Reviewed-by: Gavin Wan <gavin.wan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index 9247cd7b1868c..78af6e9282256 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -923,6 +923,7 @@ bool amdgpu_virt_fw_load_skip_check(struct amdgpu_device *adev, uint32_t ucode_i
+ || ucode_id == AMDGPU_UCODE_ID_SDMA5
+ || ucode_id == AMDGPU_UCODE_ID_SDMA6
+ || ucode_id == AMDGPU_UCODE_ID_SDMA7
++ || ucode_id == AMDGPU_UCODE_ID_SDMA_RS64
+ || ucode_id == AMDGPU_UCODE_ID_RLC_G
+ || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL
+ || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM
+--
+2.51.0
+
--- /dev/null
+From 2efbfea1cb4bf59e5e1fe989872e591cf0951a4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 19:36:56 +0530
+Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in
+ svm_migrate_gart_map()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ]
+
+In svm_migrate_gart_map(), while migrating GART mapping, the number of
+bytes copied for the GART table only accounts for CPU pages. On non-4K
+systems, each CPU page can contain multiple GPU pages, and the GART
+requires one 8-byte PTE per GPU page. As a result, an incorrect size was
+passed to the DMA, causing only a partial update of the GART table.
+
+Fix this function to work correctly on non-4K page-size systems by
+accounting for the number of GPU pages per CPU page when calculating the
+number of bytes to be copied.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index f31e9fbf634a0..52246f16cc242 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -62,7 +62,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, uint64_t npages,
+ *gart_addr = adev->gmc.gart_start;
+
+ num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8);
+- num_bytes = npages * 8;
++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE;
+
+ r = amdgpu_job_alloc_with_ib(adev, &adev->mman.high_pr,
+ AMDGPU_FENCE_OWNER_UNDEFINED,
+--
+2.51.0
+
--- /dev/null
+From f85f02f037897ae4a1d19730998ba295e802a0f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:32:45 -0500
+Subject: drm/amdkfd: Handle GPU reset and drain retry fault race
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 5b57c3c3f22336e8fd5edb7f0fef3c7823f8eac1 ]
+
+Only check and drain IH1 ring if CAM is not enabled.
+
+If GPU is under reset, don't access IH to drain retry fault.
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index d65b0b23ec7b8..7f2dbb6c2cbf8 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -33,6 +33,7 @@
+ #include "amdgpu_hmm.h"
+ #include "amdgpu.h"
+ #include "amdgpu_xgmi.h"
++#include "amdgpu_reset.h"
+ #include "kfd_priv.h"
+ #include "kfd_svm.h"
+ #include "kfd_migrate.h"
+@@ -2334,6 +2335,9 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms)
+
+ pr_debug("drain retry fault gpu %d svms %p\n", i, svms);
+
++ if (!down_read_trylock(&pdd->dev->adev->reset_domain->sem))
++ continue;
++
+ amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev,
+ pdd->dev->adev->irq.retry_cam_enabled ?
+ &pdd->dev->adev->irq.ih :
+@@ -2343,6 +2347,7 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms)
+ amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev,
+ &pdd->dev->adev->irq.ih_soft);
+
++ up_read(&pdd->dev->adev->reset_domain->sem);
+
+ pr_debug("drain retry fault gpu %d svms 0x%p done\n", i, svms);
+ }
+@@ -2526,7 +2531,7 @@ svm_range_unmap_from_cpu(struct mm_struct *mm, struct svm_range *prange,
+ adev = pdd->dev->adev;
+
+ /* Check and drain ih1 ring if cam not available */
+- if (adev->irq.ih1.ring_size) {
++ if (!adev->irq.retry_cam_enabled && adev->irq.ih1.ring_size) {
+ ih = &adev->irq.ih1;
+ checkpoint_wptr = amdgpu_ih_get_wptr(adev, ih);
+ if (ih->rptr != checkpoint_wptr) {
+--
+2.51.0
+
--- /dev/null
+From 69c438060da4fd6f7a0983ae9cddcfdd6f54689f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 19:36:54 +0530
+Subject: drm/amdkfd: Relax size checking during queue buffer get
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 42ea9cf2f16b7131cb7302acb3dac510968f8bdc ]
+
+HW-supported EOP buffer sizes are 4K and 32K. On systems that do not
+use 4K pages, the minimum buffer object (BO) allocation size is
+PAGE_SIZE (for example, 64K). During queue buffer acquisition, the driver
+currently checks the allocated BO size against the supported EOP buffer
+size. Since the allocated BO is larger than the expected size, this check
+fails, preventing queue creation.
+
+Relax the strict size validation and allow PAGE_SIZE-sized BOs to be used.
+Only the required 4K region of the buffer will be used as the EOP buffer
+and avoids queue creation failures on non-4K page systems.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Suggested-by: Philip Yang <yangp@amd.com>
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+index 0c6ef2919d870..1f1169a4d1540 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+@@ -275,8 +275,8 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
+
+ /* EOP buffer is not required for all ASICs */
+ if (properties->eop_ring_buffer_address) {
+- if (properties->eop_ring_buffer_size != topo_dev->node_props.eop_buffer_size) {
+- pr_debug("queue eop bo size 0x%x not equal to node eop buf size 0x%x\n",
++ if (properties->eop_ring_buffer_size < topo_dev->node_props.eop_buffer_size) {
++ pr_debug("queue eop bo size 0x%x is less than node eop buf size 0x%x\n",
+ properties->eop_ring_buffer_size,
+ topo_dev->node_props.eop_buffer_size);
+ err = -EINVAL;
+@@ -284,7 +284,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
+ }
+ err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address,
+ &properties->eop_buf_bo,
+- properties->eop_ring_buffer_size);
++ ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE));
+ if (err)
+ goto out_err_unreserve;
+ }
+--
+2.51.0
+
--- /dev/null
+From c1427eb9d47ab0cb59201acfc17a5ad8df6757e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 11:38:25 +0100
+Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has
+ fractional parts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ]
+
+Don’t reject the commit when the source rectangle has fractional parts.
+This can occur due to scaling: drm_atomic_helper_check_plane_state() calls
+drm_rect_clip_scaled(), which may introduce fractional parts while
+computing the clipped source rectangle. This does not imply the commit is
+invalid, so we should accept it instead of discarding it.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 410ec747cc7e0..caf6deda717ce 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -78,8 +78,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s)
+ return container_of(s, struct atmel_hlcdc_plane_state, base);
+ }
+
+-#define SUBPIXEL_MASK 0xffff
+-
+ static uint32_t rgb_formats[] = {
+ DRM_FORMAT_C8,
+ DRM_FORMAT_XRGB4444,
+@@ -744,24 +742,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p,
+ if (ret || !s->visible)
+ return ret;
+
+- hstate->src_x = s->src.x1;
+- hstate->src_y = s->src.y1;
+- hstate->src_w = drm_rect_width(&s->src);
+- hstate->src_h = drm_rect_height(&s->src);
++ hstate->src_x = s->src.x1 >> 16;
++ hstate->src_y = s->src.y1 >> 16;
++ hstate->src_w = drm_rect_width(&s->src) >> 16;
++ hstate->src_h = drm_rect_height(&s->src) >> 16;
+ hstate->crtc_x = s->dst.x1;
+ hstate->crtc_y = s->dst.y1;
+ hstate->crtc_w = drm_rect_width(&s->dst);
+ hstate->crtc_h = drm_rect_height(&s->dst);
+
+- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) &
+- SUBPIXEL_MASK)
+- return -EINVAL;
+-
+- hstate->src_x >>= 16;
+- hstate->src_y >>= 16;
+- hstate->src_w >>= 16;
+- hstate->src_h >>= 16;
+-
+ hstate->nplanes = fb->format->num_planes;
+ if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From a7cc4e219db3a4d7ac152fc6dc4e144f6862d72e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:52 +0200
+Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state
+ callback
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ]
+
+After several commits, the slab memory increases. Some drm_crtc_commit
+objects are not freed. The atomic_destroy_state callback only put the
+framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
+to put all the objects that are no longer needed.
+
+It has been seen after hours of usage of a graphics application or using
+kmemleak:
+
+unreferenced object 0xc63a6580 (size 64):
+ comm "egt_basic", pid 171, jiffies 4294940784
+ hex dump (first 32 bytes):
+ 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.
+ 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.
+ backtrace (crc c25aa925):
+ kmemleak_alloc+0x34/0x3c
+ __kmalloc_cache_noprof+0x150/0x1a4
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 3787db014501e..410ec747cc7e0 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -1204,8 +1204,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
+ state->dscrs[i]->self);
+ }
+
+- if (s->fb)
+- drm_framebuffer_put(s->fb);
++ __drm_atomic_helper_plane_destroy_state(s);
+
+ kfree(state);
+ }
+--
+2.51.0
+
--- /dev/null
+From fcfaa8952ac404adf2106ad604ea5c7a941b238b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:53 +0200
+Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ]
+
+The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
+the atmel_hlcdc_plane state structure without properly duplicating the
+drm_plane_state. In particular, state->commit remained set to the old
+state commit, which can lead to a use-after-free in the next
+drm_atomic_commit() call.
+
+Fix this by calling
+__drm_atomic_helper_duplicate_plane_state(), which correctly clones
+the base drm_plane_state (including the ->commit pointer).
+
+It has been seen when closing and re-opening the device node while
+another DRM client (e.g. fbdev) is still attached:
+
+=============================================================================
+BUG kmalloc-64 (Not tainted): Poison overwritten
+-----------------------------------------------------------------------------
+
+0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b
+FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b
+Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0
+pid=29
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_framebuffer_remove+0x4cc/0x5a8
+ drm_mode_rmfb_work_fn+0x6c/0x80
+ process_one_work+0x12c/0x2cc
+ worker_thread+0x2a8/0x400
+ kthread+0xc0/0xdc
+ ret_from_fork+0x14/0x28
+Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0
+pid=169
+ drm_atomic_helper_commit_hw_done+0x100/0x150
+ drm_atomic_helper_commit_tail+0x64/0x8c
+ commit_tail+0x168/0x18c
+ drm_atomic_helper_commit+0x138/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0
+flags=0x200(workingset|zone=0)
+Object 0xc611b340 @offset=832 fp=0xc611b7c0
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index caf6deda717ce..ae8d7b017968d 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -1174,8 +1174,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
+ return NULL;
+ }
+
+- if (copy->base.fb)
+- drm_framebuffer_get(copy->base.fb);
++ __drm_atomic_helper_plane_duplicate_state(p, ©->base);
+
+ return ©->base;
+ }
+--
+2.51.0
+
--- /dev/null
+From a9601449b68e4b73ad99d49517fb7a184b2a2e37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 15:16:50 +0530
+Subject: drm/display/dp_mst: Add protection against 0 vcpi
+
+From: Suraj Kandpal <suraj.kandpal@intel.com>
+
+[ Upstream commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa ]
+
+When releasing a timeslot there is a slight chance we may end up
+with the wrong payload mask due to overflow if the delayed_destroy_work
+ends up coming into play after a DP 2.1 monitor gets disconnected
+which causes vcpi to become 0 then we try to make the payload =
+~BIT(vcpi - 1) which is a negative shift. VCPI id should never
+really be 0 hence skip changing the payload mask if VCPI is 0.
+
+Otherwise it leads to
+<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc
+[drm_display_helper]] port ffff888126ce9000 (3)
+<4> [515.287267] -----------[ cut here ]-----------
+<3> [515.287268] UBSAN: shift-out-of-bounds in
+../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36
+<3> [515.287271] shift exponent -1 is negative
+<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G
+S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)
+<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
+<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P
+WIFI, BIOS 1645 03/15/2024
+<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work
+[drm_display_helper]
+<4> [515.287303] Call Trace:
+<4> [515.287304] <TASK>
+<4> [515.287306] dump_stack_lvl+0xc1/0xf0
+<4> [515.287313] dump_stack+0x10/0x20
+<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0
+<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0
+<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d
+[drm_display_helper]
+<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]
+<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0
+<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60
+<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe]
+<4> [515.287740] ? find_held_lock+0x31/0x90
+<4> [515.287747] ? lock_release+0xce/0x2a0
+<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40
+<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140
+<4> [515.287765] drm_atomic_commit+0x6e/0xf0
+<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10
+<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0
+<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0
+<4> [515.287795] ? mutex_lock_nested+0x1b/0x30
+<4> [515.287801] drm_client_modeset_commit+0x26/0x50
+<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110
+<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140
+<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0
+<4> [515.287819] drm_client_hotplug+0x6c/0xf0
+<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0
+<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30
+<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410
+[drm_display_helper]
+<4> [515.287861] process_one_work+0x22b/0x6f0
+<4> [515.287874] worker_thread+0x1e8/0x3d0
+<4> [515.287879] ? __pfx_worker_thread+0x10/0x10
+<4> [515.287882] kthread+0x11c/0x250
+<4> [515.287886] ? __pfx_kthread+0x10/0x10
+<4> [515.287890] ret_from_fork+0x2d7/0x310
+<4> [515.287894] ? __pfx_kthread+0x10/0x10
+<4> [515.287897] ret_from_fork_asm+0x1a/0x30
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303
+Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+index 3e5f721d75400..997f2489f00f3 100644
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -4571,7 +4571,8 @@ int drm_dp_atomic_release_time_slots(struct drm_atomic_state *state,
+ if (!payload->delete) {
+ payload->pbn = 0;
+ payload->delete = true;
+- topology_state->payload_mask &= ~BIT(payload->vcpi - 1);
++ if (payload->vcpi > 0)
++ topology_state->payload_mask &= ~BIT(payload->vcpi - 1);
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 5f7e2c9010a1578bd22061f7747a02da72a20f58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 20:09:55 +0800
+Subject: drm/panel: Fix a possible null-pointer dereference in
+ jdi_panel_dsi_remove()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit 95eed73b871111123a8b1d31cb1fce7e902e49ea ]
+
+In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it
+may be NULL:
+
+ if (!jdi)
+ mipi_dsi_detach(dsi);
+
+However, when jdi is NULL, the function does not return and continues by
+calling jdi_panel_disable():
+
+ err = jdi_panel_disable(&jdi->base);
+
+Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can
+lead to a NULL-pointer dereference:
+
+ struct jdi_panel *jdi = to_panel_jdi(panel);
+ backlight_disable(jdi->backlight);
+
+To prevent such a potential NULL-pointer dereference, return early from
+jdi_panel_dsi_remove() when jdi is NULL.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patch.msgid.link/20251218120955.11185-1-islituo@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
+index 5b5082efb282b..eba560e422e8b 100644
+--- a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
++++ b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
+@@ -510,8 +510,10 @@ static void jdi_panel_dsi_remove(struct mipi_dsi_device *dsi)
+ int err;
+
+ /* only detach from host for the DSI-LINK2 interface */
+- if (!jdi)
++ if (!jdi) {
+ mipi_dsi_detach(dsi);
++ return;
++ }
+
+ err = jdi_panel_disable(&jdi->base);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From e3c782ce832a02697f3a44e3f99aa3c2c8d2473c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:26:00 +0000
+Subject: drm/radeon: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for radeon.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 9deb91970d4df..f12227145ef08 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2925,6 +2925,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((rdev->pdev->device == 0x666f) &&
++ (rdev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (rdev->family == CHIP_OLAND) {
+ if ((rdev->pdev->revision == 0xC7) ||
+ (rdev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From c0167ebdcd3bec43a9e6b79ea159524e81cd4a9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 21:03:23 +0800
+Subject: drm/v3d: Set DMA segment size to avoid debug warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ]
+
+When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
+kernel occasionally reports a segment size mismatch. This is because
+'max_seg_size' is not set. The kernel defaults to 64K. setting
+'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
+from complaining about the over-mapping of the V3D segment length.
+
+DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device
+ claims to support [len=8290304] [max=65536]
+WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388
+CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1
+Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : debug_dma_map_sg+0x330/0x388
+lr : debug_dma_map_sg+0x330/0x388
+sp : ffff8000829a3ac0
+x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000
+x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000
+x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002
+x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff
+x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573
+x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000
+x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c
+x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001
+x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280
+Call trace:
+ debug_dma_map_sg+0x330/0x388
+ __dma_map_sg_attrs+0xc0/0x278
+ dma_map_sgtable+0x30/0x58
+ drm_gem_shmem_get_pages_sgt+0xb4/0x140
+ v3d_bo_create_finish+0x28/0x130 [v3d]
+ v3d_create_bo_ioctl+0x54/0x180 [v3d]
+ drm_ioctl_kernel+0xc8/0x140
+ drm_ioctl+0x2d4/0x4d8
+
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
+index 7c17108da7d2d..f45fdd7d542f6 100644
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -302,6 +302,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ if (ret)
+ goto clk_disable;
+
++ dma_set_max_seg_size(&pdev->dev, UINT_MAX);
++
+ v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH);
+
+ ident1 = V3D_READ(V3D_HUB_IDENT1);
+--
+2.51.0
+
--- /dev/null
+From 76d8d266ef902dbd4aed660fd6752f44460b244c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 17:27:35 -0800
+Subject: drm/xe: Only toggle scheduling in TDR if GuC is running
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit dd1ef5e2456558876244795bb22a4d90cb24f160 ]
+
+If the firmware is not running during TDR (e.g., when the driver is
+unloading), there's no need to toggle scheduling in the GuC. In such
+cases, skip this step.
+
+v4:
+ - Bail on wait UC not running (Niranjana)
+
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
+Link: https://patch.msgid.link/20260110012739.2888434-4-matthew.brost@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_submit.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index f316be1e96452..d0ef3a6a68d2c 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1112,7 +1112,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
+ if (exec_queue_reset(q))
+ err = -EIO;
+
+- if (!exec_queue_destroyed(q)) {
++ if (!exec_queue_destroyed(q) && xe_uc_fw_is_running(&guc->fw)) {
+ /*
+ * Wait for any pending G2H to flush out before
+ * modifying state
+@@ -1143,6 +1143,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
+ */
+ smp_rmb();
+ ret = wait_event_timeout(guc->ct.wq,
++ !xe_uc_fw_is_running(&guc->fw) ||
+ !exec_queue_pending_disable(q) ||
+ guc_read_stopped(guc), HZ * 5);
+ if (!ret || guc_read_stopped(guc)) {
+--
+2.51.0
+
--- /dev/null
+From e0d0a80cfe0f32c7c48edf2210385be6af7e8936 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:06 +0100
+Subject: EFI/CPER: don't dump the entire memory region
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ]
+
+The current logic at cper_print_fw_err() doesn't check if the
+error record length is big enough to handle offset. On a bad firmware,
+if the ofset is above the actual record, length -= offset will
+underflow, making it dump the entire memory.
+
+The end result can be:
+
+ - the logic taking a lot of time dumping large regions of memory;
+ - data disclosure due to the memory dumps;
+ - an OOPS, if it tries to dump an unmapped memory region.
+
+Fix it by checking if the section length is too small before doing
+a hex dump.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 16b27fe9608fd..e7fa5efea0d17 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -560,6 +560,11 @@ static void cper_print_fw_err(const char *pfx,
+ } else {
+ offset = sizeof(*fw_err);
+ }
++ if (offset > length) {
++ printk("%s""error section length is too small: offset=%d, length=%d\n",
++ pfx, offset, length);
++ return;
++ }
+
+ buf += offset;
+ length -= offset;
+--
+2.51.0
+
--- /dev/null
+From 4d9b2d57276e3e068a3b0f37304461d57826b61e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:04 +0100
+Subject: EFI/CPER: don't go past the ARM processor CPER record buffer
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ]
+
+There's a logic inside GHES/CPER to detect if the section_length
+is too small, but it doesn't detect if it is too big.
+
+Currently, if the firmware receives an ARM processor CPER record
+stating that a section length is big, kernel will blindly trust
+section_length, producing a very long dump. For instance, a 67
+bytes record with ERR_INFO_NUM set 46198 and section length
+set to 854918320 would dump a lot of data going a way past the
+firmware memory-mapped area.
+
+Fix it by adding a logic to prevent it to go past the buffer
+if ERR_INFO_NUM is too big, making it report instead:
+
+ [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+ [Hardware Error]: event severity: recoverable
+ [Hardware Error]: Error 0, type: recoverable
+ [Hardware Error]: section_type: ARM processor error
+ [Hardware Error]: MIDR: 0xff304b2f8476870a
+ [Hardware Error]: section length: 854918320, CPER size: 67
+ [Hardware Error]: section length is too big
+ [Hardware Error]: firmware-generated error record is incorrect
+ [Hardware Error]: ERR_INFO_NUM is 46198
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject and changelog tweaks ]
+Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper-arm.c | 12 ++++++++----
+ drivers/firmware/efi/cper.c | 3 ++-
+ include/linux/cper.h | 3 ++-
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
+index 52d18490b59e3..70e1735dfcdd4 100644
+--- a/drivers/firmware/efi/cper-arm.c
++++ b/drivers/firmware/efi/cper-arm.c
+@@ -226,7 +226,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
+ }
+
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc)
++ const struct cper_sec_proc_arm *proc,
++ u32 length)
+ {
+ int i, len, max_ctx_type;
+ struct cper_arm_err_info *err_info;
+@@ -238,9 +239,12 @@ void cper_print_proc_arm(const char *pfx,
+
+ len = proc->section_length - (sizeof(*proc) +
+ proc->err_info_num * (sizeof(*err_info)));
+- if (len < 0) {
+- printk("%ssection length: %d\n", pfx, proc->section_length);
+- printk("%ssection length is too small\n", pfx);
++
++ if (len < 0 || proc->section_length > length) {
++ printk("%ssection length: %d, CPER size: %d\n",
++ pfx, proc->section_length, length);
++ printk("%ssection length is too %s\n", pfx,
++ (len < 0) ? "small" : "big");
+ printk("%sfirmware-generated error record is incorrect\n", pfx);
+ printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num);
+ return;
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index e7fa5efea0d17..3587295cd0206 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -664,7 +664,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata
+
+ printk("%ssection_type: ARM processor error\n", newpfx);
+ if (gdata->error_data_length >= sizeof(*arm_err))
+- cper_print_proc_arm(newpfx, arm_err);
++ cper_print_proc_arm(newpfx, arm_err,
++ gdata->error_data_length);
+ else
+ goto err_section_too_small;
+ #endif
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index 3670b866ac119..951291fa50d4f 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -591,7 +591,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *,
+ const char *cper_mem_err_unpack(struct trace_seq *,
+ struct cper_mem_err_compact *);
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc);
++ const struct cper_sec_proc_arm *proc,
++ u32 length);
+ void cper_print_proc_ia(const char *pfx,
+ const struct cper_sec_proc_ia *proc);
+ int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg);
+--
+2.51.0
+
--- /dev/null
+From d17321030e936b4e2b0a54926f3eeb2cd93ca67b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:41 +0800
+Subject: ext4: mark group add fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ]
+
+Fast commits only log operations that have dedicated replay support.
+Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group
+descriptor metadata without going through the fast commit tracking
+paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+ext4_ioctl_group_add() adds new block groups.
+This forces those transactions to fall back to a full commit,
+ensuring that the filesystem geometry updates are captured by the
+normal journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_ADD safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted
+ filesystem and checked the resize ineligible reason:
+ ./group_add_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows "Resize": > 0.
+3. Fsynced a file on the resized filesystem and verified that the fast
+ commit stats report at least one ineligible commit:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+ shows fc stats ineligible > 0.
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 1c77400bd88e1..9bfd0ccee6983 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -963,6 +963,7 @@ static long ext4_ioctl_group_add(struct file *file,
+
+ err = ext4_group_add(sb, input);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From 307d051a203be11df8b59b0b609a80f2518fa316 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:42 +0800
+Subject: ext4: mark group extend fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ]
+
+Fast commits only log operations that have dedicated replay support.
+EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last
+block group and updates the same on-disk metadata without going
+through the fast commit tracking paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+EXT4_IOC_GROUP_EXTEND grows the filesystem.
+This forces those transactions to fall back to a full commit,
+ensuring that the group extension changes are captured by the normal
+journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_EXTEND safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Extended the filesystem to the end of the last block group using a
+ helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem
+ and checked fc_info:
+ ./group_extend_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows the "Resize" ineligible reason increased.
+3. Fsynced a file on the resized filesystem and confirmed that the fast
+ commit ineligible counter incremented for the resize transaction:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 9bfd0ccee6983..99d185d00f377 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1315,6 +1315,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+
+ err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE,
++ NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From 3e35338c66a45bbb14e2a148c3bf1b07894fc7c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 21:31:16 +0800
+Subject: ext4: move ext4_percpu_param_init() before ext4_mb_init()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 270564513489d98b721a1e4a10017978d5213bff ]
+
+When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the
+`DOUBLE_CHECK` macro defined, the following panic is triggered:
+
+==================================================================
+EXT4-fs error (device vdc): ext4_validate_block_bitmap:423:
+ comm mount: bg 0: bad block bitmap checksum
+BUG: unable to handle page fault for address: ff110000fa2cc000
+PGD 3e01067 P4D 3e02067 PUD 0
+Oops: Oops: 0000 [#1] SMP NOPTI
+CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W
+ 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none)
+RIP: 0010:percpu_counter_add_batch+0x13/0xa0
+Call Trace:
+ <TASK>
+ ext4_mark_group_bitmap_corrupted+0xcb/0xe0
+ ext4_validate_block_bitmap+0x2a1/0x2f0
+ ext4_read_block_bitmap+0x33/0x50
+ mb_group_bb_bitmap_alloc+0x33/0x80
+ ext4_mb_add_groupinfo+0x190/0x250
+ ext4_mb_init_backend+0x87/0x290
+ ext4_mb_init+0x456/0x640
+ __ext4_fill_super+0x1072/0x1680
+ ext4_fill_super+0xd3/0x280
+ get_tree_bdev_flags+0x132/0x1d0
+ vfs_get_tree+0x29/0xd0
+ vfs_cmd_create+0x59/0xe0
+ __do_sys_fsconfig+0x4f6/0x6b0
+ do_syscall_64+0x50/0x1f0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+==================================================================
+
+This issue can be reproduced using the following commands:
+ mkfs.ext4 -F -q -b 1024 /dev/sda 5G
+ tune2fs -O quota,project /dev/sda
+ mount /dev/sda /tmp/test
+
+With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads
+and validates the block bitmap. When the validation fails,
+ext4_mark_group_bitmap_corrupted() attempts to update
+sbi->s_freeclusters_counter. However, this percpu_counter has not been
+initialized yet at this point, which leads to the panic described above.
+
+Fix this by moving the execution of ext4_percpu_param_init() to occur
+before ext4_mb_init(), ensuring the per-CPU counters are initialized
+before they are used.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index d26a754bb9c83..9eec13f88d5a5 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5534,6 +5534,10 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ clear_opt2(sb, MB_OPTIMIZE_SCAN);
+ }
+
++ err = ext4_percpu_param_init(sbi);
++ if (err)
++ goto failed_mount5;
++
+ err = ext4_mb_init(sb);
+ if (err) {
+ ext4_msg(sb, KERN_ERR, "failed to initialize mballoc (%d)",
+@@ -5549,10 +5553,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ sbi->s_journal->j_commit_callback =
+ ext4_journal_commit_callback;
+
+- err = ext4_percpu_param_init(sbi);
+- if (err)
+- goto failed_mount6;
+-
+ if (ext4_has_feature_flex_bg(sb))
+ if (!ext4_fill_flex_info(sb)) {
+ ext4_msg(sb, KERN_ERR,
+@@ -5632,8 +5632,8 @@ failed_mount8: __maybe_unused
+ failed_mount6:
+ ext4_mb_release(sb);
+ ext4_flex_groups_free(sbi);
+- ext4_percpu_param_destroy(sbi);
+ failed_mount5:
++ ext4_percpu_param_destroy(sbi);
+ ext4_ext_release(sb);
+ ext4_release_system_zone(sb);
+ failed_mount4a:
+--
+2.51.0
+
--- /dev/null
+From de0351f4d98fdf08c79e69bfb96f2d8ac2ae07e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 11:55:35 +0530
+Subject: ext4: propagate flags to convert_initialized_extent()
+
+From: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+
+[ Upstream commit 3fffa44b6ebf65be92a562a5063303979385a1c9 ]
+
+Currently, ext4_zero_range passes EXT4_EX_NOCACHE flag to avoid caching
+extents however this is not respected by convert_initialized_extent().
+Hence, modify it to accept flags from the caller and to pass the flags
+on to other extent manipulation functions it calls. This makes
+sure the NOCACHE flag is respected throughout the code path.
+
+Also, we no longer explicitly pass CONVERT_UNWRITTEN as the caller takes
+care of this.
+
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Link: https://patch.msgid.link/07008fbb14db727fddcaf4c30e2346c49f6c8fe0.1769149131.git.ojaswin@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index da68c3726ddaf..b4ea8d3745a52 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3816,6 +3816,7 @@ static struct ext4_ext_path *
+ convert_initialized_extent(handle_t *handle, struct inode *inode,
+ struct ext4_map_blocks *map,
+ struct ext4_ext_path *path,
++ int flags,
+ unsigned int *allocated)
+ {
+ struct ext4_extent *ex;
+@@ -3841,11 +3842,11 @@ convert_initialized_extent(handle_t *handle, struct inode *inode,
+
+ if (ee_block != map->m_lblk || ee_len > map->m_len) {
+ path = ext4_split_convert_extents(handle, inode, map, path,
+- EXT4_GET_BLOCKS_CONVERT_UNWRITTEN, NULL);
++ flags, NULL);
+ if (IS_ERR(path))
+ return path;
+
+- path = ext4_find_extent(inode, map->m_lblk, path, 0);
++ path = ext4_find_extent(inode, map->m_lblk, path, flags);
+ if (IS_ERR(path))
+ return path;
+ depth = ext_depth(inode);
+@@ -4257,7 +4258,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
+ if ((!ext4_ext_is_unwritten(ex)) &&
+ (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN)) {
+ path = convert_initialized_extent(handle,
+- inode, map, path, &allocated);
++ inode, map, path, flags, &allocated);
+ if (IS_ERR(path))
+ err = PTR_ERR(path);
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From 10a425bd24448013c7526eb1efc00190ea79561f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 09:45:16 +0800
+Subject: ext4: use reserved metadata blocks when splitting extent on endio
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit 01942af95ab6c9d98e64ae01fdc243a03e4b973f ]
+
+When performing buffered writes, we may need to split and convert an
+unwritten extent into a written one during the end I/O process. However,
+we do not reserve space specifically for these metadata changes, we only
+reserve 2% of space or 4096 blocks. To address this, we use
+EXT4_GET_BLOCKS_PRE_IO to potentially split extents in advance and
+EXT4_GET_BLOCKS_METADATA_NOFAIL to utilize reserved space if necessary.
+
+These two approaches can reduce the likelihood of running out of space
+and losing data. However, these methods are merely best efforts, we
+could still run out of space, and there is not much difference between
+converting an extent during the writeback process and the end I/O
+process, it won't increase the risk of losing data if we postpone the
+conversion.
+
+Therefore, also use EXT4_GET_BLOCKS_METADATA_NOFAIL in
+ext4_convert_unwritten_extents_endio() to prepare for the buffered I/O
+iomap conversion, which may perform extent conversion during the end I/O
+process.
+
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Link: https://patch.msgid.link/20260105014522.1937690-2-yi.zhang@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 2f9c3cd4f26cc..da68c3726ddaf 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3768,6 +3768,8 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode,
+ * illegal.
+ */
+ if (ee_block != map->m_lblk || ee_len > map->m_len) {
++ int flags = EXT4_GET_BLOCKS_CONVERT |
++ EXT4_GET_BLOCKS_METADATA_NOFAIL;
+ #ifdef CONFIG_EXT4_DEBUG
+ ext4_warning(inode->i_sb, "Inode (%ld) finished: extent logical block %llu,"
+ " len %u; IO logical block %llu, len %u",
+@@ -3775,7 +3777,7 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode,
+ (unsigned long long)map->m_lblk, map->m_len);
+ #endif
+ path = ext4_split_convert_extents(handle, inode, map, path,
+- EXT4_GET_BLOCKS_CONVERT, NULL);
++ flags, NULL);
+ if (IS_ERR(path))
+ return path;
+
+--
+2.51.0
+
--- /dev/null
+From 7aa9d8559190316b117133bc8284378f623d6aea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 11:16:56 +0800
+Subject: firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 9fda364cb78c8b9e1abe4029f877300c94655742 ]
+
+ffa_init() maps the Rx/Tx buffers via ffa_rxtx_map() but on the
+partition setup failure path it never unmaps them.
+
+Add the missing ffa_rxtx_unmap() call in the error path so that
+the Rx/Tx buffers are properly released before freeing the backing
+pages.
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Message-Id: <20251210031656.56194-1-lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
+index 7e486e49d1eed..9516ee870cd25 100644
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -1832,6 +1832,7 @@ static int __init ffa_init(void)
+
+ cleanup_notifs:
+ ffa_notifications_cleanup();
++ ffa_rxtx_unmap(drv_info->vm_id);
+ free_pages:
+ if (drv_info->tx_buffer)
+ free_pages_exact(drv_info->tx_buffer, rxtx_bufsz);
+--
+2.51.0
+
--- /dev/null
+From 3cf8535b0c7904c628b50a51c071806d4d09ae74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 13:11:24 +0100
+Subject: fix it87_wdt early reboot by reporting running timer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ]
+
+Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87
+wdt enabled by the firmware and a broken BIOS option that does not
+allow to change the time or turn it off. As this makes installing
+Linux rather difficult, change the it87_wdt to report it running to
+the watchdog core.
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/it87_wdt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
+index 1a5a0a2c3f2e3..8c42cb41fa230 100644
+--- a/drivers/watchdog/it87_wdt.c
++++ b/drivers/watchdog/it87_wdt.c
+@@ -186,6 +186,12 @@ static void _wdt_update_timeout(unsigned int t)
+ superio_outb(t >> 8, WDTVALMSB);
+ }
+
++/* Internal function, should be called after superio_select(GPIO) */
++static bool _wdt_running(void)
++{
++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB));
++}
++
+ static int wdt_update_timeout(unsigned int t)
+ {
+ int ret;
+@@ -372,6 +378,12 @@ static int __init it87_wdt_init(void)
+ }
+ }
+
++ /* wdt already left running by firmware? */
++ if (_wdt_running()) {
++ pr_info("Left running by firmware.\n");
++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status);
++ }
++
+ superio_exit();
+
+ if (timeout < 1 || timeout > max_units * 60) {
+--
+2.51.0
+
--- /dev/null
+From 040616bf37a64fb9633109ab71bed474533c3f80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 16:58:48 +0100
+Subject: fpga: of-fpga-region: Fail if any bridge is missing
+
+From: Romain Gantois <romain.gantois@bootlin.com>
+
+[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ]
+
+When parsing the region bridge list from the "fpga-bridges" device tree
+property, the of-fpga-region driver will silently ignore bridges which fail
+to be obtained, for example due to a missing bridge driver or invalid
+phandle.
+
+This can lead to hardware issues if a region bridge stays coupled when
+partial programming is performed.
+
+Fail if any of the bridges specified in "fpga-bridges" cannot be obtained.
+
+Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
+Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com
+Reviewed-by: Xu Yilun <yilun.xu@intel.com>
+Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/of-fpga-region.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
+index 8526a5a86f0cb..efc35dad6aaa3 100644
+--- a/drivers/fpga/of-fpga-region.c
++++ b/drivers/fpga/of-fpga-region.c
+@@ -83,7 +83,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np)
+ * done with the bridges.
+ *
+ * Return: 0 for success (even if there are no bridges specified)
+- * or -EBUSY if any of the bridges are in use.
++ * or an error code if any of the bridges are not available.
+ */
+ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ {
+@@ -130,10 +130,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ ®ion->bridge_list);
+ of_node_put(br);
+
+- /* If any of the bridges are in use, give up */
+- if (ret == -EBUSY) {
++ /* If any of the bridges are not available, give up */
++ if (ret) {
+ fpga_bridges_put(®ion->bridge_list);
+- return -EBUSY;
++ return ret;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6b8277469e4dc089b221899204c544b1b7581eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 18:42:11 +0530
+Subject: fs/buffer: add alert in try_to_free_buffers() for folios without
+ buffers
+
+From: Deepakkumar Karn <dkarn@redhat.com>
+
+[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ]
+
+try_to_free_buffers() can be called on folios with no buffers attached
+when filemap_release_folio() is invoked on a folio belonging to a mapping
+with AS_RELEASE_ALWAYS set but no release_folio operation defined.
+
+In such cases, folio_needs_release() returns true because of the
+AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This
+causes try_to_free_buffers() to call drop_buffers() on a folio with no
+buffers, leading to a null pointer dereference.
+
+Adding a check in try_to_free_buffers() to return early if the folio has no
+buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.
+This provides defensive hardening.
+
+Signed-off-by: Deepakkumar Karn <dkarn@redhat.com>
+Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/buffer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 79c19ffa44015..c5aaf1419d341 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2968,6 +2968,10 @@ bool try_to_free_buffers(struct folio *folio)
+ if (folio_test_writeback(folio))
+ return false;
+
++ /* Misconfigured folio check */
++ if (WARN_ON_ONCE(!folio_buffers(folio)))
++ return true;
++
+ if (mapping == NULL) { /* can this still happen? */
+ ret = drop_buffers(folio, &buffers_to_free);
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From 83e40040dbc00cb069932b45c02e2fcc3368dc8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 16:07:32 +0100
+Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in
+ ntfs_read_run_nb_ra()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ]
+
+When ntfs_read_run_nb_ra() is invoked with run == NULL the code later
+assumes run is valid and may call run_get_entry(NULL, ...), and also
+uses clen/idx without initializing them. Smatch reported uninitialized
+variable warnings and this can lead to undefined behaviour. This patch
+fixes it.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fsntfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index 57933576212bb..37c5d9a1f77b7 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -1276,6 +1276,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run,
+
+ } while (len32);
+
++ if (!run) {
++ err = -EINVAL;
++ goto out;
++ }
++
++ /* Get next fragment to read. */
+ vcn_next = vcn + clen;
+ if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) ||
+ vcn != vcn_next) {
+--
+2.51.0
+
--- /dev/null
+From 415ccad2fb66aee3229788b8ff96c64ee9593090 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 19:59:59 +0900
+Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed dentry in the ntfs3 filesystem can cause the kernel to hang
+during the lookup operations. By setting the HAS_SUB_NODE flag in an
+INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the
+VCN pointer, an attacker can cause the indx_find() function to repeatedly
+read the same block, allocating 4 KB of memory each time. The kernel lacks
+VCN loop detection and depth limits, causing memory exhaustion and an OOM
+crash.
+
+This patch adds a return value check for fnd_push() to prevent a memory
+exhaustion vulnerability caused by infinite loops. When the index exceeds the
+size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()
+function checks this return value and stops processing, preventing further
+memory allocation.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 6d1bf890929d9..050b3709e0204 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1190,7 +1190,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni,
+ return -EINVAL;
+ }
+
+- fnd_push(fnd, node, e);
++ err = fnd_push(fnd, node, e);
++
++ if (err) {
++ put_indx_node(node);
++ return err;
++ }
+ }
+
+ *entry = e;
+--
+2.51.0
+
--- /dev/null
+From f17337fa99c6c49aa49d8370ce5528dc17c748fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 14:27:48 +0300
+Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ]
+
+Do not keep preallocated clusters for sparsed and compressed files.
+Preserving preallocation in these cases causes fsx failures when running
+with sparse files and preallocation enabled.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index 873d14a5174a9..4390c0e4bfb78 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -448,8 +448,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type,
+
+ is_ext = is_attr_ext(attr_b);
+ align = sbi->cluster_size;
+- if (is_ext)
++ if (is_ext) {
+ align <<= attr_b->nres.c_unit;
++ keep_prealloc = false;
++ }
+
+ old_valid = le64_to_cpu(attr_b->nres.valid_size);
+ old_size = le64_to_cpu(attr_b->nres.data_size);
+--
+2.51.0
+
--- /dev/null
+From 292dc6ccfd914e137ed20b58f5f2e1bdf9283d9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:09 +0900
+Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
+ metadata
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an attribute header
+indicates an empty run list, while directory entries reference it as
+containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way
+to represent an empty run list, and run_unpack() correctly handles this by
+checking if evcn + 1 equals svcn and returning early without parsing any run
+data. However, this creates a problem when there is metadata inconsistency,
+where the attribute header claims to be empty (evcn=-1) but the caller
+expects to read actual data. When run_unpack() immediately returns success
+upon seeing this condition, it leaves the runs_tree uninitialized with
+run->runs as a NULL. The calling function attr_load_runs_range() assumes
+that a successful return means that the runs were loaded and sets clen to 0,
+expecting the next run_lookup_entry() call to succeed. Because runs_tree
+remains uninitialized, run_lookup_entry() continues to fail, and the loop
+increments vcn by zero (vcn += 0), leading to an infinite loop.
+
+This patch adds a retry counter to detect when run_lookup_entry() fails
+consecutively after attr_load_runs_vcn(). If the run is still not found on
+the second attempt, it indicates corrupted metadata and returns -EINVAL,
+preventing the Denial-of-Service (DoS) vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index dd459316529e8..873d14a5174a9 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -1353,19 +1353,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type,
+ CLST vcn;
+ CLST vcn_last = (to - 1) >> cluster_bits;
+ CLST lcn, clen;
+- int err;
++ int err = 0;
++ int retry = 0;
+
+ for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) {
+ if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) {
++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */
++ err = -EINVAL;
++ break;
++ }
+ err = attr_load_runs_vcn(ni, type, name, name_len, run,
+ vcn);
+ if (err)
+- return err;
++ break;
++
+ clen = 0; /* Next run_lookup_entry(vcn) must be success. */
++ retry++;
+ }
++ else
++ retry = 0;
+ }
+
+- return 0;
++ return err;
+ }
+
+ #ifdef CONFIG_NTFS3_LZX_XPRESS
+--
+2.51.0
+
--- /dev/null
+From 12e04e20b3275c64e59fea4f113d45756188ce1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:46 +0900
+Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
+indicates a zero data size while the driver allocates memory for it.
+
+When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
+to zero, it still allocates memory because of al_aligned(0). This creates an
+inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
+non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
+list exists and enumerates only the primary MFT record. When it finds
+ATTR_LIST, the code reloads it and restarts the enumeration, repeating
+indefinitely. The mount operation never completes, hanging the kernel thread.
+
+This patch adds validation to ensure that data_size is non-zero before memory
+allocation. When a zero-sized ATTR_LIST is detected, the function returns
+-EINVAL, preventing a DoS vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrlist.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
+index a4d74bed74fab..098bd7e8c3d64 100644
+--- a/fs/ntfs3/attrlist.c
++++ b/fs/ntfs3/attrlist.c
+@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+
+ if (!attr->non_res) {
+ lsize = le32_to_cpu(attr->res.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ /* attr is resident: lsize < record_size (1K or 4K) */
+ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+ u16 run_off = le16_to_cpu(attr->nres.run_off);
+
+ lsize = le64_to_cpu(attr->nres.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
+
+ run_init(&ni->attr_list.run);
+
+--
+2.51.0
+
--- /dev/null
+From fff23144e4666d4e493e01dcd4be7ee5b29f8645 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 15:52:57 +0100
+Subject: gfs2: fiemap page fault fix
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ]
+
+In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode
+glock. This can lead to recursive glock taking if the fiemap buffer is
+memory mapped to the same inode and accessing it triggers a page fault.
+
+Fix by disabling page faults for iomap_fiemap() and faulting in the
+buffer by hand if necessary.
+
+Fixes xfstest generic/742.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/inode.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index c8a59bc1714bf..c37079718fdd5 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -2201,6 +2201,14 @@ static int gfs2_getattr(struct mnt_idmap *idmap,
+ return 0;
+ }
+
++static bool fault_in_fiemap(struct fiemap_extent_info *fi)
++{
++ struct fiemap_extent __user *dest = fi->fi_extents_start;
++ size_t size = sizeof(*dest) * fi->fi_extents_max;
++
++ return fault_in_safe_writeable((char __user *)dest, size) == 0;
++}
++
+ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ u64 start, u64 len)
+ {
+@@ -2210,14 +2218,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+
+ inode_lock_shared(inode);
+
++retry:
+ ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh);
+ if (ret)
+ goto out;
+
++ pagefault_disable();
+ ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops);
++ pagefault_enable();
+
+ gfs2_glock_dq_uninit(&gh);
+
++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) {
++ fieinfo->fi_extents_mapped = 0;
++ goto retry;
++ }
++
+ out:
+ inode_unlock_shared(inode);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 7ebc7819dcf03adc9e15323a77f9d7f7951d1a29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:26:26 +0800
+Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ]
+
+Use module_platform_driver() to replace module_platform_driver_probe().
+The former utilizes platform_driver_register(), which allows the driver to
+defer probing when it doesn't acquire the necessary resources due to probe
+order. In contrast, the latter uses __platform_driver_probe(), which
+includes the comment "Note that this is incompatible with deferred
+probing." Since our SGPIO driver requires access to the clock resource, the
+former is more suitable.
+
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed-sgpio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
+index 72755fee64784..e69a6ce7be3fb 100644
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -534,7 +534,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = {
+
+ MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table);
+
+-static int __init aspeed_sgpio_probe(struct platform_device *pdev)
++static int aspeed_sgpio_probe(struct platform_device *pdev)
+ {
+ u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask;
+ const struct aspeed_sgpio_pdata *pdata;
+@@ -629,11 +629,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ }
+
+ static struct platform_driver aspeed_sgpio_driver = {
++ .probe = aspeed_sgpio_probe,
+ .driver = {
+ .name = KBUILD_MODNAME,
+ .of_match_table = aspeed_sgpio_of_table,
+ },
+ };
+
+-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe);
++module_platform_driver(aspeed_sgpio_driver);
+ MODULE_DESCRIPTION("Aspeed Serial GPIO Driver");
+--
+2.51.0
+
--- /dev/null
+From 161ee904752a18544c9d714f2ed6845d1807374c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 07:45:55 +0000
+Subject: gpu/panel-edp: add AUO panel entry for B140HAN06.4
+
+From: Alexey Klimov <alexey.klimov@linaro.org>
+
+[ Upstream commit 2976aeb0de77da599ad37691963efbdcb07435ce ]
+
+Add an eDP panel entry for AUO B140HAN06.4 that is also used in
+some variants of Lenovo Flex 5G with Qcom SC8180 SoC.
+
+The raw edid of the panel is:
+
+00 ff ff ff ff ff ff 00 06 af 3d 64 00 00 00 00
+2b 1d 01 04 a5 1f 11 78 03 b8 1a a6 54 4a 9b 26
+0e 52 55 00 00 00 01 01 01 01 01 01 01 01 01 01
+01 01 01 01 01 01 14 37 80 b8 70 38 24 40 10 10
+3e 00 35 ae 10 00 00 18 10 2c 80 b8 70 38 24 40
+10 10 3e 00 35 ae 10 00 00 18 00 00 00 fe 00 41
+55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe
+00 42 31 34 30 48 41 4e 30 36 2e 34 20 0a 00 eb
+
+I do not have access to the datasheet and but it is tested on above
+mentioned laptop for a few weeks and seems to work just fine with
+timing info of similar panels.
+
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20251203074555.690613-1-alexey.klimov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 663af985d1b38..d6806956f63e9 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1852,6 +1852,7 @@ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x635c, &delay_200_500_e50, "B116XAN06.3"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x639c, &delay_200_500_e50, "B140HAK02.7"),
++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x643d, &delay_200_500_e50, "B140HAN06.4"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x723c, &delay_200_500_e50, "B140XTN07.2"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x73aa, &delay_200_500_e50, "B116XTN02.3"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x8594, &delay_200_500_e50, "B133UAN01.0"),
+--
+2.51.0
+
--- /dev/null
+From 28a0e1486412fa0e7c4bb0240b0b90983db4d4f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 04:57:17 +0000
+Subject: gro: change the BUG_ON() in gro_pull_from_frag0()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ]
+
+Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE()
+
+$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2
+add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116)
+Function old new delta
+gro_try_pull_from_frag0 - 196 +196
+napi_gro_frags 771 929 +158
+__pfx_gro_try_pull_from_frag0 - 16 +16
+__pfx_gro_pull_from_frag0 16 - -16
+dev_gro_receive 1514 1464 -50
+gro_pull_from_frag0 188 - -188
+Total: Before=22565899, After=22566015, chg +0.00%
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/gro.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/gro.c b/net/core/gro.c
+index 40aaac4e04f34..ac498c9f82cf5 100644
+--- a/net/core/gro.c
++++ b/net/core/gro.c
+@@ -416,7 +416,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow)
+ {
+ struct skb_shared_info *pinfo = skb_shinfo(skb);
+
+- BUG_ON(skb->end - skb->tail < grow);
++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow);
+
+ memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
+
+--
+2.51.0
+
--- /dev/null
+From fa17d61a509260ea2764450ade51ccf9f9f2ee60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Dec 2025 19:58:22 -0800
+Subject: hfsplus: fix volume corruption issue for generic/498
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ]
+
+The xfstests' test-case generic/498 leaves HFS+ volume
+in corrupted state:
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
+(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details)
+
+Ran: generic/498
+Failures: generic/498
+Failed 1 of 1 tests
+
+sudo fsck.hfsplus -d /dev/loop51
+** /dev/loop51
+Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+Executing fsck_hfs (version 540.1-Linux).
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+Invalid leaf record count
+(It should be 16 instead of 2)
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
+CBTStat = 0x8000 CatStat = 0x00000000
+** Repairing volume.
+** Rechecking volume.
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled was repaired successfully.
+
+The generic/498 test executes such steps on final phase:
+
+mkdir $SCRATCH_MNT/A
+mkdir $SCRATCH_MNT/B
+mkdir $SCRATCH_MNT/A/C
+touch $SCRATCH_MNT/B/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo
+
+ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A
+
+"Simulate a power failure and mount the filesystem
+to check that what we explicitly fsync'ed exists."
+
+_flakey_drop_and_remount
+
+The FSCK tool complains about "Invalid leaf record count".
+HFS+ b-tree header contains leaf_count field is updated
+by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert()
+is involved into hard link creation process. However,
+modified in-core leaf_count field is stored into HFS+
+b-tree header by hfs_btree_write() method. But,
+unfortunately, hfs_btree_write() hasn't been called
+by hfsplus_cat_write_inode() and hfsplus_file_fsync()
+stores not fully consistent state of the Catalog File's
+b-tree.
+
+This patch adds calling hfs_btree_write() method in
+the hfsplus_cat_write_inode() with the goal of
+storing consistent state of Catalog File's b-tree.
+Finally, it makes FSCK tool happy.
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 33s ... 31s
+Ran: generic/498
+Passed all 1 tests
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/inode.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 2d68c52f894f9..3f64f68d625c1 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -601,6 +601,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ int hfsplus_cat_write_inode(struct inode *inode)
+ {
+ struct inode *main_inode = inode;
++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree;
+ struct hfs_find_data fd;
+ hfsplus_cat_entry entry;
+ int res = 0;
+@@ -611,7 +612,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ if (!main_inode->i_nlink)
+ return 0;
+
+- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd))
++ if (hfs_find_init(tree, &fd))
+ /* panic? */
+ return -EIO;
+
+@@ -676,6 +677,15 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags);
+ out:
+ hfs_find_exit(&fd);
++
++ if (!res) {
++ res = hfs_btree_write(tree);
++ if (res) {
++ pr_err("b-tree write err: %d, ino %lu\n",
++ res, inode->i_ino);
++ }
++ }
++
+ return res;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a5b42a499f88eab116840c91cdb1e7b59eef0708 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 18:39:33 +0900
+Subject: hfsplus: pretend special inodes as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index 0831cd7aa5deb..b4c7748c4cf98 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode)
+ return -EIO;
+ }
+
++ /*
++ * Assign a dummy file type, for may_open() requires that
++ * an inode has a valid file type.
++ */
++ inode->i_mode = S_IFREG;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f94dee4575229c663e9c9527ad691c0cdc4b06a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 06:06:23 +0000
+Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple
+ keyboards
+
+From: Joey Bednar <linux@joeybednar.com>
+
+[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ]
+
+The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium
+Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX
+KN85 Keyboard" to the list of non-apple keyboards fixes the function
+keys.
+
+Signed-off-by: Joey Bednar <linux@joeybednar.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index a0f79803df3bd..b0cf13cd292bd 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -353,6 +353,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+ };
+
+ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
++ { "SONiX KN85 Keyboard" },
+ { "SONiX USB DEVICE" },
+ { "SONiX AK870 PRO" },
+ { "Keychron" },
+--
+2.51.0
+
--- /dev/null
+From 43b67aa3b878446fe2499e76cc52083581fb3bfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 12:56:09 +0900
+Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
+
+From: David Phillips <david@profile.sh>
+
+[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ]
+
+New model in the ELECOM HUGE trackball line that has 8 buttons but the
+report descriptor specifies only 5. The HUGE Plus supports connecting via
+Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable.
+Each connection type reports a different device id, 01AA for cable,
+01AB for USB dongle, and 01AC for Bluetooth.
+
+This patch adds these device IDs and applies the fixups similar to the
+other ELECOM devices to get all 8 buttons working for all 3 connection
+types.
+
+For reference, the usbhid-dump output:
+001:013:001:DESCRIPTOR 1769085639.598405
+ 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01
+ 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01
+ 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10
+ 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06
+ 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0
+ C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01
+ 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01
+ 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03
+ 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00
+ A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81
+ 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26
+ FF 00 75 08 95 07 B1 02 C0
+
+Signed-off-by: David Phillips <david@profile.sh>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-elecom.c | 16 ++++++++++++++++
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 3 +++
+ 4 files changed, 23 insertions(+)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 95a4ede270991..f283f271d87e7 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -328,6 +328,7 @@ config HID_ELECOM
+ - EX-G Trackballs (M-XT3DRBK, M-XT3URBK)
+ - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ - HUGE Plus Trackball (M-HT1MRBK)
+
+ config HID_ELO
+ tristate "ELO USB 4000/4500 touchscreen"
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index b57b6deb36f42..f1e3fc374a1d5 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -5,6 +5,7 @@
+ * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK)
+ * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ * - HUGE Plus Trackball (M-HT1MRBK)
+ *
+ * Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
+ * Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
+@@ -111,12 +112,25 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
+ break;
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC:
++ /*
++ * Report descriptor format:
++ * 24: button bit count
++ * 28: padding bit count
++ * 22: button report size
++ * 16: button usage maximum
++ */
++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8);
++ break;
+ }
+ return rdesc;
+ }
+
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+@@ -127,6 +141,8 @@ static const struct hid_device_id elecom_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, elecom_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 9ed994e34211d..dfa39a37405e3 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -459,6 +459,9 @@
+ #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac
+
+ #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34
+ #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 1f531626192cd..7a3e0675d9ba2 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -415,6 +415,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+@@ -424,6 +425,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_ELO)
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
+--
+2.51.0
+
--- /dev/null
+From c07000ee8cfb63cb7d108b5ef93a2a61a8b219ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 17:40:41 +0800
+Subject: HID: i2c-hid: Add FocalTech FT8112
+
+From: Daniel Peng <Daniel_Peng@pegatron.corp-partner.google.com>
+
+[ Upstream commit 3d9586f1f90c9101b1abf5b0e9d70ca45f5f16db ]
+
+Information for touchscreen model HKO/RB116AS01-2 as below:
+- HID :FTSC1000
+- slave address:0X38
+- Interface:HID over I2C
+- Touch control lC:FT8112
+- I2C ID: PNP0C50
+
+Signed-off-by: Daniel Peng <Daniel_Peng@pegatron.corp-partner.google.com>
+Acked-by: Jiri Kosina <jkosina@suse.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20251117094041.300083-2-Daniel_Peng@pegatron.corp-partner.google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-of-elan.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+index 3fcff6daa0d3a..f215bad8b3ab1 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c
++++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+@@ -159,6 +159,13 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = {
+ .main_supply_name = "vcc33",
+ };
+
++static const struct elan_i2c_hid_chip_data focaltech_ft8112_chip_data = {
++ .post_power_delay_ms = 10,
++ .post_gpio_reset_on_delay_ms = 150,
++ .hid_descriptor_address = 0x0001,
++ .main_supply_name = "vcc33",
++};
++
+ static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = {
+ .post_power_delay_ms = 1,
+ .post_gpio_reset_on_delay_ms = 200,
+@@ -182,6 +189,7 @@ static const struct elan_i2c_hid_chip_data ilitek_ili2901_chip_data = {
+ static const struct of_device_id elan_i2c_hid_of_match[] = {
+ { .compatible = "elan,ekth6915", .data = &elan_ekth6915_chip_data },
+ { .compatible = "elan,ekth6a12nay", .data = &elan_ekth6a12nay_chip_data },
++ { .compatible = "focaltech,ft8112", .data = &focaltech_ft8112_chip_data },
+ { .compatible = "ilitek,ili9882t", .data = &ilitek_ili9882t_chip_data },
+ { .compatible = "ilitek,ili2901", .data = &ilitek_ili2901_chip_data },
+ { }
+--
+2.51.0
+
--- /dev/null
+From c3cb4d3673ac4aae7b4c05ee54b366ee225131d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 13:12:02 +0100
+Subject: HID: logitech-hidpp: Add support for Logitech K980
+
+From: Bastien Nocera <hadess@hadess.net>
+
+[ Upstream commit af4fe07a9d963a72438ade96cf090e84b3399d0c ]
+
+Add support for the solar-charging Logitech K980 keyboard, over
+Bluetooth. Bolt traffic doesn't get routed through logitech-dj, so
+this code isn't triggered when Bolt is used.
+
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index c470b4f0e9211..b4cc402787397 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -4693,6 +4693,8 @@ static const struct hid_device_id hidpp_devices[] = {
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb037) },
+ { /* MX Anywhere 3SB mouse over Bluetooth */
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) },
++ { /* Slim Solar+ K980 Keyboard over Bluetooth */
++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From e85689ec9cbffd7624072c099374ce4858e9e5e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 09:57:05 +0100
+Subject: HID: multitouch: add eGalaxTouch EXC3188 support
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ]
+
+Add support for the for the EXC3188 touchscreen from eGalaxy.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 9d0a97a3b06a2..9ed994e34211d 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -433,6 +433,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
+
+ #define USB_VENDOR_ID_EDIFIER 0x2d99
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index fcfc508d1b54d..c3a914458358c 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2026,6 +2026,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
++ { .driver_data = MT_CLS_EGALAX_SERIAL,
++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) },
+ { .driver_data = MT_CLS_EGALAX,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
+--
+2.51.0
+
--- /dev/null
+From c1ecb8dc8b7b71d54012d999d2a6126daa1e8f7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 10:02:03 +0800
+Subject: hisi_acc_vfio_pci: update status after RAS error
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ]
+
+After a RAS error occurs on the accelerator device, the accelerator
+device will be reset. The live migration state will be abnormal
+after reset, and the original state needs to be restored during
+the reset process.
+Therefore, reset processing needs to be performed in a live
+migration scenario.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+index dda8cb3262e0b..1a36b687e0085 100644
+--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+@@ -1139,8 +1139,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev)
+ {
+ struct hisi_acc_vf_core_device *hisi_acc_vdev = hisi_acc_drvdata(pdev);
+
+- if (hisi_acc_vdev->core_device.vdev.migration_flags !=
+- VFIO_MIGRATION_STOP_COPY)
++ if (!hisi_acc_vdev->core_device.vdev.mig_ops)
+ return;
+
+ mutex_lock(&hisi_acc_vdev->state_mutex);
+--
+2.51.0
+
--- /dev/null
+From ea7748cb2e5fab1fe8249e4665604906d44b8628 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jan 2026 01:06:10 +0100
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7080
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 46c3e87a79179454f741f797c274dd25f5c6125e ]
+
+The Dell OptiPlex 7080 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/16
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Acked-by: Pali Rohár <pali@kernel.org>
+Link: https://lore.kernel.org/r/20260104000654.6406-1-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 9df78861f5f88..2cb92a53e7c2c 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1275,6 +1275,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "MP061"),
+ },
+ },
++ {
++ .ident = "Dell OptiPlex 7080",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7080"),
++ },
++ },
+ {
+ .ident = "Dell OptiPlex 7060",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From fa1fb38ff4ea9b55b442595c053be579f5a02824 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 13:10:40 +0800
+Subject: hwmon: (f71882fg) Add F81968 support
+
+From: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+
+[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ]
+
+Add hardware monitoring support for the Fintek F81968 Super I/O chip.
+It is fully compatible with F81866.
+
+Several products share compatibility with the F81866. To better distinguish
+between them, ensure that the Product ID is displayed when the device is
+probed.
+
+Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/f71882fg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
+index 7c941d320a186..734df959276af 100644
+--- a/drivers/hwmon/f71882fg.c
++++ b/drivers/hwmon/f71882fg.c
+@@ -51,6 +51,7 @@
+ #define SIO_F81866_ID 0x1010 /* Chipset ID */
+ #define SIO_F71858AD_ID 0x0903 /* Chipset ID */
+ #define SIO_F81966_ID 0x1502 /* Chipset ID */
++#define SIO_F81968_ID 0x1806 /* Chipset ID */
+
+ #define REGION_LENGTH 8
+ #define ADDR_REG_OFFSET 5
+@@ -2570,6 +2571,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ break;
+ case SIO_F81866_ID:
+ case SIO_F81966_ID:
++ case SIO_F81968_ID:
+ sio_data->type = f81866a;
+ break;
+ default:
+@@ -2599,9 +2601,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */
+
+ err = address;
+- pr_info("Found %s chip at %#x, revision %d\n",
++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n",
+ f71882fg_names[sio_data->type], (unsigned int)address,
+- (int)superio_inb(sioaddr, SIO_REG_DEVREV));
++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid);
+ exit:
+ superio_exit(sioaddr);
+ return err;
+--
+2.51.0
+
--- /dev/null
+From eace774b3b4a6e56a6bf4c3c0c2e21d3cc498dae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 17:53:14 +0200
+Subject: hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
+
+From: Denis Pauk <pauk.denis@gmail.com>
+
+[ Upstream commit 246167b17c14e8a5142368ac6457e81622055e0a ]
+
+Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's
+no use of it because of resource conflict with WMI method.
+
+Add the board to the WMI monitoring list.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807
+Signed-off-by: Denis Pauk <pauk.denis@gmail.com>
+Tested-by: Marcus <shoes2ga@gmail.com>
+Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775-platform.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c
+index 1218a3b449a80..ece183a0d4e91 100644
+--- a/drivers/hwmon/nct6775-platform.c
++++ b/drivers/hwmon/nct6775-platform.c
+@@ -1356,6 +1356,7 @@ static const char * const asus_msi_boards[] = {
+ "Pro WS W680-ACE IPMI",
+ "Pro WS W790-ACE",
+ "Pro WS W790E-SAGE SE",
++ "Pro WS WRX90E-SAGE SE",
+ "ProArt B650-CREATOR",
+ "ProArt B660-CREATOR D4",
+ "ProArt B760-CREATOR D4",
+--
+2.51.0
+
--- /dev/null
+From 7ce85ac1aa836ec2253282af9ca308da75a73883 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:44 +0100
+Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ]
+
+The unpacked union within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value'
+ is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)'
+ and is usually due to 'struct hv_kvp_exchg_msg_value' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 361 | union {
+ | ^
+
+With the recent changes to compile-test the UAPI headers in more cases,
+this warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warning.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/hyperv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h
+index aaa502a7bff46..1749b35ab2c21 100644
+--- a/include/uapi/linux/hyperv.h
++++ b/include/uapi/linux/hyperv.h
+@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value {
+ __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE];
+ __u32 value_u32;
+ __u64 value_u64;
+- };
++ } __attribute__((packed));
+ } __attribute__((packed));
+
+ struct hv_kvp_msg_enumerate {
+--
+2.51.0
+
--- /dev/null
+From 871003ed83e11c651b3c6b398f07cd6d15e409c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:08:51 -0500
+Subject: i3c: master: svc: Initialize 'dev' to NULL in
+ svc_i3c_master_ibi_isr()
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ]
+
+Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add
+a NULL check in the error path.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 985f30ef0c939..cc13892e45963 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -426,8 +426,8 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ {
+ struct svc_i3c_master *master = container_of(work, struct svc_i3c_master, ibi_work);
+ struct svc_i3c_i2c_dev_data *data;
++ struct i3c_dev_desc *dev = NULL;
+ unsigned int ibitype, ibiaddr;
+- struct i3c_dev_desc *dev;
+ u32 status, val;
+ int ret;
+
+@@ -511,7 +511,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ * for the slave to interrupt again.
+ */
+ if (svc_i3c_master_error(master)) {
+- if (master->ibi.tbq_slot) {
++ if (master->ibi.tbq_slot && dev) {
+ data = i3c_dev_get_master_data(dev);
+ i3c_generic_ibi_recycle_slot(data->ibi_pool,
+ master->ibi.tbq_slot);
+--
+2.51.0
+
--- /dev/null
+From 34a6d6d912e05b71fda712b1cbdf1ec8c61dc9cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 09:26:42 +0200
+Subject: i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 78f63ae4a82db173f93adca462e63d11ba06b126 ]
+
+The MIPI I3C HCI specification does not define reset values for
+RING_OPERATION1 fields, and some controllers (e.g., Intel) do not clear
+them during a software reset. Ensure the ring pointers are explicitly
+set to zero during bus initialization to avoid inconsistent state.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260113072702.16268-2-adrian.hunter@intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/dma.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
+index fe955703e59b5..68c2923f55664 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
+@@ -328,6 +328,14 @@ static int hci_dma_init(struct i3c_hci *hci)
+ rh_reg_write(INTR_SIGNAL_ENABLE, regval);
+
+ ring_ready:
++ /*
++ * The MIPI I3C HCI specification does not document reset values for
++ * RING_OPERATION1 fields and some controllers (e.g. Intel controllers)
++ * do not reset the values, so ensure the ring pointers are set to zero
++ * here.
++ */
++ rh_reg_write(RING_OPERATION1, 0);
++
+ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE |
+ RING_CTRL_RUN_STOP);
+ }
+--
+2.51.0
+
--- /dev/null
+From 0dc93d34bbc0772d4b5b3313799cc36f49a4fd1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:38 +0100
+Subject: iio: magnetometer: Remove IRQF_ONESHOT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+The force-threading functionality is required on PREEMPT_RT because the
+handler is using locks with can sleep on PREEMPT_RT.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index 18077fb463a91..6975e0af50536 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -581,7 +581,7 @@ static int ak8975_setup_irq(struct ak8975_data *data)
+ irq = gpiod_to_irq(data->eoc_gpiod);
+
+ rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ dev_name(&client->dev), data);
+ if (rc < 0) {
+ dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc);
+--
+2.51.0
+
--- /dev/null
+From 4153c2a0624db26f605e3a52a7adf982413b278c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:36 +0100
+Subject: iio: Use IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ]
+
+The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke
+other interrupt handler and this supposed to happen from within the
+hardirq.
+
+Use IRQF_NO_THREAD to forbid forced-threading.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/bma180.c | 5 +++--
+ drivers/iio/adc/ad7766.c | 2 +-
+ drivers/iio/gyro/itg3200_buffer.c | 8 +++-----
+ drivers/iio/light/si1145.c | 2 +-
+ 4 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
+index 2445a0f7bc2ba..ff64bfb348ed8 100644
+--- a/drivers/iio/accel/bma180.c
++++ b/drivers/iio/accel/bma180.c
+@@ -990,8 +990,9 @@ static int bma180_probe(struct i2c_client *client)
+ }
+
+ ret = devm_request_irq(dev, client->irq,
+- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING,
+- "bma180_event", data->trig);
++ iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "bma180_event", data->trig);
+ if (ret) {
+ dev_err(dev, "unable to request IRQ\n");
+ goto err_trigger_free;
+diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c
+index 4d570383ef025..1e6bfe8765ab3 100644
+--- a/drivers/iio/adc/ad7766.c
++++ b/drivers/iio/adc/ad7766.c
+@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi)
+ * don't enable the interrupt to avoid extra load on the system
+ */
+ ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq,
+- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD,
+ dev_name(&spi->dev),
+ ad7766->trig);
+ if (ret < 0)
+diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
+index 4cfa0d4395605..d1c125a77308a 100644
+--- a/drivers/iio/gyro/itg3200_buffer.c
++++ b/drivers/iio/gyro/itg3200_buffer.c
+@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev)
+ if (!st->trig)
+ return -ENOMEM;
+
+- ret = request_irq(st->i2c->irq,
+- &iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_RISING,
+- "itg3200_data_rdy",
+- st->trig);
++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "itg3200_data_rdy", st->trig);
+ if (ret)
+ goto error_free_trig;
+
+diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c
+index 66abda021696a..1050bf68e076e 100644
+--- a/drivers/iio/light/si1145.c
++++ b/drivers/iio/light/si1145.c
+@@ -1250,7 +1250,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev)
+
+ ret = devm_request_irq(&client->dev, client->irq,
+ iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_FALLING,
++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD,
+ "si1145_irq",
+ trig);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From 834ee5ebedfe6437d623ad0d97ae74c04362805c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 15:54:06 +0100
+Subject: include: uapi: netfilter_bridge.h: Cover for musl libc
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ]
+
+Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
+zero. To avoid struct redefinition errors, user space is therefore
+supposed to include netinet/if_ether.h before (or instead of)
+linux/if_ether.h. To relieve them from this burden, include the libc
+header here if not building for kernel space.
+
+Reported-by: Alyssa Ross <hi@alyssa.is>
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter_bridge.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 1610fdbab98df..ad520d3e9df8f 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -5,6 +5,10 @@
+ /* bridge-specific defines for netfilter.
+ */
+
++#ifndef __KERNEL__
++#include <netinet/if_ether.h> /* for __UAPI_DEF_ETHHDR if defined */
++#endif
++
+ #include <linux/in.h>
+ #include <linux/netfilter.h>
+ #include <linux/if_ether.h>
+--
+2.51.0
+
--- /dev/null
+From 4943cba666c1e05b6b920cb67833325938863b81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 14:39:40 +0000
+Subject: iommu/amd: move wait_on_sem() out of spinlock
+
+From: Ankit Soni <Ankit.Soni@amd.com>
+
+[ Upstream commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf ]
+
+With iommu.strict=1, the existing completion wait path can cause soft
+lockups under stressed environment, as wait_on_sem() busy-waits under the
+spinlock with interrupts disabled.
+
+Move the completion wait in iommu_completion_wait() out of the spinlock.
+wait_on_sem() only polls the hardware-updated cmd_sem and does not require
+iommu->lock, so holding the lock during the busy wait unnecessarily
+increases contention and extends the time with interrupts disabled.
+
+Signed-off-by: Ankit Soni <Ankit.Soni@amd.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 5fb7bb7a84f41..fecca5c32e8a2 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -1022,7 +1022,12 @@ static int wait_on_sem(struct amd_iommu *iommu, u64 data)
+ {
+ int i = 0;
+
+- while (*iommu->cmd_sem != data && i < LOOP_TIMEOUT) {
++ /*
++ * cmd_sem holds a monotonically non-decreasing completion sequence
++ * number.
++ */
++ while ((__s64)(READ_ONCE(*iommu->cmd_sem) - data) < 0 &&
++ i < LOOP_TIMEOUT) {
+ udelay(1);
+ i += 1;
+ }
+@@ -1267,14 +1272,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+
+ ret = __iommu_queue_command_sync(iommu, &cmd, false);
++ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++
+ if (ret)
+- goto out_unlock;
++ return ret;
+
+ ret = wait_on_sem(iommu, data);
+
+-out_unlock:
+- raw_spin_unlock_irqrestore(&iommu->lock, flags);
+-
+ return ret;
+ }
+
+@@ -2931,13 +2935,18 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+ ret = __iommu_queue_command_sync(iommu, &cmd, true);
+ if (ret)
+- goto out;
++ goto out_err;
+ ret = __iommu_queue_command_sync(iommu, &cmd2, false);
+ if (ret)
+- goto out;
++ goto out_err;
++ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++
+ wait_on_sem(iommu, data);
+-out:
++ return;
++
++out_err:
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++ return;
+ }
+
+ static void set_dte_irq_entry(struct amd_iommu *iommu, u16 devid,
+--
+2.51.0
+
--- /dev/null
+From 34bfb60c6eb5ce510fbdbd458ea504d76b9a614d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 13:28:57 -0800
+Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
+
+From: Alexander Grest <Alexander.Grest@microsoft.com>
+
+[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ]
+
+The SMMU CMDQ lock is highly contentious when there are multiple CPUs
+issuing commands and the queue is nearly full.
+
+The lock has the following states:
+ - 0: Unlocked
+ - >0: Shared lock held with count
+ - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters
+ - INT_MIN: Exclusive lock held, no shared waiters
+
+When multiple CPUs are polling for space in the queue, they attempt to
+grab the exclusive lock to update the cons pointer from the hardware. If
+they fail to get the lock, they will spin until either the cons pointer
+is updated by another CPU.
+
+The current code allows the possibility of shared lock starvation
+if there is a constant stream of CPUs trying to grab the exclusive lock.
+This leads to severe latency issues and soft lockups.
+
+Consider the following scenario where CPU1's attempt to acquire the
+shared lock is starved by CPU2 and CPU0 contending for the exclusive
+lock.
+
+CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock`
+--------------------------------------------------------------------------
+trylock() //takes | | | 0
+ | shared_lock() | | INT_MIN
+ | fetch_inc() | | INT_MIN
+ | no return | | INT_MIN + 1
+ | spins // VAL >= 0 | | INT_MIN + 1
+unlock() | spins... | | INT_MIN + 1
+set_release(0) | spins... | | 0 see[NOTE]
+(done) | (sees 0) | trylock() // takes | 0
+ | *exits loop* | cmpxchg(0, INT_MIN) | 0
+ | | *cuts in* | INT_MIN
+ | cmpxchg(0, 1) | | INT_MIN
+ | fails // != 0 | | INT_MIN
+ | spins // VAL >= 0 | | INT_MIN
+ | *starved* | | INT_MIN
+
+[NOTE] The current code resets the exclusive lock to 0 regardless of the
+state of the lock. This causes two problems:
+1. It opens the possibility of back-to-back exclusive locks and the
+ downstream effect of starving shared lock.
+2. The count of shared lock waiters are lost.
+
+To mitigate this, we release the exclusive lock by only clearing the sign
+bit while retaining the shared lock waiter count as a way to avoid
+starving the shared lock waiters.
+
+Also deleted cmpxchg loop while trying to acquire the shared lock as it
+is not needed. The waiters can see the positive lock count and proceed
+immediately after the exclusive lock is released.
+
+Exclusive lock is not starved in that submitters will try exclusive lock
+first when new spaces become available.
+
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Alexander Grest <Alexander.Grest@microsoft.com>
+Signed-off-by: Jacob Pan <jacob.pan@linux.microsoft.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++-------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+index 560a670ee7911..5d11e5177a3c9 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+@@ -465,20 +465,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
+ */
+ static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq)
+ {
+- int val;
+-
+ /*
+- * We can try to avoid the cmpxchg() loop by simply incrementing the
+- * lock counter. When held in exclusive state, the lock counter is set
+- * to INT_MIN so these increments won't hurt as the value will remain
+- * negative.
++ * When held in exclusive state, the lock counter is set to INT_MIN
++ * so these increments won't hurt as the value will remain negative.
++ * The increment will also signal the exclusive locker that there are
++ * shared waiters.
+ */
+ if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0)
+ return;
+
+- do {
+- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0);
+- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val);
++ /*
++ * Someone else is holding the lock in exclusive state, so wait
++ * for them to finish. Since we already incremented the lock counter,
++ * no exclusive lock can be acquired until we finish. We don't need
++ * the return value since we only care that the exclusive lock is
++ * released (i.e. the lock counter is non-negative).
++ * Once the exclusive locker releases the lock, the sign bit will
++ * be cleared and our increment will make the lock counter positive,
++ * allowing us to proceed.
++ */
++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0);
+ }
+
+ static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq)
+@@ -505,9 +511,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq)
+ __ret; \
+ })
+
++/*
++ * Only clear the sign bit when releasing the exclusive lock this will
++ * allow any shared_lock() waiters to proceed without the possibility
++ * of entering the exclusive lock in a tight loop.
++ */
+ #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \
+ ({ \
+- atomic_set_release(&cmdq->lock, 0); \
++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \
+ local_irq_restore(flags); \
+ })
+
+--
+2.51.0
+
--- /dev/null
+From 854385bd7004884eb298f201082cb75c8f3e1baa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 04:35:24 +0000
+Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ]
+
+syzbot reported that struct fib_alias.fa_state can be
+modified locklessly by RCU readers. [0]
+
+Let's use READ_ONCE()/WRITE_ONCE() properly.
+
+[0]:
+BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup
+
+write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0:
+ fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline]
+ fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1:
+ fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline]
+ fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+value changed: 0x00 -> 0x01
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
+
+Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/fib_lookup.h | 6 ++++--
+ net/ipv4/fib_trie.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
+index f9b9e26c32c19..0b72796dd1ad3 100644
+--- a/net/ipv4/fib_lookup.h
++++ b/net/ipv4/fib_lookup.h
+@@ -28,8 +28,10 @@ struct fib_alias {
+ /* Don't write on fa_state unless needed, to keep it shared on all cpus */
+ static inline void fib_alias_accessed(struct fib_alias *fa)
+ {
+- if (!(fa->fa_state & FA_S_ACCESSED))
+- fa->fa_state |= FA_S_ACCESSED;
++ u8 fa_state = READ_ONCE(fa->fa_state);
++
++ if (!(fa_state & FA_S_ACCESSED))
++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED);
+ }
+
+ /* Exported by fib_semantics.c */
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 658f26d9a9ec5..ee47b67a08703 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1286,7 +1286,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
+ new_fa->fa_dscp = fa->fa_dscp;
+ new_fa->fa_info = fi;
+ new_fa->fa_type = cfg->fc_type;
+- state = fa->fa_state;
++ state = READ_ONCE(fa->fa_state);
+ new_fa->fa_state = state & ~FA_S_ACCESSED;
+ new_fa->fa_slen = fa->fa_slen;
+ new_fa->tb_id = tb->tb_id;
+@@ -1751,7 +1751,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb,
+
+ fib_remove_alias(t, tp, l, fa_to_delete);
+
+- if (fa_to_delete->fa_state & FA_S_ACCESSED)
++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED)
+ rt_cache_flush(cfg->fc_nlinfo.nl_net);
+
+ fib_release_info(fa_to_delete->fa_info);
+--
+2.51.0
+
--- /dev/null
+From 11ffcef49824e8dc9c4a74d347f2326541f51534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 17:22:47 +0000
+Subject: ipv4: igmp: annotate data-races around idev->mr_maxdelay
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit e4faaf65a75f650ac4366ddff5dabb826029ca5a ]
+
+idev->mr_maxdelay is read and written locklessly,
+add READ_ONCE()/WRITE_ONCE() annotations.
+
+While we are at it, make this field an u32.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/inetdevice.h | 2 +-
+ net/ipv4/igmp.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index cb5280e6cc219..9c0f263e2cd28 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -38,11 +38,11 @@ struct in_device {
+ struct ip_mc_list *mc_tomb;
+ unsigned long mr_v1_seen;
+ unsigned long mr_v2_seen;
+- unsigned long mr_maxdelay;
+ unsigned long mr_qi; /* Query Interval */
+ unsigned long mr_qri; /* Query Response Interval */
+ unsigned char mr_qrv; /* Query Robustness Variable */
+ unsigned char mr_gq_running;
++ u32 mr_maxdelay;
+ u32 mr_ifc_count;
+ struct timer_list mr_gq_timer; /* general query timer */
+ struct timer_list mr_ifc_timer; /* interface change timer */
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index f4a87b90351e9..52c661c6749f3 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -224,7 +224,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
+
+ static void igmp_gq_start_timer(struct in_device *in_dev)
+ {
+- int tv = get_random_u32_below(in_dev->mr_maxdelay);
++ int tv = get_random_u32_below(READ_ONCE(in_dev->mr_maxdelay));
+ unsigned long exp = jiffies + tv + 2;
+
+ if (in_dev->mr_gq_running &&
+@@ -1006,7 +1006,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
+ if (!max_delay)
+ max_delay = 1; /* can't mod w/ 0 */
+- in_dev->mr_maxdelay = max_delay;
++ WRITE_ONCE(in_dev->mr_maxdelay, max_delay);
+
+ /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently
+ * received value was zero, use the default or statically
+--
+2.51.0
+
--- /dev/null
+From 2fd676987ca4d44f2f37836aa6d8f0f1b5a455d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:37 +0000
+Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ]
+
+Add missing READ_ONCE() when reading sysctl values.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ipv6.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 2651bd76e5b75..e843eb7efbccd 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -1005,11 +1005,11 @@ static inline int ip6_default_np_autolabel(struct net *net)
+ #if IS_ENABLED(CONFIG_IPV6)
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_policy;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy);
+ }
+ static inline u32 ip6_multipath_hash_fields(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_fields;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields);
+ }
+ #else
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+--
+2.51.0
+
--- /dev/null
+From 6ca84df0622f9bcfd8d0d0e69dc7c1323595ed23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:38 +0000
+Subject: ipv6: annotate data-races over sysctl.flowlabel_reflect
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5ade47c974b46eb2a1279185962a0ffa15dc5450 ]
+
+Add missing READ_ONCE() when reading ipv6.sysctl.flowlabel_reflect,
+as its value can be changed under us.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-6-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/af_inet6.c | 4 ++--
+ net/ipv6/icmp.c | 3 ++-
+ net/ipv6/tcp_ipv6.c | 3 ++-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index f60ec8b0f8ea4..0786155715249 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -224,8 +224,8 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
+ inet6_set_bit(MC6_LOOP, sk);
+ inet6_set_bit(MC6_ALL, sk);
+ np->pmtudisc = IPV6_PMTUDISC_WANT;
+- inet6_assign_bit(REPFLOW, sk, net->ipv6.sysctl.flowlabel_reflect &
+- FLOWLABEL_REFLECT_ESTABLISHED);
++ inet6_assign_bit(REPFLOW, sk, READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
++ FLOWLABEL_REFLECT_ESTABLISHED);
+ sk->sk_ipv6only = net->ipv6.sysctl.bindv6only;
+ sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash);
+
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index c8609147fce89..e43b49f1ddbb2 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -763,7 +763,8 @@ static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb)
+ tmp_hdr.icmp6_type = type;
+
+ memset(&fl6, 0, sizeof(fl6));
+- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
++ FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
+ fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb));
+
+ fl6.flowi6_proto = IPPROTO_ICMPV6;
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 06edfe0b2db90..c90b20c218bff 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1123,7 +1123,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb,
+ txhash = inet_twsk(sk)->tw_txhash;
+ }
+ } else {
+- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_TCP_RESET)
++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
++ FLOWLABEL_REFLECT_TCP_RESET)
+ label = ip6_flowlabel(ipv6h);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 550be03e4b28575319f14e331b2690db006c77ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:40 +0000
+Subject: ipv6: exthdrs: annotate data-race over multiple sysctl
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ]
+
+Following four sysctls can change under us, add missing READ_ONCE().
+
+- ipv6.sysctl.max_dst_opts_len
+- ipv6.sysctl.max_dst_opts_cnt
+- ipv6.sysctl.max_hbh_opts_len
+- ipv6.sysctl.max_hbh_opts_cnt
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/exthdrs.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index 20f77fdfb73da..fb1aa587a0d6a 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -314,7 +314,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_dst_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len))
+ goto fail_and_free;
+
+ opt->lastopt = opt->dst1 = skb_network_header_len(skb);
+@@ -322,7 +322,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ dstbuf = opt->dst1;
+ #endif
+
+- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) {
++ if (ip6_parse_tlv(false, skb,
++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ #if IS_ENABLED(CONFIG_IPV6_MIP6)
+@@ -1051,11 +1052,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len))
+ goto fail_and_free;
+
+ opt->flags |= IP6SKB_HOPBYHOP;
+- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) {
++ if (ip6_parse_tlv(true, skb,
++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ opt->nhoff = sizeof(struct ipv6hdr);
+--
+2.51.0
+
--- /dev/null
+From 56238c05c6ff7ea24a06a844a5919470fdfee823 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 19:38:01 +0800
+Subject: jfs: Add missing set_freezable() for freezable kthread
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ]
+
+The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(),
+causing it to remain non-freezable by default. This prevents proper
+freezing during system suspend.
+
+Add set_freezable() to make the thread freezable as intended.
+
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_logmgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
+index 270808b6219be..a9cfa6307252d 100644
+--- a/fs/jfs/jfs_logmgr.c
++++ b/fs/jfs/jfs_logmgr.c
+@@ -2312,6 +2312,7 @@ int jfsIOWait(void *arg)
+ {
+ struct lbuf *bp;
+
++ set_freezable();
+ do {
+ spin_lock_irq(&log_redrive_lock);
+ while ((bp = log_redrive_list)) {
+--
+2.51.0
+
--- /dev/null
+From 79b49439e99045693205fc3b8aaea63215b9c2dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 13:22:12 +0100
+Subject: jfs: nlink overflow in jfs_rename
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ]
+
+If nlink is maximal for a directory (-1) and inside that directory you
+perform a rename for some child directory (not moving from the parent),
+then the nlink of the first directory is first incremented and later
+decremented. Normally this is fine, but when nlink = -1 this causes a
+wrap around to 0, and then drop_nlink issues a warning.
+
+After applying the patch syzbot no longer issues any warnings. I also
+ran some basic fs tests to look for any regressions.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
+Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/namei.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
+index d68a4e6ac3454..e9bd7d3e61e9a 100644
+--- a/fs/jfs/namei.c
++++ b/fs/jfs/namei.c
+@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ jfs_err("jfs_rename: dtInsert returned -EIO");
+ goto out_tx;
+ }
+- if (S_ISDIR(old_ip->i_mode))
++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
+ inc_nlink(new_dir);
+ }
+ /*
+@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ goto out_tx;
+ }
+ if (S_ISDIR(old_ip->i_mode)) {
+- drop_nlink(old_dir);
++ if (new_ip || old_dir != new_dir)
++ drop_nlink(old_dir);
++
+ if (old_dir != new_dir) {
+ /*
+ * Change inode number of parent for moved directory
+--
+2.51.0
+
--- /dev/null
+From f3b4fc098af18e663f65b8e14327fb5089202724 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 16:30:50 +0200
+Subject: libceph: define and enforce CEPH_MAX_KEY_LEN
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ]
+
+When decoding the key, verify that the key material would fit into
+a fixed-size buffer in process_auth_done() and generally has a sane
+length.
+
+The new CEPH_MAX_KEY_LEN check replaces the existing check for a key
+with no key material which is a) not universal since CEPH_CRYPTO_NONE
+has to be excluded and b) doesn't provide much value since a smaller
+than needed key is just as invalid as no key -- this has to be handled
+elsewhere anyway.
+
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/crypto.c | 8 +++++---
+ net/ceph/crypto.h | 2 +-
+ net/ceph/messenger_v2.c | 2 +-
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
+index 051d22c0e4ad4..3397d105f74f9 100644
+--- a/net/ceph/crypto.c
++++ b/net/ceph/crypto.c
+@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf)
+ return -ENOTSUPP;
+ }
+
+- if (!key->len)
+- return -EINVAL;
+-
+ key->key = kmemdup(buf, key->len, GFP_NOIO);
+ if (!key->key) {
+ ret = -ENOMEM;
+@@ -95,6 +92,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
+ ceph_decode_copy(p, &key->created, sizeof(key->created));
+ key->len = ceph_decode_16(p);
+ ceph_decode_need(p, end, key->len, bad);
++ if (key->len > CEPH_MAX_KEY_LEN) {
++ pr_err("secret too big %d\n", key->len);
++ return -EINVAL;
++ }
++
+ ret = set_secret(key, *p);
+ memzero_explicit(*p, key->len);
+ *p += key->len;
+diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h
+index 13bd526349fa1..0d32f1649f3d0 100644
+--- a/net/ceph/crypto.h
++++ b/net/ceph/crypto.h
+@@ -5,7 +5,7 @@
+ #include <linux/ceph/types.h>
+ #include <linux/ceph/buffer.h>
+
+-#define CEPH_KEY_LEN 16
++#define CEPH_MAX_KEY_LEN 16
+ #define CEPH_MAX_CON_SECRET_LEN 64
+
+ /*
+diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
+index f163283abc4e9..83c29714226fd 100644
+--- a/net/ceph/messenger_v2.c
++++ b/net/ceph/messenger_v2.c
+@@ -2389,7 +2389,7 @@ static int process_auth_reply_more(struct ceph_connection *con,
+ */
+ static int process_auth_done(struct ceph_connection *con, void *p, void *end)
+ {
+- u8 session_key_buf[CEPH_KEY_LEN + 16];
++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16];
+ u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16];
+ u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16);
+ u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16);
+--
+2.51.0
+
--- /dev/null
+From 5136e668792a33573c1401b511231d2fee0ef299 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:09:18 -0800
+Subject: libperf build: Always place libperf includes first
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ]
+
+When building tools/perf the CFLAGS can contain a directory for the
+installed headers.
+
+As the headers may be being installed while building libperf.a this can
+cause headers to be partially installed and found in the include path
+while building an object file for libperf.a.
+
+The installed header may reference other installed headers that are
+missing given the partial nature of the install and then the build fails
+with a missing header file.
+
+Avoid this by ensuring the libperf source headers are always first in
+the CFLAGS.
+
+Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index 478fe57bf8cee..703a8ff0b3430 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -63,9 +63,9 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
++override CFLAGS := $(INCLUDES) $(CFLAGS)
+ override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+-override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += $(EXTRA_CFLAGS)
+--
+2.51.0
+
--- /dev/null
+From 0ac8084fe715c4e0eb8a648eae0284fb2461c29d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 11:40:09 +0000
+Subject: libperf: Don't remove -g when EXTRA_CFLAGS are used
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit f5b07010c13c77541e8ade167d05bef3b8a63739 ]
+
+When using EXTRA_CFLAGS, for example "EXTRA_CFLAGS=-DREFCNT_CHECKING=1",
+this construct stops setting -g which you'd expect would not be affected
+by adding extra flags. Additionally, EXTRA_CFLAGS should be the last
+thing to be appended so that it can be used to undo any defaults. And no
+condition is required, just += appends to any existing CFLAGS and also
+appends or doesn't append EXTRA_CFLAGS if they are or aren't set.
+
+It's not clear why DEBUG=1 is required for -g in Perf when in libperf
+it's always on, but I don't think we need to change that behavior now
+because someone may be depending on it.
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250319114009.417865-1-james.clark@linaro.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 8c5b40678c63 ("libperf build: Always place libperf includes first")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index 3a9b2140aa048..478fe57bf8cee 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -54,13 +54,6 @@ endif
+
+ TEST_ARGS := $(if $(V),-v)
+
+-# Set compile option CFLAGS
+-ifdef EXTRA_CFLAGS
+- CFLAGS := $(EXTRA_CFLAGS)
+-else
+- CFLAGS := -g -Wall
+-endif
+-
+ INCLUDES = \
+ -I$(srctree)/tools/lib/perf/include \
+ -I$(srctree)/tools/lib/ \
+@@ -70,11 +63,12 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
+-override CFLAGS += $(EXTRA_WARNINGS)
+-override CFLAGS += -Werror -Wall
++override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+ override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
++override CFLAGS += $(EXTRA_WARNINGS)
++override CFLAGS += $(EXTRA_CFLAGS)
+
+ all:
+
+--
+2.51.0
+
--- /dev/null
+From a485ef06f4ec3191518b9b109d9631812b22ccb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 16:36:32 -0500
+Subject: libsubcmd: Fix null intersection case in exclude_cmds()
+
+From: Sri Jayaramappa <sjayaram@akamai.com>
+
+[ Upstream commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8 ]
+
+When there is no exclusion occurring from the cmds list - for example -
+cmds contains ["read-vdso32"] and excludes contains ["archive"] - the
+main loop completes with ci == cj == 0. In the original code the loop
+processing the remaining elements in the list was conditional:
+
+ if (ci != cj) { ...}
+
+So we end up in the assertion loop since ci < cmds->cnt and we
+incorrectly try to assert the list elements to be NULL and fail with
+the following error
+
+ help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+Fix this by moving the if (ci != cj) check inside of a broader loop.
+If ci != cj, left shift the list elements, as before, and then
+unconditionally advance the ci and cj indicies which also covers the
+ci == cj case.
+
+Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()")
+Reviewed-by: Guilherme Amadio <amadio@gentoo.org>
+Signed-off-by: Sri Jayaramappa <sjayaram@akamai.com>
+Tested-by: Guilherme Amadio <amadio@gentoo.org>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: Joshua Hunt <johunt@akamai.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index ddaeb4eb3e249..db94aa685b73b 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -97,11 +97,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ ei++;
+ }
+ }
+- if (ci != cj) {
+- while (ci < cmds->cnt) {
+- cmds->names[cj++] = cmds->names[ci];
+- cmds->names[ci++] = NULL;
++ while (ci < cmds->cnt) {
++ if (ci != cj) {
++ cmds->names[cj] = cmds->names[ci];
++ cmds->names[ci] = NULL;
+ }
++ ci++;
++ cj++;
+ }
+ for (ci = cj; ci < cmds->cnt; ci++)
+ assert(cmds->names[ci] == NULL);
+--
+2.51.0
+
--- /dev/null
+From d8cd0ba55dd66a15613fe3074e421f94ff89f053 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Dec 2025 21:04:01 +0900
+Subject: m68k: nommu: fix memmove() with differently aligned src and dest for
+ 68000
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ]
+
+68000 has different alignment needs to 68020+.
+memcpy() checks if the destination is aligned and does a smaller copy
+to fix the alignment and then critically for 68000 it checks if the
+source is still unaligned and if it is reverts to smaller copies.
+
+memmove() does not currently do the second part and malfunctions if
+one of the pointers is aligned and the other isn't.
+
+This is apparently getting triggered by printk. If I put breakpoints
+into the new checks added by this commit the first hit looks like this:
+
+memmove (n=205, src=0x2f3971 <printk_shared_pbufs+205>, dest=0x2f3980 <printk_shared_pbufs+220>) at arch/m68k/lib/memmove.c:82
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Signed-off-by: Greg Ungerer <gerg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/lib/memmove.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c
+index 6519f7f349f66..e33f00b02e4c0 100644
+--- a/arch/m68k/lib/memmove.c
++++ b/arch/m68k/lib/memmove.c
+@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *cdest++ = *csrc++;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *--cdest = *--csrc;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+--
+2.51.0
+
--- /dev/null
+From 402bc6c940d43d90ebad1745f949f419c08feaae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:24 +0100
+Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ]
+
+request_threaded_irq() is invoked with a primary and a secondary handler
+and no flags are passed. The primary handler is the same as
+irq_default_primary_handler() so there is no need to have an identical
+copy.
+
+The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt
+source is not masked while the threaded handler is active. This means,
+especially on LEVEL typed interrupt lines, the interrupt can fire again
+before the threaded handler had a chance to run.
+
+Use the default primary interrupt handler by specifying NULL and set
+IRQF_ONESHOT so the interrupt source is masked until the secondary handler
+is done.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index b1abc2a0c971a..b616a8eacc0ee 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset)
+
+ /* ====== FlexRM interrupt handler ===== */
+
+-static irqreturn_t flexrm_irq_event(int irq, void *dev_id)
+-{
+- /* We only have MSI for completions so just wakeup IRQ thread */
+- /* Ring related errors will be informed via completion descriptors */
+-
+- return IRQ_WAKE_THREAD;
+-}
+-
+ static irqreturn_t flexrm_irq_thread(int irq, void *dev_id)
+ {
+ flexrm_process_completions(dev_id);
+@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan)
+ ret = -ENODEV;
+ goto fail_free_cmpl_memory;
+ }
+- ret = request_threaded_irq(ring->irq,
+- flexrm_irq_event,
+- flexrm_irq_thread,
+- 0, dev_name(ring->mbox->dev), ring);
++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread,
++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring);
+ if (ret) {
+ dev_err(ring->mbox->dev,
+ "failed to request ring%d IRQ\n", ring->num);
+--
+2.51.0
+
--- /dev/null
+From bdfe713db358b1f15e873f3c499484ea39d5a650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 16:00:54 +0800
+Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP
+
+From: Jacky Bai <ping.bai@nxp.com>
+
+[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ]
+
+In current imx-mailbox driver, the MU IRQ is configured with
+'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow,
+the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx:
+fix wakeup failure from freeze mode"), if the MU IRQ is triggered after
+the priv->suspended flag has been set, the system suspend will be
+aborted.
+
+On i.MX7ULP platform, certain drivers that depend on rpmsg may need
+to send rpmsg request and receive an acknowledgment from the remote
+core during the late_suspend stage. Early suspend abort is not
+expected, and the i.MX7ULP already has additional hardware and
+software to make sure the system can be wakeup from freeze mode
+correctly when MU IRQ is trigger.
+
+Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the
+early abort when doing suspend.
+
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/imx-mailbox.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
+index 0657bd3d8f97b..aa9a299859d6a 100644
+--- a/drivers/mailbox/imx-mailbox.c
++++ b/drivers/mailbox/imx-mailbox.c
+@@ -122,6 +122,7 @@ struct imx_mu_dcfg {
+ u32 xRR; /* Receive Register0 */
+ u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */
+ u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */
++ bool skip_suspend_flag;
+ };
+
+ #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x))))
+@@ -988,6 +989,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = {
+ .xRR = 0x40,
+ .xSR = {0x60, 0x60, 0x60, 0x60},
+ .xCR = {0x64, 0x64, 0x64, 0x64, 0x64},
++ .skip_suspend_flag = true,
+ };
+
+ static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = {
+@@ -1071,7 +1073,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev)
+ priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = true;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = true;
+
+ return 0;
+ }
+@@ -1094,7 +1097,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev)
+ imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = false;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = false;
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 01ea7d8b81f3e46c9605a0ffcab29b965ee1c54f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 14:07:40 +0000
+Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ]
+
+The PCC code currently specifies IRQF_ONESHOT if the interrupt could
+potentially be shared but doesn't actually use request_threaded_irq() and
+the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is
+never relevant. Since commit aef30c8d569c ("genirq: Warn about using
+IRQF_ONESHOT without a threaded handler") specifying it has resulted in a
+WARN_ON(), fix this by removing IRQF_ONESHOT.
+
+Reported-by: Aishwarya TCV <Aishwarya.TCV@arm.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/pcc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
+index 2b7d0bc920726..1d4191cb91380 100644
+--- a/drivers/mailbox/pcc.c
++++ b/drivers/mailbox/pcc.c
+@@ -481,7 +481,7 @@ static int pcc_startup(struct mbox_chan *chan)
+
+ if (pchan->plat_irq > 0) {
+ irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ?
+- IRQF_SHARED | IRQF_ONESHOT : 0;
++ IRQF_SHARED : 0;
+ rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq,
+ irqflags, MBOX_IRQ_NAME, chan);
+ if (unlikely(rc)) {
+--
+2.51.0
+
--- /dev/null
+From 33dd593d62c373b405b2944cc5b048fcbb19b721 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:36 +0100
+Subject: mailbox: sprd: clear delivery flag before handling TX done
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ]
+
+If there are any pending messages in the mailbox queue, they are sent
+as soon as a TX done event arrives from the driver. This may trigger a
+new delivery interrupt while the previous one is still being handled.
+If the delivery status is cleared after this, the interrupt is lost.
+To prevent this from happening, clear the delivery status immediately
+after checking it and before any new messages are sent.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index c1a5fe6cc8771..46d0c34177ab9 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -166,6 +166,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ return IRQ_NONE;
+ }
+
++ /* Clear FIFO delivery and overflow status first */
++ writel(fifo_sts &
++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
++ priv->inbox_base + SPRD_MBOX_FIFO_RST);
++
+ while (send_sts) {
+ id = __ffs(send_sts);
+ send_sts &= (send_sts - 1);
+@@ -181,11 +186,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ mbox_chan_txdone(chan, 0);
+ }
+
+- /* Clear FIFO delivery and overflow status */
+- writel(fifo_sts &
+- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
+- priv->inbox_base + SPRD_MBOX_FIFO_RST);
+-
+ /* Clear irq status */
+ writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS);
+
+--
+2.51.0
+
--- /dev/null
+From cba2fb6b669c552726f644801656df3e3d71f453 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:38 +0100
+Subject: mailbox: sprd: mask interrupts that are not handled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ]
+
+To reduce the amount of spurious interrupts, disable the interrupts that
+are not handled in this driver.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index ee8539dfcef54..c1a5fe6cc8771 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -243,21 +243,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan)
+ /* Select outbox FIFO mode and reset the outbox FIFO status */
+ writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST);
+
+- /* Enable inbox FIFO overflow and delivery interrupt */
+- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ);
++ /* Enable inbox FIFO delivery interrupt */
++ val = SPRD_INBOX_FIFO_IRQ_MASK;
++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ;
+ writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable outbox FIFO not empty interrupt */
+- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ val = SPRD_OUTBOX_FIFO_IRQ_MASK;
+ val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable supplementary outbox as the fundamental one */
+ if (priv->supp_base) {
+ writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST);
+- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From b68d34fb39900dcf3227d5a2732da544b77af9d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 14:59:03 +0000
+Subject: md-cluster: fix NULL pointer dereference in process_metadata_update
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ]
+
+The function process_metadata_update() blindly dereferences the 'thread'
+pointer (acquired via rcu_dereference_protected) within the wait_event()
+macro.
+
+While the code comment states "daemon thread must exist", there is a valid
+race condition window during the MD array startup sequence (md_run):
+
+1. bitmap_load() is called, which invokes md_cluster_ops->join().
+2. join() starts the "cluster_recv" thread (recv_daemon).
+3. At this point, recv_daemon is active and processing messages.
+4. However, mddev->thread (the main MD thread) is not initialized until
+ later in md_run().
+
+If a METADATA_UPDATED message is received from a remote node during this
+specific window, process_metadata_update() will be called while
+mddev->thread is still NULL, leading to a kernel panic.
+
+To fix this, we must validate the 'thread' pointer. If it is NULL, we
+release the held lock (no_new_dev_lockres) and return early, safely
+ignoring the update request as the array is not yet fully ready to
+process it.
+
+Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-cluster.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index 6595f89becdb7..bf9ab478df2c0 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -549,8 +549,13 @@ static void process_metadata_update(struct mddev *mddev, struct cluster_msg *msg
+
+ dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_CR);
+
+- /* daemaon thread must exist */
+ thread = rcu_dereference_protected(mddev->thread, true);
++ if (!thread) {
++ pr_warn("md-cluster: Received metadata update but MD thread is not ready\n");
++ dlm_unlock_sync(cinfo->no_new_dev_lockres);
++ return;
++ }
++
+ wait_event(thread->wqueue,
+ (got_lock = mddev_trylock(mddev)) ||
+ test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state));
+--
+2.51.0
+
--- /dev/null
+From eb7526c6704068996bef89c09a3bb63fd11fe65b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 15:29:57 +0100
+Subject: media: adv7180: fix frame interval in progressive mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ]
+
+The ADV7280-M may internally convert interlaced video input to
+progressive video. If this mode is enabled, the ADV7280-M delivers
+progressive video frames at the field rate of 50 fields per second (PAL)
+or 60 fields per second (NTSC).
+
+Fix the reported frame interval if progressive video is enabled.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index f3f47beff76bb..36e0f7a8c6d57 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -480,6 +480,13 @@ static int adv7180_get_frame_interval(struct v4l2_subdev *sd,
+ fi->interval.denominator = 25;
+ }
+
++ /*
++ * If the de-interlacer is active, the chip produces full video frames
++ * at the field rate.
++ */
++ if (state->field == V4L2_FIELD_NONE)
++ fi->interval.denominator *= 2;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2fce3a226e9c4683ab2ecdf359b6a9836c9bf122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 11:02:22 +0800
+Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
+
+From: Ming Qian <ming.qian@oss.nxp.com>
+
+[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ]
+
+The V4L2_DEC_CMD_START command may be used to handle the dynamic source
+change, which will triggers an implicit decoder drain.
+The last_buffer_dequeued flag is set in the implicit decoder drain,
+so driver need to clear it to continue the following decoding flow.
+
+Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vdec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
+index 6a38a0fa0e2d4..86abc1ca202c6 100644
+--- a/drivers/media/platform/amphion/vdec.c
++++ b/drivers/media/platform/amphion/vdec.c
+@@ -630,6 +630,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd
+ switch (cmd->cmd) {
+ case V4L2_DEC_CMD_START:
+ vdec_cmd_start(inst);
++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx));
+ break;
+ case V4L2_DEC_CMD_STOP:
+ vdec_cmd_stop(inst);
+--
+2.51.0
+
--- /dev/null
+From 6f657a57aed2ad53bad856aa3b511bf1ee186780 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 15:46:17 -0500
+Subject: media: chips-media: wave5: Fix conditional in start_streaming
+
+From: Brandon Brnich <b-brnich@ti.com>
+
+[ Upstream commit b4e26c6fc1b3c225caf80d4a95c6f9fcbe959e17 ]
+
+When STREAMON(CAP) is called after STREAMON(OUT), the driver was failing to
+switch states from VPU_INST_STATE_OPEN to VPU_INST_STATE_INIT_SEQ and
+VPU_INST_STATE_PIC_RUN because the capture queue streaming boolean had not
+yet been set to true. This led to a hang in the encoder since the state
+was stuck in VPU_INST_STATE_OPEN. During the second call to
+start_streaming, the sequence initialization and frame buffer allocation
+should occur.
+
+Signed-off-by: Brandon Brnich <b-brnich@ti.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+index a1330c54b17e6..d62e8976bc52e 100644
+--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+@@ -1336,7 +1336,8 @@ static int wave5_vpu_enc_start_streaming(struct vb2_queue *q, unsigned int count
+ if (ret)
+ goto return_buffers;
+ }
+- if (inst->state == VPU_INST_STATE_OPEN && m2m_ctx->cap_q_ctx.q.streaming) {
++ if (inst->state == VPU_INST_STATE_OPEN &&
++ (m2m_ctx->cap_q_ctx.q.streaming || q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) {
+ ret = initialize_sequence(inst);
+ if (ret) {
+ dev_warn(inst->dev->dev, "Sequence not found: %d\n", ret);
+--
+2.51.0
+
--- /dev/null
+From 6e61c3ac314b49159fd6268dbe664751a1757a8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 15:46:18 -0500
+Subject: media: chips-media: wave5: Process ready frames when CMD_STOP sent to
+ Encoder
+
+From: Brandon Brnich <b-brnich@ti.com>
+
+[ Upstream commit 5da0380de41439ed64ed9a5218850db38544e315 ]
+
+CMD_STOP being sent to encoder before last job is executed by device_run
+can lead to an occasional dropped frame. Ensure that remaining ready
+buffers are drained by making a call to v4l2_m2m_try_schedule.
+
+Signed-off-by: Brandon Brnich <b-brnich@ti.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+index d62e8976bc52e..dd34946873ace 100644
+--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+@@ -640,6 +640,8 @@ static int wave5_vpu_enc_encoder_cmd(struct file *file, void *fh, struct v4l2_en
+
+ m2m_ctx->last_src_buf = v4l2_m2m_last_src_buf(m2m_ctx);
+ m2m_ctx->is_draining = true;
++
++ v4l2_m2m_try_schedule(m2m_ctx);
+ break;
+ case V4L2_ENC_CMD_START:
+ break;
+--
+2.51.0
+
--- /dev/null
+From c56a6335112c573b25c2eeb1f4ec303a92dd5678 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 15:46:47 +0800
+Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ]
+
+Add release_mem_region() if ioremap() fails to release the memory
+region obtained by cx25821_get_resources().
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index 6627fa9166d30..a7336be444748 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
+
+ if (!dev->lmmio) {
+ CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n");
++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0));
+ cx25821_iounmap(dev);
+ return -ENOMEM;
+ }
+--
+2.51.0
+
--- /dev/null
+From 02c74b4adbb81830c8ea3596dc9418d19ccd58ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 08:57:35 +0200
+Subject: media: dvb-core: dmxdevfilter must always flush bufs
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ]
+
+Currently the buffers are being filled until full, which works fine
+for the transport stream, but not when reading sections, those have
+to be returned to userspace immediately, otherwise dvbv5-scan will
+just wait forever.
+
+Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether
+the buffer must be flushed or wait until it is full.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dmxdev.c | 8 ++++----
+ drivers/media/dvb-core/dvb_vb2.c | 5 +++--
+ include/media/dvb_vb2.h | 6 ++++--
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index 9ce5f010de3f8..804fb339f7355 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -396,11 +396,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
+ if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) {
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, true);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, true);
+ } else {
+ ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer,
+ buffer1, buffer1_len);
+@@ -451,10 +451,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
+
+ if (dvb_vb2_is_streaming(ctx)) {
+ ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, false);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, false);
+ } else {
+ if (buffer->error) {
+ spin_unlock(&dmxdevfilter->dev->lock);
+diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c
+index 29edaaff7a5c9..7444bbc2f24d9 100644
+--- a/drivers/media/dvb-core/dvb_vb2.c
++++ b/drivers/media/dvb-core/dvb_vb2.c
+@@ -249,7 +249,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx)
+
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags)
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush)
+ {
+ unsigned long flags = 0;
+ void *vbuf = NULL;
+@@ -306,7 +307,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ }
+ }
+
+- if (ctx->nonblocking && ctx->buf) {
++ if (flush && ctx->buf) {
+ vb2_set_plane_payload(&ctx->buf->vb, 0, ll);
+ vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE);
+ list_del(&ctx->buf->list);
+diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h
+index 8cb88452cd6c2..0fbbfc65157e6 100644
+--- a/include/media/dvb_vb2.h
++++ b/include/media/dvb_vb2.h
+@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx)
+ return 0;
+ };
+ #define dvb_vb2_is_streaming(ctx) (0)
+-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0)
++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0)
+
+ static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx,
+ struct file *file,
+@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx);
+ * @buffer_flags:
+ * pointer to buffer flags as defined by &enum dmx_buffer_flags.
+ * can be NULL.
++ * @flush: flush the buffer, even if it isn't full.
+ */
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags);
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush);
+
+ /**
+ * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV
+--
+2.51.0
+
--- /dev/null
+From 63fe87a869a4fb33677499338e37bf1675c3e687 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 23:55:31 +0200
+Subject: media: ipu6: Always close firmware stream
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 2b08b7007e55bd1793a58478d3ecea4fd95849a5 ]
+
+Close the firmware stream even when disabling a stream on an upstream
+sub-device fails. This allows the firmware to release resources related to
+a stream that is stopped in any case.
+
+Suggested-by: Bingbu Cao <bingbu.cao@linux.intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
+Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
+Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+index 0ea892d1f51e1..f25ea042598b0 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+@@ -1023,11 +1023,10 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state,
+ sd->name, r_pad->index, stream_mask);
+ ret = v4l2_subdev_disable_streams(sd, r_pad->index,
+ stream_mask);
+- if (ret) {
++ if (ret)
+ dev_err(dev, "stream off %s failed with %d\n", sd->name,
+ ret);
+- return ret;
+- }
++
+ close_streaming_firmware(av);
+ } else {
+ ret = start_stream_firmware(av, bl);
+--
+2.51.0
+
--- /dev/null
+From 803ec859d91c7f28044cc3ffb811848f621462dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 00:05:38 +0200
+Subject: media: ipu6: Close firmware streams on streaming enable failure
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 5925a92cc70d10c7d3124923c36da09b9c1a6eeb ]
+
+When enabling streaming fails, the stream is stopped in firmware but not
+closed. Do this to release resources on firmware side.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
+Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
+Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+index 48388c0c851ca..0ea892d1f51e1 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+@@ -1053,6 +1053,7 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state,
+
+ out_media_entity_stop_streaming_firmware:
+ stop_streaming_firmware(av);
++ close_streaming_firmware(av);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 3fe4a522038f4f1155412fec816001687e32e24f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 14:14:22 +0200
+Subject: media: ipu6: Ensure stream_mutex is acquired when dealing with node
+ list
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 779bdaad2abf718fb8116839e818e58852874b4d ]
+
+The ipu6 isys driver maintains the list of video buffer queues related to
+a stream (in ipu6 context streams on the same CSI-2 virtual channel) and
+this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs.
+Ensure the common mutex is acquired when accessing the linked list, i.e.
+the isys device context's stream_mutex.
+
+Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard()
+while at it as the error handling becomes more simple this way.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-queue.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
+index bbb66b56ee88c..c2acf70af347e 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
+@@ -3,6 +3,7 @@
+ * Copyright (C) 2013--2024 Intel Corporation
+ */
+ #include <linux/atomic.h>
++#include <linux/cleanup.h>
+ #include <linux/bug.h>
+ #include <linux/device.h>
+ #include <linux/list.h>
+@@ -201,6 +202,8 @@ static int buffer_list_get(struct ipu6_isys_stream *stream,
+ unsigned long flags;
+ unsigned long buf_flag = IPU6_ISYS_BUFFER_LIST_FL_INCOMING;
+
++ lockdep_assert_held(&stream->mutex);
++
+ bl->nbufs = 0;
+ INIT_LIST_HEAD(&bl->head);
+
+@@ -294,9 +297,8 @@ static int ipu6_isys_stream_start(struct ipu6_isys_video *av,
+ struct ipu6_isys_buffer_list __bl;
+ int ret;
+
+- mutex_lock(&stream->isys->stream_mutex);
++ guard(mutex)(&stream->isys->stream_mutex);
+ ret = ipu6_isys_video_set_streaming(av, 1, bl);
+- mutex_unlock(&stream->isys->stream_mutex);
+ if (ret)
+ goto out_requeue;
+
+@@ -637,10 +639,10 @@ static void stop_streaming(struct vb2_queue *q)
+ mutex_lock(&av->isys->stream_mutex);
+ if (stream->nr_streaming == stream->nr_queues && stream->streaming)
+ ipu6_isys_video_set_streaming(av, 0, NULL);
++ list_del(&aq->node);
+ mutex_unlock(&av->isys->stream_mutex);
+
+ stream->nr_streaming--;
+- list_del(&aq->node);
+ stream->streaming = 0;
+ mutex_unlock(&stream->mutex);
+
+--
+2.51.0
+
--- /dev/null
+From 573511d91a9a23ab458ec97fe898f4fb93ae8565 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 14:16:16 -0500
+Subject: media: mediatek: vcodec: Don't try to decode 422/444 VP9
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 3e92d7e4935084ecdbdc88880cc4688618ae1557 ]
+
+This is not supported by the hardware and trying to decode
+these leads to LAT timeout errors.
+
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
+index 3307dc15fc1df..f5aa0b06f9e70 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
+@@ -504,6 +504,12 @@ static int mtk_vdec_s_ctrl(struct v4l2_ctrl *ctrl)
+ mtk_v4l2_vdec_err(ctx, "VP9: bit_depth:%d", frame->bit_depth);
+ return -EINVAL;
+ }
++
++ if (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
++ !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)) {
++ mtk_v4l2_vdec_err(ctx, "VP9: only 420 subsampling is supported");
++ return -EINVAL;
++ }
+ break;
+ case V4L2_CID_STATELESS_AV1_SEQUENCE:
+ seq = (struct v4l2_ctrl_av1_sequence *)hdr_ctrl->p_new.p;
+--
+2.51.0
+
--- /dev/null
+From f34cec7681f0f031f55650481dc2ab479b3cef55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 18:03:03 +0100
+Subject: media: mt9m114: Avoid a reset low spike during probe()
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit 84359d0a5e3afce5e3e3b6562efadff690614d5b ]
+
+mt9m114_probe() requests the reset GPIO in output low state:
+
+ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+
+and then almost immediately afterwards calls mt9m114_power_on() which does:
+
+ gpiod_set_value(sensor->reset, 1);
+ fsleep(duration);
+ gpiod_set_value(sensor->reset, 0);
+
+which means that if the reset pin was high before this code runs that
+it will very briefly be driven low because of passing GPIOD_OUT_LOW when
+requesting the GPIO only to be driven high again possibly directly after
+that. Such a very brief driving low of the reset pin may put the chip in
+a confused state.
+
+Request the GPIO in high (reset the chip) state instead to avoid this,
+turning the initial gpiod_set_value() in mt9m114_power_on() into a no-op.
+and the fsleep() ensures that it will stay high long enough to properly
+reset the chip.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9m114.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c
+index c00f9412d08eb..de5227bdf7e65 100644
+--- a/drivers/media/i2c/mt9m114.c
++++ b/drivers/media/i2c/mt9m114.c
+@@ -2359,7 +2359,7 @@ static int mt9m114_probe(struct i2c_client *client)
+ goto error_ep_free;
+ }
+
+- sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
++ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(sensor->reset)) {
+ ret = PTR_ERR(sensor->reset);
+ dev_err_probe(dev, ret, "Failed to get reset GPIO\n");
+--
+2.51.0
+
--- /dev/null
+From 8a7492ef34d9b1b703f051c826a808dd28566c9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 18:03:10 +0100
+Subject: media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit 437e1f6a960035166495a5117aacbc596115eeb6 ]
+
+With IPU# bridges, endpoints may only be created when the IPU bridge is
+initialized. This may happen after the sensor driver's first probe().
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9m114.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c
+index de5227bdf7e65..4100f7ffe5e16 100644
+--- a/drivers/media/i2c/mt9m114.c
++++ b/drivers/media/i2c/mt9m114.c
+@@ -2296,11 +2296,17 @@ static int mt9m114_parse_dt(struct mt9m114 *sensor)
+ struct fwnode_handle *ep;
+ int ret;
+
++ /*
++ * On ACPI systems the fwnode graph can be initialized by a bridge
++ * driver, which may not have probed yet. Wait for this.
++ *
++ * TODO: Return an error once bridge driver code will have moved
++ * to the ACPI core.
++ */
+ ep = fwnode_graph_get_next_endpoint(fwnode, NULL);
+- if (!ep) {
+- dev_err(&sensor->client->dev, "No endpoint found\n");
+- return -EINVAL;
+- }
++ if (!ep)
++ return dev_err_probe(&sensor->client->dev, -EPROBE_DEFER,
++ "waiting for fwnode graph endpoint\n");
+
+ sensor->bus_cfg.bus_type = V4L2_MBUS_UNKNOWN;
+ ret = v4l2_fwnode_endpoint_alloc_parse(ep, &sensor->bus_cfg);
+--
+2.51.0
+
--- /dev/null
+From d875c2d35c97c20ba36f0e6e7fa950e7e830047f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 15:26:40 +0200
+Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ]
+
+The isp_video_mbus_to_pix/pix_to_mbus functions did not take
+the last empty entry { 0, } of the formats array into account.
+
+As a result, isp_video_mbus_to_pix would accept code 0 and
+isp_video_pix_to_mbus would select code 0 if no match was found.
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index daca689dc0825..7334e1b4f0b2b 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video,
+ pix->width = mbus->width;
+ pix->height = mbus->height;
+
+- for (i = 0; i < ARRAY_SIZE(formats); ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
+ if (formats[i].code == mbus->code)
+ break;
+ }
+
+- if (WARN_ON(i == ARRAY_SIZE(formats)))
++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1))
+ return 0;
+
+ min_bpl = pix->width * formats[i].bpp;
+@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix,
+ /* Skip the last format in the loop so that it will be selected if no
+ * match is found.
+ */
+- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) {
+ if (formats[i].pixelformat == pix->pixelformat)
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 78cc08ee22d7c8e441e862753d5227758d42f6a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 17:09:18 +0200
+Subject: media: omap3isp: isppreview: always clamp in preview_try_format()
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ]
+
+If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't
+clamped. Just always clamp.
+
+This fixes a v4l2-compliance error:
+
+ fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
+ fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
+test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c
+index e383a57654de8..5c492b31b5160 100644
+--- a/drivers/media/platform/ti/omap3isp/isppreview.c
++++ b/drivers/media/platform/ti/omap3isp/isppreview.c
+@@ -1742,22 +1742,17 @@ static void preview_try_format(struct isp_prev_device *prev,
+
+ switch (pad) {
+ case PREV_PAD_SINK:
+- /* When reading data from the CCDC, the input size has already
+- * been mangled by the CCDC output pad so it can be accepted
+- * as-is.
+- *
+- * When reading data from memory, clamp the requested width and
+- * height. The TRM doesn't specify a minimum input height, make
++ /*
++ * Clamp the requested width and height.
++ * The TRM doesn't specify a minimum input height, make
+ * sure we got enough lines to enable the noise filter and color
+ * filter array interpolation.
+ */
+- if (prev->input == PREVIEW_INPUT_MEMORY) {
+- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
+- preview_max_out_width(prev));
+- fmt->height = clamp_t(u32, fmt->height,
+- PREV_MIN_IN_HEIGHT,
+- PREV_MAX_IN_HEIGHT);
+- }
++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
++ preview_max_out_width(prev));
++ fmt->height = clamp_t(u32, fmt->height,
++ PREV_MIN_IN_HEIGHT,
++ PREV_MAX_IN_HEIGHT);
+
+ fmt->colorspace = V4L2_COLORSPACE_SRGB;
+
+--
+2.51.0
+
--- /dev/null
+From 95cbad5e5bc9de4233f3cc1dfa8e6e0cde698c82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 09:21:53 +0200
+Subject: media: omap3isp: set initial format
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ]
+
+Initialize the v4l2_format to a default. Empty formats are
+not allowed in V4L2, so this fixes v4l2-compliance issues:
+
+ fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height
+test VIDIOC_G_FMT: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index 7334e1b4f0b2b..b9e0b6215fa04 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -1288,6 +1288,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = {
+ static int isp_video_open(struct file *file)
+ {
+ struct isp_video *video = video_drvdata(file);
++ struct v4l2_mbus_framefmt fmt;
+ struct isp_video_fh *handle;
+ struct vb2_queue *queue;
+ int ret = 0;
+@@ -1329,6 +1330,13 @@ static int isp_video_open(struct file *file)
+
+ memset(&handle->format, 0, sizeof(handle->format));
+ handle->format.type = video->type;
++ handle->format.fmt.pix.width = 720;
++ handle->format.fmt.pix.height = 480;
++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY;
++ handle->format.fmt.pix.field = V4L2_FIELD_NONE;
++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt);
++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix);
+ handle->timeperframe.denominator = 1;
+
+ handle->video = video;
+--
+2.51.0
+
--- /dev/null
+From b8548ecf16840e93038e7f1688bbe93543b2590d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 19:24:19 +0100
+Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex
+
+From: Szymon Wilczek <szymonwilczek@gmx.com>
+
+[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ]
+
+When pvr2_send_request_ex() submits a write URB successfully but fails to
+submit the read URB (e.g. returns -ENOMEM), it returns immediately without
+waiting for the write URB to complete. Since the driver reuses the same
+URB structure, a subsequent call to pvr2_send_request_ex() attempts to
+submit the still-active write URB, triggering a 'URB submitted while
+active' warning in usb_submit_urb().
+
+Fix this by ensuring the write URB is unlinked and waited upon if the read
+URB submission fails.
+
+Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
+Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com>
+Acked-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 2de104736f874..943d56b10251b 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -3709,6 +3709,11 @@ status);
+ "Failed to submit read-control URB status=%d",
+ status);
+ hdw->ctl_read_pend_flag = 0;
++ if (hdw->ctl_write_pend_flag) {
++ usb_unlink_urb(hdw->ctl_write_urb);
++ while (hdw->ctl_write_pend_flag)
++ wait_for_completion(&hdw->ctl_done);
++ }
+ goto done;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 342d841259698197644b2b2834d2b35b15968cc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 12:11:42 -0500
+Subject: media: rkisp1: Fix filter mode register configuration
+
+From: Rui Wang <rui.wang@ideasonboard.com>
+
+[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ]
+
+The rkisp1_flt_config() function performs an initial direct write to
+RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA
+bit, which clears the filter enable bit in the hardware.
+
+The subsequent read/modify/write sequence then reads back the register
+with the enable bit already cleared and cannot restore it, resulting in
+the filter being inadvertently disabled.
+
+Remove the redundant direct write. The read/modify/write sequence alone
+correctly preserves the existing enable bit state while updating the
+DNR mode and filter configuration bits.
+
+Signed-off-by: Rui Wang <rui.wang@ideasonboard.com>
+Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+index 320581a9f866e..ba6fff91fa17a 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+@@ -407,12 +407,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params,
+ rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT,
+ arg->lum_weight);
+
+- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE,
+- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) |
+- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) |
+- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) |
+- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1));
+-
+ /* avoid to override the old enable value */
+ filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE);
+ filt_mode &= RKISP1_CIF_ISP_FLT_ENA;
+--
+2.51.0
+
--- /dev/null
+From d4c75f79a6f70614189dfdd08e66c0a4bf0fe5f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:00:35 -0800
+Subject: media: solo6x10: Check for out of bounds chip_id
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ]
+
+Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
+(literal "1" is an "int") could end up being shifted beyond 32 bits,
+so instrumentation was added (and due to the double is_tw286x() call
+seen via inlining), Clang decides the second one must now be undefined
+behavior and elides the rest of the function[1]. This is a known problem
+with Clang (that is still being worked on), but we can avoid the entire
+problem by actually checking the existing max chip ID, and now there is
+no runtime instrumentation added at all since everything is known to be
+within bounds.
+
+Additionally use an unsigned value for the shift to remove the
+instrumentation even without the explicit bounds checking.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
+Suggested-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: fix checkpatch warning for is_tw286x]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+index 1b7c22a9bc94f..8f53946c67928 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c
++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = {
+ 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0,
+ };
+
+-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id)))
++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id))))
+
+ static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off,
+ u8 tw_off)
+@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ if (val > 255 || val < 0)
+ return -ERANGE;
+
+@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ switch (ctrl) {
+ case V4L2_CID_SHARPNESS:
+ /* Only 286x has sharpness */
+--
+2.51.0
+
--- /dev/null
+From 8fbc239c343fdd362b55a02c6db3de10574b8e62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 13:48:40 +0200
+Subject: media: v4l2-async: Fix error handling on steps after finding a match
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 7345d6d356336c448d6b9230ed8704f39679fd12 ]
+
+Once an async connection is found to be matching with an fwnode, a
+sub-device may be registered (in case it wasn't already), its bound
+operation is called, ancillary links are created, the async connection
+is added to the sub-device's list of connections and removed from the
+global waiting connection list. Further on, the sub-device's possible own
+notifier is searched for possible additional matches.
+
+Fix these specific issues:
+
+- If v4l2_async_match_notify() failed before the sub-notifier handling,
+ the async connection was unbound and its entry removed from the
+ sub-device's async connection list. The latter part was also done in
+ v4l2_async_match_notify().
+
+- The async connection's sd field was only set after creating ancillary
+ links in v4l2_async_match_notify(). It was however dereferenced in
+ v4l2_async_unbind_subdev_one(), which was called on error path of
+ v4l2_async_match_notify() failure.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Tested-by: "Yew, Chang Ching" <chang.ching.yew@intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-async.c | 45 +++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
+index ee884a8221fbd..1c08bba9ecb91 100644
+--- a/drivers/media/v4l2-core/v4l2-async.c
++++ b/drivers/media/v4l2-core/v4l2-async.c
+@@ -343,7 +343,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ struct v4l2_subdev *sd,
+ struct v4l2_async_connection *asc)
+ {
+- struct v4l2_async_notifier *subdev_notifier;
+ bool registered = false;
+ int ret;
+
+@@ -389,6 +388,25 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ dev_dbg(notifier_dev(notifier), "v4l2-async: %s bound (ret %d)\n",
+ dev_name(sd->dev), ret);
+
++ return 0;
++
++err_call_unbind:
++ v4l2_async_nf_call_unbind(notifier, sd, asc);
++ list_del(&asc->asc_subdev_entry);
++
++err_unregister_subdev:
++ if (registered)
++ v4l2_device_unregister_subdev(sd);
++
++ return ret;
++}
++
++static int
++v4l2_async_nf_try_subdev_notifier(struct v4l2_async_notifier *notifier,
++ struct v4l2_subdev *sd)
++{
++ struct v4l2_async_notifier *subdev_notifier;
++
+ /*
+ * See if the sub-device has a notifier. If not, return here.
+ */
+@@ -404,16 +422,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ subdev_notifier->parent = notifier;
+
+ return v4l2_async_nf_try_all_subdevs(subdev_notifier);
+-
+-err_call_unbind:
+- v4l2_async_nf_call_unbind(notifier, sd, asc);
+- list_del(&asc->asc_subdev_entry);
+-
+-err_unregister_subdev:
+- if (registered)
+- v4l2_device_unregister_subdev(sd);
+-
+- return ret;
+ }
+
+ /* Test all async sub-devices in a notifier for a match. */
+@@ -445,6 +453,10 @@ v4l2_async_nf_try_all_subdevs(struct v4l2_async_notifier *notifier)
+ if (ret < 0)
+ return ret;
+
++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
++ if (ret < 0)
++ return ret;
++
+ /*
+ * v4l2_async_match_notify() may lead to registering a
+ * new notifier and thus changing the async subdevs
+@@ -829,7 +841,11 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module)
+ ret = v4l2_async_match_notify(notifier, v4l2_dev, sd,
+ asc);
+ if (ret)
+- goto err_unbind;
++ goto err_unlock;
++
++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
++ if (ret)
++ goto err_unbind_one;
+
+ ret = v4l2_async_nf_try_complete(notifier);
+ if (ret)
+@@ -853,9 +869,10 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module)
+ if (subdev_notifier)
+ v4l2_async_nf_unbind_all_subdevs(subdev_notifier);
+
+- if (asc)
+- v4l2_async_unbind_subdev_one(notifier, asc);
++err_unbind_one:
++ v4l2_async_unbind_subdev_one(notifier, asc);
+
++err_unlock:
+ mutex_unlock(&list_lock);
+
+ sd->owner = NULL;
+--
+2.51.0
+
--- /dev/null
+From 84eb7c18957d170426c3acef9255920945795b5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 19:21:50 +0200
+Subject: mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit cefd793fa17de708d043adab50e7f96f414b0f1d ]
+
+Add Intel Nova Lake-S LPSS PCI IDs.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20260113172151.48062-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 5b1c13fb23468..a7feb82c28e3f 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -437,6 +437,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_spi_info },
+ { PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_spi_info },
+ { PCI_VDEVICE(INTEL, 0x5aee), (kernel_ulong_t)&bxt_uart_info },
++ /* NVL-S */
++ { PCI_VDEVICE(INTEL, 0x6e28), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x6e29), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x6e2a), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x6e2b), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x6e4c), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e4d), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e4e), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e4f), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e5c), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x6e5e), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x6e7a), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e7b), (kernel_ulong_t)&ehl_i2c_info },
+ /* ARL-H */
+ { PCI_VDEVICE(INTEL, 0x7725), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x7726), (kernel_ulong_t)&bxt_uart_info },
+--
+2.51.0
+
--- /dev/null
+From 360a57dea244a8acfa84fda70d7e8cf391905416 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 16:39:47 +0100
+Subject: minix: Add required sanity checking to minix_check_superblock()
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ]
+
+The fs/minix implementation of the minix filesystem does not currently
+support any other value for s_log_zone_size than 0. This is also the
+only value supported in util-linux; see mkfs.minix.c line 511. In
+addition, this patch adds some sanity checking for the other minix
+superblock fields, and moves the minix_blocks_needed() checks for the
+zmap and imap also to minix_check_super_block().
+
+This also closes a related syzbot bug report.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/inode.c | 50 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 29 insertions(+), 21 deletions(-)
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index fc01f9dc8c391..b38eec2760699 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -154,10 +154,38 @@ static int minix_reconfigure(struct fs_context *fc)
+ static bool minix_check_superblock(struct super_block *sb)
+ {
+ struct minix_sb_info *sbi = minix_sb(sb);
++ unsigned long block;
+
+- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
++ if (sbi->s_log_zone_size != 0) {
++ printk("minix-fs error: zone size must equal block size. "
++ "s_log_zone_size > 0 is not supported.\n");
++ return false;
++ }
++
++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
++ sbi->s_firstdatazone >= sbi->s_nzones)
+ return false;
+
++ /* Apparently minix can create filesystems that allocate more blocks for
++ * the bitmaps than needed. We simply ignore that, but verify it didn't
++ * create one with not enough blocks and bail out if so.
++ */
++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize);
++ if (sbi->s_imap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "imap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
++ block = minix_blocks_needed(
++ (sbi->s_nzones - sbi->s_firstdatazone + 1),
++ sb->s_blocksize);
++ if (sbi->s_zmap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "zmap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
+ /*
+ * s_max_size must not exceed the block mapping limitation. This check
+ * is only needed for V1 filesystems, since V2/V3 support an extra level
+@@ -277,26 +305,6 @@ static int minix_fill_super(struct super_block *s, struct fs_context *fc)
+ minix_set_bit(0,sbi->s_imap[0]->b_data);
+ minix_set_bit(0,sbi->s_zmap[0]->b_data);
+
+- /* Apparently minix can create filesystems that allocate more blocks for
+- * the bitmaps than needed. We simply ignore that, but verify it didn't
+- * create one with not enough blocks and bail out if so.
+- */
+- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
+- if (sbi->s_imap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "imap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+- block = minix_blocks_needed(
+- (sbi->s_nzones - sbi->s_firstdatazone + 1),
+- s->s_blocksize);
+- if (sbi->s_zmap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "zmap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+ /* set up enough so that it can read an inode */
+ s->s_op = &minix_sops;
+ s->s_time_min = 0;
+--
+2.51.0
+
--- /dev/null
+From 960e1a4c90afccf0d92d83b8c10534b8ce6ee442 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 09:40:06 +0000
+Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ]
+
+The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which
+is a valid index - so add a check for this.
+
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mach-loongson64/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h
+index 3414a1fd17835..89bb4deab98a6 100644
+--- a/arch/mips/include/asm/mach-loongson64/topology.h
++++ b/arch/mips/include/asm/mach-loongson64/topology.h
+@@ -7,7 +7,7 @@
+ #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2)
+
+ extern cpumask_t __node_cpumask[];
+-#define cpumask_of_node(node) (&__node_cpumask[node])
++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node])
+
+ struct pci_bus;
+ extern int pcibus_to_node(struct pci_bus *);
+--
+2.51.0
+
--- /dev/null
+From c700ecfdad9625e4d3ff0605f343ba96790d3ad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 14:36:37 +0800
+Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ]
+
+In the function bcm_vk_read(), the pointer entry is checked, indicating
+that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
+following code may cause null-pointer dereferences:
+
+ struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+ set_msg_id(&tmp_msg, entry->usr_msg_id);
+ tmp_msg.size = entry->to_h_blks - 1;
+
+To prevent these possible null-pointer dereferences, copy to_h_msg,
+usr_msg_id, and to_h_blks from iter into temporary variables, and return
+these temporary variables to the application instead of accessing them
+through a potentially NULL entry.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Reviewed-by: Scott Branden <scott.branden@broadcom.com>
+Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
+index 1f42d1d5a630a..665a3888708ac 100644
+--- a/drivers/misc/bcm-vk/bcm_vk_msg.c
++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
+@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ struct device *dev = &vk->pdev->dev;
+ struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan;
+ struct bcm_vk_wkent *entry = NULL, *iter;
++ struct vk_msg_blk tmp_msg;
++ u32 tmp_usr_msg_id;
++ u32 tmp_blks;
+ u32 q_num;
+ u32 rsp_length;
+
+@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ entry = iter;
+ } else {
+ /* buffer not big enough */
++ tmp_msg = iter->to_h_msg[0];
++ tmp_usr_msg_id = iter->usr_msg_id;
++ tmp_blks = iter->to_h_blks;
+ rc = -EMSGSIZE;
+ }
+ goto read_loop_exit;
+@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file,
+
+ bcm_vk_free_wkent(dev, entry);
+ } else if (rc == -EMSGSIZE) {
+- struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+-
+ /*
+ * in this case, return just the first block, so
+ * that app knows what size it is looking for.
+ */
+- set_msg_id(&tmp_msg, entry->usr_msg_id);
+- tmp_msg.size = entry->to_h_blks - 1;
++ set_msg_id(&tmp_msg, tmp_usr_msg_id);
++ tmp_msg.size = tmp_blks - 1;
+ if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) {
+ dev_err(dev, "Error return 1st block in -EMSGSIZE\n");
+ rc = -EFAULT;
+--
+2.51.0
+
--- /dev/null
+From ed9ced8e8e0f86999ca111b5b937694a166f0ca1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 11:48:24 +0100
+Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
+
+From: Markus Perkins <markus@notsyncing.net>
+
+[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ]
+
+commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66
+compatible strings") added support for 93xx56 and 93xx66 eeproms, but
+didn't take into account that the write enable/disable + erase all
+commands are hardcoded for the 6-bit address of the 93xx46.
+
+This commit fixes the command word generation by increasing the number
+of shifts as the address field grows, keeping the command intact.
+
+Also, the check for 8-bit or 16-bit mode is no longer required as this
+is already taken into account in the edev->addrlen field.
+
+Signed-off-by: Markus Perkins <markus@notsyncing.net>
+Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index e2221be884458..cc7599f08b391 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -45,6 +45,7 @@ struct eeprom_93xx46_platform_data {
+ #define OP_START 0x4
+ #define OP_WRITE (OP_START | 0x1)
+ #define OP_READ (OP_START | 0x2)
++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */
+ #define ADDR_EWDS 0x00
+ #define ADDR_ERAL 0x20
+ #define ADDR_EWEN 0x30
+@@ -191,10 +192,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1;
+- else
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS);
++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+@@ -328,10 +326,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= ADDR_ERAL << 1;
+- else
+- cmd_addr |= ADDR_ERAL;
++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+--
+2.51.0
+
--- /dev/null
+From e2d8395d4ea477f0fd59814f09ab9f6a5d03b4ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 13:13:30 +0100
+Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ]
+
+Building a size optimized ppc64 kernel (-Os), gcc emits more FP
+save/restore symbols, that the linker generates on demand into the
+.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c,
+too. They are needed for the amdgpu in-kernel floating point support.
+
+MODPOST Module.symvers
+ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many)
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 971eda0c6ba73..07e8a4eb71d04 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -593,6 +593,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
+ /* Special register function linked on all modules during final link of .ko */
+ if (strstarts(symname, "_restgpr0_") ||
+ strstarts(symname, "_savegpr0_") ||
++ strstarts(symname, "_restgpr1_") ||
++ strstarts(symname, "_savegpr1_") ||
++ strstarts(symname, "_restfpr_") ||
++ strstarts(symname, "_savefpr_") ||
+ strstarts(symname, "_restvr_") ||
+ strstarts(symname, "_savevr_") ||
+ strcmp(symname, ".TOC.") == 0)
+--
+2.51.0
+
--- /dev/null
+From df21579ea55dc6e4fc15981a49344aae3dc7b554 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 16:53:37 +0000
+Subject: most: core: fix resource leak in most_register_interface error paths
+
+From: Navaneeth K <knavaneeth786@gmail.com>
+
+[ Upstream commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 ]
+
+The function most_register_interface() did not correctly release resources
+if it failed early (before registering the device). In these cases, it
+returned an error code immediately, leaking the memory allocated for the
+interface.
+
+Fix this by initializing the device early via device_initialize() and
+calling put_device() on all error paths.
+
+The most_register_interface() is expected to call put_device() on
+error which frees the resources allocated in the caller. The
+put_device() either calls release_mdev() or dim2_release(),
+depending on the caller.
+
+Switch to using device_add() instead of device_register() to handle
+the split initialization.
+
+Acked-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://patch.msgid.link/20251127165337.19172-1-knavaneeth786@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/most/core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/most/core.c b/drivers/most/core.c
+index da319d108ea1d..6277e6702ca8c 100644
+--- a/drivers/most/core.c
++++ b/drivers/most/core.c
+@@ -1286,15 +1286,19 @@ int most_register_interface(struct most_interface *iface)
+ !iface->poison_channel || (iface->num_channels > MAX_CHANNELS))
+ return -EINVAL;
+
++ device_initialize(iface->dev);
++
+ id = ida_alloc(&mdev_id, GFP_KERNEL);
+ if (id < 0) {
+ dev_err(iface->dev, "Failed to allocate device ID\n");
++ put_device(iface->dev);
+ return id;
+ }
+
+ iface->p = kzalloc(sizeof(*iface->p), GFP_KERNEL);
+ if (!iface->p) {
+ ida_free(&mdev_id, id);
++ put_device(iface->dev);
+ return -ENOMEM;
+ }
+
+@@ -1304,7 +1308,7 @@ int most_register_interface(struct most_interface *iface)
+ iface->dev->bus = &mostbus;
+ iface->dev->groups = interface_attr_groups;
+ dev_set_drvdata(iface->dev, iface);
+- if (device_register(iface->dev)) {
++ if (device_add(iface->dev)) {
+ dev_err(iface->dev, "Failed to register interface device\n");
+ kfree(iface->p);
+ put_device(iface->dev);
+--
+2.51.0
+
--- /dev/null
+From 36e61c56feb48c8c52e4e23531ad751730a3cf06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 17:28:09 +0100
+Subject: myri10ge: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ]
+
+While compile testing on less common architectures, I noticed that gcc-10 on
+s390 finds a bug that all other configurations seem to miss:
+
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized]
+ 391 | buf->data0 = htonl(data->data0);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+ | ^~~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized]
+ 393 | buf->data2 = htonl(data->data2);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+
+It would be nice to understand how to make other compilers catch this as
+well, but for the moment I'll just shut up the warning by fixing the
+undefined behavior in this driver.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index b7d9657a7af3d..3f2086873a483 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
+
+ /* probe for IPv6 TSO support */
+ mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE,
+ &cmd, 0);
+ if (status == 0) {
+@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp,
+ | (addr[2] << 8) | addr[3]);
+
+ cmd.data1 = ((addr[4] << 8) | (addr[5]));
++ cmd.data2 = 0;
+
+ status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0);
+ return status;
+@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause)
+ int status, ctl;
+
+ ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, 0);
+
+ if (status) {
+@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic)
+ int status, ctl;
+
+ ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC;
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic);
+ if (status)
+ netdev_err(mgp->dev, "Failed to set promisc mode\n");
+@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss)
+ /* get ring sizes */
+ slice = ss - mgp->ss;
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
+ tx_ring_size = cmd.data0;
+ cmd.data0 = slice;
+@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice)
+ status = 0;
+ if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) {
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET,
+ &cmd, 0);
+ ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *)
+ (mgp->sram + cmd.data0);
+ }
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET,
+ &cmd, 0);
+ ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *)
+@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev)
+ if (mgp->num_slices > 1) {
+ cmd.data0 = mgp->num_slices;
+ cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE;
++ cmd.data2 = 0;
+ if (mgp->dev->real_num_tx_queues > 1)
+ cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES,
+@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev)
+
+ /* now give firmware buffers sizes, and MTU */
+ cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0);
+ cmd.data0 = mgp->small_bytes;
+ status |=
+@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev)
+ static int myri10ge_close(struct net_device *dev)
+ {
+ struct myri10ge_priv *mgp = netdev_priv(dev);
+- struct myri10ge_cmd cmd;
+ int status, old_down_cnt;
+ int i;
+
+@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev)
+
+ netif_tx_stop_all_queues(dev);
+ if (mgp->rebooted == 0) {
++ struct myri10ge_cmd cmd;
++
+ old_down_cnt = mgp->down_cnt;
+ mb();
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status =
+ myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0);
+ if (status)
+@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev)
+
+ /* Disable multicast filtering */
+
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1);
+ if (err != 0) {
+ netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n",
+--
+2.51.0
+
--- /dev/null
+From 0f6d143f2dc6b7242828b0da7c00329c71d9dd0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:47:55 +0800
+Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits
+
+From: Jijie Shao <shaojijie@huawei.com>
+
+[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ]
+
+Currently, HCLGE_FD_AD_QID has only 10 bits and supports a
+maximum of 1023 queues. However, there are actually scenarios
+where the queue_id exceeds 1023.
+
+This patch adds an additional bit to HCLGE_FD_AD_QID to ensure
+that queue_id greater than 1023 are supported.
+
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++--
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 416e02e7b995f..bc333d8710ac1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd {
+
+ #define HCLGE_FD_AD_DROP_B 0
+ #define HCLGE_FD_AD_DIRECT_QID_B 1
+-#define HCLGE_FD_AD_QID_S 2
+-#define HCLGE_FD_AD_QID_M GENMASK(11, 2)
++#define HCLGE_FD_AD_QID_L_S 2
++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2)
+ #define HCLGE_FD_AD_USE_COUNTER_B 12
+ #define HCLGE_FD_AD_COUNTER_NUM_S 13
+ #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)
+@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd {
+ #define HCLGE_FD_AD_TC_OVRD_B 16
+ #define HCLGE_FD_AD_TC_SIZE_S 17
+ #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17)
++#define HCLGE_FD_AD_QID_H_B 21
+
+ struct hclge_fd_ad_config_cmd {
+ u8 stage;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 7468e03051ea4..434f40ce3062b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5689,11 +5689,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc,
+ hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M,
+ HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size);
+ }
++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B,
++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0);
+ ad_data <<= 32;
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B,
+ action->forward_to_direct_queue);
+- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S,
++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S,
+ action->queue_id);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter);
+ hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M,
+--
+2.51.0
+
--- /dev/null
+From 2c28245515c7a7f74ab9564c2eb672157e4c8a74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:57:20 -0700
+Subject: net/rds: Clear reconnect pending bit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ]
+
+When canceling the reconnect worker, care must be taken to reset the
+reconnect-pending bit. If the reconnect worker has not yet been
+scheduled before it is canceled, the reconnect-pending bit will stay
+on forever.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 8b7199f9ae70c..3a1b548dcdcb2 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ * to the conn hash, so we never trigger a reconnect on this
+ * conn - the reconnect is always triggered by the active peer. */
+ cancel_delayed_work_sync(&cp->cp_conn_w);
++
++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags);
+ rcu_read_lock();
+ if (!hlist_unhashed(&conn->c_hash_node)) {
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From ea2fd0dbfd4d454da41f1cf76f196af0a41c0188 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 22:52:12 -0700
+Subject: net/rds: No shortcut out of RDS_CONN_ERROR
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ]
+
+RDS connections carry a state "rds_conn_path::cp_state"
+and transitions from one state to another and are conditional
+upon an expected state: "rds_conn_path_transition."
+
+There is one exception to this conditionality, which is
+"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"
+regardless of what state the condition is currently in.
+
+But as soon as a connection enters state "RDS_CONN_ERROR",
+the connection handling code expects it to go through the
+shutdown-path.
+
+The RDS/TCP multipath changes added a shortcut out of
+"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"
+via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").
+
+A subsequent "rds_tcp_reset_callbacks" can then transition
+the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.
+
+That'll trip up "rds_conn_init_shutdown", which was
+never adjusted to handle "RDS_CONN_RESETTING" and subsequently
+drops the connection with the dreaded "DR_INV_CONN_STATE",
+which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever.
+
+So we do two things here:
+
+a) Don't shortcut "RDS_CONN_ERROR", but take the longer
+ path through the shutdown code.
+
+b) Add "RDS_CONN_RESETTING" to the expected states in
+ "rds_conn_init_shutdown" so that we won't error out
+ and get stuck, if we ever hit weird state transitions
+ like this again."
+
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ net/rds/tcp_listen.c | 5 -----
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index c749c5525b40f..8b7199f9ae70c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ if (!rds_conn_path_transition(cp, RDS_CONN_UP,
+ RDS_CONN_DISCONNECTING) &&
+ !rds_conn_path_transition(cp, RDS_CONN_ERROR,
++ RDS_CONN_DISCONNECTING) &&
++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING,
+ RDS_CONN_DISCONNECTING)) {
+ rds_conn_path_error(cp,
+ "shutdown called in state %d\n",
+diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
+index d89bd8d0c3545..fced9e286f79f 100644
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -59,9 +59,6 @@ void rds_tcp_keepalive(struct socket *sock)
+ * socket and force a reconneect from smaller -> larger ip addr. The reason
+ * we special case cp_index 0 is to allow the rds probe ping itself to itself
+ * get through efficiently.
+- * Since reconnects are only initiated from the node with the numerically
+- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side
+- * by moving them to CONNECTING in this function.
+ */
+ static
+ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+@@ -86,8 +83,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+ struct rds_conn_path *cp = &conn->c_path[i];
+
+ if (rds_conn_path_transition(cp, RDS_CONN_DOWN,
+- RDS_CONN_CONNECTING) ||
+- rds_conn_path_transition(cp, RDS_CONN_ERROR,
+ RDS_CONN_CONNECTING)) {
+ return cp->cp_transport_data;
+ }
+--
+2.51.0
+
--- /dev/null
+From 08e8e47f24d24ea83b638a2be3ba6c589d4dd5b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 18:00:44 +0100
+Subject: net: sfp: add quirk for Lantech 8330-265D
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 86a8e8e0ddbc3d14c799536eb888180b84d002f3 ]
+
+Similar to Lantech 8330-262D-E, the Lantech 8330-265D also reports
+2500MBd instead of 3125MBd.
+
+Also, all 8330-265D report normal RX_LOS in EEPROM, but some signal
+inverted RX_LOS. We therefore need to ignore RX_LOS on these modules.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Link: https://patch.msgid.link/20260128170044.15576-1-kabel@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/sfp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 6153a35af1070..cae748b762236 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -525,9 +525,13 @@ static const struct sfp_quirk sfp_quirks[] = {
+ SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex,
+ sfp_fixup_ignore_tx_fault),
+
+- // Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report
+- // 2500MBd NRZ in their EEPROM
++ // Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but
++ // incorrectly report 2500MBd NRZ in their EEPROM.
++ // Some 8330-265D modules have inverted LOS, while all of them report
++ // normal LOS in EEPROM. Therefore we need to ignore LOS entirely.
+ SFP_QUIRK_S("Lantech", "8330-262D-E", sfp_quirk_2500basex),
++ SFP_QUIRK("Lantech", "8330-265D", sfp_quirk_2500basex,
++ sfp_fixup_ignore_los),
+
+ SFP_QUIRK_S("UBNT", "UF-INSTANT", sfp_quirk_ubnt_uf_instant),
+
+--
+2.51.0
+
--- /dev/null
+From 2ec3276bdd07319a2aae62ab414c73ce19ea71ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 09:59:49 +0800
+Subject: net: usb: r8152: fix transmit queue timeout
+
+From: Mingj Ye <insyelu@gmail.com>
+
+[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ]
+
+When the TX queue length reaches the threshold, the netdev watchdog
+immediately detects a TX queue timeout.
+
+This patch updates the trans_start timestamp of the transmit queue
+on every asynchronous USB URB submission along the transmit path,
+ensuring that the network watchdog accurately reflects ongoing
+transmission activity.
+
+Signed-off-by: Mingj Ye <insyelu@gmail.com>
+Reviewed-by: Hayes Wang <hayeswang@realtek.com>
+Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index d27e62939bf13..e4eb4e5425364 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -2447,6 +2447,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
+ ret = usb_submit_urb(agg->urb, GFP_ATOMIC);
+ if (ret < 0)
+ usb_autopm_put_interface_async(tp->intf);
++ else
++ netif_trans_update(tp->netdev);
+
+ out_tx_fill:
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 1e6b8e41569c9f2ca146cfb94791050a389b28b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:39:09 -0800
+Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter
+
+From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+
+[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ]
+
+Several registers referenced in this driver's source code do not
+actually exist (they are not writable and read as zero in my testing).
+They exist in this driver because it originated as a copy of the dm9601
+driver. Notably, these include the multicast filter registers - this
+causes the driver to not support multicast packets correctly. Remove
+the multicast filter code and register definitions. Instead, set the
+chip to receive all multicast filter packets when any multicast
+addresses are in the list.
+
+Reviewed-by: Simon Horman <horms@kernel.org> (from v1)
+Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/Kconfig | 1 -
+ drivers/net/usb/sr9700.c | 25 ++++---------------------
+ drivers/net/usb/sr9700.h | 7 +------
+ 3 files changed, 5 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index 3c360d4f06352..73498a3ea44ce 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -321,7 +321,6 @@ config USB_NET_DM9601
+ config USB_NET_SR9700
+ tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
+ depends on USB_USBNET
+- select CRC32
+ help
+ This option adds support for CoreChip-sz SR9700 based USB 1.1
+ 10/100 Ethernet adapters.
+diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
+index 213b4817cfdf6..e4d7bcd0d99c2 100644
+--- a/drivers/net/usb/sr9700.c
++++ b/drivers/net/usb/sr9700.c
+@@ -18,7 +18,6 @@
+ #include <linux/ethtool.h>
+ #include <linux/mii.h>
+ #include <linux/usb.h>
+-#include <linux/crc32.h>
+ #include <linux/usb/usbnet.h>
+
+ #include "sr9700.h"
+@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = {
+ static void sr9700_set_multicast(struct net_device *netdev)
+ {
+ struct usbnet *dev = netdev_priv(netdev);
+- /* We use the 20 byte dev->data for our 8 byte filter buffer
+- * to avoid allocating memory that is tricky to free later
+- */
+- u8 *hashes = (u8 *)&dev->data;
+ /* rx_ctl setting : enable, disable_long, disable_crc */
+ u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG;
+
+- memset(hashes, 0x00, SR_MCAST_SIZE);
+- /* broadcast address */
+- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG;
+- if (netdev->flags & IFF_PROMISC) {
++ if (netdev->flags & IFF_PROMISC)
+ rx_ctl |= RCR_PRMSC;
+- } else if (netdev->flags & IFF_ALLMULTI ||
+- netdev_mc_count(netdev) > SR_MCAST_MAX) {
+- rx_ctl |= RCR_RUNT;
+- } else if (!netdev_mc_empty(netdev)) {
+- struct netdev_hw_addr *ha;
+-
+- netdev_for_each_mc_addr(ha, netdev) {
+- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26;
+- hashes[crc >> 3] |= 1 << (crc & 0x7);
+- }
+- }
++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev))
++ /* The chip has no multicast filter */
++ rx_ctl |= RCR_ALL;
+
+- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes);
+ sr_write_reg_async(dev, SR_RCR, rx_ctl);
+ }
+
+diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
+index ea2b4de621c86..c479908f7d823 100644
+--- a/drivers/net/usb/sr9700.h
++++ b/drivers/net/usb/sr9700.h
+@@ -104,9 +104,7 @@
+ #define WCR_LINKEN (1 << 5)
+ /* Physical Address Reg */
+ #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */
+-/* Multicast Address Reg */
+-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */
+-/* 0x1e unused */
++/* 0x16 --> 0x1E unused */
+ /* Phy Reset Reg */
+ #define SR_PRR 0x1F
+ #define PRR_PHY_RST (1 << 0)
+@@ -161,9 +159,6 @@
+ /* parameters */
+ #define SR_SHARE_TIMEOUT 1000
+ #define SR_EEPROM_LEN 256
+-#define SR_MCAST_SIZE 8
+-#define SR_MCAST_ADDR_FLAG 0x80
+-#define SR_MCAST_MAX 64
+ #define SR_TX_OVERHEAD 2 /* 2bytes header */
+ #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */
+
+--
+2.51.0
+
--- /dev/null
+From abfa59333a2841c01a7aa2bfc05ea01d090126af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 10:26:46 +0800
+Subject: net: wwan: mhi: Add network support for Foxconn T99W760
+
+From: Slark Xiao <slark_xiao@163.com>
+
+[ Upstream commit 915a5f60ad947e8dd515d2cc77a96a14dffb3f15 ]
+
+T99W760 is designed based on Qualcomm SDX35 chip. It use similar
+architecture with SDX72/SDX75 chip. So we need to assign initial
+link id for this device to make sure network available.
+
+Signed-off-by: Slark Xiao <slark_xiao@163.com>
+Link: https://patch.msgid.link/20260105022646.10630-1-slark_xiao@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/mhi_wwan_mbim.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
+index f8bc9a39bfa30..1d7e3ad900c12 100644
+--- a/drivers/net/wwan/mhi_wwan_mbim.c
++++ b/drivers/net/wwan/mhi_wwan_mbim.c
+@@ -98,7 +98,8 @@ static struct mhi_mbim_link *mhi_mbim_get_link_rcu(struct mhi_mbim_context *mbim
+ static int mhi_mbim_get_link_mux_id(struct mhi_controller *cntrl)
+ {
+ if (strcmp(cntrl->name, "foxconn-dw5934e") == 0 ||
+- strcmp(cntrl->name, "foxconn-t99w640") == 0)
++ strcmp(cntrl->name, "foxconn-t99w640") == 0 ||
++ strcmp(cntrl->name, "foxconn-t99w760") == 0)
+ return WDS_BIND_MUX_DATA_PORT_MUX_ID;
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From d28a9aa27312dd29cd04f5d8bf038f266fc036cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Dec 2025 20:53:51 +0900
+Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler
+
+From: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+
+[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ]
+
+The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
+ ("netfilter: conntrack: introduce clash resolution on insertion race"),
+sets allow_clash=true in the UDP/UDPLITE protocol handler
+but does not set it in the generic protocol handler.
+
+As a result, packets composed of connectionless protocols at each layer,
+such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
+
+To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.
+
+Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_generic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
+index e831637bc8ca8..cb260eb3d012c 100644
+--- a/net/netfilter/nf_conntrack_proto_generic.c
++++ b/net/netfilter/nf_conntrack_proto_generic.c
+@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net)
+ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
+ {
+ .l4proto = 255,
++ .allow_clash = true,
+ #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ .ctnl_timeout = {
+ .nlattr_to_obj = generic_timeout_nlattr_to_obj,
+--
+2.51.0
+
--- /dev/null
+From 5701cec8128d88d39b1314f882ce84e9a6387e10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 12:30:42 +0100
+Subject: netfilter: xt_tcpmss: check remaining length before reading optlen
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ]
+
+Quoting reporter:
+ In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
+ op[i+1] directly without validating the remaining option length.
+
+ If the last byte of the option field is not EOL/NOP (0/1), the code attempts
+ to index op[i+1]. In the case where i + 1 == optlen, this causes an
+ out-of-bounds read, accessing memory past the optlen boundary
+ (either reading beyond the stack buffer _opt or the
+ following payload).
+
+Reported-by: sungzii <sungzii@pm.me>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_tcpmss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
+index 37704ab017992..0d32d4841cb32 100644
+--- a/net/netfilter/xt_tcpmss.c
++++ b/net/netfilter/xt_tcpmss.c
+@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ return (mssval >= info->mss_min &&
+ mssval <= info->mss_max) ^ info->invert;
+ }
+- if (op[i] < 2)
++ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i+1] ? : 1;
+--
+2.51.0
+
--- /dev/null
+From 04314a94b763b14a744a40cce9caa259a22f7db5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 19:11:39 +0800
+Subject: nfc: nxp-nci: remove interrupt trigger type
+
+From: Carl Lee <carl.lee@amd.com>
+
+[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ]
+
+For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and
+active high, not edge-triggered.
+
+Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail
+to trigger correctly.
+
+Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured
+via Device Tree.
+
+Signed-off-by: Carl Lee <carl.lee@amd.com>
+Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index 049662ffdf972..6a5ce8ff91f0b 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -305,7 +305,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client)
+
+ r = request_threaded_irq(client->irq, NULL,
+ nxp_nci_i2c_irq_thread_fn,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_ONESHOT,
+ NXP_NCI_I2C_DRIVER_NAME, phy);
+ if (r < 0)
+ nfc_err(&client->dev, "Unable to register IRQ handler\n");
+--
+2.51.0
+
--- /dev/null
+From 41c6c4cde24a4bb9608f6cbda58ac49d1de235b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:18 -0800
+Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]
+
+Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
+This patch protects against invalid index out of bounds access to mw_sizes
+When invalid access print message to user that configuration is not valid.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index f851397b65d6e..f15ebab138144 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev)
+ for (i = 0; i < sndev->nr_lut_mw; i++) {
+ int idx = sndev->nr_direct_mw + i;
+
++ if (idx >= MAX_MWS) {
++ dev_err(&sndev->stdev->dev,
++ "Total number of MW cannot be bigger than %d", MAX_MWS);
++ break;
++ }
++
+ sndev->self_shared->mw_sizes[idx] = LUT_SIZE;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 69981db3d53bf263d42147a3ecf5d635905f33d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:17 -0800
+Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]
+
+Number of MW LUTs depends on NTB configuration and can be set to zero,
+in such scenario rounddown_pow_of_two will cause undefined behaviour and
+should not be performed.
+This patch ensures that rounddown_pow_of_two is called on valid value.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index f15ebab138144..0536521fa6ccc 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+ sndev->mmio_self_ctrl);
+
+ sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries);
+- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
++ if (sndev->nr_lut_mw)
++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n",
+ sndev->nr_direct_mw, sndev->nr_lut_mw);
+@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+
+ sndev->peer_nr_lut_mw =
+ ioread16(&sndev->mmio_peer_ctrl->lut_table_entries);
+- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
++ if (sndev->peer_nr_lut_mw)
++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n",
+ sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw);
+--
+2.51.0
+
--- /dev/null
+From 925388727682d9c2639a75cdd74dfe6661b1c0df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 18:21:47 +0530
+Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ]
+
+NIX SQ manager sticky mode is known to cause stalls when multiple SQs
+share an SMQ and transmit concurrently. Additionally, PSE may deadlock
+on transitions between sticky and non-sticky transmissions. There is
+also a credit drop issue observed when certain condition clocks are
+gated.
+
+work around these hardware errata by:
+- Disabling SQM sticky operation:
+ - Clear TM6 (bit 15)
+ - Clear TM11 (bit 14)
+- Disabling sticky → non-sticky transition path that can deadlock PSE:
+ - Clear TM5 (bit 23)
+- Preventing credit drops by keeping the control-flow clock enabled:
+ - Set TM9 (bit 21)
+
+These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this
+configuration the SQM/PSE maintain forward progress under load without
+credit loss, at the cost of disabling sticky optimizations.
+
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index da69350c6f765..0a23e0a918280 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -4861,12 +4861,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw)
+ /* Set chan/link to backpressure TL3 instead of TL2 */
+ rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
+
+- /* Disable SQ manager's sticky mode operation (set TM6 = 0)
++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0)
+ * This sticky mode is known to cause SQ stalls when multiple
+- * SQs are mapped to same SMQ and transmitting pkts at a time.
++ * SQs are mapped to same SMQ and transmitting pkts simultaneously.
++ * NIX PSE may deadlock when there are any sticky to non-sticky
++ * transmission. Hence disable it (TM5 = 0).
+ */
+ cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
+- cfg &= ~BIT_ULL(15);
++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23));
++ /* NIX may drop credits when condition clocks are turned off.
++ * Hence enable control flow clk (set TM9 = 1).
++ */
++ cfg |= BIT_ULL(21);
+ rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
+
+ ltdefs = rvu->kpu.lt_def;
+--
+2.51.0
+
--- /dev/null
+From dffd1ec9e0224c644fd6b2d1dfbf488497c2b7e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 12:07:23 -0500
+Subject: openrisc: define arch-specific version of nop()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ]
+
+When compiling a driver written for MIPS on OpenRISC that uses the nop()
+function, it fails due to the following error:
+
+ drivers/watchdog/pic32-wdt.c: Assembler messages:
+ drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop'
+
+The driver currently uses the generic version of nop() from
+include/asm-generic/barrier.h:
+
+ #ifndef nop
+ #define nop() asm volatile ("nop")
+ #endif
+
+Let's fix this on OpenRISC by defining an architecture-specific version
+of nop().
+
+This was tested by performing an allmodconfig openrisc cross compile on
+an aarch64 host.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/barrier.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+index 7538294721bed..8e592c9909023 100644
+--- a/arch/openrisc/include/asm/barrier.h
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -4,6 +4,8 @@
+
+ #define mb() asm volatile ("l.msync" ::: "memory")
+
++#define nop() asm volatile ("l.nop")
++
+ #include <asm-generic/barrier.h>
+
+ #endif /* __ASM_BARRIER_H */
+--
+2.51.0
+
--- /dev/null
+From 07c135ba194df719ee370fce1975e010c5e3a5b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 17:58:55 +0100
+Subject: parisc: Prevent interrupts during reboot
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/process.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index ed93bd8c15453..d7b0f233f2cc9 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -85,6 +85,9 @@ void machine_restart(char *cmd)
+ #endif
+ /* set up a new led state on systems shipped with a LED State panel */
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN);
++
++ /* prevent interrupts during reboot */
++ set_eiem(0);
+
+ /* "Normal" system reset */
+ pdc_do_reset();
+--
+2.51.0
+
--- /dev/null
+From 48468bbb8049cbb0ddea1783978061f8214b6559 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:53:32 +0530
+Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
+
+From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+
+[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ]
+
+The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability,
+but they do provide ACS-like features to disable peer transactions and
+validate bus numbers in requests.
+
+Add an ACS quirk for Hamoa & Glymur.
+
+Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7162bc6d073c8..8f2f8ea9ff9a0 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5117,6 +5117,10 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
+ /* QCOM SA8775P root port */
+ { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },
++ /* QCOM Hamoa root port */
++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs },
++ /* QCOM Glymur root port */
++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs },
+ /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */
+ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs },
+ /* Intel PCH root ports */
+--
+2.51.0
+
--- /dev/null
+From 918cb544648df9179037eded1fcdc4df9dc85982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 21:35:04 +0200
+Subject: PCI: Add Intel Nova Lake audio Device ID
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit b190870e0e0cfb375c0d4da02761c32083f3644d ]
+
+Add Nova Lake (NVL) audio Device ID
+
+The ID will be used by HDA legacy, SOF audio stack and the driver
+to determine which audio stack should be used (intel-dsp-config).
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260120193507.14019-2-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pci_ids.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index c395b3c5c05cf..ba1b9617f724a 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -3134,6 +3134,7 @@
+ #define PCI_DEVICE_ID_INTEL_HDA_CML_S 0xa3f0
+ #define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828
+ #define PCI_DEVICE_ID_INTEL_S21152BB 0xb152
++#define PCI_DEVICE_ID_INTEL_HDA_NVL 0xd328
+ #define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7
+ #define PCI_DEVICE_ID_INTEL_HDA_PTL_H 0xe328
+ #define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428
+--
+2.51.0
+
--- /dev/null
+From 4004bbcf40cb98a1bd74e86170a6c8e430a823b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 10:25:51 +0100
+Subject: PCI/AER: Clear stale errors on reporting agents upon probe
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ]
+
+Correctable and Uncorrectable Error Status Registers on reporting agents
+are cleared upon PCI device enumeration in pci_aer_init() to flush past
+events. They're cleared again when an error is handled by the AER driver.
+
+If an agent reports a new error after pci_aer_init() and before the AER
+driver has probed on the corresponding Root Port or Root Complex Event
+Collector, that error is not handled by the AER driver: It clears the
+Root Error Status Register on probe, but neglects to re-clear the
+Correctable and Uncorrectable Error Status Registers on reporting agents.
+
+The error will eventually be reported when another error occurs. Which
+is irritating because to an end user it appears as if the earlier error
+has just happened.
+
+Amend the AER driver to clear stale errors on reporting agents upon probe.
+
+Skip reporting agents which have not invoked pci_aer_init() yet to avoid
+using an uninitialized pdev->aer_cap. They're recognizable by the error
+bits in the Device Control register still being clear.
+
+Reporting agents may execute pci_aer_init() after the AER driver has
+probed, particularly when devices are hotplugged or removed/rescanned via
+sysfs. For this reason, it continues to be necessary that pci_aer_init()
+clears Correctable and Uncorrectable Error Status Registers.
+
+Reported-by: Lucas Van <lucas.van@intel.com> # off-list
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Lucas Van <lucas.van@intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 36b6188a3a46f..fe7603e7ee8c8 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -1386,6 +1386,20 @@ static void aer_disable_irq(struct pci_dev *pdev)
+ pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_COMMAND, reg32);
+ }
+
++static int clear_status_iter(struct pci_dev *dev, void *data)
++{
++ u16 devctl;
++
++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */
++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl);
++ if (!(devctl & PCI_EXP_AER_FLAGS))
++ return 0;
++
++ pci_aer_clear_status(dev);
++ pcie_clear_device_status(dev);
++ return 0;
++}
++
+ /**
+ * aer_enable_rootport - enable Root Port's interrupts when receiving messages
+ * @rpc: pointer to a Root Port data structure
+@@ -1407,9 +1421,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc)
+ pcie_capability_clear_word(pdev, PCI_EXP_RTCTL,
+ SYSTEM_ERROR_INTR_ON_MESG_MASK);
+
+- /* Clear error status */
++ /* Clear error status of this Root Port or RCEC */
+ pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32);
++
++ /* Clear error status of agents reporting to this Root Port or RCEC */
++ if (reg32 & AER_ERR_STATUS_MASK) {
++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC)
++ pcie_walk_rcec(pdev, clear_status_iter, NULL);
++ else if (pdev->subordinate)
++ pci_walk_bus(pdev->subordinate, clear_status_iter,
++ NULL);
++ }
++
+ pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32);
+ pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32);
+--
+2.51.0
+
--- /dev/null
+From 8a05b5b9bbc8bfb7dd08b6d3173dbf8946f9a01c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 21:04:47 +0530
+Subject: PCI: Enable ACS after configuring IOMMU for OF platforms
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ]
+
+Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets
+'pci_acs_enable' to request that ACS be enabled for any devices enumerated
+in the future.
+
+OF platforms called pci_enable_acs() for the first device before
+of_iommu_configure() called pci_request_acs(), so ACS was never enabled for
+that device (typically a Root Port).
+
+Call pci_enable_acs() later, from pci_dma_configure(), after
+of_dma_configure() has had a chance to call pci_request_acs().
+
+Here's the call path, showing the move of pci_enable_acs() from
+pci_acs_init() to pci_dma_configure(), where it always happens after
+pci_request_acs():
+
+ pci_device_add
+ pci_init_capabilities
+ pci_acs_init
+ - pci_enable_acs
+ - if (pci_acs_enable) <-- previous test
+ - ...
+ device_add
+ bus_notify(BUS_NOTIFY_ADD_DEVICE)
+ iommu_bus_notifier
+ iommu_probe_device
+ iommu_init_device
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ of_dma_configure
+ of_iommu_configure
+ pci_request_acs
+ pci_acs_enable = 1 <-- set
+ + pci_enable_acs
+ + if (pci_acs_enable) <-- new test
+ + ...
+ bus_probe_device
+ device_initial_probe
+ ...
+ really_probe
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ ...
+ pci_enable_acs
+
+Note that we will now call pci_enable_acs() twice for every device, first
+from the iommu_probe_device() path and again from the really_probe() path.
+Presumably that's not an issue since we also call dev->bus->dma_configure()
+twice.
+
+For the ACPI platforms, pci_request_acs() is called during ACPI
+initialization time itself, independent of the IOMMU framework.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 8 ++++++++
+ drivers/pci/pci.c | 10 +---------
+ drivers/pci/pci.h | 1 +
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index a00a2ce01045f..9846ab70cff11 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1656,6 +1656,14 @@ static int pci_dma_configure(struct device *dev)
+ ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
+ }
+
++ /*
++ * Attempt to enable ACS regardless of capability because some Root
++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
++ * the standard ACS capability but still support ACS via those
++ * quirks.
++ */
++ pci_enable_acs(to_pci_dev(dev));
++
+ pci_put_host_bridge_device(bridge);
+
+ if (!ret && !driver->driver_managed_dma) {
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index c1cdc9b717906..e3e7b4008ac98 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1072,7 +1072,7 @@ static void pci_std_enable_acs(struct pci_dev *dev, struct pci_acs *caps)
+ * pci_enable_acs - enable ACS if hardware support it
+ * @dev: the PCI device
+ */
+-static void pci_enable_acs(struct pci_dev *dev)
++void pci_enable_acs(struct pci_dev *dev)
+ {
+ struct pci_acs caps;
+ bool enable_acs = false;
+@@ -3718,14 +3718,6 @@ bool pci_acs_path_enabled(struct pci_dev *start,
+ void pci_acs_init(struct pci_dev *dev)
+ {
+ dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
+-
+- /*
+- * Attempt to enable ACS regardless of capability because some Root
+- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+- * the standard ACS capability but still support ACS via those
+- * quirks.
+- */
+- pci_enable_acs(dev);
+ }
+
+ /**
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index b1f393a42a875..b9b97ec0f836a 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -653,6 +653,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
+ }
+
+ void pci_acs_init(struct pci_dev *dev);
++void pci_enable_acs(struct pci_dev *dev);
+ #ifdef CONFIG_PCI_QUIRKS
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);
+--
+2.51.0
+
--- /dev/null
+From 4c392570f6861e1218a9a341885396c52546e554 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 08:59:51 -0800
+Subject: PCI: Fix pci_slot_lock () device locking
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ]
+
+Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to
+prevent warnings like:
+
+ pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0
+
+Take and release the lock for the bridge providing the slot for the
+lock/trylock and unlock routines.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index aad6cb7949ff9..c1cdc9b717906 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5610,10 +5610,9 @@ static int pci_bus_trylock(struct pci_bus *bus)
+ /* Do any devices on or below this slot prevent a bus reset? */
+ static bool pci_slot_resettable(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+- if (slot->bus->self &&
+- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
+ return false;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+@@ -5630,7 +5629,10 @@ static bool pci_slot_resettable(struct pci_slot *slot)
+ /* Lock devices from the top of the tree down */
+ static void pci_slot_lock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge)
++ pci_dev_lock(bridge);
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5645,7 +5647,7 @@ static void pci_slot_lock(struct pci_slot *slot)
+ /* Unlock devices from the bottom of the tree up */
+ static void pci_slot_unlock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5655,12 +5657,18 @@ static void pci_slot_unlock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ }
+
+ /* Return 1 on successful lock, 0 on contention */
+ static int pci_slot_trylock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge && !pci_dev_trylock(bridge))
++ return 0;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5685,6 +5693,9 @@ static int pci_slot_trylock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e23b9e580358cd383348b427718b58f00082cd40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 17:02:08 -0700
+Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset
+
+From: Alex Williamson <alex.williamson@nvidia.com>
+
+[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ]
+
+User forums report issues when assigning ASM1164 SATA controllers to VMs,
+especially in configurations with multiple controllers. Logs show the
+device fails to retrain after bus reset. Reports suggest this is an issue
+across multiple platforms. The device indicates support for PM reset,
+therefore the device still has a viable function level reset mechanism.
+The reporting user confirms the device is well behaved in this use case
+with bus reset disabled.
+
+Reported-by: Patrick Bianchi <patrick.w.bianchi@gmail.com>
+Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
+Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index d9ba1786fc1ae..7162bc6d073c8 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3791,6 +3791,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset);
+ */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
+
++/*
++ * Reports from users making use of PCI device assignment with ASM1164
++ * controllers indicate an issue with bus reset where the device fails to
++ * retrain. The issue appears more common in configurations with multiple
++ * controllers. The device does indicate PM reset support (NoSoftRst-),
++ * therefore this still leaves a viable reset method.
++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset);
++
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
+ /*
+--
+2.51.0
+
--- /dev/null
+From 465c402dcdaac00cc226c069640f951ffabd79b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 16:44:06 +0800
+Subject: PCI: Mark Nvidia GB10 to avoid bus reset
+
+From: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+
+[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ]
+
+After asserting Secondary Bus Reset to downstream devices via a GB10 Root
+Port, the link may not retrain correctly, e.g., the link may retrain with a
+lower lane count or config accesses to downstream devices may fail.
+
+Prevent use of Secondary Bus Reset for devices below GB10.
+
+Signed-off-by: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+[bhelgaas: drop pci_ids.h update (only used once), update commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 8f2f8ea9ff9a0..3d05ea35c536f 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3748,6 +3748,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+ }
+
++/*
++ * After asserting Secondary Bus Reset to downstream devices via a GB10
++ * Root Port, the link may not retrain correctly.
++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset);
++
+ /*
+ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
+ * prevented for those affected devices.
+--
+2.51.0
+
--- /dev/null
+From c4ff629ac4d9f9673ae5d63c8341c7f90c76cdcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 22:44:52 +0800
+Subject: PCI/MSI: Unmap MSI-X region on error
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ]
+
+msix_capability_init() fails to unmap the MSI-X region if
+msix_setup_interrupts() fails.
+
+Add the missing iounmap() for that error path.
+
+[ tglx: Massaged change log ]
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi/msi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
+index 8b88487886184..54627c3a2dc8c 100644
+--- a/drivers/pci/msi/msi.c
++++ b/drivers/pci/msi/msi.c
+@@ -739,7 +739,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+
+ ret = msix_setup_interrupts(dev, entries, nvec, affd);
+ if (ret)
+- goto out_disable;
++ goto out_unmap;
+
+ /* Disable INTX */
+ pci_intx_for_msi(dev, 0);
+@@ -760,6 +760,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ pcibios_free_irq(dev);
+ return 0;
+
++out_unmap:
++ iounmap(dev->msix_base);
+ out_disable:
+ dev->msix_enabled = 0;
+ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
+--
+2.51.0
+
--- /dev/null
+From 3b233fcda4dc06e96532fdb20a274abe4f481552 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 22:47:04 +0530
+Subject: perf annotate: Fix memcpy size in arch__grow_instructions()
+
+From: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+
+[ Upstream commit f0d98c78f8bf73ce2a9b7793f66cda240fa9ab10 ]
+
+The memcpy() in arch__grow_instructions() is copying the wrong number of
+bytes when growing from a non-allocated table.
+
+It should copy arch->nr_instructions * sizeof(struct ins) bytes, not
+just arch->nr_instructions bytes.
+
+This bug causes data corruption as only a partial copy of the
+instruction table is made, leading to garbage data in most entries and
+potential crashes
+
+Fixes: 2a1ff812c40be982 ("perf annotate: Introduce alternative method of keeping instructions table")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/disasm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
+index a228a7ba30caa..2dc93199ac258 100644
+--- a/tools/perf/util/disasm.c
++++ b/tools/perf/util/disasm.c
+@@ -79,7 +79,7 @@ static int arch__grow_instructions(struct arch *arch)
+ if (new_instructions == NULL)
+ return -1;
+
+- memcpy(new_instructions, arch->instructions, arch->nr_instructions);
++ memcpy(new_instructions, arch->instructions, arch->nr_instructions * sizeof(struct ins));
+ goto out_update_instructions;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6660f23fb4d810591a5877b4479c686636af29dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 16:39:54 +0000
+Subject: perf/arm-cmn: Support CMN-600AE
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ]
+
+The functional safety features of CMN-600AE have little to no impact on
+the PMU relative to the base CMN-600 design, so for simplicity we can
+reasonably just treat it as the same thing. The only obvious difference
+is that the revision numbers aren't aligned, so we may hide some aliases
+for events which do actually exist, but those can still be specified via
+the underlying "type,eventid" format so it's not too big a deal.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Tested-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index e6b0c8ec9c1fa..3a36cc646c15e 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -210,6 +210,7 @@ enum cmn_model {
+ enum cmn_part {
+ PART_CMN600 = 0x434,
+ PART_CMN650 = 0x436,
++ PART_CMN600AE = 0x438,
+ PART_CMN700 = 0x43c,
+ PART_CI700 = 0x43a,
+ PART_CMN_S3 = 0x43e,
+@@ -2273,6 +2274,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01);
+ part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg);
+ part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8;
++ /* 600AE is close enough that it's not really worth more complexity */
++ if (part == PART_CMN600AE)
++ part = PART_CMN600;
+ if (cmn->part && cmn->part != part)
+ dev_warn(cmn->dev,
+ "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n",
+--
+2.51.0
+
--- /dev/null
+From ccc607f7bc4a9fcab0efa939be7c61488824b1c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:36 -0800
+Subject: perf callchain: Fix srcline printing with inlines
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ]
+
+sample__fprintf_callchain() was using map__fprintf_srcline() which won't
+report inline line numbers.
+
+Fix by using the srcline from the callchain and falling back to the map
+variant.
+
+Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel_fprintf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
+index c2c0500d5da99..2108e02d4b6cd 100644
+--- a/tools/perf/util/evsel_fprintf.c
++++ b/tools/perf/util/evsel_fprintf.c
+@@ -180,8 +180,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
+ if (print_dso && (!sym || !sym->inlined))
+ printed += map__fprintf_dsoname_dsoff(map, print_dsoff, addr, fp);
+
+- if (print_srcline)
+- printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ if (print_srcline) {
++ if (node->srcline)
++ printed += fprintf(fp, "\n %s", node->srcline);
++ else
++ printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ }
+
+ if (sym && sym->inlined)
+ printed += fprintf(fp, " (inlined)");
+--
+2.51.0
+
--- /dev/null
+From 7d3f961aeff1a4cece628630fbf6a2132d33505f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:34 +0100
+Subject: perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+
+The intention here was probably not allowing forced-threading.
+
+Replace IRQF_ONESHOT with IRQF_NO_THREAD.
+
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/cxl_pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c
+index 16328569fde93..24244096f5141 100644
+--- a/drivers/perf/cxl_pmu.c
++++ b/drivers/perf/cxl_pmu.c
+@@ -874,7 +874,7 @@ static int cxl_pmu_probe(struct device *dev)
+ if (!irq_name)
+ return -ENOMEM;
+
+- rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_ONESHOT,
++ rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD,
+ irq_name, info);
+ if (rc)
+ return rc;
+--
+2.51.0
+
--- /dev/null
+From 0c1c29bc3bada8ba5695482a5646c7338e88b8cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:35:07 -0800
+Subject: perf maps: Fix reference count leak in maps__find_ams()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 6fdd2676db55b503c52dd3f1359b5c57f774ab75 ]
+
+ams and so ams->ms.map is an in argument, however, it is also
+overwritten. As a map is reference counted, ensure a map__put() is done
+before overwriting it.
+
+Fixes: 42fd623b58dbcc48 ("perf maps: Get map before returning in maps__find")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Dr. David Alan Gilbert <linux@treblig.org>
+Cc: Guo Ren <guoren@kernel.org>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Julia Lawall <Julia.Lawall@inria.fr>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Paul Walmsley <pjw@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sergei Trofimovich <slyich@gmail.com>
+Cc: Shimin Guo <shimin.guo@skydio.com>
+Cc: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Tianyou Li <tianyou.li@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Zecheng Li <zecheng@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/maps.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c
+index 09c9cc326c08d..67133b60b03cd 100644
+--- a/tools/perf/util/maps.c
++++ b/tools/perf/util/maps.c
+@@ -664,6 +664,7 @@ int maps__find_ams(struct maps *maps, struct addr_map_symbol *ams)
+ if (ams->addr < map__start(ams->ms.map) || ams->addr >= map__end(ams->ms.map)) {
+ if (maps == NULL)
+ return -1;
++ map__put(ams->ms.map);
+ ams->ms.map = maps__find(maps, ams->addr);
+ if (ams->ms.map == NULL)
+ return -1;
+--
+2.51.0
+
--- /dev/null
+From 3beeebfdb1fe9a9508ff207062588a772a7fa528 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 14:32:16 +0100
+Subject: perf test stat tests: Fix for virtualized machines
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit e272628902c1c96731e2d9f62a7fc77767686eb0 ]
+
+On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for
+z/VM systems. The root cause is this statement:
+
+ $(perf stat -a -- sleep 0.1 2>&1 |\
+ grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* -c)
+
+The 'perf stat' output on a s390 z/VM system is
+
+ # perf stat -a -- sleep 0.1 2>&1
+ Performance counter stats for 'system wide':
+
+ 56 context-switches # 46.3 cs/sec cs_per_second
+ 1,210.41 msec cpu-clock # 11.9 CPUs CPUs_utilized
+ 12 cpu-migrations # 9.9 migrations/sec ...
+ 81 page-faults # 66.9 faults/sec ...
+
+ 0.100891009 seconds time elapsed
+
+The grep command does not match any single line and exits with error
+code 1.
+
+As the bash script is executed with 'set -e', it aborts with the first
+error code being non-zero.
+
+Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'.
+
+Output before:
+
+ # perf test 102
+ 102: perf stat tests : FAILED!
+ #
+
+Output after:
+
+ # perf test 102
+ 102: perf stat tests : Ok
+ #
+
+Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: linux-s390@vger.kernel.org
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index a20bf3bdcb9f8..a76ccf2deb563 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -159,7 +159,7 @@ test_hybrid() {
+ fi
+
+ # Run default Perf stat
+- cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c)
++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " | wc -l)
+
+ # The expectation is that default output will have a cycles events on each
+ # hybrid PMU. In situations with no cycles PMU events, like virtualized, this
+--
+2.51.0
+
--- /dev/null
+From a3ef83fcc13a4b1cb62b7468b74118778df6bc4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 13:22:04 -0800
+Subject: perf test stat: Update test expectations and events
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit a48cd551d7436be3b1bd65c63a6d00163f7e7706 ]
+
+test_stat_record_report and test_stat_record_script used default
+output which triggers a bug when sending metrics. As this isn't
+relevant to the test switch to using named software events.
+
+Update the match in test_hybrid as the cycles event is now cpu-cycles
+to workaround potential ARM issues.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: e272628902c1 ("perf test stat tests: Fix for virtualized machines")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index 62f13dfeae8e4..a20bf3bdcb9f8 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -18,7 +18,7 @@ test_default_stat() {
+
+ test_stat_record_report() {
+ echo "stat record and report test"
+- if ! perf stat record -o - true | perf stat report -i - 2>&1 | \
++ if ! perf stat record -e task-clock -o - true | perf stat report -i - 2>&1 | \
+ grep -E -q "Performance counter stats for 'pipe':"
+ then
+ echo "stat record and report test [Failed]"
+@@ -30,7 +30,7 @@ test_stat_record_report() {
+
+ test_stat_record_script() {
+ echo "stat record and script test"
+- if ! perf stat record -o - true | perf script -i - 2>&1 | \
++ if ! perf stat record -e task-clock -o - true | perf script -i - 2>&1 | \
+ grep -E -q "CPU[[:space:]]+THREAD[[:space:]]+VAL[[:space:]]+ENA[[:space:]]+RUN[[:space:]]+TIME[[:space:]]+EVENT"
+ then
+ echo "stat record and script test [Failed]"
+@@ -159,7 +159,7 @@ test_hybrid() {
+ fi
+
+ # Run default Perf stat
+- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c)
++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c)
+
+ # The expectation is that default output will have a cycles events on each
+ # hybrid PMU. In situations with no cycles PMU events, like virtualized, this
+--
+2.51.0
+
--- /dev/null
+From ae599a0a20031e4acd3653115e9814e136baaa75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:32 -0800
+Subject: perf unwind-libdw: Fix invalid reference counts
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f815fc0c66e777c727689666cfb46b8d461c2f99 ]
+
+The addition of addr_location__exit() causes use-after put on the maps
+and map references in the unwind info. Add the gets and then add the
+map_symbol__exit() calls.
+
+Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/unwind-libdw.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index bde216e630d29..216f0d3762fda 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -133,8 +133,8 @@ static int entry(u64 ip, struct unwind_info *ui)
+ }
+
+ e->ip = ip;
+- e->ms.maps = al.maps;
+- e->ms.map = al.map;
++ e->ms.maps = maps__get(al.maps);
++ e->ms.map = map__get(al.map);
+ e->ms.sym = al.sym;
+
+ pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n",
+@@ -319,6 +319,9 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
+ if (err)
+ pr_debug("unwind: failed with '%s'\n", dwfl_errmsg(-1));
+
++ for (i = 0; i < ui->idx; i++)
++ map_symbol__exit(&ui->entries[i].ms);
++
+ dwfl_end(ui->dwfl);
+ free(ui);
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From b79f9eab7cbf3a92318c13a53254b8eb9836d9e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:39:46 +0530
+Subject: perf vendor events amd: Fix Zen 5 MAB allocation events
+
+From: Sandipan Das <sandipan.das@amd.com>
+
+[ Upstream commit 76b2cf07a6d2a836108f9c2486d76599f7adf6e8 ]
+
+The unit masks for PMCx041 vary across different generations of Zen
+processors.
+
+Fix the Zen 5 events based on PMCx041 as they incorrectly use the same
+unit masks as that of Zen 4.
+
+Fixes: 45c072f2537ab07b ("perf vendor events amd: Add Zen 5 core events")
+Reported-by: Suyash Mahar <smahar@meta.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ananth Narayan <ananth.narayan@amd.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/arch/x86/amdzen5/load-store.json | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
+index af2fdf1f55d64..917f9d68f85a6 100644
+--- a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
++++ b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
+@@ -70,19 +70,19 @@
+ "EventName": "ls_mab_alloc.load_store_allocations",
+ "EventCode": "0x41",
+ "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for load-store allocations.",
+- "UMask": "0x3f"
++ "UMask": "0x07"
+ },
+ {
+ "EventName": "ls_mab_alloc.hardware_prefetcher_allocations",
+ "EventCode": "0x41",
+ "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for hardware prefetcher allocations.",
+- "UMask": "0x40"
++ "UMask": "0x08"
+ },
+ {
+ "EventName": "ls_mab_alloc.all_allocations",
+ "EventCode": "0x41",
+ "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for all types of allocations.",
+- "UMask": "0x7f"
++ "UMask": "0x0f"
+ },
+ {
+ "EventName": "ls_dmnd_fills_from_sys.local_l2",
+--
+2.51.0
+
--- /dev/null
+From aa5a6eff36019e820e36082dc18997111f56f446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 08:48:46 +0100
+Subject: perf/x86/cstate: Add Airmont NP
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 3006911f284d769b0f66c12b39da130325ef1440 ]
+
+From the perspective of Intel cstate residency counters, the Airmont NP
+(aka Lightning Mountain) is identical to the Airmont.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Link: https://patch.msgid.link/20251124074846.9653-4-ms@dev.tdt.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/cstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index aee2dfc108408..05bc2b799dd29 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -597,6 +597,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
+ X86_MATCH_VFM(INTEL_ATOM_SILVERMONT, &slm_cstates),
+ X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_D, &slm_cstates),
+ X86_MATCH_VFM(INTEL_ATOM_AIRMONT, &slm_cstates),
++ X86_MATCH_VFM(INTEL_ATOM_AIRMONT_NP, &slm_cstates),
+
+ X86_MATCH_VFM(INTEL_BROADWELL, &snb_cstates),
+ X86_MATCH_VFM(INTEL_BROADWELL_D, &snb_cstates),
+--
+2.51.0
+
--- /dev/null
+From f90efc0b20bfd994ccfe25ca726a641f03110a84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 08:48:44 +0100
+Subject: perf/x86/msr: Add Airmont NP
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 63dbadcafc1f4d1da796a8e2c0aea1e561f79ece ]
+
+Like Airmont, the Airmont NP (aka Intel / MaxLinear Lightning Mountain)
+supports SMI_COUNT MSR.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Link: https://patch.msgid.link/20251124074846.9653-2-ms@dev.tdt.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/msr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c
+index 45b1866ff0513..3a05ea2871dc5 100644
+--- a/arch/x86/events/msr.c
++++ b/arch/x86/events/msr.c
+@@ -76,6 +76,7 @@ static bool test_intel(int idx, void *data)
+ case INTEL_ATOM_SILVERMONT:
+ case INTEL_ATOM_SILVERMONT_D:
+ case INTEL_ATOM_AIRMONT:
++ case INTEL_ATOM_AIRMONT_NP:
+
+ case INTEL_ATOM_GOLDMONT:
+ case INTEL_ATOM_GOLDMONT_D:
+--
+2.51.0
+
--- /dev/null
+From 6dd2929a7c9510c0df4933cb51127b0133c389d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 15:24:25 +0100
+Subject: phy: cadence-torrent: restore parent clock for refclk during resume
+
+From: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+
+[ Upstream commit 434e1a0ee145d0389b192252be4c993f86cf1134 ]
+
+While suspend and resume, parent clock config for refclk was getting lost.
+So save and restore it in suspend and resume operations.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+Link: https://patch.msgid.link/20251216-phy-cadence-torrent-resume-restore-refclk-parent-v3-1-8a7ed84b47e3@bootlin.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/phy-cadence-torrent.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c
+index 8bbbbb87bb22e..92feb45fb56e6 100644
+--- a/drivers/phy/cadence/phy-cadence-torrent.c
++++ b/drivers/phy/cadence/phy-cadence-torrent.c
+@@ -392,6 +392,7 @@ struct cdns_torrent_refclk_driver {
+ struct clk_hw hw;
+ struct regmap_field *cmn_fields[REFCLK_OUT_NUM_CMN_CONFIG];
+ struct clk_init_data clk_data;
++ u8 parent_index;
+ };
+
+ #define to_cdns_torrent_refclk_driver(_hw) \
+@@ -3151,11 +3152,29 @@ static const struct cdns_torrent_vals sgmii_qsgmii_xcvr_diag_ln_vals = {
+ .num_regs = ARRAY_SIZE(sgmii_qsgmii_xcvr_diag_ln_regs),
+ };
+
++static void cdns_torrent_refclk_driver_suspend(struct cdns_torrent_phy *cdns_phy)
++{
++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER];
++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw);
++
++ refclk_driver->parent_index = cdns_torrent_refclk_driver_get_parent(hw);
++}
++
++static int cdns_torrent_refclk_driver_resume(struct cdns_torrent_phy *cdns_phy)
++{
++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER];
++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw);
++
++ return cdns_torrent_refclk_driver_set_parent(hw, refclk_driver->parent_index);
++}
++
+ static int cdns_torrent_phy_suspend_noirq(struct device *dev)
+ {
+ struct cdns_torrent_phy *cdns_phy = dev_get_drvdata(dev);
+ int i;
+
++ cdns_torrent_refclk_driver_suspend(cdns_phy);
++
+ reset_control_assert(cdns_phy->phy_rst);
+ reset_control_assert(cdns_phy->apb_rst);
+ for (i = 0; i < cdns_phy->nsubnodes; i++)
+@@ -3177,6 +3196,10 @@ static int cdns_torrent_phy_resume_noirq(struct device *dev)
+ int node = cdns_phy->nsubnodes;
+ int ret, i;
+
++ ret = cdns_torrent_refclk_driver_resume(cdns_phy);
++ if (ret)
++ return ret;
++
+ ret = cdns_torrent_clk(cdns_phy);
+ if (ret)
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From fd9c471d17550012b4b0abcd3f2e476738cf27d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 19:17:12 +0800
+Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ]
+
+Disabling PHYs in runtime usually causes the client with external abort
+exception or similar issue due to lack of API to notify clients about PHY
+removal. This patch removes the possibility to unbind i.MX PHY drivers in
+runtime.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+index 043063699e064..41194083e358c 100644
+--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+@@ -411,6 +411,7 @@ static struct platform_driver imx8mq_usb_phy_driver = {
+ .driver = {
+ .name = "imx8mq-usb-phy",
+ .of_match_table = imx8mq_usb_phy_of_match,
++ .suppress_bind_attrs = true,
+ }
+ };
+ module_platform_driver(imx8mq_usb_phy_driver);
+--
+2.51.0
+
--- /dev/null
+From 3dfd041558b8cd705a66e5bca485c09f01030df3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 15:06:43 +0000
+Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts
+
+From: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+
+[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ]
+
+The problem with the current implementation is that it does not consider
+that the USB controller can have multiple PHY handles with different
+arguments count, as for example we have in our cn9131 based platform:
+"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;".
+
+In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells)
+leads to not proper phy detection, taking the "marvell,cp110-utmi-phy"
+dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0
+(#phy-cells = <0>) and safely look for that phy.
+
+Signed-off-by: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+index 4922a5f3327d5..30391d0d7d4b4 100644
+--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+@@ -326,7 +326,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
+- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1);
++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0);
+ if ((port->dr_mode != USB_DR_MODE_HOST) &&
+ (port->dr_mode != USB_DR_MODE_PERIPHERAL)) {
+ dev_err(&pdev->dev,
+--
+2.51.0
+
--- /dev/null
+From a38a817cd8e638f4a5be765212fee6b95ba062a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 15:26:20 +0100
+Subject: phy: ti: phy-j721e-wiz: restore mux selection during resume
+
+From: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+
+[ Upstream commit 53f6240e88c9e8715e09fc19942f13450db4cb33 ]
+
+While suspend and resume mux selection was getting lost. So save and
+restore these values in suspend and resume operations.
+
+Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+Link: https://patch.msgid.link/20251216-phy-ti-phy-j721e-wiz-resume-restore-mux-sel-v1-1-771d564db966@bootlin.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-j721e-wiz.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c
+index c6e846d385d28..cbcc7bd5dde0a 100644
+--- a/drivers/phy/ti/phy-j721e-wiz.c
++++ b/drivers/phy/ti/phy-j721e-wiz.c
+@@ -393,6 +393,7 @@ struct wiz {
+ struct clk *output_clks[WIZ_MAX_OUTPUT_CLOCKS];
+ struct clk_onecell_data clk_data;
+ const struct wiz_data *data;
++ int mux_sel_status[WIZ_MUX_NUM_CLOCKS];
+ };
+
+ static int wiz_reset(struct wiz *wiz)
+@@ -1655,11 +1656,25 @@ static void wiz_remove(struct platform_device *pdev)
+ pm_runtime_disable(dev);
+ }
+
++static int wiz_suspend_noirq(struct device *dev)
++{
++ struct wiz *wiz = dev_get_drvdata(dev);
++ int i;
++
++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++)
++ regmap_field_read(wiz->mux_sel_field[i], &wiz->mux_sel_status[i]);
++
++ return 0;
++}
++
+ static int wiz_resume_noirq(struct device *dev)
+ {
+ struct device_node *node = dev->of_node;
+ struct wiz *wiz = dev_get_drvdata(dev);
+- int ret;
++ int ret, i;
++
++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++)
++ regmap_field_write(wiz->mux_sel_field[i], wiz->mux_sel_status[i]);
+
+ /* Enable supplemental Control override if available */
+ if (wiz->sup_legacy_clk_override)
+@@ -1681,7 +1696,7 @@ static int wiz_resume_noirq(struct device *dev)
+ return ret;
+ }
+
+-static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, NULL, wiz_resume_noirq);
++static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, wiz_suspend_noirq, wiz_resume_noirq);
+
+ static struct platform_driver wiz_driver = {
+ .probe = wiz_probe,
+--
+2.51.0
+
--- /dev/null
+From dcdb021224f816c8893184fa17bcee545a3aefe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 18:26:51 +0000
+Subject: power: sequencing: fix missing state_lock in pwrseq_power_on() error
+ path
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e1dccb485c2876ac1318f36ccc0155416c633a48 ]
+
+pwrseq_power_on() calls pwrseq_unit_disable() when the
+post_enable callback fails. However, this call is outside the
+scoped_guard(mutex, &pwrseq->state_lock) block that ends.
+
+pwrseq_unit_disable() has lockdep_assert_held(&pwrseq->state_lock),
+which will fail when called from this error path.
+
+Add the scoped_guard block to cover the post_enable callback and its
+error handling to ensure the lock is held when pwrseq_unit_disable() is
+called.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Link: https://patch.msgid.link/20260130182651.1576579-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/sequencing/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/sequencing/core.c b/drivers/power/sequencing/core.c
+index 0ffc259c6bb6c..70b92e1c3ac5e 100644
+--- a/drivers/power/sequencing/core.c
++++ b/drivers/power/sequencing/core.c
+@@ -914,8 +914,10 @@ int pwrseq_power_on(struct pwrseq_desc *desc)
+ if (target->post_enable) {
+ ret = target->post_enable(pwrseq);
+ if (ret) {
+- pwrseq_unit_disable(pwrseq, unit);
+- desc->powered_on = false;
++ scoped_guard(mutex, &pwrseq->state_lock) {
++ pwrseq_unit_disable(pwrseq, unit);
++ desc->powered_on = false;
++ }
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 18e39684fec02b54e99b629316e0d5f46df7b003 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 21:01:52 -0500
+Subject: powercap: intel_rapl: Add PL4 support for Ice Lake
+
+From: Daniel Tang <danielzgtg.opensource@gmail.com>
+
+[ Upstream commit 54b3cd55a515c7c0fcfa0c1f0b10d62c11d64bcc ]
+
+Microsoft Surface Pro 7 firmware throttles the processor upon
+boot/resume. Userspace needs to be able to restore the correct value.
+
+Link: https://github.com/linux-surface/linux-surface/issues/706
+Signed-off-by: Daniel Tang <danielzgtg.opensource@gmail.com>
+Link: https://patch.msgid.link/6088605.ChMirdbgyp@daniel-desktop3
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/powercap/intel_rapl_msr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c
+index cbe07450de933..458a90a6d57c0 100644
+--- a/drivers/powercap/intel_rapl_msr.c
++++ b/drivers/powercap/intel_rapl_msr.c
+@@ -139,6 +139,7 @@ static int rapl_msr_write_raw(int cpu, struct reg_action *ra)
+
+ /* List of verified CPUs. */
+ static const struct x86_cpu_id pl4_support_ids[] = {
++ X86_MATCH_VFM(INTEL_ICELAKE_L, NULL),
+ X86_MATCH_VFM(INTEL_TIGERLAKE_L, NULL),
+ X86_MATCH_VFM(INTEL_ALDERLAKE, NULL),
+ X86_MATCH_VFM(INTEL_ALDERLAKE_L, NULL),
+--
+2.51.0
+
--- /dev/null
+From cbb513091872104ddec198994303c6d65bf55a16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 10:03:58 +0800
+Subject: pstore: ram_core: fix incorrect success return when vmap() fails
+
+From: Ruipeng Qi <ruipengqi3@gmail.com>
+
+[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ]
+
+In persistent_ram_vmap(), vmap() may return NULL on failure.
+
+If offset is non-zero, adding offset_in_page(start) causes the function
+to return a non-NULL pointer even though the mapping failed.
+persistent_ram_buffer_map() therefore incorrectly returns success.
+
+Subsequent access to prz->buffer may dereference an invalid address
+and cause crashes.
+
+Add proper NULL checking for vmap() failures.
+
+Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
+Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index c9eaacdec37e4..7b6d6378a3b87 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot);
+ kfree(pages);
+
++ /*
++ * vmap() may fail and return NULL. Do not add the offset in this
++ * case, otherwise a NULL mapping would appear successful.
++ */
++ if (!vaddr)
++ return NULL;
++
+ /*
+ * Since vmap() uses page granularity, we must add the offset
+ * into the page here, to get the byte granularity address
+--
+2.51.0
+
--- /dev/null
+From 3b327178778c220719d828cd2c260e01b898a793 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:15:16 +0100
+Subject: RDMA/rtrs-clt: For conn rejection use actual err number
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ]
+
+When the connection establishment request is rejected from the server
+side, then the actual error number sent back should be used.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com
+Reviewed-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 2b397a544cb93..8fa1d72bd20a4 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1923,7 +1923,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ struct rtrs_path *s = con->c.path;
+ const struct rtrs_msg_conn_rsp *msg;
+ const char *rej_msg;
+- int status, errno;
++ int status, errno = -ECONNRESET;
+ u8 data_len;
+
+ status = ev->status;
+@@ -1945,7 +1945,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ status, rej_msg);
+ }
+
+- return -ECONNRESET;
++ return errno;
+ }
+
+ void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait)
+--
+2.51.0
+
--- /dev/null
+From 4c2cb4c9faa7bda2809ec581ac282c2994e811ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 14:28:23 +0200
+Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox
+ TX channel is uninitialized
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ]
+
+Firmwares that do not use mailbox communication (e.g., the hello_world
+sample) leave priv->tx_ch as NULL. The current suspend logic
+unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without
+an initialized TX channel.
+
+Detect the no_mailboxes case early and skip sending the suspend
+message. Instead, proceed directly to the runtime PM suspend path,
+which is the correct behavior for firmwares that cannot respond to
+mailbox requests.
+
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c
+index 376187ad5754c..713a57200cf09 100644
+--- a/drivers/remoteproc/imx_dsp_rproc.c
++++ b/drivers/remoteproc/imx_dsp_rproc.c
+@@ -1184,6 +1184,15 @@ static int imx_dsp_suspend(struct device *dev)
+ if (rproc->state != RPROC_RUNNING)
+ goto out;
+
++ /*
++ * No channel available for sending messages;
++ * indicates no mailboxes present, so trigger PM runtime suspend
++ */
++ if (!priv->tx_ch) {
++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n");
++ goto out;
++ }
++
+ reinit_completion(&priv->pm_comp);
+
+ /* Tell DSP that suspend is happening */
+--
+2.51.0
+
--- /dev/null
+From afec3484c47211286b946e1285a350a38df2fbd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 11:07:55 +0000
+Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock`
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ]
+
+A potential circular locking dependency (ABBA deadlock) exists between
+`ec_dev->lock` and the clock framework's `prepare_lock`.
+
+The first order (A -> B) occurs when scp_ipi_send() is called while
+`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()):
+1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send().
+2. scp_ipi_send() calls clk_prepare_enable(), which acquires
+ `prepare_lock`.
+See #0 in the following example calling trace.
+(Lock Order: `ec_dev->lock` -> `prepare_lock`)
+
+The reverse order (B -> A) is more complex and has been observed
+(learned) by lockdep. It involves the clock prepare operation
+triggering power domain changes, which then propagates through sysfs
+and power supply uevents, eventually calling back into the ChromeOS EC
+driver and attempting to acquire `ec_dev->lock`:
+1. Something calls clk_prepare(), which acquires `prepare_lock`. It
+ then triggers genpd operations like genpd_runtime_resume(), which
+ takes `&genpd->mlock`.
+2. Power domain changes can trigger regulator changes; regulator
+ changes can then trigger device link changes; device link changes
+ can then trigger sysfs changes. Eventually, power_supply_uevent()
+ is called.
+3. This leads to calls like cros_usbpd_charger_get_prop(), which calls
+ cros_ec_cmd_xfer_status(), which then attempts to acquire
+ `ec_dev->lock`.
+See #1 ~ #6 in the following example calling trace.
+(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`)
+
+Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the
+remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock`
+is only acquired in prepare()/unprepare() callbacks. Since
+`ec_dev->lock` is not involved in the callbacks, the dependency loop is
+broken.
+
+This means the clock is always "prepared" when the SCP is running. The
+prolonged "prepared time" for the clock should be acceptable as SCP is
+designed to be a very power efficient processor. The power consumption
+impact can be negligible.
+
+A simplified calling trace reported by lockdep:
+> -> #6 (&ec_dev->lock)
+> cros_ec_cmd_xfer
+> cros_ec_cmd_xfer_status
+> cros_usbpd_charger_get_port_status
+> cros_usbpd_charger_get_prop
+> power_supply_get_property
+> power_supply_show_property
+> power_supply_uevent
+> dev_uevent
+> uevent_show
+> dev_attr_show
+> sysfs_kf_seq_show
+> kernfs_seq_show
+> -> #5 (kn->active#2)
+> kernfs_drain
+> __kernfs_remove
+> kernfs_remove_by_name_ns
+> sysfs_remove_file_ns
+> device_del
+> __device_link_del
+> device_links_driver_bound
+> -> #4 (device_links_lock)
+> device_link_remove
+> _regulator_put
+> regulator_put
+> -> #3 (regulator_list_mutex)
+> regulator_lock_dependent
+> regulator_disable
+> scpsys_power_off
+> _genpd_power_off
+> genpd_power_off
+> -> #2 (&genpd->mlock/1)
+> genpd_add_subdomain
+> pm_genpd_add_subdomain
+> scpsys_add_subdomain
+> scpsys_probe
+> -> #1 (&genpd->mlock)
+> genpd_runtime_resume
+> __rpm_callback
+> rpm_callback
+> rpm_resume
+> __pm_runtime_resume
+> clk_core_prepare
+> clk_prepare
+> -> #0 (prepare_lock)
+> clk_prepare
+> scp_ipi_send
+> scp_send_ipi
+> mtk_rpmsg_send
+> rpmsg_send
+> cros_ec_pkt_xfer_rpmsg
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++---------
+ drivers/remoteproc/mtk_scp_ipi.c | 4 ++--
+ 2 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
+index f98a11d4cf292..ae20d2221c8e0 100644
+--- a/drivers/remoteproc/mtk_scp.c
++++ b/drivers/remoteproc/mtk_scp.c
+@@ -282,7 +282,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+ struct mtk_scp *scp = priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return IRQ_NONE;
+@@ -290,7 +290,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+
+ scp->data->scp_irq_handler(scp);
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return IRQ_HANDLED;
+ }
+@@ -664,7 +664,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -679,7 +679,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+
+ ret = scp_elf_load_segments(rproc, fw);
+ leave:
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+@@ -690,14 +690,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+ }
+
+ ret = scp_ipi_init(scp, fw);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -708,7 +708,7 @@ static int scp_start(struct rproc *rproc)
+ struct scp_run *run = &scp->run;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -733,14 +733,14 @@ static int scp_start(struct rproc *rproc)
+ goto stop;
+ }
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver);
+
+ return 0;
+
+ stop:
+ scp->data->scp_reset_assert(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -908,7 +908,7 @@ static int scp_stop(struct rproc *rproc)
+ struct mtk_scp *scp = rproc->priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return ret;
+@@ -916,12 +916,29 @@ static int scp_stop(struct rproc *rproc)
+
+ scp->data->scp_reset_assert(scp);
+ scp->data->scp_stop(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return 0;
+ }
+
++static int scp_prepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ return clk_prepare(scp->clk);
++}
++
++static int scp_unprepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ clk_unprepare(scp->clk);
++ return 0;
++}
++
+ static const struct rproc_ops scp_ops = {
++ .prepare = scp_prepare,
++ .unprepare = scp_unprepare,
+ .start = scp_start,
+ .stop = scp_stop,
+ .load = scp_load,
+diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c
+index c068227e251e7..7a37e273b3af8 100644
+--- a/drivers/remoteproc/mtk_scp_ipi.c
++++ b/drivers/remoteproc/mtk_scp_ipi.c
+@@ -171,7 +171,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+ WARN_ON(len > scp_sizes->ipi_share_buffer_size) || WARN_ON(!buf))
+ return -EINVAL;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clock\n");
+ return ret;
+@@ -211,7 +211,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+
+ unlock_mutex:
+ mutex_unlock(&scp->send_lock);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 57d9fa398b07af9c87669564291973f6e56087a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 09:53:54 +0200
+Subject: Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
+
+From: Tomas Melin <tomas.melin@vaisala.com>
+
+[ Upstream commit c197179990124f991fca220d97fac56779a02c6d ]
+
+This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.
+
+OP-TEE logic in U-Boot automatically injects a reserved-memory
+node along with optee firmware node to kernel device tree.
+The injection logic is dependent on that there is no manually
+defined optee node. Having the node in zynqmp.dtsi effectively
+breaks OP-TEE's insertion of the reserved-memory node, causing
+memory access violations during runtime.
+
+Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/20251125-revert-zynqmp-optee-v1-1-d2ce4c0fcaf6@vaisala.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index e2ad5fb2cb0a4..0ff45540ca874 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -187,11 +187,6 @@ psci {
+ };
+
+ firmware {
+- optee: optee {
+- compatible = "linaro,optee-tz";
+- method = "smc";
+- };
+-
+ zynqmp_firmware: zynqmp-firmware {
+ compatible = "xlnx,zynqmp-firmware";
+ #power-domain-cells = <1>;
+--
+2.51.0
+
--- /dev/null
+From 29ff7d40ad0bdc26300855ccfd0a8f8045249a31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 17:16:51 +0100
+Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask"
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ]
+
+This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed.
+
+Almost every register in this chip can be customized via OTP
+memory. Somehow the value for R19, which decide if the flag is set
+on read or write operation, seems to have been overwritten for the chip
+the original patch were written for.
+
+Revert the change to follow the default behavior.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9052-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c
+index 80fc5c0cac2fb..be5f2b34e18ae 100644
+--- a/drivers/mfd/da9052-spi.c
++++ b/drivers/mfd/da9052-spi.c
+@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)
+ spi_set_drvdata(spi, da9052);
+
+ config = da9052_regmap_config;
+- config.write_flag_mask = 1;
++ config.read_flag_mask = 1;
+ config.reg_bits = 7;
+ config.pad_bits = 1;
+ config.val_bits = 8;
+--
+2.51.0
+
--- /dev/null
+From ec5f9ff04dd06a89c83d7c4dfba5af4781ca358f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 21:09:56 -0700
+Subject: riscv: vector: init vector context with proper vlenb
+
+From: Sergey Matyukevich <geomatsi@gmail.com>
+
+[ Upstream commit ef3ff40346db8476a9ef7269fc9d1837e7243c40 ]
+
+The vstate in thread_struct is zeroed when the vector context is
+initialized. That includes read-only register vlenb, which holds
+the vector register length in bytes. Zeroed state persists until
+mstatus.VS becomes 'dirty' and a context switch saves the actual
+hardware values.
+
+This can expose the zero vlenb value to the user-space in early
+debug scenarios, e.g. when ptrace attaches to a traced process
+early, before any vector instruction except the first one was
+executed.
+
+Fix this by specifying proper vlenb on vector context init.
+
+Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
+Reviewed-by: Andy Chiu <andybnac@gmail.com>
+Tested-by: Andy Chiu <andybnac@gmail.com>
+Link: https://patch.msgid.link/20251214163537.1054292-3-geomatsi@gmail.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/vector.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/vector.c b/arch/riscv/kernel/vector.c
+index a30fb2fb8a2b1..2afd5f926155b 100644
+--- a/arch/riscv/kernel/vector.c
++++ b/arch/riscv/kernel/vector.c
+@@ -99,8 +99,8 @@ static bool insn_is_vector(u32 insn_buf)
+ return false;
+ }
+
+-static int riscv_v_thread_zalloc(struct kmem_cache *cache,
+- struct __riscv_v_ext_state *ctx)
++static int riscv_v_thread_ctx_alloc(struct kmem_cache *cache,
++ struct __riscv_v_ext_state *ctx)
+ {
+ void *datap;
+
+@@ -110,13 +110,15 @@ static int riscv_v_thread_zalloc(struct kmem_cache *cache,
+
+ ctx->datap = datap;
+ memset(ctx, 0, offsetof(struct __riscv_v_ext_state, datap));
++ ctx->vlenb = riscv_v_vsize / 32;
++
+ return 0;
+ }
+
+ void riscv_v_thread_alloc(struct task_struct *tsk)
+ {
+ #ifdef CONFIG_RISCV_ISA_V_PREEMPTIVE
+- riscv_v_thread_zalloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate);
++ riscv_v_thread_ctx_alloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate);
+ #endif
+ }
+
+@@ -202,12 +204,14 @@ bool riscv_v_first_use_handler(struct pt_regs *regs)
+ * context where VS has been off. So, try to allocate the user's V
+ * context and resume execution.
+ */
+- if (riscv_v_thread_zalloc(riscv_v_user_cachep, ¤t->thread.vstate)) {
++ if (riscv_v_thread_ctx_alloc(riscv_v_user_cachep, ¤t->thread.vstate)) {
+ force_sig(SIGBUS);
+ return true;
+ }
++
+ riscv_v_vstate_on(regs);
+ riscv_v_vstate_set_restore(current, regs);
++
+ return true;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From bd996c395cf9542dbe5a9ee488d11bbd49a61eea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 13:47:33 +0100
+Subject: rnbd-srv: Zero the rsp buffer before using it
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ]
+
+Before using the data buffer to send back the response message, zero it
+completely. This prevents any stray bytes to be picked up by the client
+side when there the message is exchanged between different protocol
+versions.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-srv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
+index ba44018b00af5..0c7d40ed8d199 100644
+--- a/drivers/block/rnbd/rnbd-srv.c
++++ b/drivers/block/rnbd/rnbd-srv.c
+@@ -551,6 +551,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp,
+ {
+ struct block_device *bdev = file_bdev(sess_dev->bdev_file);
+
++ memset(rsp, 0, sizeof(*rsp));
++
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP);
+ rsp->device_id = cpu_to_le32(sess_dev->device_id);
+ rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev));
+@@ -657,6 +659,7 @@ static void process_msg_sess_info(struct rnbd_srv_session *srv_sess,
+
+ trace_process_msg_sess_info(srv_sess, sess_info_msg);
+
++ memset(rsp, 0, sizeof(*rsp));
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP);
+ rsp->ver = srv_sess->ver;
+ }
+--
+2.51.0
+
--- /dev/null
+From 40cb146d4d366b3b3a95ecefcf41eedd957de080 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 17:35:19 +0000
+Subject: rtc: interface: Alarm race handling should not discard preceding
+ error
+
+From: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+
+[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ]
+
+Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting
+alarm") should not discard any errors from the preceding validations.
+
+Prior to that commit, if the alarm feature was disabled, or the
+set_alarm failed, a meaningful error code would be returned to the
+caller for further action.
+
+After, more often than not, the __rtc_read_time will cause a success
+return code instead, misleading the caller.
+
+An example of this is when timer_enqueue is called for a rtc-abx080x
+device. Since that driver does not clear the alarm feature bit, but
+instead relies on the set_alarm operation to return invalid, the discard
+of the return code causes very different behaviour; i.e.
+ hwclock: select() to /dev/rtc0 to wait for clock tick timed out
+
+Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm")
+Signed-off-by: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+Reviewed-by: Esben Haabendal <esben@geanix.com>
+Tested-by: Nick Bowler <nbowler@draconx.ca>
+Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 39db12f267cc6..ee185710262ac 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ * are in, we can return -ETIME to signal that the timer has already
+ * expired, which is true in both cases.
+ */
+- if ((scheduled - now) <= 1) {
++ if (!err && (scheduled - now) <= 1) {
+ err = __rtc_read_time(rtc, &tm);
+ if (err)
+ return err;
+--
+2.51.0
+
--- /dev/null
+From b71f955d00011629c9424020791dc406de248218 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:53:45 +0000
+Subject: rtc: zynqmp: correct frequency value
+
+From: Tomas Melin <tomas.melin@vaisala.com>
+
+[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ]
+
+Fix calibration value in case a clock reference is provided.
+The actual calibration value written into register is
+frequency - 1.
+
+Reviewed-by: Harini T <harini.t@amd.com>
+Tested-by: Harini T <harini.t@amd.com>
+Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-zynqmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c
+index b6f96c10196ae..f49af7d963fbd 100644
+--- a/drivers/rtc/rtc-zynqmp.c
++++ b/drivers/rtc/rtc-zynqmp.c
+@@ -330,7 +330,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev)
+ &xrtcdev->freq);
+ if (ret)
+ xrtcdev->freq = RTC_CALIB_DEF;
++ } else {
++ xrtcdev->freq--;
+ }
++
+ ret = readl(xrtcdev->reg_base + RTC_CALIB_RD);
+ if (!ret)
+ writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR));
+--
+2.51.0
+
--- /dev/null
+From cdcc0887163246f605e37977bb3d1035c2f37edf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 10:14:12 +0100
+Subject: s390/perf: Disable register readout on sampling events
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ]
+
+Running commands
+ # ./perf record -IR0,R1 -a sleep 1
+extracts and displays register value of general purpose register r1 and r0.
+However the value displayed of any register is random and does not
+reflect the register value recorded at the time of the sample interrupt.
+
+The sampling device driver on s390 creates a very large buffer
+for the hardware to store the samples. Only when that large buffer
+gets full an interrupt is generated and many hundreds of sample
+entries are processed and copied to the kernel ring buffer and
+eventually get copied to the perf tool. It is during the copy
+to the kernel ring buffer that each sample is processed (on s390)
+and at that time the register values are extracted.
+This is not the original goal, the register values should be read
+when the samples are created not when the samples are copied to the
+kernel ring buffer.
+
+Prevent this event from being installed in the first place and
+return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index efdd6ead7ba81..23a2a49547b7a 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -856,7 +856,7 @@ static bool is_callchain_event(struct perf_event *event)
+ u64 sample_type = event->attr.sample_type;
+
+ return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER |
+- PERF_SAMPLE_STACK_USER);
++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER);
+ }
+
+ static int cpumsf_pmu_event_init(struct perf_event *event)
+--
+2.51.0
+
--- /dev/null
+From 0fd32afd75e32844dfac482bcfb3c1f4a788877e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 16:47:07 +0100
+Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ]
+
+Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
+to scripts/Makefile.extrawarn, since clang generates warnings for the
+dummy variable in typecheck():
+
+ CC arch/s390/purgatory/purgatory.o
+ arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
+ 221 | return psw_bits(regs->psw).pstate;
+ | ^
+ arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
+ 98 | typecheck(psw_t, __psw); \
+ | ^
+ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
+ 11 | typeof(x) __dummy2; \
+ | ^
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/purgatory/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
+index bdcf2a3b6c41b..df6636c8b492e 100644
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -21,6 +21,7 @@ KBUILD_CFLAGS += -fno-stack-protector
+ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+ KBUILD_CFLAGS += $(CLANG_FLAGS)
+ KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
+ KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS))
+
+ # Since we link purgatory with -r unresolved symbols are not checked, so we
+--
+2.51.0
+
--- /dev/null
+From 4ac703128bdcf7772782eb6aebad53fee80cfed5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 10:59:00 +0100
+Subject: sched/debug: Fix updating of ppos on server write ops
+
+From: Joel Fernandes <joelagnelf@nvidia.com>
+
+[ Upstream commit 6080fb211672aec6ce8f2f5a2e0b4eae736f2027 ]
+
+Updating "ppos" on error conditions does not make much sense. The pattern
+is to return the error code directly without modifying the position, or
+modify the position on success and return the number of bytes written.
+
+Since on success, the return value of apply is 0, there is no point in
+modifying ppos either. Fix it by removing all this and just returning
+error code or number of bytes written on success.
+
+Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Juri Lelli <juri.lelli@redhat.com>
+Reviewed-by: Andrea Righi <arighi@nvidia.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Tested-by: Christian Loehle <christian.loehle@arm.com>
+Link: https://patch.msgid.link/20260126100050.3854740-3-arighi@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 72958b31549fb..7d14e9fa53ac3 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -347,8 +347,8 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
+ long cpu = (long) ((struct seq_file *) filp->private_data)->private;
+ struct rq *rq = cpu_rq(cpu);
+ u64 runtime, period;
++ int retval = 0;
+ size_t err;
+- int retval;
+ u64 value;
+
+ err = kstrtoull_from_user(ubuf, cnt, 10, &value);
+@@ -384,8 +384,6 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
+ }
+
+ retval = dl_server_apply_params(&rq->fair_server, runtime, period, 0);
+- if (retval)
+- cnt = retval;
+
+ if (!runtime)
+ printk_deferred("Fair server disabled in CPU %d, system may crash due to starvation.\n",
+@@ -393,6 +391,9 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
+
+ if (rq->cfs.h_nr_queued)
+ dl_server_start(&rq->fair_server);
++
++ if (retval < 0)
++ return retval;
+ }
+
+ *ppos += cnt;
+--
+2.51.0
+
--- /dev/null
+From 199c02500d8c071274ccf6283b1ccb01d46f4569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:33:15 +0100
+Subject: scsi: buslogic: Reduce stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ]
+
+Some randconfig builds run into excessive stack usage with gcc-14 or
+higher, which use __attribute__((cold)) where earlier versions did not do
+that:
+
+drivers/scsi/BusLogic.c: In function 'blogic_init':
+drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
+
+The problem is that a lot of code gets inlined into blogic_init() here. Two
+functions stick out, but they are a bit different:
+
+ - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel
+ stack, which is a problem in combination with other functions that also
+ do. Marking this one as noinline means that the stack slots get get
+ reused between function calls
+
+ - blogic_reportconfig() has a few large variables, but whenever it is not
+ inlined into its caller, the compiler is actually smart enough to reuse
+ stack slots for these automatically, so marking it as noinline saves
+ most of the stack space by itself.
+
+The combination of both of these should avoid the problem entirely.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/BusLogic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index 2135a2b3e2d00..c17b09d966f14 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -920,7 +920,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter)
+ a particular probe order.
+ */
+
+-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter)
++static noinline_for_stack void __init
++blogic_init_probeinfo_list(struct blogic_adapter *adapter)
+ {
+ /*
+ If a PCI BIOS is present, interrogate it for MultiMaster and
+@@ -1690,7 +1691,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter)
+ blogic_reportconfig reports the configuration of Host Adapter.
+ */
+
+-static bool __init blogic_reportconfig(struct blogic_adapter *adapter)
++static noinline_for_stack bool __init
++blogic_reportconfig(struct blogic_adapter *adapter)
+ {
+ unsigned short alltgt_mask = (1 << adapter->maxdev) - 1;
+ unsigned short sync_ok, fast_ok;
+--
+2.51.0
+
--- /dev/null
+From 304e7a4fcbdf875b103a7195707bad3b5ac55565 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 11:45:26 +0900
+Subject: scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace
+ event
+
+From: Keita Morisaki <keita.morisaki@tier4.jp>
+
+[ Upstream commit 9672ed3de7d772ceddd713c769c05e832fc69bae ]
+
+The ufs_mtk_clk_scale() trace event currently stores the address of the
+name string directly via __field(const char *, name). This pointer may
+become invalid after the module is unloaded, causing page faults when the
+trace buffer is subsequently accessed.
+
+This can occur because the MediaTek UFS driver can be configured as a
+loadable module (tristate in Kconfig), meaning the name string passed to
+the trace event may reside in module memory that becomes invalid after
+module unload.
+
+Fix this by using __string() and __assign_str() to copy the string contents
+into the ring buffer instead of storing the pointer. This ensures the trace
+data remains valid regardless of module state.
+
+This change increases the memory usage for each ftrace entry by a few bytes
+(clock names are typically 7-15 characters like "ufs_sel" or
+"ufs_sel_max_src") compared to storing an 8-byte pointer.
+
+Note that this change does not affect anything unless all of the following
+conditions are met:
+
+ - CONFIG_SCSI_UFS_MEDIATEK is enabled
+
+ - ftrace tracing is enabled
+
+ - The ufs_mtk_clk_scale event is enabled in ftrace
+
+Signed-off-by: Keita Morisaki <keita.morisaki@tier4.jp>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://patch.msgid.link/20260202024526.122515-1-keita.morisaki@tier4.jp
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek-trace.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek-trace.h b/drivers/ufs/host/ufs-mediatek-trace.h
+index b5f2ec3140748..0df8ac843379a 100644
+--- a/drivers/ufs/host/ufs-mediatek-trace.h
++++ b/drivers/ufs/host/ufs-mediatek-trace.h
+@@ -33,19 +33,19 @@ TRACE_EVENT(ufs_mtk_clk_scale,
+ TP_ARGS(name, scale_up, clk_rate),
+
+ TP_STRUCT__entry(
+- __field(const char*, name)
++ __string(name, name)
+ __field(bool, scale_up)
+ __field(unsigned long, clk_rate)
+ ),
+
+ TP_fast_assign(
+- __entry->name = name;
++ __assign_str(name);
+ __entry->scale_up = scale_up;
+ __entry->clk_rate = clk_rate;
+ ),
+
+ TP_printk("ufs: clk (%s) scaled %s @ %lu",
+- __entry->name,
++ __get_str(name),
+ __entry->scale_up ? "up" : "down",
+ __entry->clk_rate)
+ );
+--
+2.51.0
+
--- /dev/null
+From 710fb9164c82d1a2c318f2df74f0cb21eb6a9a5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:28 +0530
+Subject: serial: 8250: 8250_omap.c: Add support for handling UART error
+ conditions
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit 623b07b370e9963122d167e04fdc1dc713ebfbaf ]
+
+The DMA IRQ handler does not accounts for the overrun(OE) or any other
+errors being reported by the IP before triggering a DMA transaction which
+leads to the interrupts not being handled resulting into an IRQ storm.
+
+The way to handle OE is to:
+1. Reset the RX FIFO.
+2. Read the UART_RESUME register, which clears the internal flag
+
+Earlier, the driver issued DMA transations even in case of OE which shouldn't
+be done according to the OE handling mechanism mentioned above, as we are
+resetting the FIFO's, refer section: "12.1.6.4.8.1.3.6 Overrun During
+Receive" [0].
+
+[0] https://www.ti.com/lit/pdf/spruiu1
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-2-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 4f57991944dc4..3f85270d16c45 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -98,6 +98,9 @@
+ #define OMAP_UART_REV_52 0x0502
+ #define OMAP_UART_REV_63 0x0603
+
++/* Resume register */
++#define UART_OMAP_RESUME 0x0B
++
+ /* Interrupt Enable Register 2 */
+ #define UART_OMAP_IER2 0x1B
+ #define UART_OMAP_IER2_RHR_IT_DIS BIT(2)
+@@ -117,7 +120,6 @@
+ /* Timeout low and High */
+ #define UART_OMAP_TO_L 0x26
+ #define UART_OMAP_TO_H 0x27
+-
+ struct omap8250_priv {
+ void __iomem *membase;
+ int line;
+@@ -1268,6 +1270,20 @@ static u16 omap_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, u16 status
+ return status;
+ }
+
++static void am654_8250_handle_uart_errors(struct uart_8250_port *up, u8 iir, u16 status)
++{
++ if (status & UART_LSR_OE) {
++ serial8250_clear_and_reinit_fifos(up);
++ serial_in(up, UART_LSR);
++ serial_in(up, UART_OMAP_RESUME);
++ } else {
++ if (status & (UART_LSR_FE | UART_LSR_PE | UART_LSR_BI))
++ serial_in(up, UART_RX);
++ if (iir & UART_IIR_XOFF)
++ serial_in(up, UART_IIR);
++ }
++}
++
+ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
+ u16 status)
+ {
+@@ -1278,7 +1294,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
+ * Queue a new transfer if FIFO has data.
+ */
+ if ((status & (UART_LSR_DR | UART_LSR_BI)) &&
+- (up->ier & UART_IER_RDI)) {
++ (up->ier & UART_IER_RDI) && !(status & UART_LSR_OE)) {
++ am654_8250_handle_uart_errors(up, iir, status);
+ omap_8250_rx_dma(up);
+ serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE);
+ } else if ((iir & 0x3f) == UART_IIR_RX_TIMEOUT) {
+@@ -1294,6 +1311,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
+ serial_out(up, UART_OMAP_EFR2, 0x0);
+ up->ier |= UART_IER_RLSI | UART_IER_RDI;
+ serial_out(up, UART_IER, up->ier);
++ } else {
++ am654_8250_handle_uart_errors(up, iir, status);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 18ba7a8df0f4333d07054340a85a4ab515657b2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:29 +0530
+Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
+ termination is done
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ]
+
+Clear rx_running flag only after DMA teardown polling completes. In the
+previous implementation the flag was being cleared while hardware teardown
+was still in progress, creating a mismatch between software state
+(flag = 0, "ready") and hardware state (still terminating).
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 3f85270d16c45..0f4ce0c691147 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -936,7 +936,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+
+ cookie = dma->rx_cookie;
+- dma->rx_running = 0;
+
+ /* Re-enable RX FIFO interrupt now that transfer is complete */
+ if (priv->habit & UART_HAS_RHR_IT_DIS) {
+@@ -970,6 +969,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+ ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+
++ dma->rx_running = 0;
+ p->port.icount.rx += ret;
+ p->port.icount.buf_overrun += count - ret;
+ out:
+--
+2.51.0
+
--- /dev/null
+From 6293bb26bd8d7a813070a300a4e0839e652282d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 17:54:25 +0300
+Subject: serial: 8250_dw: handle clock enable errors in runtime_resume
+
+From: Artem Shimko <a.shimko.dev@gmail.com>
+
+[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ]
+
+Add error checking for clk_prepare_enable() calls in
+dw8250_runtime_resume(). Currently if either clock fails to enable,
+the function returns success while leaving clocks in inconsistent state.
+
+This change implements comprehensive error handling by checking the return
+values of both clk_prepare_enable() calls. If the second clock enable
+operation fails after the first clock has already been successfully
+enabled, the code now properly cleans up by disabling and unpreparing
+the first clock before returning. The error code is then propagated to
+the caller, ensuring that clock enable failures are properly reported
+rather than being silently ignored.
+
+Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
+Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index 83d186c038cd9..f17dc3de020c1 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -718,11 +718,18 @@ static int dw8250_runtime_suspend(struct device *dev)
+
+ static int dw8250_runtime_resume(struct device *dev)
+ {
++ int ret;
+ struct dw8250_data *data = dev_get_drvdata(dev);
+
+- clk_prepare_enable(data->pclk);
++ ret = clk_prepare_enable(data->pclk);
++ if (ret)
++ return ret;
+
+- clk_prepare_enable(data->clk);
++ ret = clk_prepare_enable(data->clk);
++ if (ret) {
++ clk_disable_unprepare(data->pclk);
++ return ret;
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
asoc-dt-bindings-asahi-kasei-ak4458-set-unevaluatedproperties-false.patch
asoc-dt-bindings-asahi-kasei-ak4458-fix-the-supply-names.patch
asoc-dt-bindings-asahi-kasei-ak5558-fix-the-supply-names.patch
+perf-test-stat-update-test-expectations-and-events.patch
+perf-test-stat-tests-fix-for-virtualized-machines.patch
+perf-unwind-libdw-fix-invalid-reference-counts.patch
+perf-callchain-fix-srcline-printing-with-inlines.patch
+libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch
+perf-maps-fix-reference-count-leak-in-maps__find_ams.patch
+perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch
+perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch
+libperf-don-t-remove-g-when-extra_cflags-are-used.patch
+libperf-build-always-place-libperf-includes-first.patch
+rtc-interface-alarm-race-handling-should-not-discard.patch
+statmount-permission-check-should-return-eperm.patch
+audit-add-fchmodat2-to-change-attributes-class.patch
+hfsplus-fix-volume-corruption-issue-for-generic-498.patch
+fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch
+audit-add-missing-syscalls-to-read-class.patch
+hfsplus-pretend-special-inodes-as-regular-files.patch
+i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch
+i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch
+minix-add-required-sanity-checking-to-minix_check_su.patch
+dlm-validate-length-in-dlm_search_rsb_tree.patch
+btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch
+btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch
+smb-client-add-proper-locking-around-ses-iface_last_.patch
+gfs2-fiemap-page-fault-fix.patch
+smb-client-prevent-races-in-query_interfaces.patch
+tools-power-cpupower-reset-errno-before-strtoull.patch
+s390-purgatory-add-wno-default-const-init-unsafe-to-.patch
+perf-arm-cmn-support-cmn-600ae.patch
+arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch
+rnbd-srv-zero-the-rsp-buffer-before-using-it.patch
+x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch
+efi-cper-don-t-dump-the-entire-memory-region.patch
+apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch
+apei-ghes-arm-processor-error-don-t-go-past-allocate.patch
+efi-cper-don-t-go-past-the-arm-processor-cper-record.patch
+acpi-processor-fix-null-pointer-dereference-in-acpi_.patch
+acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch
+acpica-abort-aml-bytecode-execution-when-executing-a.patch
+powercap-intel_rapl-add-pl4-support-for-ice-lake.patch
+alpha-fix-user-space-corruption-during-memory-compac.patch
+md-cluster-fix-null-pointer-dereference-in-process_m.patch
+cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch
+s390-perf-disable-register-readout-on-sampling-event.patch
+perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch
+acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch
+acpi-battery-fix-incorrect-charging-status-when-curr.patch
+xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch
+blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch
+block-decouple-secure-erase-size-limit-from-discard-.patch
+sparc-synchronize-user-stack-on-fork-and-clone.patch
+sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch
+bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch
+perf-x86-msr-add-airmont-np.patch
+perf-x86-cstate-add-airmont-np.patch
+bpf-crypto-use-the-correct-destructor-kfunc-type.patch
+bpf-recognize-special-arithmetic-shift-in-the-verifi.patch
+clocksource-drivers-sh_tmu-always-leave-device-runni.patch
+clocksource-drivers-timer-integrator-ap-add-missing-.patch
+pci-msi-unmap-msi-x-region-on-error.patch
+crypto-hisilicon-qm-move-the-barrier-before-writing-.patch
+mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch
+char-tpm-cr50-remove-irqf_oneshot.patch
+sched-debug-fix-updating-of-ppos-on-server-write-ops.patch
+pstore-ram_core-fix-incorrect-success-return-when-vm.patch
+firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch
+revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch
+arm64-tegra-smaug-add-usb-role-switch-support.patch
+parisc-prevent-interrupts-during-reboot.patch
+drm-display-dp_mst-add-protection-against-0-vcpi.patch
+gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch
+drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch
+drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch
+spi-geni-qcom-initialize-mode-related-registers-to-0.patch
+spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch
+drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch
+asoc-sof-ipc4-support-for-sending-payload-along-with.patch
+media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch
+spi-stm32-fix-overrun-issue-at-8bpw.patch
+drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch
+media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch
+media-omap3isp-isppreview-always-clamp-in-preview_tr.patch
+media-omap3isp-set-initial-format.patch
+media-chips-media-wave5-fix-conditional-in-start_str.patch
+media-chips-media-wave5-process-ready-frames-when-cm.patch
+media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch
+drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch
+drm-amd-display-fix-dsc-edp-issue.patch
+drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch
+drm-amd-display-add-signal-type-check-for-dcn401-get.patch
+hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch
+drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch
+drm-amd-display-only-power-down-dig-on-phy-endpoints.patch
+drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch
+asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch
+asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch
+spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch
+media-amphion-clear-last_buffer_dequeued-flag-for-de.patch
+drm-panel-fix-a-possible-null-pointer-dereference-in.patch
+media-adv7180-fix-frame-interval-in-progressive-mode.patch
+media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch
+media-solo6x10-check-for-out-of-bounds-chip_id.patch
+media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch
+media-v4l2-async-fix-error-handling-on-steps-after-f.patch
+media-mt9m114-avoid-a-reset-low-spike-during-probe.patch
+media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch
+media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch
+media-ipu6-close-firmware-streams-on-streaming-enabl.patch
+media-ipu6-always-close-firmware-stream.patch
+alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch
+drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch
+drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch
+drm-account-property-blob-allocations-to-memcg.patch
+hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch
+virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch
+asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch
+pci-add-intel-nova-lake-audio-device-id.patch
+drm-amd-display-disable-fec-when-powering-down-encod.patch
+drm-amd-display-ensure-link-output-is-disabled-in-ba.patch
+drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch
+drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch
+drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch
+media-rkisp1-fix-filter-mode-register-configuration.patch
+hid-multitouch-add-egalaxtouch-exc3188-support.patch
+hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch
+alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch
+alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch
+gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch
+asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch
+spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch
+drm-amd-display-fix-gfx12-family-constant-checks.patch
+drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch
+asoc-codecs-max98390-check-return-value-of-devm_gpio.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch
+hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch
+hwmon-f71882fg-add-f81968-support.patch
+hid-logitech-hidpp-add-support-for-logitech-k980.patch
+asoc-es8328-add-error-unwind-in-resume.patch
+modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch
+power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch
+asoc-sof-intel-hda-fix-null-pointer-dereference.patch
+spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch
+asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch
+alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch
+alsa-mixer-oss-add-card-disconnect-checkpoints.patch
+alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch
+jfs-add-missing-set_freezable-for-freezable-kthread.patch
+jfs-nlink-overflow-in-jfs_rename.patch
+wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch
+wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch
+wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch
+wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch
+wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch
+wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch
+wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch
+dm-replace-eexist-with-ebusy.patch
+dm-remove-fake-timeout-to-avoid-leak-request.patch
+iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch
+net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch
+wifi-libertas-fix-warning-in-usb_tx_block.patch
+iommu-amd-move-wait_on_sem-out-of-spinlock.patch
+wifi-rtw89-mac-correct-page-number-for-csi-response.patch
+wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch
+wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch
+wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch
+wifi-ath12k-fix-preferred-hardware-mode-calculation.patch
+wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch
+ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch
+ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch
+ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch
+ext4-mark-group-add-fast-commit-ineligible.patch
+ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch
+ext4-mark-group-extend-fast-commit-ineligible.patch
+ext4-use-reserved-metadata-blocks-when-splitting-ext.patch
+netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch
+netfilter-xt_tcpmss-check-remaining-length-before-re.patch
+openrisc-define-arch-specific-version-of-nop.patch
+net-usb-r8152-fix-transmit-queue-timeout.patch
+wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch
+wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch
+wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch
+net-rds-no-shortcut-out-of-rds_conn_error.patch
+ext4-propagate-flags-to-convert_initialized_extent.patch
+gro-change-the-bug_on-in-gro_pull_from_frag0.patch
+ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch
+net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch
+ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch
+bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch
+bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch
+bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch
+bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch
+bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch
+octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch
+net-sfp-add-quirk-for-lantech-8330-265d.patch
+wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch
+wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch
+bnxt_en-allow-ntuple-filters-for-drops.patch
+net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch
+vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch
+net-rds-clear-reconnect-pending-bit.patch
+pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch
+pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch
+pci-fix-pci_slot_lock-device-locking.patch
+pci-enable-acs-after-configuring-iommu-for-of-platfo.patch
+pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch
+pci-mark-nvidia-gb10-to-avoid-bus-reset.patch
+myri10ge-avoid-uninitialized-variable-use.patch
+nfc-nxp-nci-remove-interrupt-trigger-type.patch
+rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch
+ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch
+hisi_acc_vfio_pci-update-status-after-ras-error.patch
+scsi-buslogic-reduce-stack-usage.patch
+vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch
+scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch
+riscv-vector-init-vector-context-with-proper-vlenb.patch
+tracing-fix-false-sharing-in-hwlat-get_sample.patch
+remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch
+mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch
+mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch
+mailbox-sprd-mask-interrupts-that-are-not-handled.patch
+remoteproc-mediatek-break-lock-dependency-to-prepare.patch
+mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch
+clk-microchip-core-correct-return-value-on-_get_pare.patch
+hid-i2c-hid-add-focaltech-ft8112.patch
+m68k-nommu-fix-memmove-with-differently-aligned-src-.patch
+9p-xen-protect-xen_9pfs_front_free-against-concurren.patch
+dmaengine-stm32-dma3-use-module_platform_driver.patch
+soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch
+soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch
+staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch
+serial-8250_dw-handle-clock-enable-errors-in-runtime.patch
+usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch
+fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch
+most-core-fix-resource-leak-in-most_register_interfa.patch
+dmaengine-sun6i-choose-appropriate-burst-length-unde.patch
+dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch
+phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch
+phy-cadence-torrent-restore-parent-clock-for-refclk-.patch
+misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch
+misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch
+usb-gadget-f_fs-fix-dma-buf-out-queues.patch
+usb-gadget-f_fs-fix-ioctl-error-handling.patch
+usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch
+staging-rtl8723bs-fix-memory-leak-on-failure-path.patch
+serial-8250-8250_omap.c-add-support-for-handling-uar.patch
+serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch
+fix-it87_wdt-early-reboot-by-reporting-running-timer.patch
+binder-don-t-use-pk-through-printk.patch
+watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch
+phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch
+phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch
+revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch
+mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch
+iio-use-irqf_no_thread.patch
+iio-magnetometer-remove-irqf_oneshot.patch
+mips-loongson-make-cpumask_of_node-robust-against-nu.patch
+fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch
+fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch
+fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch
+fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch
+fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch
+ceph-supply-snapshot-context-in-ceph_uninline_data.patch
+libceph-define-and-enforce-ceph_max_key_len.patch
+thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch
+acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch
+include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch
+arm-9467-1-mm-don-t-use-pk-through-printk.patch
+drm-amd-display-fix-writeback-on-dcn-3.2.patch
+drm-amd-display-fix-system-resume-lag-issue.patch
+drm-amd-display-avoid-updating-surface-with-the-same.patch
+drm-amdgpu-adjust-usleep_range-in-fence-wait.patch
+alsa-usb-audio-update-the-number-of-packets-properly.patch
+drm-amdgpu-add-hainan-clock-adjustment.patch
+drm-amd-display-bypass-post-csc-for-additional-color.patch
+spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch
+drm-radeon-add-hainan-clock-adjustment.patch
+alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch
+btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch
+arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch
+drm-amd-display-remove-conditional-for-shaper-3dlut-.patch
+rtc-zynqmp-correct-frequency-value.patch
+ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch
+ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch
--- /dev/null
+From ba7c36c253566c2f4b3743179854c4406ad712d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 14:54:45 -0300
+Subject: smb: client: add proper locking around ses->iface_last_update
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ]
+
+There is a missing ses->iface_lock in cifs_setup_session,
+around ses->iface_last_update.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/connect.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
+index 3b0f63e0a2534..3c83bda8298ee 100644
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -4068,7 +4068,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
+ ses->ses_status = SES_IN_SETUP;
+
+ /* force iface_list refresh */
++ spin_lock(&ses->iface_lock);
+ ses->iface_last_update = 0;
++ spin_unlock(&ses->iface_lock);
+ }
+ spin_unlock(&ses->ses_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 4449b922e466271db605e152ea0514aa2c310c15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 14:54:44 -0300
+Subject: smb: client: prevent races in ->query_interfaces()
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ]
+
+It was possible for two query interface works to be concurrently trying
+to update the interfaces.
+
+Prevent this by checking and updating iface_last_update under
+iface_lock.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index 4e7e6ad79966e..300573be10bc1 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -637,13 +637,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ p = buf;
+
+ spin_lock(&ses->iface_lock);
+- /* do not query too frequently, this time with lock held */
+- if (ses->iface_last_update &&
+- time_before(jiffies, ses->iface_last_update +
+- (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
+- spin_unlock(&ses->iface_lock);
+- return 0;
+- }
+
+ /*
+ * Go through iface_list and mark them as inactive
+@@ -666,7 +659,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ "Empty network interface list returned by server %s\n",
+ ses->server->hostname);
+ rc = -EOPNOTSUPP;
+- ses->iface_last_update = jiffies;
+ goto out;
+ }
+
+@@ -795,8 +787,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ + sizeof(p->Next) && p->Next))
+ cifs_dbg(VFS, "%s: incomplete interface info\n", __func__);
+
+- ses->iface_last_update = jiffies;
+-
+ out:
+ /*
+ * Go through the list again and put the inactive entries
+@@ -825,10 +815,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_
+ struct TCP_Server_Info *pserver;
+
+ /* do not query too frequently */
++ spin_lock(&ses->iface_lock);
+ if (ses->iface_last_update &&
+ time_before(jiffies, ses->iface_last_update +
+- (SMB_INTERFACE_POLL_INTERVAL * HZ)))
++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
++ spin_unlock(&ses->iface_lock);
+ return 0;
++ }
++
++ ses->iface_last_update = jiffies;
++
++ spin_unlock(&ses->iface_lock);
+
+ rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
+ FSCTL_QUERY_NETWORK_INTERFACE_INFO,
+--
+2.51.0
+
--- /dev/null
+From 0b3a0c892aa166d7d96ca170c9e00e8e103e5de3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:09:47 +0200
+Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of
+ NUC15)
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ]
+
+Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and
+LAPBC710.
+
+Link: https://github.com/thesofproject/linux/issues/5529
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/dmi-quirks.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
+index 91ab97a456fa9..5854218e1a274 100644
+--- a/drivers/soundwire/dmi-quirks.c
++++ b/drivers/soundwire/dmi-quirks.c
+@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
+ },
+ .driver_data = (void *)intel_tgl_bios,
+ },
++ {
++ /*
++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County'
++ * LAPBC510 and LAPBC710)
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"),
++ },
++ .driver_data = (void *)intel_tgl_bios,
++ },
+ {
+ /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 30a0cee7be3d6c184f9ece6fade4db7496c680ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:17:29 +0000
+Subject: soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
+
+From: Maciej Strozek <mstrozek@opensource.cirrus.com>
+
+[ Upstream commit f87e5575a6bd1925cd55f500b61b661724372e5f ]
+
+Add cs42l45 to the wake_capable_list because it can generate jack events
+whilst the bus is stopped.
+
+Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20251215151729.3911077-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/intel_auxdevice.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soundwire/intel_auxdevice.c b/drivers/soundwire/intel_auxdevice.c
+index ae689d5d1ab9e..61f07d2d75efc 100644
+--- a/drivers/soundwire/intel_auxdevice.c
++++ b/drivers/soundwire/intel_auxdevice.c
+@@ -48,6 +48,7 @@ struct wake_capable_part {
+
+ static struct wake_capable_part wake_capable_list[] = {
+ {0x01fa, 0x4243},
++ {0x01fa, 0x4245},
+ {0x025d, 0x5682},
+ {0x025d, 0x700},
+ {0x025d, 0x711},
+--
+2.51.0
+
--- /dev/null
+From e72a46db5b8a36767e295e25eed3e0107ca7bdd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 13:40:29 +0000
+Subject: sparc: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ]
+
+Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros").
+
+glibc-2.42 drops the legacy termio struct, but the ioctls.h header still
+defines some TC* constants in terms of termio (via sizeof). Hardcode the
+values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h
+index 7fd2f5873c9e7..a8bbdf9877a41 100644
+--- a/arch/sparc/include/uapi/asm/ioctls.h
++++ b/arch/sparc/include/uapi/asm/ioctls.h
+@@ -5,10 +5,10 @@
+ #include <asm/ioctl.h>
+
+ /* Big T */
+-#define TCGETA _IOR('T', 1, struct termio)
+-#define TCSETA _IOW('T', 2, struct termio)
+-#define TCSETAW _IOW('T', 3, struct termio)
+-#define TCSETAF _IOW('T', 4, struct termio)
++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */
++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */
++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */
++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */
+ #define TCSBRK _IO('T', 5)
+ #define TCXONC _IO('T', 6)
+ #define TCFLSH _IO('T', 7)
+--
+2.51.0
+
--- /dev/null
+From da3e54a446eb5385b9058c131d7be05ae03e152f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:47:52 +0100
+Subject: sparc: Synchronize user stack on fork and clone
+
+From: Andreas Larsson <andreas@gaisler.com>
+
+[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ]
+
+Flush all uncommitted user windows before calling the generic syscall
+handlers for clone, fork, and vfork.
+
+Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the
+arch-specific syscall wrappers for these syscalls will attempt to flush
+all windows (including user windows).
+
+In the window overflow trap handlers on both SPARC{32|64},
+if the window can't be stored (i.e due to MMU related faults) the routine
+backups the user window and increments a thread counter (wsaved).
+
+By adding a synchronization point after the flush attempt, when fault
+handling is enabled, any uncommitted user windows will be flushed.
+
+Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394
+Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++--------------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
+index 0442ab00518d3..7d69877511fac 100644
+--- a/arch/sparc/kernel/process.c
++++ b/arch/sparc/kernel/process.c
+@@ -17,14 +17,18 @@
+
+ asmlinkage long sparc_fork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+ struct kernel_clone_args args = {
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs)
+
+ asmlinkage long sparc_vfork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+-
+ struct kernel_clone_args args = {
+ .flags = CLONE_VFORK | CLONE_VM,
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs)
+
+ asmlinkage long sparc_clone(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
+- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ unsigned long orig_i1;
++ unsigned int flags;
+ long ret;
++ struct kernel_clone_args args = {0};
+
+- struct kernel_clone_args args = {
+- .flags = (flags & ~CSIGNAL),
+- .exit_signal = (flags & CSIGNAL),
+- .tls = regs->u_regs[UREG_I3],
+- };
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ args.flags = (flags & ~CSIGNAL);
++ args.exit_signal = (flags & CSIGNAL);
++ args.tls = regs->u_regs[UREG_I3];
+
+ #ifdef CONFIG_COMPAT
+ if (test_thread_flag(TIF_32BIT)) {
+--
+2.51.0
+
--- /dev/null
+From 92c804ca21e16e2ef6b9992c8ca416c8e703b108 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 21:58:52 +0530
+Subject: spi: geni-qcom: Fix abort sequence execution for serial engine errors
+
+From: Praveen Talari <praveen.talari@oss.qualcomm.com>
+
+[ Upstream commit 96e041647bb0f9d92f95df1d69cb7442d7408b79 ]
+
+The driver currently skips the abort sequence for target mode when serial
+engine errors occur. This leads to improper error recovery as the serial
+engine may remain in an undefined state without proper cleanup, potentially
+causing subsequent operations to fail or behave unpredictably.
+
+Fix this by ensuring the abort sequence and DMA reset always execute during
+error recovery, as both are required for proper serial engine error
+handling.
+
+Co-developed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260204162854.1206323-3-praveen.talari@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 24 ++++++++++--------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 05e1b9ae0ed8b..38606c9e12ee8 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -160,24 +160,20 @@ static void handle_se_timeout(struct spi_controller *spi,
+ xfer = mas->cur_xfer;
+ mas->cur_xfer = NULL;
+
+- if (spi->target) {
+- /*
+- * skip CMD Cancel sequnece since spi target
+- * doesn`t support CMD Cancel sequnece
+- */
++ /* The controller doesn't support the Cancel commnand in target mode */
++ if (!spi->target) {
++ reinit_completion(&mas->cancel_done);
++ geni_se_cancel_m_cmd(se);
++
+ spin_unlock_irq(&mas->lock);
+- goto reset_if_dma;
+- }
+
+- reinit_completion(&mas->cancel_done);
+- geni_se_cancel_m_cmd(se);
+- spin_unlock_irq(&mas->lock);
++ time_left = wait_for_completion_timeout(&mas->cancel_done, HZ);
++ if (time_left)
++ goto reset_if_dma;
+
+- time_left = wait_for_completion_timeout(&mas->cancel_done, HZ);
+- if (time_left)
+- goto reset_if_dma;
++ spin_lock_irq(&mas->lock);
++ }
+
+- spin_lock_irq(&mas->lock);
+ reinit_completion(&mas->abort_done);
+ geni_se_abort_m_cmd(se);
+ spin_unlock_irq(&mas->lock);
+--
+2.51.0
+
--- /dev/null
+From 164d4b7e4989d3f93aa472d3dde377a18e66cda5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:01 -0500
+Subject: spi-geni-qcom: initialize mode related registers to 0
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ]
+
+setup_fifo_params assumes these will be zero, it won't write these
+registers if the initial mode is zero.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 768d7482102ad..d2f7a46c0910c 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -718,6 +718,12 @@ static int spi_geni_init(struct spi_geni_master *mas)
+ case 0:
+ mas->cur_xfer_mode = GENI_SE_FIFO;
+ geni_se_select_mode(se, GENI_SE_FIFO);
++ /* setup_fifo_params assumes that these registers start with a zero value */
++ writel(0, se->base + SE_SPI_LOOPBACK);
++ writel(0, se->base + SE_SPI_DEMUX_SEL);
++ writel(0, se->base + SE_SPI_CPHA);
++ writel(0, se->base + SE_SPI_CPOL);
++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV);
+ ret = 0;
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From aa61d28fdb132ac76e41d0415f2e45f8f962bd3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:00 -0500
+Subject: spi-geni-qcom: use xfer->bits_per_word for can_dma()
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit fb2bbe3838728f572485706677590e4fc41eec5c ]
+
+mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word
+when can_dma() is called. Use the right value instead.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index d2f7a46c0910c..05e1b9ae0ed8b 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -548,10 +548,10 @@ static u32 get_xfer_len_in_words(struct spi_transfer *xfer,
+ {
+ u32 len;
+
+- if (!(mas->cur_bits_per_word % MIN_WORD_LEN))
+- len = xfer->len * BITS_PER_BYTE / mas->cur_bits_per_word;
++ if (!(xfer->bits_per_word % MIN_WORD_LEN))
++ len = xfer->len * BITS_PER_BYTE / xfer->bits_per_word;
+ else
+- len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1);
++ len = xfer->len / (xfer->bits_per_word / BITS_PER_BYTE + 1);
+ len &= TRANS_LEN_MSK;
+
+ return len;
+@@ -571,7 +571,7 @@ static bool geni_can_dma(struct spi_controller *ctlr,
+ return true;
+
+ len = get_xfer_len_in_words(xfer, mas);
+- fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / mas->cur_bits_per_word;
++ fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / xfer->bits_per_word;
+
+ if (len > fifo_size)
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 90e773477843f41804aacf6b470cbaeeb7a479ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 18:18:01 +0100
+Subject: spi: spi-mem: Limit octal DTR constraints to octal DTR situations
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9 ]
+
+In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is
+considered requiring a duplicated command opcode. This is wrong as this
+constraint only applies to octal DTR operations (8D-8D-8D).
+
+Narrow the application of this constraint to the concerned bus
+interface.
+
+Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2,
+4} would benefit from this check either as there is only in octal DTR
+mode that a single clock edge would be enough to transmit the full
+opcode.
+
+Make sure the constraint of expecting two bytes for the command is
+applied to the relevant bus interface.
+
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 96374afd0193c..402809cc0e09d 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -175,8 +175,19 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,
+ if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16))
+ return false;
+
+- if (op->cmd.nbytes != 2)
+- return false;
++ /* Extra 8D-8D-8D limitations */
++ if (op->cmd.dtr && op->cmd.buswidth == 8) {
++ if (op->cmd.nbytes != 2)
++ return false;
++
++ if ((op->addr.nbytes % 2) ||
++ (op->dummy.nbytes % 2) ||
++ (op->data.nbytes % 2)) {
++ dev_err(&ctlr->dev,
++ "Even byte numbers not allowed in octal DTR operations\n");
++ return false;
++ }
++ }
+ } else {
+ if (op->cmd.nbytes != 1)
+ return false;
+--
+2.51.0
+
--- /dev/null
+From 7d6cbb987e77469829f148aab71949a5ce03bba0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 20:30:04 +0800
+Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
+
+From: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+
+[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ]
+
+spi_mem_dirmap_create() may reconfigure controller-wide settings,
+which can interfere with concurrent transfers to other devices
+sharing the same SPI controller but using different chip selects.
+
+Wrap the ->dirmap_create() callback with spi_mem_access_start() and
+spi_mem_access_end() to serialize access and prevent cross-CS
+interference during dirmap creation.
+
+This patch has been verified on a setup where a SPI TPM is connected
+to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1
+of the same controller. Without this patch, spi_mem_dirmap_create()
+for the SPI NOR flash interferes with ongoing SPI TPM data transfers,
+resulting in failure to create the TPM device. This was tested on an
+ASPEED AST2700 EVB.
+
+Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 402809cc0e09d..ff9f2e9abe619 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -648,9 +648,18 @@ spi_mem_dirmap_create(struct spi_mem *mem,
+
+ desc->mem = mem;
+ desc->info = *info;
+- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create)
++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) {
++ ret = spi_mem_access_start(mem);
++ if (ret) {
++ kfree(desc);
++ return ERR_PTR(ret);
++ }
++
+ ret = ctlr->mem_ops->dirmap_create(desc);
+
++ spi_mem_access_end(mem);
++ }
++
+ if (ret) {
+ desc->nodirmap = true;
+ if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
+--
+2.51.0
+
--- /dev/null
+From 54ac41358d87fa31fe231ee357399688ae6461bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 08:26:16 +0100
+Subject: spi: spidev: fix lock inversion between spi_lock and buf_lock
+
+From: Fabian Godehardt <fg@emlix.com>
+
+[ Upstream commit 40534d19ed2afb880ecf202dab26a8e7a5808d16 ]
+
+The spidev driver previously used two mutexes, spi_lock and buf_lock,
+but acquired them in different orders depending on the code path:
+
+ write()/read(): buf_lock -> spi_lock
+ ioctl(): spi_lock -> buf_lock
+
+This AB-BA locking pattern triggers lockdep warnings and can
+cause real deadlocks:
+
+ WARNING: possible circular locking dependency detected
+ spidev_ioctl() -> mutex_lock(&spidev->buf_lock)
+ spidev_sync_write() -> mutex_lock(&spidev->spi_lock)
+ *** DEADLOCK ***
+
+The issue is reproducible with a simple userspace program that
+performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from
+separate threads on the same spidev file descriptor.
+
+Fix this by simplifying the locking model and removing the lock
+inversion entirely. spidev_sync() no longer performs any locking,
+and all callers serialize access using spi_lock.
+
+buf_lock is removed since its functionality is fully covered by
+spi_lock, eliminating the possibility of lock ordering issues.
+
+This removes the lock inversion and prevents deadlocks without
+changing userspace ABI or behaviour.
+
+Signed-off-by: Fabian Godehardt <fg@emlix.com>
+Link: https://patch.msgid.link/20260211072616.489522-1-fg@emlix.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spidev.c | 63 ++++++++++++++++----------------------------
+ 1 file changed, 22 insertions(+), 41 deletions(-)
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 653f82984216c..661b84f3ee622 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -74,7 +74,6 @@ struct spidev_data {
+ struct list_head device_entry;
+
+ /* TX/RX buffers are NULL unless this device is open (users > 0) */
+- struct mutex buf_lock;
+ unsigned users;
+ u8 *tx_buffer;
+ u8 *rx_buffer;
+@@ -102,24 +101,6 @@ spidev_sync_unlocked(struct spi_device *spi, struct spi_message *message)
+ return status;
+ }
+
+-static ssize_t
+-spidev_sync(struct spidev_data *spidev, struct spi_message *message)
+-{
+- ssize_t status;
+- struct spi_device *spi;
+-
+- mutex_lock(&spidev->spi_lock);
+- spi = spidev->spi;
+-
+- if (spi == NULL)
+- status = -ESHUTDOWN;
+- else
+- status = spidev_sync_unlocked(spi, message);
+-
+- mutex_unlock(&spidev->spi_lock);
+- return status;
+-}
+-
+ static inline ssize_t
+ spidev_sync_write(struct spidev_data *spidev, size_t len)
+ {
+@@ -132,7 +113,8 @@ spidev_sync_write(struct spidev_data *spidev, size_t len)
+
+ spi_message_init(&m);
+ spi_message_add_tail(&t, &m);
+- return spidev_sync(spidev, &m);
++
++ return spidev_sync_unlocked(spidev->spi, &m);
+ }
+
+ static inline ssize_t
+@@ -147,7 +129,8 @@ spidev_sync_read(struct spidev_data *spidev, size_t len)
+
+ spi_message_init(&m);
+ spi_message_add_tail(&t, &m);
+- return spidev_sync(spidev, &m);
++
++ return spidev_sync_unlocked(spidev->spi, &m);
+ }
+
+ /*-------------------------------------------------------------------------*/
+@@ -157,7 +140,7 @@ static ssize_t
+ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
+ {
+ struct spidev_data *spidev;
+- ssize_t status;
++ ssize_t status = -ESHUTDOWN;
+
+ /* chipselect only toggles at start or end of operation */
+ if (count > bufsiz)
+@@ -165,7 +148,11 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
+
+ spidev = filp->private_data;
+
+- mutex_lock(&spidev->buf_lock);
++ mutex_lock(&spidev->spi_lock);
++
++ if (spidev->spi == NULL)
++ goto err_spi_removed;
++
+ status = spidev_sync_read(spidev, count);
+ if (status > 0) {
+ unsigned long missing;
+@@ -176,7 +163,9 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
+ else
+ status = status - missing;
+ }
+- mutex_unlock(&spidev->buf_lock);
++
++err_spi_removed:
++ mutex_unlock(&spidev->spi_lock);
+
+ return status;
+ }
+@@ -187,7 +176,7 @@ spidev_write(struct file *filp, const char __user *buf,
+ size_t count, loff_t *f_pos)
+ {
+ struct spidev_data *spidev;
+- ssize_t status;
++ ssize_t status = -ESHUTDOWN;
+ unsigned long missing;
+
+ /* chipselect only toggles at start or end of operation */
+@@ -196,13 +185,19 @@ spidev_write(struct file *filp, const char __user *buf,
+
+ spidev = filp->private_data;
+
+- mutex_lock(&spidev->buf_lock);
++ mutex_lock(&spidev->spi_lock);
++
++ if (spidev->spi == NULL)
++ goto err_spi_removed;
++
+ missing = copy_from_user(spidev->tx_buffer, buf, count);
+ if (missing == 0)
+ status = spidev_sync_write(spidev, count);
+ else
+ status = -EFAULT;
+- mutex_unlock(&spidev->buf_lock);
++
++err_spi_removed:
++ mutex_unlock(&spidev->spi_lock);
+
+ return status;
+ }
+@@ -379,14 +374,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+
+ ctlr = spi->controller;
+
+- /* use the buffer lock here for triple duty:
+- * - prevent I/O (from us) so calling spi_setup() is safe;
+- * - prevent concurrent SPI_IOC_WR_* from morphing
+- * data fields while SPI_IOC_RD_* reads them;
+- * - SPI_IOC_MESSAGE needs the buffer locked "normally".
+- */
+- mutex_lock(&spidev->buf_lock);
+-
+ switch (cmd) {
+ /* read requests */
+ case SPI_IOC_RD_MODE:
+@@ -510,7 +497,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ break;
+ }
+
+- mutex_unlock(&spidev->buf_lock);
+ spi_dev_put(spi);
+ mutex_unlock(&spidev->spi_lock);
+ return retval;
+@@ -541,9 +527,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
+ return -ESHUTDOWN;
+ }
+
+- /* SPI_IOC_MESSAGE needs the buffer locked "normally" */
+- mutex_lock(&spidev->buf_lock);
+-
+ /* Check message and copy into scratch area */
+ ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc);
+ if (IS_ERR(ioc)) {
+@@ -564,7 +547,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
+ kfree(ioc);
+
+ done:
+- mutex_unlock(&spidev->buf_lock);
+ spi_dev_put(spi);
+ mutex_unlock(&spidev->spi_lock);
+ return retval;
+@@ -790,7 +772,6 @@ static int spidev_probe(struct spi_device *spi)
+ /* Initialize the driver data */
+ spidev->spi = spi;
+ mutex_init(&spidev->spi_lock);
+- mutex_init(&spidev->buf_lock);
+
+ INIT_LIST_HEAD(&spidev->device_entry);
+
+--
+2.51.0
+
--- /dev/null
+From 9673d543976e2ddaaf98cdcc555125ed7022ae2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 11:48:28 +0100
+Subject: spi: stm32: fix Overrun issue at < 8bpw
+
+From: Deepak Kumar <deepak.kumar01@st.com>
+
+[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ]
+
+When SPI communication is suspended by hardware automatically, it could
+happen that few bits of next frame are already clocked out due to
+internal synchronization delay.
+
+To achieve a safe suspension, we need to ensure that each word must be
+at least 8 SPI clock cycles long. That's why, if bpw is less than 8
+bits, we need to use midi to reach 8 SPI clock cycles at least.
+
+This will ensure that each word achieve safe suspension and prevent
+overrun condition.
+
+Signed-off-by: Deepak Kumar <deepak.kumar01@st.com>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 3b1b810f33bf7..e749ce27267fd 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1711,11 +1711,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, u32 len)
+ cfg2_clrb |= STM32H7_SPI_CFG2_MIDI;
+ if ((len > 1) && (spi->cur_midi > 0)) {
+ u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed);
+- u32 midi = min_t(u32,
+- DIV_ROUND_UP(spi->cur_midi, sck_period_ns),
+- FIELD_GET(STM32H7_SPI_CFG2_MIDI,
+- STM32H7_SPI_CFG2_MIDI));
++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns);
+
++ if ((spi->cur_bpw + midi) < 8)
++ midi = 8 - spi->cur_bpw;
++
++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI));
+
+ dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n",
+ sck_period_ns, midi, midi * sck_period_ns);
+--
+2.51.0
+
--- /dev/null
+From ffc3243f38a4153a9fb3696f297f4493ad473e29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:47:12 +0530
+Subject: staging: rtl8723bs: fix memory leak on failure path
+
+From: Diksha Kumari <dikshakdevgan@gmail.com>
+
+[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ]
+
+cfg80211_inform_bss_frame() may return NULL on failure. In that case,
+the allocated buffer 'buf' is not freed and the function returns early,
+leading to potential memory leak.
+Fix this by ensuring that 'buf' is freed on both success and failure paths.
+
+Signed-off-by: Diksha Kumari <dikshakdevgan@gmail.com>
+Reviewed-by: Mukesh Kumar Chaurasiya <mkchauras@linux.ibm.com>
+Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+index b63a74e669bcf..b300d52e241b5 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -315,9 +315,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl
+ len, notify_signal, GFP_ATOMIC);
+
+ if (unlikely(!bss))
+- goto exit;
++ goto free_buf;
+
+ cfg80211_put_bss(wiphy, bss);
++free_buf:
+ kfree(buf);
+
+ exit:
+--
+2.51.0
+
--- /dev/null
+From 04bd2ff13f4db2b78e320189ee8fe441f8a08f04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:27:28 +0800
+Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq()
+ failure
+
+From: Liang Jie <liangjie@lixiang.com>
+
+[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ]
+
+The return value of sdio_alloc_irq() was not stored in status.
+If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds,
+status remains _SUCCESS and the error path skips resource cleanup,
+while rtw_drv_init() still returns success.
+
+Store the return value of sdio_alloc_irq() in status and reuse the
+existing error handling which relies on status.
+
+Reviewed-by: fanggeng <fanggeng@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+index d18fde4e5d6ce..d64998be6b2bb 100644
+--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+@@ -379,7 +379,8 @@ static int rtw_drv_init(
+ if (status != _SUCCESS)
+ goto free_if1;
+
+- if (sdio_alloc_irq(dvobj) != _SUCCESS)
++ status = sdio_alloc_irq(dvobj);
++ if (status != _SUCCESS)
+ goto free_if1;
+
+ rtw_ndev_notifier_register();
+--
+2.51.0
+
--- /dev/null
+From 43879afc7a5671cb9d2813a36f3a7a93eb77fa13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Nov 2025 14:41:20 +0530
+Subject: statmount: permission check should return EPERM
+
+From: Bhavik Sachdev <b.sachdev1904@gmail.com>
+
+[ Upstream commit fccbe38a5d06dbe44bcd89196fe1d2c2272a1f4a ]
+
+Currently, statmount() returns ENOENT when caller is not CAP_SYS_ADMIN
+in the user namespace owner of target mount namespace. This should be
+EPERM instead.
+
+Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
+Signed-off-by: Bhavik Sachdev <b.sachdev1904@gmail.com>
+Link: https://patch.msgid.link/20251129091455.757724-2-b.sachdev1904@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index c3702f3303a89..3869d2b32ac21 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -5395,7 +5395,7 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,
+
+ if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) &&
+ !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
+- return -ENOENT;
++ return -EPERM;
+
+ ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT);
+ if (!ks)
+--
+2.51.0
+
--- /dev/null
+From ce059c919f12367faa9aee712b03759ea348d409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 08:23:15 +0000
+Subject: thermal: int340x: Fix sysfs group leak on DLVR registration failure
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ]
+
+When DLVR sysfs group creation fails in proc_thermal_rfim_add(),
+the function returns immediately without cleaning up the FIVR group
+that may have been created earlier.
+
+Add proper error unwinding to remove the FIVR group before returning
+failure.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../thermal/intel/int340x_thermal/processor_thermal_rfim.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+index 0e2dc1426282d..c9c7451c34d7e 100644
+--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+@@ -449,8 +449,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc
+
+ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DLVR) {
+ ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group);
+- if (ret)
++ if (ret) {
++ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR)
++ sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group);
+ return ret;
++ }
+ }
+
+ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) {
+--
+2.51.0
+
--- /dev/null
+From 865f8415697e4e3f29de81e0078de1a87a362a78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:47:45 +0530
+Subject: tools/power cpupower: Reset errno before strtoull()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ]
+
+cpuidle_state_get_one_value() never cleared errno before calling
+strtoull(), so a prior ERANGE caused every cpuidle counter read to
+return zero. Reset errno to 0 before the conversion so each sysfs read
+is evaluated independently.
+
+Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index f2c1139adf716..bd857ee7541a7 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -150,6 +150,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu,
+ if (len == 0)
+ return 0;
+
++ errno = 0;
+ value = strtoull(linebuf, &endp, 0);
+
+ if (endp == linebuf || errno == ERANGE)
+--
+2.51.0
+
--- /dev/null
+From d744d89fe77a04619b28047edc533ef2af9665dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 23:48:10 -0800
+Subject: tracing: Fix false sharing in hwlat get_sample()
+
+From: Colin Lord <clord@mykolab.com>
+
+[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ]
+
+The get_sample() function in the hwlat tracer assumes the caller holds
+hwlat_data.lock, but this is not actually happening. The result is
+unprotected data access to hwlat_data, and in per-cpu mode can result in
+false sharing which may show up as false positive latency events.
+
+The specific case of false sharing observed was primarily between
+hwlat_data.sample_width and hwlat_data.count. These are separated by
+just 8B and are therefore likely to share a cache line. When one thread
+modifies count, the cache line is in a modified state so when other
+threads read sample_width in the main latency detection loop, they fetch
+the modified cache line. On some systems, the fetch itself may be slow
+enough to count as a latency event, which could set up a self
+reinforcing cycle of latency events as each event increments count which
+then causes more latency events, continuing the cycle.
+
+The other result of the unprotected data access is that hwlat_data.count
+can end up with duplicate or missed values, which was observed on some
+systems in testing.
+
+Convert hwlat_data.count to atomic64_t so it can be safely modified
+without locking, and prevent false sharing by pulling sample_width into
+a local variable.
+
+One system this was tested on was a dual socket server with 32 CPUs on
+each numa node. With settings of 1us threshold, 1000us width, and
+2000us window, this change reduced the number of latency events from
+500 per second down to approximately 1 event per minute. Some machines
+tested did not exhibit measurable latency from the false sharing.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com
+Signed-off-by: Colin Lord <clord@mykolab.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_hwlat.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
+index 3bd6071441ade..bc437b6ce8969 100644
+--- a/kernel/trace/trace_hwlat.c
++++ b/kernel/trace/trace_hwlat.c
+@@ -102,9 +102,9 @@ struct hwlat_sample {
+ /* keep the global state somewhere. */
+ static struct hwlat_data {
+
+- struct mutex lock; /* protect changes */
++ struct mutex lock; /* protect changes */
+
+- u64 count; /* total since reset */
++ atomic64_t count; /* total since reset */
+
+ u64 sample_window; /* total sampling window (on+off) */
+ u64 sample_width; /* active sampling portion of window */
+@@ -195,8 +195,7 @@ void trace_hwlat_callback(bool enter)
+ * get_sample - sample the CPU TSC and look for likely hardware latencies
+ *
+ * Used to repeatedly capture the CPU TSC (or similar), looking for potential
+- * hardware-induced latency. Called with interrupts disabled and with
+- * hwlat_data.lock held.
++ * hardware-induced latency. Called with interrupts disabled.
+ */
+ static int get_sample(void)
+ {
+@@ -206,6 +205,7 @@ static int get_sample(void)
+ time_type start, t1, t2, last_t2;
+ s64 diff, outer_diff, total, last_total = 0;
+ u64 sample = 0;
++ u64 sample_width = READ_ONCE(hwlat_data.sample_width);
+ u64 thresh = tracing_thresh;
+ u64 outer_sample = 0;
+ int ret = -1;
+@@ -269,7 +269,7 @@ static int get_sample(void)
+ if (diff > sample)
+ sample = diff; /* only want highest value */
+
+- } while (total <= hwlat_data.sample_width);
++ } while (total <= sample_width);
+
+ barrier(); /* finish the above in the view for NMIs */
+ trace_hwlat_callback_enabled = false;
+@@ -287,8 +287,7 @@ static int get_sample(void)
+ if (kdata->nmi_total_ts)
+ do_div(kdata->nmi_total_ts, NSEC_PER_USEC);
+
+- hwlat_data.count++;
+- s.seqnum = hwlat_data.count;
++ s.seqnum = atomic64_inc_return(&hwlat_data.count);
+ s.duration = sample;
+ s.outer_duration = outer_sample;
+ s.nmi_total_ts = kdata->nmi_total_ts;
+@@ -837,7 +836,7 @@ static int hwlat_tracer_init(struct trace_array *tr)
+
+ hwlat_trace = tr;
+
+- hwlat_data.count = 0;
++ atomic64_set(&hwlat_data.count, 0);
+ tr->max_latency = 0;
+ save_tracing_thresh = tracing_thresh;
+
+--
+2.51.0
+
--- /dev/null
+From ef70b9b66f97304874b8921952a3ab79f1df5949 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 16:59:02 +0000
+Subject: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
+
+From: Mario Peter <mario.peter@leica-geosystems.com>
+
+[ Upstream commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123 ]
+
+The ChipIdea UDC driver can encounter "not page aligned sg buffer"
+errors when a USB device is reconnected after being disconnected
+during an active transfer. This occurs because _ep_nuke() returns
+requests to the gadget layer without properly unmapping DMA buffers
+or cleaning up scatter-gather bounce buffers.
+
+Root cause:
+When a disconnect happens during a multi-segment DMA transfer, the
+request's num_mapped_sgs field and sgt.sgl pointer remain set with
+stale values. The request is returned to the gadget driver with status
+-ESHUTDOWN but still has active DMA state. If the gadget driver reuses
+this request on reconnect without reinitializing it, the stale DMA
+state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero
+num_mapped_sgs) and attempt to use freed/invalid DMA addresses,
+leading to alignment errors and potential memory corruption.
+
+The normal completion path via _hardware_dequeue() properly calls
+usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before
+returning the request. The _ep_nuke() path must do the same cleanup
+to ensure requests are returned in a clean, reusable state.
+
+Fix:
+Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror
+the cleanup sequence in _hardware_dequeue():
+- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set
+- Call sglist_do_debounce() with copy=false if bounce buffer exists
+
+This ensures that when requests are returned due to endpoint shutdown,
+they don't retain stale DMA mappings. The 'false' parameter to
+sglist_do_debounce() prevents copying data back (appropriate for
+shutdown path where transfer was aborted).
+
+Signed-off-by: Mario Peter <mario.peter@leica-geosystems.com>
+Reviewed-by: Xu Yang <xu.yang_2@nxp.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/udc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 8f73bd5057a64..5f28aac85d7d4 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -919,6 +919,13 @@ __acquires(hwep->lock)
+ list_del_init(&hwreq->queue);
+ hwreq->req.status = -ESHUTDOWN;
+
++ /* Unmap DMA and clean up bounce buffers before giving back */
++ usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent,
++ &hwreq->req, hwep->dir);
++
++ if (hwreq->sgt.sgl)
++ sglist_do_debounce(hwreq, false);
++
+ if (hwreq->req.complete != NULL) {
+ spin_unlock(hwep->lock);
+ usb_gadget_giveback_request(&hwep->ep, &hwreq->req);
+--
+2.51.0
+
--- /dev/null
+From 0a8da52b5cb348e809b0115b7de8f4111268cccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 08:30:21 +1000
+Subject: usb: gadget: f_fs: fix DMA-BUF OUT queues
+
+From: Sam Day <me@samcday.com>
+
+[ Upstream commit 0145e7acd29855dfba4a2f387d455b5d9a520f0e ]
+
+Currently, DMA_FROM_DEVICE is used when attaching DMABUFs to IN
+endpoints and DMA_TO_DEVICE for OUT endpoints. This is inverted from
+how it should be.
+
+The result is IOMMU read-only mappings placed on OUT queues,
+triggering arm-smmu write faults.
+
+Put differently, OUT endpoints flow data from host -> gadget, meaning
+the UDC peripheral needs to have write access to the buffer to fill it
+with the incoming data.
+
+This commit flips the directions and updates the implicit-sync helpers
+so IN endpoints act as readers and OUT endpoints as writers.
+
+Signed-off-by: Sam Day <me@samcday.com>
+Tested-by: David Heidelberg <david@ixit.cz> # OnePlus 6T on sdm845-next-20251119
+Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-2-e51633891a81@samcday.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index f7be1548cc18a..738c10d83d272 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1499,7 +1499,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd)
+ goto err_dmabuf_detach;
+ }
+
+- dir = epfile->in ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
++ dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
+
+ err = ffs_dma_resv_lock(dmabuf, nonblock);
+ if (err)
+@@ -1629,7 +1629,7 @@ static int ffs_dmabuf_transfer(struct file *file,
+ /* Make sure we don't have writers */
+ timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS);
+ retl = dma_resv_wait_timeout(dmabuf->resv,
+- dma_resv_usage_rw(epfile->in),
++ dma_resv_usage_rw(!epfile->in),
+ true, timeout);
+ if (retl == 0)
+ retl = -EBUSY;
+@@ -1674,7 +1674,7 @@ static int ffs_dmabuf_transfer(struct file *file,
+ dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops,
+ &priv->lock, priv->context, seqno);
+
+- resv_dir = epfile->in ? DMA_RESV_USAGE_WRITE : DMA_RESV_USAGE_READ;
++ resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE;
+
+ dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir);
+ dma_resv_unlock(dmabuf->resv);
+--
+2.51.0
+
--- /dev/null
+From 1b7f5656332d9f4d15f6c0e4a3decd95e5c3ac73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 08:30:20 +1000
+Subject: usb: gadget: f_fs: Fix ioctl error handling
+
+From: Sam Day <me@samcday.com>
+
+[ Upstream commit 8e4c1d06183c25022f6b0002a5cab84979ca6337 ]
+
+When ffs_epfile_ioctl handles FUNCTIONFS_DMABUF_* ioctls, it's currently
+falling through when copy_from_user fails.
+
+However, this fallthrough isn't being checked properly, so the handler
+continues executing further than it should. It then tries the secondary
+dispatch where it ultimately gives up and returns -ENOTTY.
+
+The end result is invalid ioctl invocations will yield a -ENOTTY rather
+than an -EFAULT.
+
+It's a common pattern elsewhere in the kernel code to directly return
+-EFAULT when copy_from_user fails. So we update ffs_epfile_ioctl to do
+the same and fix this issue.
+
+Signed-off-by: Sam Day <me@samcday.com>
+Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-1-e51633891a81@samcday.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 738c10d83d272..e03ac64361cc5 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1734,10 +1734,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ {
+ int fd;
+
+- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
+- ret = -EFAULT;
+- break;
+- }
++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
++ return -EFAULT;
+
+ return ffs_dmabuf_attach(file, fd);
+ }
+@@ -1745,10 +1743,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ {
+ int fd;
+
+- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
+- ret = -EFAULT;
+- break;
+- }
++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
++ return -EFAULT;
+
+ return ffs_dmabuf_detach(file, fd);
+ }
+@@ -1756,10 +1752,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ {
+ struct usb_ffs_dmabuf_transfer_req req;
+
+- if (copy_from_user(&req, (void __user *)value, sizeof(req))) {
+- ret = -EFAULT;
+- break;
+- }
++ if (copy_from_user(&req, (void __user *)value, sizeof(req)))
++ return -EFAULT;
+
+ return ffs_dmabuf_transfer(file, &req);
+ }
+--
+2.51.0
+
--- /dev/null
+From da033eeefe0b483d992aa7899491f8709912151a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:48:48 +0000
+Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
+
+From: Benson Leung <bleung@chromium.org>
+
+[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ]
+
+ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated
+using whichever pdo is in the last position of the src_pdos array, presuming
+it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current
+helpers are used on that last pdo.
+
+However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and
+for PPS) may exist, and are always at the end of the array if they do.
+In the event one of these more advanced chargers are attached the helpers for
+fixed return mangled values.
+
+Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger
+with PPS support:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=13400000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=5790000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS
+APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect.
+
+Instead, enumerate through the src_pdos and filter just for Fixed PDOs for
+now, and find the one with the highest voltage and current respectively.
+
+After, from the same charger:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=20000000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=4000000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Signed-off-by: Benson Leung <bleung@chromium.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c
+index 7f176382b1a0f..c7d2fb611be4c 100644
+--- a/drivers/usb/typec/ucsi/psy.c
++++ b/drivers/usb/typec/ucsi/psy.c
+@@ -88,15 +88,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_voltage = 0;
+
+ switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_fixed_voltage(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_voltage = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000;
++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage
++ : max_voltage;
+ }
++ val->intval = max_voltage;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0:
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+@@ -144,6 +149,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_current = 0;
+
+ if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) {
+ val->intval = 0;
+@@ -152,12 +158,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+
+ switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_max_current(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_current = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_current = pdo_max_current(pdo) * 1000;
++ max_current = (pdo_current > max_current) ? pdo_current
++ : max_current;
+ }
++ val->intval = max_current;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+ val->intval = UCSI_TYPEC_1_5_CURRENT * 1000;
+--
+2.51.0
+
--- /dev/null
+From 259dc7b5873f02e72837e75c8f5e65fbf15e9580 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 12:27:03 +0530
+Subject: vhost: fix caching attributes of MMIO regions by setting them
+ explicitly
+
+From: Kommula Shiva Shankar <kshankar@marvell.com>
+
+[ Upstream commit 5145b277309f3818e2db507f525d19ac3b910922 ]
+
+Explicitly set non-cached caching attributes for MMIO regions.
+Default write-back mode can cause CPU to cache device memory,
+causing invalid reads and unpredictable behavior.
+
+Invalid read and write issues were observed on ARM64 when mapping the
+notification area to userspace via mmap.
+
+Signed-off-by: Kommula Shiva Shankar <kshankar@marvell.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Message-Id: <20260102065703.656255-1-kshankar@marvell.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index 5a49b5a6d4964..b8bbf5ef71c0b 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -1527,6 +1527,7 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma)
+ if (vma->vm_end - vma->vm_start != notify.size)
+ return -ENOTSUPP;
+
++ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);
+ vma->vm_ops = &vhost_vdpa_vm_ops;
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 4fcf9b2b0215633c485e03d28ea2c6b6c0c6c3a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:45 +0100
+Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ]
+
+The unpacked unions within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)'
+ and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 239 | } u;
+ | ^
+
+./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+
+With the recent changes to compile-test the UAPI headers in more cases,
+these warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warnings.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/vbox_vmmdev_types.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
+index 6073858d52a2e..11f3627c3729b 100644
+--- a/include/uapi/linux/vbox_vmmdev_types.h
++++ b/include/uapi/linux/vbox_vmmdev_types.h
+@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 {
+ /** Relative to the request header. */
+ __u32 offset;
+ } page_list;
+- } u;
++ } __packed u;
+ } __packed;
+ VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
+
+@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 {
+ union {
+ __u64 phys_addr;
+ __u64 linear_addr;
+- } u;
++ } __packed u;
+ } __packed pointer;
+ struct {
+ /** Size of the buffer described by the page list. */
+--
+2.51.0
+
--- /dev/null
+From b1c97d608ca9376548763242d0731da8c749628c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:34:00 +0100
+Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ]
+
+The gcc-16.0.1 snapshot produces a false-positive warning that turns
+into a build failure with CONFIG_WERROR:
+
+In file included from arch/x86/include/asm/string.h:6,
+ from net/vmw_vsock/vmci_transport.c:10:
+In function 'vmci_transport_packet_init',
+ inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2:
+arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull]
+ 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy'
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+
+This seems relatively harmless, and it so far the only instance of this
+warning I have found. The __vmci_transport_send_control_pkt function
+is called either with wait=NULL or with one of the type values that
+pass 'wait' into memcpy() here, but not from the same caller.
+
+Replacing the memcpy with a struct assignment is otherwise the same
+but avoids the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Bryan Tan <bryan-bt.tan@broadcom.com>
+Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 7eccd6708d664..aca3132689cf1 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt,
+
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
+- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
++ pkt->u.wait = *wait;
+ break;
+
+ case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
+--
+2.51.0
+
--- /dev/null
+From 646eb8ff40c2a838b38e3ebece1fbc98cf3e0bb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 22:24:33 +0200
+Subject: watchdog: imx7ulp_wdt: handle the nowayout option
+
+From: Oleksandr Suvorov <cryosay@gmail.com>
+
+[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ]
+
+The module parameter `nowayout` indicates whether the watchdog should ever
+be allowed to stop, but the driver currently ignores this option.
+
+Pass the `nowayout` parameter to the watchdog core by setting the
+WDOG_NO_WAY_OUT flag accordingly.
+
+Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/imx7ulp_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c
+index 0f13a30533574..03479110453ce 100644
+--- a/drivers/watchdog/imx7ulp_wdt.c
++++ b/drivers/watchdog/imx7ulp_wdt.c
+@@ -346,6 +346,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev)
+ watchdog_stop_on_reboot(wdog);
+ watchdog_stop_on_unregister(wdog);
+ watchdog_set_drvdata(wdog, imx7ulp_wdt);
++ watchdog_set_nowayout(wdog, nowayout);
+
+ imx7ulp_wdt->hw = of_device_get_match_data(dev);
+ ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate);
+--
+2.51.0
+
--- /dev/null
+From ba43d20aa32ef211018daa123fa8da675f7806b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:56:11 +0000
+Subject: wifi: ath10k: fix lock protection in
+ ath10k_wmi_event_peer_sta_ps_state_chg()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ]
+
+ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to
+assert that ar->data_lock should be held by the caller, but neither
+ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock
+before calling this function.
+
+The field arsta->peer_ps_state is documented as protected by
+ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable,
+ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock.
+
+Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update,
+and remove the lockdep_assert_held() to be aligned with new locking,
+following the pattern used by other WMI event handlers in the driver.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu
+[removed excess blank line]
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index fef7d9b081963..408f062a4306f 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5289,8 +5289,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ struct ath10k_sta *arsta;
+ u8 peer_addr[ETH_ALEN];
+
+- lockdep_assert_held(&ar->data_lock);
+-
+ ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data;
+ ether_addr_copy(peer_addr, ev->peer_macaddr.addr);
+
+@@ -5305,7 +5303,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ }
+
+ arsta = (struct ath10k_sta *)sta->drv_priv;
++ spin_lock_bh(&ar->data_lock);
+ arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state);
++ spin_unlock_bh(&ar->data_lock);
+
+ exit:
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From 079b28f8dd8f6360c7aa180797a0de5fae35fc07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 17:00:34 -0800
+Subject: wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
+
+From: Ross Vandegrift <ross@kallisti.us>
+
+[ Upstream commit 4015b1972763d7d513172276e51439f37e622a92 ]
+
+Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added
+to the appropriate quirk list. I've tested this patch on top of 6.18.2,
+it fixes the issue for me on 21D4
+
+Mark Pearson provided the other product IDs covering the second Z16 Gen1
+and both Z13 Gen1 identifiers. They share the same firmware, and folks
+in the bugzilla report do indeed see the problem on Z13.
+
+[1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196
+
+Signed-off-by: Ross Vandegrift <ross@kallisti.us>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Tested-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
+index 735032c353b2d..c6d17dbbdb376 100644
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -896,6 +896,34 @@ static const struct dmi_system_id ath11k_pm_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "21F9"),
+ },
+ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z13 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D2"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z13 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D3"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z16 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D4"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z16 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D5"),
++ },
++ },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 17c5997c2e0fbda635903ea88ffd4580f4f8a6eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 11:46:07 +0800
+Subject: wifi: ath11k: Fix failure to connect to a 6 GHz AP
+
+From: Qian Zhang <qian.zhang@oss.qualcomm.com>
+
+[ Upstream commit 0bc8c48de6f06c0cac52dde024ffda4433de6234 ]
+
+STA fails to connect to a 6 GHz AP with the following errors:
+ ath11k_pci 0000:01:00.0: failed to handle chan list with power type 1
+ wlp1s0: deauthenticating from c8:a3:e8:dd:41:e3 by local choice (Reason: 3=DEAUTH_LEAVING)
+
+ath11k_reg_handle_chan_list() treats the update as redundant and
+returns -EINVAL. That causes the connection attempt to fail.
+
+Avoid unnecessary validation during association. Apply the regulatory
+redundant check only when the power type is IEEE80211_REG_UNSET_AP,
+which only occurs during core initialization.
+
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
+
+Signed-off-by: Qian Zhang <qian.zhang@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260108034607.812885-1-qian.zhang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
+index d62a2014315a0..49b79648752cf 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+ * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+ #include <linux/rtnetlink.h>
+
+@@ -926,8 +926,11 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
+ */
+ if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] &&
+ !memcmp((char *)ab->default_regd[pdev_idx]->alpha2,
+- (char *)reg_info->alpha2, 2))
+- goto retfail;
++ (char *)reg_info->alpha2, 2) &&
++ power_type == IEEE80211_REG_UNSET_AP) {
++ ath11k_reg_reset_info(reg_info);
++ return 0;
++ }
+
+ /* Intersect new rules with default regd if a new country setting was
+ * requested, i.e a default regd was already set during initialization
+--
+2.51.0
+
--- /dev/null
+From 6b5b8a9c8098a785b82cd2454704c1b818317cbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 15:36:24 +0800
+Subject: wifi: ath12k: fix preferred hardware mode calculation
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 7f852de0003219c431a6f2ffd951fd82a4673660 ]
+
+For single pdev device like WCN7850/QCC2072, preferred_hw_mode is
+initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends
+supported modes to host, each mode is compared with the initial one
+and if the priority of the new mode is higher, update the parameter
+and store mode capability.
+
+For WCN7850, this does not result in issue, as one of the supported
+mode indeed has a higher priority. However the only available mode of
+QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the
+comparison, hence mode capability is not stored. Subsequently driver
+initialization fails.
+
+Fix it by accepting a mode with the same priority.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
+
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
+index 5c5fc2b7642f6..761c169c992f1 100644
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
++++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -4047,7 +4047,7 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc,
+
+ pref = soc->wmi_ab.preferred_hw_mode;
+
+- if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) {
++ if (ath12k_hw_mode_pri_map[mode] <= ath12k_hw_mode_pri_map[pref]) {
+ svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps;
+ soc->wmi_ab.preferred_hw_mode = mode;
+ }
+--
+2.51.0
+
--- /dev/null
+From 8714272a7746379233f25330538f01f6d39d2fe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 13:51:57 +0200
+Subject: wifi: cfg80211: allow only one NAN interface, also in multi radio
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit e69fda4d07701373354e52b0321bd40311d743d0 ]
+
+According to Wi-Fi Aware (TM) 4.0 specification 2.8, A NAN device can
+have one NAN management interface. This applies also to multi radio
+devices.
+The current code allows a driver to support more than one NAN interface,
+if those are not in the same radio.
+
+Fix it.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20260107135129.fdaecec0fe8a.I246b5ba6e9da3ec1481ff197e47f6ce0793d7118@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/core.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index ad32386ed2e11..73c051f129d33 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -665,12 +665,8 @@ int wiphy_verify_iface_combinations(struct wiphy *wiphy,
+ c->limits[j].max > 1))
+ return -EINVAL;
+
+- /* Only a single NAN can be allowed, avoid this
+- * check for multi-radio global combination, since it
+- * hold the capabilities of all radio combinations.
+- */
+- if (!combined_radio &&
+- WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
++ /* Only a single NAN can be allowed */
++ if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
+ c->limits[j].max > 1))
+ return -EINVAL;
+
+--
+2.51.0
+
--- /dev/null
+From f216edd757954c09d72ff769a711bbfc0bbe723d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:30:05 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il3945_store_measurement()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ]
+
+il3945_store_measurement() calls il3945_get_measurement() which internally
+calls il_send_cmd_sync() without holding il->mutex. However,
+il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that
+callers must hold this lock.
+
+Other sysfs store functions in the same file properly acquire the mutex:
+- il3945_store_flags() acquires mutex at 3945-mac.c:3110
+- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144
+
+Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call
+in the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 74fc76c00ebcf..20d2afe1d55f9 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3262,7 +3262,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
+
+ D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n",
+ type, params.channel, buf);
++ mutex_lock(&il->mutex);
+ il3945_get_measurement(il, ¶ms, type);
++ mutex_unlock(&il->mutex);
+
+ return count;
+ }
+--
+2.51.0
+
--- /dev/null
+From 00940e6f5a22035b278ee00d1c88edcbeea8e73f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:40:39 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il4965_store_tx_power()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ]
+
+il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex.
+However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating
+that callers must hold this lock.
+
+All other callers of il_set_tx_power() properly acquire the mutex:
+- il_bg_scan_completed() acquires mutex at common.c:1683
+- il_mac_config() acquires mutex at common.c:5006
+- il3945_commit_rxon() and il4965_commit_rxon() are called via work
+ queues that hold the mutex (like il4965_bg_alive_start)
+
+Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in
+the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index a94cf27ffe4b0..ac2cfef737e4f 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4606,7 +4606,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr,
+ if (ret)
+ IL_INFO("%s is not in decimal form.\n", buf);
+ else {
++ mutex_lock(&il->mutex);
+ ret = il_set_tx_power(il, val, false);
++ mutex_unlock(&il->mutex);
+ if (ret)
+ IL_ERR("failed setting tx power (0x%08x).\n", ret);
+ else
+--
+2.51.0
+
--- /dev/null
+From 03afd340ba65b2edd047b21295818d51bdd97160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:02:15 +0200
+Subject: wifi: iwlwifi: mvm: check the validity of noa_len
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d ]
+
+Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using
+its value to determine the noa_len, which is later used for the NoA
+attribute.
+
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index d013de30e7ed6..28d329ec31b82 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -1816,6 +1816,20 @@ void iwl_mvm_probe_resp_data_notif(struct iwl_mvm *mvm,
+
+ mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
++ /*
++ * len_low should be 2 + n*13 (where n is the number of descriptors.
++ * 13 is the size of a NoA descriptor). We can have either one or two
++ * descriptors.
++ */
++ if (IWL_FW_CHECK(mvm, notif->noa_active &&
++ notif->noa_attr.len_low != 2 +
++ sizeof(struct ieee80211_p2p_noa_desc) &&
++ notif->noa_attr.len_low != 2 +
++ sizeof(struct ieee80211_p2p_noa_desc) * 2,
++ "Invalid noa_attr.len_low (%d)\n",
++ notif->noa_attr.len_low))
++ return;
++
+ new_data = kzalloc(sizeof(*new_data), GFP_KERNEL);
+ if (!new_data)
+ return;
+--
+2.51.0
+
--- /dev/null
+From b786a5f22150ddc443bf42f87cd0434d43a13aac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:58:06 +0100
+Subject: wifi: libertas: fix WARNING in usb_tx_block
+
+From: Szymon Wilczek <swilczek.lx@gmail.com>
+
+[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ]
+
+The function usb_tx_block() submits cardp->tx_urb without ensuring that
+any previous transmission on this URB has completed. If a second call
+occurs while the URB is still active (e.g. during rapid firmware loading),
+usb_submit_urb() detects the active state and triggers a warning:
+'URB submitted while active'.
+
+Fix this by enforcing serialization: call usb_kill_urb() before
+submitting the new request. This ensures the URB is idle and safe to reuse.
+
+Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
+Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
+Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index 2240b4db8c036..d98c81539ba53 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb
+ goto tx_ret;
+ }
+
++ usb_kill_urb(cardp->tx_urb);
++
+ usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
+ usb_sndbulkpipe(cardp->udev,
+ cardp->ep_out),
+--
+2.51.0
+
--- /dev/null
+From b5e97f9ecb2cceb18b8ebeac1a4ca8557812633a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Nov 2025 16:50:31 +0200
+Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ]
+
+rtw8822b_set_antenna() can be called from userspace when the chip is
+powered off. In that case a WARNING is triggered in
+rtw8822b_config_trx_mode() because trying to read the RF registers
+when the chip is powered off returns an unexpected value.
+
+Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when
+the chip is powered on.
+
+------------[ cut here ]------------
+write RF mode table fail
+WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1
+Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021
+RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+Call Trace:
+ <TASK>
+ rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]
+ rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]
+ ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]
+ nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? netdev_run_todo+0x63/0x550
+ genl_family_rcv_msg_doit+0xfc/0x160
+ genl_rcv_msg+0x1aa/0x2b0
+ ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_genl_rcv_msg+0x10/0x10
+ netlink_rcv_skb+0x59/0x110
+ genl_rcv+0x28/0x40
+ netlink_unicast+0x285/0x3c0
+ ? __alloc_skb+0xdb/0x1a0
+ netlink_sendmsg+0x20d/0x430
+ ____sys_sendmsg+0x39f/0x3d0
+ ? import_iovec+0x2f/0x40
+ ___sys_sendmsg+0x99/0xe0
+ ? refill_obj_stock+0x12e/0x240
+ __sys_sendmsg+0x8a/0xf0
+ do_syscall_64+0x81/0x970
+ ? do_syscall_64+0x81/0x970
+ ? ksys_read+0x73/0xf0
+ ? do_syscall_64+0x81/0x970
+ ? count_memcg_events+0xc2/0x190
+ ? handle_mm_fault+0x1d7/0x2d0
+ ? do_user_addr_fault+0x21a/0x690
+ ? exc_page_fault+0x7e/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+---[ end trace 0000000000000000 ]---
+
+Link: https://github.com/lwfinger/rtw88/issues/366
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+index 4a6c0a9266a09..0dba4b4c9464e 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -1045,7 +1045,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev,
+ hal->antenna_tx = antenna_tx;
+ hal->antenna_rx = antenna_rx;
+
+- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags))
++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 9fb19a6e2e0b7394111b1af13c6852de5e271ff1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 23:09:37 +0500
+Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
+
+From: Roman Peshkichev <roman.peshkichev@gmail.com>
+
+[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ]
+
+The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter,
+while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf.
+In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0.
+
+The driver unconditionally wrote (dtim_period - 1) to
+REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This
+caused delays in broadcast/multicast traffic processing and issues with
+ad-hoc operation.
+
+Convert the function parameter to u8 to match ieee80211_bss_conf and avoid
+the underflow by writing 0 when dtim_period is 0.
+
+Link: https://github.com/lwfinger/rtw88/issues/406
+Signed-off-by: Roman Peshkichev <roman.peshkichev@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 4 ++--
+ drivers/net/wireless/realtek/rtw88/main.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index a4416e8986b97..adfe23b28bf69 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -709,10 +709,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel)
+ }
+ EXPORT_SYMBOL(rtw_set_rx_freq_band);
+
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period)
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period)
+ {
+ rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE);
+- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1);
++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0);
+ }
+
+ void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel,
+diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h
+index c808bb271e9d0..b70b6e62449cc 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -2169,7 +2169,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band)
+ }
+
+ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel);
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period);
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period);
+ void rtw_get_channel_params(struct cfg80211_chan_def *chandef,
+ struct rtw_channel_params *ch_param);
+ bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target);
+--
+2.51.0
+
--- /dev/null
+From da2aeb61c4a89a7c3204833961ecbba60fd58e1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 01:26:45 +0200
+Subject: wifi: rtw88: Fix inadvertent sharing of struct
+ ieee80211_supported_band data
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit fcac0f23d4d20b11014a39f8e2527cdc12ec9c82 ]
+
+Internally wiphy writes to individual channels in this structure,
+so we must not share one static definition of channel list between
+multiple device instances, because that causes hard to debug
+breakage.
+
+For example, with two rtw88 driven devices in the system, channel
+information may get incoherent, preventing channel use.
+
+Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing
+of struct ieee80211_supported_band data").
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 34 +++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index eee6cba0bfa16..57fe4ece812c8 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1629,16 +1629,41 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev)
+ return len;
+ }
+
++static struct ieee80211_supported_band *
++rtw_sband_dup(struct rtw_dev *rtwdev,
++ const struct ieee80211_supported_band *sband)
++{
++ struct ieee80211_supported_band *dup;
++
++ dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL);
++ if (!dup)
++ return NULL;
++
++ dup->channels = devm_kmemdup_array(rtwdev->dev, sband->channels,
++ sband->n_channels,
++ sizeof(*sband->channels),
++ GFP_KERNEL);
++ if (!dup->channels)
++ return NULL;
++
++ dup->bitrates = devm_kmemdup_array(rtwdev->dev, sband->bitrates,
++ sband->n_bitrates,
++ sizeof(*sband->bitrates),
++ GFP_KERNEL);
++ if (!dup->bitrates)
++ return NULL;
++
++ return dup;
++}
++
+ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ const struct rtw_chip_info *chip)
+ {
+ struct ieee80211_supported_band *sband;
+ struct rtw_dev *rtwdev = hw->priv;
+- struct device *dev = rtwdev->dev;
+
+ if (chip->band & RTW_BAND_2G) {
+- sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband),
+- GFP_KERNEL);
++ sband = rtw_sband_dup(rtwdev, &rtw_band_2ghz);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+@@ -1647,8 +1672,7 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ }
+
+ if (chip->band & RTW_BAND_5G) {
+- sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband),
+- GFP_KERNEL);
++ sband = rtw_sband_dup(rtwdev, &rtw_band_5ghz);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+--
+2.51.0
+
--- /dev/null
+From 0979d03d7ecabdad38cdb4011d23786a94aaea8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:32:04 +0800
+Subject: wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
+
+From: Hsiu-Ming Chang <cges30901@gmail.com>
+
+[ Upstream commit 77653c327e11c71c5363b18a53fbf2b92ed21da4 ]
+
+Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB
+Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105.
+
+Signed-off-by: Hsiu-Ming Chang <cges30901@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+index a019f4085e738..1f5af09aed99f 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+@@ -37,6 +37,8 @@ static const struct usb_device_id rtw_8821cu_id_table[] = {
+ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0105, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Mercusys */
+ {},
+ };
+ MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table);
+--
+2.51.0
+
--- /dev/null
+From 32581a4cfc0bd0407e5b84e47a681bb04bb72938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 01:25:32 +0200
+Subject: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d ]
+
+Simplify the code by using device managed memory allocations.
+
+This also fixes a memory leak in rtw_register_hw(). The supported bands
+were not freed in the error path.
+
+Copied from commit 145df52a8671 ("wifi: rtw89: Convert
+rtw89_core_set_supported_band to use devm_*").
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index adfe23b28bf69..eee6cba0bfa16 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1632,11 +1632,13 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev)
+ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ const struct rtw_chip_info *chip)
+ {
+- struct rtw_dev *rtwdev = hw->priv;
+ struct ieee80211_supported_band *sband;
++ struct rtw_dev *rtwdev = hw->priv;
++ struct device *dev = rtwdev->dev;
+
+ if (chip->band & RTW_BAND_2G) {
+- sband = kmemdup(&rtw_band_2ghz, sizeof(*sband), GFP_KERNEL);
++ sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband),
++ GFP_KERNEL);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+@@ -1645,7 +1647,8 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ }
+
+ if (chip->band & RTW_BAND_5G) {
+- sband = kmemdup(&rtw_band_5ghz, sizeof(*sband), GFP_KERNEL);
++ sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband),
++ GFP_KERNEL);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+@@ -1661,13 +1664,6 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ rtw_err(rtwdev, "failed to set supported band\n");
+ }
+
+-static void rtw_unset_supported_band(struct ieee80211_hw *hw,
+- const struct rtw_chip_info *chip)
+-{
+- kfree(hw->wiphy->bands[NL80211_BAND_2GHZ]);
+- kfree(hw->wiphy->bands[NL80211_BAND_5GHZ]);
+-}
+-
+ static void rtw_vif_smps_iter(void *data, u8 *mac,
+ struct ieee80211_vif *vif)
+ {
+@@ -2285,10 +2281,7 @@ EXPORT_SYMBOL(rtw_register_hw);
+
+ void rtw_unregister_hw(struct rtw_dev *rtwdev, struct ieee80211_hw *hw)
+ {
+- const struct rtw_chip_info *chip = rtwdev->chip;
+-
+ ieee80211_unregister_hw(hw);
+- rtw_unset_supported_band(hw, chip);
+ rtw_debugfs_deinit(rtwdev);
+ }
+ EXPORT_SYMBOL(rtw_unregister_hw);
+--
+2.51.0
+
--- /dev/null
+From 5c86e367b7d76bb855c61dd8cd391eee8dbc83a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 12:41:57 +0800
+Subject: wifi: rtw89: 8922a: add digital compensation for 2GHz
+
+From: Po-Hao Huang <phhuang@realtek.com>
+
+[ Upstream commit 8da7e88682d58a7c2e2c2101e49d3c9c9ac481b0 ]
+
+This fixes transmit power too low under 2GHz connection. Previously
+we missed the settings of 2GHz, add the according calibrated tables.
+
+Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260117044157.2392958-10-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8922a.c | 57 +++++++++++++++----
+ 1 file changed, 47 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+index a4dce71db61d0..6f7ec37a76573 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+@@ -1704,6 +1704,32 @@ static int rtw8922a_ctrl_rx_path_tmac(struct rtw89_dev *rtwdev,
+ }
+
+ #define DIGITAL_PWR_COMP_REG_NUM 22
++static const u32 rtw8922a_digital_pwr_comp_2g_s0_val[][DIGITAL_PWR_COMP_REG_NUM] = {
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010000, 0x00000101,
++ 0x01010101, 0x02020201, 0x02010000, 0x03030202, 0x00000303,
++ 0x03020101, 0x06060504, 0x01010000, 0x06050403, 0x01000606,
++ 0x05040202, 0x07070706},
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101,
++ 0x01000000, 0x01010101, 0x01010000, 0x02020202, 0x00000404,
++ 0x03020101, 0x04040303, 0x02010000, 0x03030303, 0x00000505,
++ 0x03030201, 0x05050303},
++};
++
++static const u32 rtw8922a_digital_pwr_comp_2g_s1_val[][DIGITAL_PWR_COMP_REG_NUM] = {
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x01010000, 0x01010101, 0x00000101,
++ 0x01010100, 0x01010101, 0x01010000, 0x02020202, 0x01000202,
++ 0x02020101, 0x03030202, 0x02010000, 0x05040403, 0x01000606,
++ 0x05040302, 0x07070605},
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101,
++ 0x01010000, 0x02020201, 0x02010100, 0x03030202, 0x01000404,
++ 0x04030201, 0x05050404, 0x01010100, 0x04030303, 0x01000505,
++ 0x03030101, 0x05050404},
++};
++
+ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = {
+ {0x012C0096, 0x044C02BC, 0x00322710, 0x015E0096, 0x03C8028A,
+ 0x0BB80708, 0x17701194, 0x02020100, 0x03030303, 0x01000303,
+@@ -1718,7 +1744,7 @@ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = {
+ };
+
+ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev,
+- bool enable, u8 nss,
++ u8 band, u8 nss,
+ enum rtw89_rf_path path)
+ {
+ static const u32 ltpc_t0[2] = {R_BE_LTPC_T0_PATH0, R_BE_LTPC_T0_PATH1};
+@@ -1726,14 +1752,25 @@ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev,
+ u32 addr, val;
+ u32 i;
+
+- if (nss == 1)
+- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0];
+- else
+- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1];
++ if (nss == 1) {
++ if (band == RTW89_BAND_2G)
++ digital_pwr_comp = path == RF_PATH_A ?
++ rtw8922a_digital_pwr_comp_2g_s0_val[0] :
++ rtw8922a_digital_pwr_comp_2g_s1_val[0];
++ else
++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0];
++ } else {
++ if (band == RTW89_BAND_2G)
++ digital_pwr_comp = path == RF_PATH_A ?
++ rtw8922a_digital_pwr_comp_2g_s0_val[1] :
++ rtw8922a_digital_pwr_comp_2g_s1_val[1];
++ else
++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1];
++ }
+
+ addr = ltpc_t0[path];
+ for (i = 0; i < DIGITAL_PWR_COMP_REG_NUM; i++, addr += 4) {
+- val = enable ? digital_pwr_comp[i] : 0;
++ val = digital_pwr_comp[i];
+ rtw89_phy_write32(rtwdev, addr, val);
+ }
+ }
+@@ -1742,7 +1779,7 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev,
+ enum rtw89_phy_idx phy_idx)
+ {
+ const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_CHANCTX_0);
+- bool enable = chan->band_type != RTW89_BAND_2G;
++ u8 band = chan->band_type;
+ u8 path;
+
+ if (rtwdev->mlo_dbcc_mode == MLO_1_PLUS_1_1RF) {
+@@ -1750,10 +1787,10 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev,
+ path = RF_PATH_A;
+ else
+ path = RF_PATH_B;
+- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 1, path);
++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 1, path);
+ } else {
+- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_A);
+- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_B);
++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_A);
++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_B);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f2c053c326dd5c19a6b786886045889ad6bec588 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Nov 2025 10:18:56 +0100
+Subject: wifi: rtw89: 8922a: set random mac if efuse contains zeroes
+
+From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+
+[ Upstream commit 41be33d3efc120f6a2c02d12742655f2aa09e1b6 ]
+
+I have some rtl8922ae devices with no permanent mac stored in efuse.
+
+It could be properly saved and/or configured from user tools like
+NetworkManager, but it would be desirable to be able to initialize it
+somehow to get the device working by default.
+
+So, in the same way as with other devices, if the mac address read from
+efuse contains zeros, a random mac address is assigned to at least allow
+operation, and the user is warned about this in case any action needs to
+be considered.
+
+Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251126091905.217951-1-jtornosm@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8922a.c | 22 +++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+index 64a41f24b2adb..a4dce71db61d0 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+@@ -630,16 +630,30 @@ static int rtw8922a_read_efuse_rf(struct rtw89_dev *rtwdev, u8 *log_map)
+ static int rtw8922a_read_efuse(struct rtw89_dev *rtwdev, u8 *log_map,
+ enum rtw89_efuse_block block)
+ {
++ struct rtw89_efuse *efuse = &rtwdev->efuse;
++ int ret;
++
+ switch (block) {
+ case RTW89_EFUSE_BLOCK_HCI_DIG_PCIE_SDIO:
+- return rtw8922a_read_efuse_pci_sdio(rtwdev, log_map);
++ ret = rtw8922a_read_efuse_pci_sdio(rtwdev, log_map);
++ break;
+ case RTW89_EFUSE_BLOCK_HCI_DIG_USB:
+- return rtw8922a_read_efuse_usb(rtwdev, log_map);
++ ret = rtw8922a_read_efuse_usb(rtwdev, log_map);
++ break;
+ case RTW89_EFUSE_BLOCK_RF:
+- return rtw8922a_read_efuse_rf(rtwdev, log_map);
++ ret = rtw8922a_read_efuse_rf(rtwdev, log_map);
++ break;
+ default:
+- return 0;
++ ret = 0;
++ break;
++ }
++
++ if (!ret && is_zero_ether_addr(efuse->addr)) {
++ rtw89_info(rtwdev, "efuse mac address is zero, using random mac\n");
++ eth_random_addr(efuse->addr);
+ }
++
++ return ret;
+ }
+
+ #define THM_TRIM_POSITIVE_MASK BIT(6)
+--
+2.51.0
+
--- /dev/null
+From b28ae91b01d51c6db94689b0c70c6bd73b4567ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 09:39:50 +0800
+Subject: wifi: rtw89: fix unable to receive probe responses under MLO
+ connection
+
+From: Po-Hao Huang <phhuang@realtek.com>
+
+[ Upstream commit 6f6d7a325fbde4f025ee1b1277f6f44727e21223 ]
+
+During MLO connections, A1 of the probe responses we received are
+in link address, these frames will then be dropped by mac80211 due to
+not matching the MLD address in ieee80211_scan_accept_presp().
+Fix this by using MLD address to scan when not using random MAC address.
+
+Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260114013950.19704-13-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/fw.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index ae2c4ff74531a..b62b59bf528e7 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -6696,6 +6696,7 @@ void rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
+ struct cfg80211_scan_request *req = &scan_req->req;
+ const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
+ rtwvif_link->chanctx_idx);
++ struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
+ struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
+ u32 rx_fltr = rtwdev->hal.rx_fltr;
+ u8 mac_addr[ETH_ALEN];
+@@ -6714,6 +6715,8 @@ void rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
+ if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
+ get_random_mask_addr(mac_addr, req->mac_addr,
+ req->mac_addr_mask);
++ else if (ieee80211_vif_is_mld(vif))
++ ether_addr_copy(mac_addr, vif->addr);
+ else
+ ether_addr_copy(mac_addr, rtwvif_link->mac_addr);
+ rtw89_core_scan_start(rtwdev, rtwvif_link, mac_addr, true);
+--
+2.51.0
+
--- /dev/null
+From 1304cbefaaa85b89057a044c1bc3d8fbdce78bb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:17 +0800
+Subject: wifi: rtw89: mac: correct page number for CSI response
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit aa2a44d0d22d45d659b9f01638809b1735e46cff ]
+
+For beamforming procedure, hardware reserve memory page for CSI response.
+The unit of register is (value - 1), so add one accordingly as expected.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-7-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac_be.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
+index fe1964a6fcfb1..2896abce94a3c 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
+@@ -1166,7 +1166,7 @@ static int resp_pktctl_init_be(struct rtw89_dev *rtwdev, u8 mac_idx)
+
+ reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_RESP_CSI_RESERVED_PAGE, mac_idx);
+ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_START_PAGE_MASK, qt_cfg.pktid);
+- rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num);
++ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num + 1);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From a9e29d4324848e727be68056749efda0a0bc49fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 16:50:35 +0800
+Subject: wifi: rtw89: pci: restore LDO setting after device resume
+
+From: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+
+[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ]
+
+The LDO (Low Dropout Regulator) setting is missing after suspend/resume
+in some platforms, and it will cause card loss. Therefore, reconfigure
+this setting to avoid it.
+
+Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index a87e1778a0d41..c3a8a7af06472 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -4250,6 +4250,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev)
+ rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1,
+ B_AX_SEL_REQ_ENTR_L1);
+ }
++ rtw89_pci_hci_ldo(rtwdev);
+ rtw89_pci_l2_hci_ldo(rtwdev);
+ rtw89_pci_disable_eq(rtwdev);
+ rtw89_pci_cfg_dac(rtwdev);
+--
+2.51.0
+
--- /dev/null
+From 137aa900fe87de4f9a220916aa6bf44ede37171f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 11:06:44 +0800
+Subject: wifi: rtw89: ser: enable error IMR after recovering from L1
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit f4de946bdb379f543e3a599f8f048d741ad4a58e ]
+
+After recovering from L1, explicitly enable error IMR to ensure next
+L1 SER (system error recovery) can work normally.
+
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251223030651.480633-6-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac.c | 1 +
+ drivers/net/wireless/realtek/rtw89/mac.h | 1 +
+ drivers/net/wireless/realtek/rtw89/mac_be.c | 1 +
+ drivers/net/wireless/realtek/rtw89/ser.c | 10 ++++++++++
+ 4 files changed, 13 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index b956ea2add919..31465893f866d 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -6673,6 +6673,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_ax = {
+ .check_mac_en = rtw89_mac_check_mac_en_ax,
+ .sys_init = sys_init_ax,
+ .trx_init = trx_init_ax,
++ .err_imr_ctrl = err_imr_ctrl_ax,
+ .hci_func_en = rtw89_mac_hci_func_en_ax,
+ .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_ax,
+ .dle_func_en = dle_func_en_ax,
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h
+index 7974849f41e25..ad496a4f441aa 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.h
++++ b/drivers/net/wireless/realtek/rtw89/mac.h
+@@ -947,6 +947,7 @@ struct rtw89_mac_gen_def {
+ enum rtw89_mac_hwmod_sel sel);
+ int (*sys_init)(struct rtw89_dev *rtwdev);
+ int (*trx_init)(struct rtw89_dev *rtwdev);
++ void (*err_imr_ctrl)(struct rtw89_dev *rtwdev, bool en);
+ void (*hci_func_en)(struct rtw89_dev *rtwdev);
+ void (*dmac_func_pre_en)(struct rtw89_dev *rtwdev);
+ void (*dle_func_en)(struct rtw89_dev *rtwdev, bool enable);
+diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
+index f22eaa83297fb..fe1964a6fcfb1 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
+@@ -2575,6 +2575,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_be = {
+ .check_mac_en = rtw89_mac_check_mac_en_be,
+ .sys_init = sys_init_be,
+ .trx_init = trx_init_be,
++ .err_imr_ctrl = err_imr_ctrl_be,
+ .hci_func_en = rtw89_mac_hci_func_en_be,
+ .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_be,
+ .dle_func_en = dle_func_en_be,
+diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
+index 2a303a758e276..43970d0e5b33f 100644
+--- a/drivers/net/wireless/realtek/rtw89/ser.c
++++ b/drivers/net/wireless/realtek/rtw89/ser.c
+@@ -429,6 +429,14 @@ static void hal_send_m4_event(struct rtw89_ser *ser)
+ rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RCVY_EN);
+ }
+
++static void hal_enable_err_imr(struct rtw89_ser *ser)
++{
++ struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
++
++ mac->err_imr_ctrl(rtwdev, true);
++}
++
+ /* state handler */
+ static void ser_idle_st_hdl(struct rtw89_ser *ser, u8 evt)
+ {
+@@ -545,6 +553,8 @@ static void ser_do_hci_st_hdl(struct rtw89_ser *ser, u8 evt)
+ break;
+
+ case SER_EV_MAC_RESET_DONE:
++ hal_enable_err_imr(ser);
++
+ ser_state_goto(ser, SER_IDLE_ST);
+ break;
+
+--
+2.51.0
+
--- /dev/null
+From d436bb78b9e1ab01a1f20cef8cfc547471731c53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:13 +0800
+Subject: wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
+
+From: Chin-Yen Lee <timlee@realtek.com>
+
+[ Upstream commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b ]
+
+Some APs disconnect clients by sending a Disassociation frame
+rather than a Deauthentication frame. Since these frames use
+different reason codes in WoWLAN mode, this commit adds support
+for handling Disassociation to prevent missed disconnection events.
+
+Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/wow.c | 4 ++++
+ drivers/net/wireless/realtek/rtw89/wow.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
+index fdb715dc175c1..db68ac988cd24 100644
+--- a/drivers/net/wireless/realtek/rtw89/wow.c
++++ b/drivers/net/wireless/realtek/rtw89/wow.c
+@@ -759,6 +759,10 @@ static void rtw89_wow_show_wakeup_reason(struct rtw89_dev *rtwdev)
+
+ reason = rtw89_read8(rtwdev, wow_reason_reg);
+ switch (reason) {
++ case RTW89_WOW_RSN_RX_DISASSOC:
++ wakeup.disconnect = true;
++ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx disassoc\n");
++ break;
+ case RTW89_WOW_RSN_RX_DEAUTH:
+ wakeup.disconnect = true;
+ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx deauth\n");
+diff --git a/drivers/net/wireless/realtek/rtw89/wow.h b/drivers/net/wireless/realtek/rtw89/wow.h
+index f91991e8f2e30..d4b618fa4e3e5 100644
+--- a/drivers/net/wireless/realtek/rtw89/wow.h
++++ b/drivers/net/wireless/realtek/rtw89/wow.h
+@@ -28,6 +28,7 @@
+ enum rtw89_wake_reason {
+ RTW89_WOW_RSN_RX_PTK_REKEY = 0x1,
+ RTW89_WOW_RSN_RX_GTK_REKEY = 0x2,
++ RTW89_WOW_RSN_RX_DISASSOC = 0x4,
+ RTW89_WOW_RSN_RX_DEAUTH = 0x8,
+ RTW89_WOW_RSN_DISCONNECT = 0x10,
+ RTW89_WOW_RSN_RX_MAGIC_PKT = 0x21,
+--
+2.51.0
+
--- /dev/null
+From 2d3cc908d0617077d9f0958b98b06d6ae0684f16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 12:00:08 +0800
+Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when
+ CONFIG_X86_PAE is set
+
+From: Hou Wenlong <houwenlong.hwl@antgroup.com>
+
+[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ]
+
+The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests
+do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds
+different pagetables depending on whether CONFIG_X86_PAE is set.
+Therefore, enabling PAE mode for 32-bit KVM guests without
+CONFIG_X86_PAE being set would result in a boot failure during CR3
+loading.
+
+Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <d09ce9a134eb9cbc16928a5b316969f8ba606b81.1768017442.git.houwenlong.hwl@antgroup.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/pvh/head.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
+index ce4fd8d33da46..2774cf74fa940 100644
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -91,10 +91,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
+
+ leal rva(early_stack_end)(%ebp), %esp
+
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ /* Enable PAE mode. */
+ mov %cr4, %eax
+ orl $X86_CR4_PAE, %eax
+ mov %eax, %cr4
++#endif
+
+ #ifdef CONFIG_X86_64
+ /* Enable Long mode. */
+--
+2.51.0
+
--- /dev/null
+From 3a1ed66092b9e37d4d0a2f60b7e155ba67fa56f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 17:47:29 -0500
+Subject: xenbus: Use .freeze/.thaw to handle xenbus devices
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ]
+
+The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming
+from s3 or s2idle disconnects its PV devices during resume. The
+backends are not expecting this and do not reconnect.
+
+b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/
+resume/chkpt") changed xen_suspend()/do_suspend() from
+PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the
+suspend/resume callbacks remained.
+
+.freeze/restore are used with hiberation where Linux restarts in a new
+place in the future. .suspend/resume are useful for runtime power
+management for the duration of a boot.
+
+The current behavior of the callbacks works for an xl save/restore or
+live migration where the domain is restored/migrated to a new location
+and connecting to a not-already-connected backend.
+
+Change xenbus_pm_ops to use .freeze/thaw/restore and drop the
+.suspend/resume hook. This matches the use in drivers/xen/manage.c for
+save/restore and live migration. With .suspend/resume empty, PV devices
+are left connected during s2idle and s3, so PV devices are not changed
+and work after resume.
+
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Acked-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index fcb335bb7b187..1fdf5be193430 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev)
+ }
+
+ static const struct dev_pm_ops xenbus_pm_ops = {
+- .suspend = xenbus_dev_suspend,
+- .resume = xenbus_frontend_dev_resume,
+ .freeze = xenbus_dev_suspend,
+ .thaw = xenbus_dev_cancel,
+- .restore = xenbus_dev_resume,
++ .restore = xenbus_frontend_dev_resume,
+ };
+
+ static struct xen_bus_type xenbus_frontend = {
+--
+2.51.0
+
--- /dev/null
+From 0abde905a1da9b389072ba0e185154ff18e1f224 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 15:03:48 -0800
+Subject: 9p/xen: protect xen_9pfs_front_free against concurrent calls
+
+From: Stefano Stabellini <stefano.stabellini@amd.com>
+
+[ Upstream commit ce8ded2e61f47747e31eeefb44dc24a2160a7e32 ]
+
+The xenwatch thread can race with other back-end change notifications
+and call xen_9pfs_front_free() twice, hitting the observed general
+protection fault due to a double-free. Guard the teardown path so only
+one caller can release the front-end state at a time, preventing the
+crash.
+
+This is a fix for the following double-free:
+
+[ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
+[ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none)
+[ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150
+[ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42
+[ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246
+[ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000
+[ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000
+[ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000
+[ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68
+[ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040
+[ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000
+[ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660
+[ 27.052418] Call Trace:
+[ 27.052420] <TASK>
+[ 27.052422] xen_9pfs_front_changed+0x5d5/0x720
+[ 27.052426] ? xenbus_otherend_changed+0x72/0x140
+[ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10
+[ 27.052434] xenwatch_thread+0x94/0x1c0
+[ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10
+[ 27.052442] kthread+0xf8/0x240
+[ 27.052445] ? __pfx_kthread+0x10/0x10
+[ 27.052449] ? __pfx_kthread+0x10/0x10
+[ 27.052452] ret_from_fork+0x16b/0x1a0
+[ 27.052456] ? __pfx_kthread+0x10/0x10
+[ 27.052459] ret_from_fork_asm+0x1a/0x30
+[ 27.052463] </TASK>
+[ 27.052465] Modules linked in:
+[ 27.052471] ---[ end trace 0000000000000000 ]---
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
+Message-ID: <20260129230348.2390470-1-stefano.stabellini@amd.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/9p/trans_xen.c | 85 ++++++++++++++++++++++++----------------------
+ 1 file changed, 44 insertions(+), 41 deletions(-)
+
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index b9ff69c7522a1..068d57515dd58 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -274,45 +274,52 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
+ {
+ int i, j;
+
+- write_lock(&xen_9pfs_lock);
+- list_del(&priv->list);
+- write_unlock(&xen_9pfs_lock);
+-
+- for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
+- struct xen_9pfs_dataring *ring = &priv->rings[i];
+-
+- cancel_work_sync(&ring->work);
+-
+- if (!priv->rings[i].intf)
+- break;
+- if (priv->rings[i].irq > 0)
+- unbind_from_irqhandler(priv->rings[i].irq, ring);
+- if (priv->rings[i].data.in) {
+- for (j = 0;
+- j < (1 << priv->rings[i].intf->ring_order);
+- j++) {
+- grant_ref_t ref;
+-
+- ref = priv->rings[i].intf->ref[j];
+- gnttab_end_foreign_access(ref, NULL);
+- }
+- free_pages_exact(priv->rings[i].data.in,
++ if (priv->rings) {
++ for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
++ struct xen_9pfs_dataring *ring = &priv->rings[i];
++
++ cancel_work_sync(&ring->work);
++
++ if (!priv->rings[i].intf)
++ break;
++ if (priv->rings[i].irq > 0)
++ unbind_from_irqhandler(priv->rings[i].irq, ring);
++ if (priv->rings[i].data.in) {
++ for (j = 0;
++ j < (1 << priv->rings[i].intf->ring_order);
++ j++) {
++ grant_ref_t ref;
++
++ ref = priv->rings[i].intf->ref[j];
++ gnttab_end_foreign_access(ref, NULL);
++ }
++ free_pages_exact(priv->rings[i].data.in,
+ 1UL << (priv->rings[i].intf->ring_order +
+ XEN_PAGE_SHIFT));
++ }
++ gnttab_end_foreign_access(priv->rings[i].ref, NULL);
++ free_page((unsigned long)priv->rings[i].intf);
+ }
+- gnttab_end_foreign_access(priv->rings[i].ref, NULL);
+- free_page((unsigned long)priv->rings[i].intf);
++ kfree(priv->rings);
+ }
+- kfree(priv->rings);
+ kfree(priv->tag);
+ kfree(priv);
+ }
+
+ static void xen_9pfs_front_remove(struct xenbus_device *dev)
+ {
+- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
++ struct xen_9pfs_front_priv *priv;
+
++ write_lock(&xen_9pfs_lock);
++ priv = dev_get_drvdata(&dev->dev);
++ if (priv == NULL) {
++ write_unlock(&xen_9pfs_lock);
++ return;
++ }
+ dev_set_drvdata(&dev->dev, NULL);
++ list_del(&priv->list);
++ write_unlock(&xen_9pfs_lock);
++
+ xen_9pfs_front_free(priv);
+ }
+
+@@ -379,7 +386,7 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ {
+ int ret, i;
+ struct xenbus_transaction xbt;
+- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
++ struct xen_9pfs_front_priv *priv;
+ char *versions, *v;
+ unsigned int max_rings, max_ring_order, len = 0;
+
+@@ -407,6 +414,10 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ if (p9_xen_trans.maxsize > XEN_FLEX_RING_SIZE(max_ring_order))
+ p9_xen_trans.maxsize = XEN_FLEX_RING_SIZE(max_ring_order) / 2;
+
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv)
++ return -ENOMEM;
++ priv->dev = dev;
+ priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings),
+ GFP_KERNEL);
+ if (!priv->rings) {
+@@ -465,6 +476,11 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ goto error;
+ }
+
++ write_lock(&xen_9pfs_lock);
++ dev_set_drvdata(&dev->dev, priv);
++ list_add_tail(&priv->list, &xen_9pfs_devs);
++ write_unlock(&xen_9pfs_lock);
++
+ xenbus_switch_state(dev, XenbusStateInitialised);
+ return 0;
+
+@@ -479,19 +495,6 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ static int xen_9pfs_front_probe(struct xenbus_device *dev,
+ const struct xenbus_device_id *id)
+ {
+- struct xen_9pfs_front_priv *priv = NULL;
+-
+- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv)
+- return -ENOMEM;
+-
+- priv->dev = dev;
+- dev_set_drvdata(&dev->dev, priv);
+-
+- write_lock(&xen_9pfs_lock);
+- list_add_tail(&priv->list, &xen_9pfs_devs);
+- write_unlock(&xen_9pfs_lock);
+-
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9637d1d8576613a754750d628ed05b492c044a63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 10:16:03 -0800
+Subject: accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg()
+
+From: Lizhi Hou <lizhi.hou@amd.com>
+
+[ Upstream commit cd77d5a4aaf8c5c1d819f47cf814bf7d4920b0a2 ]
+
+In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll for a
+non-zero tail pointer. This assumed that a zero value indicates an error.
+However, certain corner cases legitimately produce a zero tail pointer.
+To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail
+pointer will be treated as a valid rewind event.
+
+Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
+Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
+Link: https://patch.msgid.link/20251204181603.793824-1-lizhi.hou@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------
+ 1 file changed, 1 insertion(+), 18 deletions(-)
+
+diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
+index a80c77a478bff..2bacb89cd80c9 100644
+--- a/drivers/accel/amdxdna/amdxdna_mailbox.c
++++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
+@@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct mailbox_channel *mb_chann, u32 mbox_reg)
+ return readl(ringbuf_addr);
+ }
+
+-static int mailbox_reg_read_non_zero(struct mailbox_channel *mb_chann, u32 mbox_reg, u32 *val)
+-{
+- struct xdna_mailbox_res *mb_res = &mb_chann->mb->res;
+- void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg;
+- int ret, value;
+-
+- /* Poll till value is not zero */
+- ret = readx_poll_timeout(readl, ringbuf_addr, value,
+- value, 1 /* us */, 100);
+- if (ret < 0)
+- return ret;
+-
+- *val = value;
+- return 0;
+-}
+-
+ static inline void
+ mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val)
+ {
+@@ -288,8 +272,7 @@ static int mailbox_get_msg(struct mailbox_channel *mb_chann)
+ u32 start_addr;
+ int ret;
+
+- if (mailbox_reg_read_non_zero(mb_chann, mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail))
+- return -EINVAL;
++ tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X);
+ head = mb_chann->i2x_head;
+ ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X);
+ start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr;
+--
+2.51.0
+
--- /dev/null
+From 4d80009534e94e478afc3e153a62bb98611e2c46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 17:48:56 +0300
+Subject: ACPI: battery: fix incorrect charging status when current is zero
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ata İlhan Köktürk <atailhan2006@gmail.com>
+
+[ Upstream commit bb1256e0ddc7e9e406164319769b9f8d8389f056 ]
+
+On some laptops, such as the Huawei Matebook series, the embedded
+controller continues to report "Charging" status even when the
+charge threshold is reached and no current is being drawn.
+
+This incorrect reporting prevents the system from switching to battery
+power profiles, leading to significantly higher power (e.g., 18W instead
+of 7W during browsing) and missed remaining battery time estimation.
+
+Validate the "Charging" state by checking if rate_now is zero. If the
+hardware reports charging but the current is zero, report "Not Charging"
+to user space.
+
+Signed-off-by: Ata İlhan Köktürk <atailhan2006@gmail.com>
+[ rjw: Whitespace fix, braces added to an inner if (), new comment rewrite ]
+[ rjw: Changelog edits ]
+Link: https://patch.msgid.link/20260129144856.43058-1-atailhan2006@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/battery.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 67b76492c839c..8196c17b5a970 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -212,7 +212,14 @@ static int acpi_battery_get_property(struct power_supply *psy,
+ if (battery->state & ACPI_BATTERY_STATE_DISCHARGING)
+ val->intval = acpi_battery_handle_discharging(battery);
+ else if (battery->state & ACPI_BATTERY_STATE_CHARGING)
+- val->intval = POWER_SUPPLY_STATUS_CHARGING;
++ /* Validate the status by checking the current. */
++ if (battery->rate_now != ACPI_BATTERY_VALUE_UNKNOWN &&
++ battery->rate_now == 0) {
++ /* On charge but no current (0W/0mA). */
++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
++ } else {
++ val->intval = POWER_SUPPLY_STATUS_CHARGING;
++ }
+ else if (battery->state & ACPI_BATTERY_STATE_CHARGE_LIMITING)
+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
+ else if (acpi_battery_is_charged(battery))
+--
+2.51.0
+
--- /dev/null
+From 08fbd54d930b13f50884a6a9ceb9a6969b301415 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 00:32:14 +0800
+Subject: ACPI: processor: Fix NULL-pointer dereference in
+ acpi_processor_errata_piix4()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ]
+
+In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
+device and then reassigned an ISA device:
+
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
+
+If the first lookup succeeds but the second fails, dev becomes NULL. This
+leads to a potential null-pointer dereference when dev_dbg() is called:
+
+ if (errata.piix4.bmisx)
+ dev_dbg(&dev->dev, ...);
+
+To prevent this, use two temporary pointers and retrieve each device
+independently, avoiding overwriting dev with a possible NULL value.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+[ rjw: Subject adjustment, added an empty code line ]
+Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_processor.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index 7ec1dc04fd11b..85096ce7b658b 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ {
+ u8 value1 = 0;
+ u8 value2 = 0;
++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL;
+
+
+ if (!dev)
+@@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * each IDE controller's DMA status to make sure we catch all
+ * DMA activity.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- errata.piix4.bmisx = pci_resource_start(dev, 4);
+- pci_dev_put(dev);
++ if (ide_dev) {
++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
++ pci_dev_put(ide_dev);
+ }
+
+ /*
+@@ -124,24 +125,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * disable C3 support if this is enabled, as some legacy
+ * devices won't operate well if fast DMA is disabled.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB_0,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- pci_read_config_byte(dev, 0x76, &value1);
+- pci_read_config_byte(dev, 0x77, &value2);
++ if (isa_dev) {
++ pci_read_config_byte(isa_dev, 0x76, &value1);
++ pci_read_config_byte(isa_dev, 0x77, &value2);
+ if ((value1 & 0x80) || (value2 & 0x80))
+ errata.piix4.fdma = 1;
+- pci_dev_put(dev);
++ pci_dev_put(isa_dev);
+ }
+
+ break;
+ }
+
+- if (errata.piix4.bmisx)
+- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
+- if (errata.piix4.fdma)
+- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
++ if (ide_dev)
++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
++
++ if (isa_dev)
++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From d6db05521a3a14b96f0fc28f5887588bf2ea9346 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 15:27:19 +0800
+Subject: ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
+
+From: Ai Chao <aichao@kylinos.cn>
+
+[ Upstream commit ba6ded26dffe511b862a98a25955955e7154bfa8 ]
+
+Like the JWIPC JVC9100 has its serial IRQ (10 and 11) described
+as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which
+breaks the serial.
+
+irq 10, level, active-low, shared, skip-override
+irq 11, level, active-low, shared, skip-override
+
+Add the JVC9100 to the irq1_level_low_skip_override[] quirk table to fix
+this.
+
+Signed-off-by: Ai Chao <aichao@kylinos.cn>
+Link: https://patch.msgid.link/20260113072719.4154485-1-aichao@kylinos.cn
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index d16906f46484d..bc8050d8a6f51 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -532,6 +532,12 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "16T90SP"),
+ },
+ },
++ {
++ /* JWIPC JVC9100 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "JVC9100"),
++ },
++ },
+ { }
+ };
+
+@@ -706,6 +712,8 @@ struct irq_override_cmp {
+
+ static const struct irq_override_cmp override_table[] = {
+ { irq1_level_low_skip_override, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false },
++ { irq1_level_low_skip_override, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false },
++ { irq1_level_low_skip_override, 11, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false },
+ { irq1_edge_low_force_override, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From fb0a979ee5185488228173c4ad6d98fb35b00943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Feb 2026 00:22:42 +0200
+Subject: ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
+
+From: Yauhen Kharuzhy <jekhor@gmail.com>
+
+[ Upstream commit a8c975302868c716afef0f50467bebbd069a35b8 ]
+
+The PWM2 on YB1-X90 tablets is used for keyboard backlight control but
+it is disabled in the ACPI DSDT table. Add it to the override_status_ids
+list to allow keyboard function control driver
+(drivers/platform/x86/lenovo/yogabook.c) to use it.
+
+Signed-off-by: Yauhen Kharuzhy <jekhor@gmail.com>
+Link: https://patch.msgid.link/20260211222242.4101162-1-jekhor@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index 4ee30c2897a2b..418951639f511 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -81,6 +81,18 @@ static const struct override_status_id override_status_ids[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"),
+ }),
+
++ /*
++ * Lenovo Yoga Book uses PWM2 for touch keyboard backlight control.
++ * It needs to be enabled only for the Android device version (YB1-X90*
++ * aka YETI-11); the Windows version (YB1-X91*) uses ACPI control
++ * methods.
++ */
++ PRESENT_ENTRY_HID("80862289", "2", INTEL_ATOM_AIRMONT, {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"),
++ }),
++
+ /*
+ * The INT0002 device is necessary to clear wakeup interrupt sources
+ * on Cherry Trail devices, without it we get nobody cared IRQ msgs.
+--
+2.51.0
+
--- /dev/null
+From e42212e112e51c164ae4308e0707fb2f31b87d96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 21:01:21 +0100
+Subject: ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
+
+From: Jakob Riemenschneider <riemenschneiderjakob@gmail.com>
+
+[ Upstream commit 229ecbaac6b31f89c554b77eb407377a5eade7d4 ]
+
+Windows 11, version 22H2 introduced a new function index (Function 9) to
+the Microsoft LPS0 _DSM, titled "Turn On Display Notification".
+
+According to Microsoft documentation, this function signals to the system
+firmware that the OS intends to turn on the display when exiting Modern
+Standby. This allows the firmware to release Power Limits (PLx) earlier.
+
+Crucially, this patch fixes a functional issue observed on the Lenovo Yoga
+Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to
+resume after suspend. Investigation linked shows the EC on this device
+turns off these components during sleep but requires the Function 9
+notification to wake them up again.
+
+This patch defines the new function index (ACPI_MS_TURN_ON_DISPLAY) and
+invokes it in acpi_s2idle_restore_early_lps0(). The execution order is
+updated to match the logic of an "intent" signal:
+
+ 1. LPS0 Exit (Function 6)
+ 2. Turn On Display Intent (Function 9)
+ 3. Modern Standby Exit (Function 8)
+ 4. Screen On (Function 4)
+
+Invoking Function 9 before the Modern Standby Exit ensures the firmware
+has time to restore power rails and functionality (like fans) before the
+software fully exits the sleep state.
+
+Link: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications#turn-on-display-notification-function-9
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220505
+Suggested-by: Antheas Kapenekakis <antheas@antheas.dev>
+Signed-off-by: Jakob Riemenschneider <riemenschneiderjakob@gmail.com>
+Link: https://patch.msgid.link/20260127200121.1292216-1-riemenschneiderjakob@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/s2idle.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c
+index dd0b40b9bbe8b..377a268867c21 100644
+--- a/drivers/acpi/x86/s2idle.c
++++ b/drivers/acpi/x86/s2idle.c
+@@ -45,6 +45,7 @@ static const struct acpi_device_id lps0_device_ids[] = {
+ #define ACPI_LPS0_EXIT 6
+ #define ACPI_LPS0_MS_ENTRY 7
+ #define ACPI_LPS0_MS_EXIT 8
++#define ACPI_MS_TURN_ON_DISPLAY 9
+
+ /* AMD */
+ #define ACPI_LPS0_DSM_UUID_AMD "e3f32452-febc-43ce-9039-932122d37721"
+@@ -373,6 +374,8 @@ static const char *acpi_sleep_dsm_state_to_str(unsigned int state)
+ return "lps0 ms entry";
+ case ACPI_LPS0_MS_EXIT:
+ return "lps0 ms exit";
++ case ACPI_MS_TURN_ON_DISPLAY:
++ return "lps0 ms turn on display";
+ }
+ } else {
+ switch (state) {
+@@ -619,6 +622,9 @@ void acpi_s2idle_restore_early(void)
+ if (lps0_dsm_func_mask_microsoft > 0) {
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT,
+ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
++ /* Intent to turn on display */
++ acpi_sleep_run_lps0_dsm(ACPI_MS_TURN_ON_DISPLAY,
++ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
+ /* Modern Standby exit */
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_EXIT,
+ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
+--
+2.51.0
+
--- /dev/null
+From 0fc87ea7500d31500424e1e0558523a0ef1d72a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 13:25:33 +0100
+Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ]
+
+The ACPI specification states that when executing AML_FATAL_OP,
+the OS should log the fatal error event and shutdown in a timely
+fashion.
+
+Windows complies with this requirement by immediatly entering a
+Bso_d, effectively aborting the execution of the AML bytecode in
+question.
+
+ACPICA however might continue with the AML bytecode execution
+should acpi_os_signal() simply return AE_OK. This will cause issues
+because ACPI BIOS implementations might assume that the Fatal()
+operator does not return.
+
+Fix this by aborting the AML bytecode execution in such a case
+by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a
+local variable because of its small size (12 bytes) and to ensure
+that acpi_os_signal() always receives valid information about the
+fatal ACPI BIOS error.
+
+Link: https://github.com/acpica/acpica/commit/d516c7758ba6
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++---------------------
+ 1 file changed, 18 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
+index bf08110ed6d25..c8c8c4e49563e 100644
+--- a/drivers/acpi/acpica/exoparg3.c
++++ b/drivers/acpi/acpica/exoparg3.c
+@@ -10,6 +10,7 @@
+ #include <acpi/acpi.h>
+ #include "accommon.h"
+ #include "acinterp.h"
++#include <acpi/acoutput.h>
+ #include "acparser.h"
+ #include "amlcode.h"
+
+@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3")
+ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ {
+ union acpi_operand_object **operand = &walk_state->operands[0];
+- struct acpi_signal_fatal_info *fatal;
+- acpi_status status = AE_OK;
++ struct acpi_signal_fatal_info fatal;
+
+ ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R,
+ acpi_ps_get_opcode_name(walk_state->opcode));
+@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ switch (walk_state->opcode) {
+ case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */
+
+- ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+- "FatalOp: Type %X Code %X Arg %X "
+- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
+- (u32)operand[0]->integer.value,
+- (u32)operand[1]->integer.value,
+- (u32)operand[2]->integer.value));
+-
+- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info));
+- if (fatal) {
+- fatal->type = (u32) operand[0]->integer.value;
+- fatal->code = (u32) operand[1]->integer.value;
+- fatal->argument = (u32) operand[2]->integer.value;
+- }
++ fatal.type = (u32)operand[0]->integer.value;
++ fatal.code = (u32)operand[1]->integer.value;
++ fatal.argument = (u32)operand[2]->integer.value;
+
+- /* Always signal the OS! */
++ ACPI_BIOS_ERROR((AE_INFO,
++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n",
++ fatal.type, fatal.code, fatal.argument));
+
+- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal);
++ /* Always signal the OS! */
+
+- /* Might return while OS is shutting down, just continue */
++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal);
+
+- ACPI_FREE(fatal);
+- goto cleanup;
++ /*
++ * Might return while OS is shutting down, so abort the AML execution
++ * by returning an error.
++ */
++ return_ACPI_STATUS(AE_ERROR);
+
+ case AML_EXTERNAL_OP:
+ /*
+@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ * wrong if an external opcode ever gets here.
+ */
+ ACPI_ERROR((AE_INFO, "Executed External Op"));
+- status = AE_OK;
+- goto cleanup;
++
++ return_ACPI_STATUS(AE_OK);
+
+ default:
+
+ ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X",
+ walk_state->opcode));
+
+- status = AE_AML_BAD_OPCODE;
+- goto cleanup;
++ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
+ }
+-
+-cleanup:
+-
+- return_ACPI_STATUS(status);
+ }
+
+ /*******************************************************************************
+--
+2.51.0
+
--- /dev/null
+From 80504fea45d9e98ebcd7b499ecb3fd38c90f3b8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 18:30:43 +0100
+Subject: alpha: fix user-space corruption during memory compaction
+
+From: Magnus Lindholm <linmag7@gmail.com>
+
+[ Upstream commit dd5712f3379cfe760267cdd28ff957d9ab4e51c7 ]
+
+Alpha systems can suffer sporadic user-space crashes and heap
+corruption when memory compaction is enabled.
+
+Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned
+tcache chunk"), and compiler internal errors. The failures disappear
+when compaction is disabled or when using global TLB invalidation.
+
+The root cause is insufficient TLB shootdown during page migration.
+Alpha relies on ASN-based MM context rollover for instruction cache
+coherency, but this alone is not sufficient to prevent stale data or
+instruction translations from surviving migration.
+
+Fix this by introducing a migration-specific helper that combines:
+ - MM context invalidation (ASN rollover),
+ - immediate per-CPU TLB invalidation (TBI),
+ - synchronous cross-CPU shootdown when required.
+
+The helper is used only by migration/compaction paths to avoid changing
+global TLB semantics.
+
+Additionally, update flush_tlb_other(), pte_clear(), to use
+READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering.
+
+This fixes observed crashes on both UP and SMP Alpha systems.
+
+Reviewed-by: Ivan Kokshaysky <ink@unseen.parts>
+Tested-by: Matoro Mahri <matoro_mailinglist_kernel@matoro.tk>
+Tested-by: Michael Cree <mcree@orcon.net.nz>
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/20260102173603.18247-2-linmag7@gmail.com
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/asm/pgtable.h | 33 ++++++++-
+ arch/alpha/include/asm/tlbflush.h | 4 +-
+ arch/alpha/mm/Makefile | 2 +-
+ arch/alpha/mm/tlbflush.c | 112 ++++++++++++++++++++++++++++++
+ 4 files changed, 148 insertions(+), 3 deletions(-)
+ create mode 100644 arch/alpha/mm/tlbflush.c
+
+diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
+index 90e7a95391022..c9508ec37efc4 100644
+--- a/arch/alpha/include/asm/pgtable.h
++++ b/arch/alpha/include/asm/pgtable.h
+@@ -17,6 +17,7 @@
+ #include <asm/processor.h> /* For TASK_SIZE */
+ #include <asm/machvec.h>
+ #include <asm/setup.h>
++#include <linux/page_table_check.h>
+
+ struct mm_struct;
+ struct vm_area_struct;
+@@ -183,6 +184,9 @@ extern inline void pud_set(pud_t * pudp, pmd_t * pmdp)
+ { pud_val(*pudp) = _PAGE_TABLE | ((((unsigned long) pmdp) - PAGE_OFFSET) << (32-PAGE_SHIFT)); }
+
+
++extern void migrate_flush_tlb_page(struct vm_area_struct *vma,
++ unsigned long addr);
++
+ extern inline unsigned long
+ pmd_page_vaddr(pmd_t pmd)
+ {
+@@ -202,7 +206,7 @@ extern inline int pte_none(pte_t pte) { return !pte_val(pte); }
+ extern inline int pte_present(pte_t pte) { return pte_val(pte) & _PAGE_VALID; }
+ extern inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+- pte_val(*ptep) = 0;
++ WRITE_ONCE(pte_val(*ptep), 0);
+ }
+
+ extern inline int pmd_none(pmd_t pmd) { return !pmd_val(pmd); }
+@@ -264,6 +268,33 @@ extern inline pte_t * pte_offset_kernel(pmd_t * dir, unsigned long address)
+
+ extern pgd_t swapper_pg_dir[1024];
+
++#ifdef CONFIG_COMPACTION
++#define __HAVE_ARCH_PTEP_GET_AND_CLEAR
++
++static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
++ unsigned long address,
++ pte_t *ptep)
++{
++ pte_t pte = READ_ONCE(*ptep);
++
++ pte_clear(mm, address, ptep);
++ return pte;
++}
++
++#define __HAVE_ARCH_PTEP_CLEAR_FLUSH
++
++static inline pte_t ptep_clear_flush(struct vm_area_struct *vma,
++ unsigned long addr, pte_t *ptep)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ pte_t pte = ptep_get_and_clear(mm, addr, ptep);
++
++ page_table_check_pte_clear(mm, pte);
++ migrate_flush_tlb_page(vma, addr);
++ return pte;
++}
++
++#endif
+ /*
+ * The Alpha doesn't have any external MMU info: the kernel page
+ * tables contain all the necessary information.
+diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h
+index ba4b359d6c395..0c8529997f54e 100644
+--- a/arch/alpha/include/asm/tlbflush.h
++++ b/arch/alpha/include/asm/tlbflush.h
+@@ -58,7 +58,9 @@ flush_tlb_other(struct mm_struct *mm)
+ unsigned long *mmc = &mm->context[smp_processor_id()];
+ /* Check it's not zero first to avoid cacheline ping pong
+ when possible. */
+- if (*mmc) *mmc = 0;
++
++ if (READ_ONCE(*mmc))
++ WRITE_ONCE(*mmc, 0);
+ }
+
+ #ifndef CONFIG_SMP
+diff --git a/arch/alpha/mm/Makefile b/arch/alpha/mm/Makefile
+index 101dbd06b4ceb..2d05664058f64 100644
+--- a/arch/alpha/mm/Makefile
++++ b/arch/alpha/mm/Makefile
+@@ -3,4 +3,4 @@
+ # Makefile for the linux alpha-specific parts of the memory manager.
+ #
+
+-obj-y := init.o fault.o
++obj-y := init.o fault.o tlbflush.o
+diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
+new file mode 100644
+index 0000000000000..ccbc317b9a348
+--- /dev/null
++++ b/arch/alpha/mm/tlbflush.c
+@@ -0,0 +1,112 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Alpha TLB shootdown helpers
++ *
++ * Copyright (C) 2025 Magnus Lindholm <linmag7@gmail.com>
++ *
++ * Alpha-specific TLB flush helpers that cannot be expressed purely
++ * as inline functions.
++ *
++ * These helpers provide combined MM context handling (ASN rollover)
++ * and immediate TLB invalidation for page migration and memory
++ * compaction paths, where lazy shootdowns are insufficient.
++ */
++
++#include <linux/mm.h>
++#include <linux/smp.h>
++#include <linux/sched.h>
++#include <asm/tlbflush.h>
++#include <asm/pal.h>
++#include <asm/mmu_context.h>
++
++#define asn_locked() (cpu_data[smp_processor_id()].asn_lock)
++
++/*
++ * Migration/compaction helper: combine mm context (ASN) handling with an
++ * immediate per-page TLB invalidate and (for exec) an instruction barrier.
++ *
++ * This mirrors the SMP combined IPI handler semantics, but runs locally on UP.
++ */
++#ifndef CONFIG_SMP
++void migrate_flush_tlb_page(struct vm_area_struct *vma,
++ unsigned long addr)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ int tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2;
++
++ /*
++ * First do the mm-context side:
++ * If we're currently running this mm, reload a fresh context ASN.
++ * Otherwise, mark context invalid.
++ *
++ * On UP, this is mostly about matching the SMP semantics and ensuring
++ * exec/i-cache tagging assumptions hold when compaction migrates pages.
++ */
++ if (mm == current->active_mm)
++ flush_tlb_current(mm);
++ else
++ flush_tlb_other(mm);
++
++ /*
++ * Then do the immediate translation kill for this VA.
++ * For exec mappings, order instruction fetch after invalidation.
++ */
++ tbi(tbi_type, addr);
++}
++
++#else
++struct tlb_mm_and_addr {
++ struct mm_struct *mm;
++ unsigned long addr;
++ int tbi_type; /* 2 = DTB, 3 = ITB+DTB */
++};
++
++static void ipi_flush_mm_and_page(void *x)
++{
++ struct tlb_mm_and_addr *d = x;
++
++ /* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */
++ if (d->mm == current->active_mm && !asn_locked())
++ __load_new_mm_context(d->mm);
++ else
++ flush_tlb_other(d->mm);
++
++ /* Part 2: immediate per-VA invalidation on this CPU. */
++ tbi(d->tbi_type, d->addr);
++}
++
++void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ struct tlb_mm_and_addr d = {
++ .mm = mm,
++ .addr = addr,
++ .tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2,
++ };
++
++ /*
++ * One synchronous rendezvous: every CPU runs ipi_flush_mm_and_page().
++ * This is the "combined" version of flush_tlb_mm + per-page invalidate.
++ */
++ preempt_disable();
++ on_each_cpu(ipi_flush_mm_and_page, &d, 1);
++
++ /*
++ * mimic flush_tlb_mm()'s mm_users<=1 optimization.
++ */
++ if (atomic_read(&mm->mm_users) <= 1) {
++
++ int cpu, this_cpu;
++ this_cpu = smp_processor_id();
++
++ for (cpu = 0; cpu < NR_CPUS; cpu++) {
++ if (!cpu_online(cpu) || cpu == this_cpu)
++ continue;
++ if (READ_ONCE(mm->context[cpu]))
++ WRITE_ONCE(mm->context[cpu], 0);
++ }
++ }
++ preempt_enable();
++}
++
++#endif
+--
+2.51.0
+
--- /dev/null
+From 0e6ea2eb32f1158e6e85c0004806d69c20e1ec0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 23:55:01 +0800
+Subject: ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
+
+From: gongqi <550230171hxy@gmail.com>
+
+[ Upstream commit f2581ea2d9f30844c437e348a462027ea25c12e9 ]
+
+The headset microphone on the MECHREVO Wujie 15X Pro requires the
+CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID
+(0x1d05:0x3012) to the quirk table.
+
+Signed-off-by: gongqi <550230171hxy@gmail.com>
+Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
+index 0c517378a6d28..f71123a475464 100644
+--- a/sound/hda/codecs/conexant.c
++++ b/sound/hda/codecs/conexant.c
+@@ -1134,6 +1134,7 @@ static const struct hda_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad/Ideapad", CXT_FIXUP_LENOVO_XPAD_ACPI),
+ SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
+ SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
++ SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC),
+ HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER),
+ HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER),
+ {}
+--
+2.51.0
+
--- /dev/null
+From 0ad864a57fdd6da36d713f9d0d3867a49c69b48d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Feb 2026 22:32:10 +0100
+Subject: ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
+
+From: Aaron Erhardt <aer@tuxedocomputers.com>
+
+[ Upstream commit d649c58bcad8fb9b749e3837136a201632fa109d ]
+
+Depending on the timing during boot, the BIOS might report wrong pin
+capabilities, which can lead to HDMI audio being disabled. Therefore,
+force HDMI audio connection on TUXEDO InfinityBook S 14 Gen6.
+
+Signed-off-by: Aaron Erhardt <aer@tuxedocomputers.com>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260218213234.429686-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/hdmi/hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c
+index 111c9b5335afc..c2e3adc7b3c00 100644
+--- a/sound/hda/codecs/hdmi/hdmi.c
++++ b/sound/hda/codecs/hdmi/hdmi.c
+@@ -1557,6 +1557,7 @@ static const struct snd_pci_quirk force_connect_list[] = {
+ SND_PCI_QUIRK(0x1043, 0x86ae, "ASUS", 1), /* Z170 PRO */
+ SND_PCI_QUIRK(0x1043, 0x86c7, "ASUS", 1), /* Z170M PLUS */
+ SND_PCI_QUIRK(0x1462, 0xec94, "MS-7C94", 1),
++ SND_PCI_QUIRK(0x1558, 0x14a1, "TUXEDO InfinityBook S 14 Gen6", 1),
+ SND_PCI_QUIRK(0x8086, 0x2060, "Intel NUC5CPYB", 1),
+ SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1),
+ {}
+--
+2.51.0
+
--- /dev/null
+From 1743ca4241fdf8a80f9736f9b35c7510ed12dbd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 00:12:40 +0530
+Subject: ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
+
+From: Bharat Dev Burman <bharat.singh7924@gmail.com>
+
+[ Upstream commit 72919c57a055f6d7b79d66731dc398e9b433f47c ]
+
+HP Victus 16-e0xxx with ALC245 codec does not handle the toggling of
+the mute LED.
+This patch adds a quirk entry for subsystem ID 0x88eb using a new
+ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT fixup, enabling correct mute LED
+behavior.
+
+Signed-off-by: Bharat Dev Burman <bharat.singh7924@gmail.com>
+Link: https://patch.msgid.link/20260112184253.33376-1-bharat.singh7924@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 66da4584aa7a5..48edf55621854 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -1551,6 +1551,22 @@ static void alc245_fixup_hp_mute_led_v1_coefbit(struct hda_codec *codec,
+ }
+ }
+
++static void alc245_fixup_hp_mute_led_v2_coefbit(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->mute_led_polarity = 0;
++ spec->mute_led_coef.idx = 0x0b;
++ spec->mute_led_coef.mask = 1 << 3;
++ spec->mute_led_coef.on = 1 << 3;
++ spec->mute_led_coef.off = 0;
++ snd_hda_gen_add_mute_led_cdev(codec, coef_mute_led_set);
++ }
++}
++
+ /* turn on/off mic-mute LED per capture hook by coef bit */
+ static int coef_micmute_led_set(struct led_classdev *led_cdev,
+ enum led_brightness brightness)
+@@ -3719,6 +3735,7 @@ enum {
+ ALC287_FIXUP_YOGA7_14ARB7_I2C,
+ ALC245_FIXUP_HP_MUTE_LED_COEFBIT,
+ ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT,
++ ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT,
+ ALC245_FIXUP_HP_X360_MUTE_LEDS,
+ ALC287_FIXUP_THINKPAD_I2S_SPK,
+ ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD,
+@@ -6047,6 +6064,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc245_fixup_hp_mute_led_v1_coefbit,
+ },
++ [ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc245_fixup_hp_mute_led_v2_coefbit,
++ },
+ [ALC245_FIXUP_HP_X360_MUTE_LEDS] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc245_fixup_hp_mute_led_coefbit,
+@@ -6520,6 +6541,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
++ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT),
+ SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+ SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),
+--
+2.51.0
+
--- /dev/null
+From 721dbc0a8f4b32cce2302377e355481059be8085 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Feb 2026 23:19:37 +0100
+Subject: ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
+
+From: Illia Barbashyn <04baril@gmail.com>
+
+[ Upstream commit ac1ff574bbc09a6c90f4fe8f9e6b8d66c983064c ]
+
+The mute and mic-mute LEDs on HP ENVY x360 Convertible 15-es0xxx
+(PCI SSID 103c:88b3) do not work with the current driver.
+
+This model requires a combination of COEFBIT and GPIO fixups to
+correctly control the LEDs. Introduce a new fixup function
+alc245_fixup_hp_envy_x360_mute_led and add a quirk to apply it.
+
+Signed-off-by: Illia Barbashyn <04baril@gmail.com>
+Link: https://patch.msgid.link/20260207221955.24132-1-04baril@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 138570d2da68e..553ffed048ea7 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -1646,6 +1646,13 @@ static void alc285_fixup_hp_spectre_x360_mute_led(struct hda_codec *codec,
+ alc285_fixup_hp_gpio_micmute_led(codec, fix, action);
+ }
+
++static void alc245_fixup_hp_envy_x360_mute_led(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ alc245_fixup_hp_mute_led_v1_coefbit(codec, fix, action);
++ alc245_fixup_hp_gpio_led(codec, fix, action);
++}
++
+ static void alc236_fixup_hp_mute_led(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -3810,6 +3817,7 @@ enum {
+ ALC285_FIXUP_HP_GPIO_LED,
+ ALC285_FIXUP_HP_MUTE_LED,
+ ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED,
++ ALC245_FIXUP_HP_ENVY_X360_MUTE_LED,
+ ALC285_FIXUP_HP_BEEP_MICMUTE_LED,
+ ALC236_FIXUP_HP_MUTE_LED_COEFBIT2,
+ ALC236_FIXUP_HP_GPIO_LED,
+@@ -5460,6 +5468,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_spectre_x360_mute_led,
+ },
++ [ALC245_FIXUP_HP_ENVY_X360_MUTE_LED] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc245_fixup_hp_envy_x360_mute_led,
++ },
+ [ALC285_FIXUP_HP_BEEP_MICMUTE_LED] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_beep,
+@@ -6708,6 +6720,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8895, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x103c, 0x88b3, "HP ENVY x360 Convertible 15-es0xxx", ALC245_FIXUP_HP_ENVY_X360_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT),
+--
+2.51.0
+
--- /dev/null
+From fbb4cf91fc9d54716cf1bb8cc2b482521dfd2c3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Feb 2026 17:21:12 +0700
+Subject: ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA
+
+From: Erik Sanjaya <sirreidlos@gmail.com>
+
+[ Upstream commit 91062e119b4eafde553c894ca072cd615a6dae2e ]
+
+The ASUS Zenbook 14 UX3405MA uses an ALC294 codec with CS35L41
+amplifiers over SPI. The existing quirk for this model only configured
+the amplifiers, leaving the headset microphone on the combo jack
+non-functional.
+
+Introduce a new fixup that configures pin 0x19 as headset mic input
+and chains to ALC245_FIXUP_CS35L41_SPI_2 to preserve speaker
+functionality.
+
+Similar to the fix done for the UM3406HA in commit 018f659753fd
+("ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14").
+
+Signed-off-by: Erik Sanjaya <sirreidlos@gmail.com>
+Link: https://patch.msgid.link/20260217102112.20651-1-sirreidlos@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 553ffed048ea7..6d3d464f1f6c6 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -3777,6 +3777,7 @@ enum {
+ ALC294_FIXUP_ASUS_MIC,
+ ALC294_FIXUP_ASUS_HEADSET_MIC,
+ ALC294_FIXUP_ASUS_I2C_HEADSET_MIC,
++ ALC294_FIXUP_ASUS_SPI_HEADSET_MIC,
+ ALC294_FIXUP_ASUS_SPK,
+ ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+ ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
+@@ -5121,6 +5122,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC287_FIXUP_CS35L41_I2C_2
+ },
++ [ALC294_FIXUP_ASUS_SPI_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x04a11020 }, /* use as headset mic */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC245_FIXUP_CS35L41_SPI_2
++ },
+ [ALC294_FIXUP_ASUS_SPK] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -7027,7 +7037,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
+ SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+- SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC294_FIXUP_ASUS_SPI_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x1a8e, "ASUS G712LWS", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2),
+--
+2.51.0
+
--- /dev/null
+From e6641524278dff45e10a6659c8d305245f715df3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 18:14:52 +0100
+Subject: ALSA: hda/realtek: fix LG Gram Style 14 speakers
+
+From: Damien Dagorn <damien.dagorn29@gmail.com>
+
+[ Upstream commit cc051fbd7f40226cc407558bc97c5099513e8657 ]
+
+The LG Gram Style 14 (14Z90RS-G.AD77F, SSID 1854:0490) with Realtek ALC298
+shows normal routing and volume changes, but internal speakers stay silent
+unless a userland HDA-verb workaround is applied.
+
+Add a dedicated quirk for the LG Gram Style 14 that programs the codec
+coefficient sequence used by the known workaround and enables the speaker
+amps only during playback.
+
+Tested-by: Damien Dagorn <damien.dagorn29@gmail.com>
+Signed-off-by: Damien Dagorn <damien.dagorn29@gmail.com>
+Link: https://lore.kernel.org/CAN59QMUhd4kHrkRoJA6VzEr2VKezN2yjHnANaQoZn2-Bnwe3bQ@mail.gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 170 ++++++++++++++++++++++++++++++
+ 1 file changed, 170 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 48edf55621854..138570d2da68e 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -1828,6 +1828,163 @@ static void alc298_samsung_v2_init_amps(struct hda_codec *codec,
+ spec->gen.pcm_playback_hook = alc298_samsung_v2_playback_hook;
+ }
+
++/* LG Gram Style 14: program vendor coef sequence used by HDA-verb workaround */
++struct alc298_lg_gram_style_seq {
++ unsigned short verb;
++ unsigned short idx;
++ unsigned short val;
++};
++
++static void alc298_lg_gram_style_coef_write(struct hda_codec *codec,
++ unsigned int verb,
++ unsigned int idx,
++ unsigned int val)
++{
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_COEF_INDEX, 0x23);
++ snd_hda_codec_write(codec, 0x20, 0, verb, idx);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0x00);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, val);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0xb011);
++}
++
++static void alc298_lg_gram_style_run_seq(struct hda_codec *codec,
++ const struct alc298_lg_gram_style_seq *seq,
++ int seq_size)
++{
++ int i;
++
++ for (i = 0; i < seq_size; i++)
++ alc298_lg_gram_style_coef_write(codec, seq[i].verb,
++ seq[i].idx, seq[i].val);
++}
++
++/* Coef sequences derived from the HDA-verb workaround for this model. */
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_preinit_seq[] = {
++ { 0x420, 0x00, 0x01 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_disable_seq[] = {
++ { 0x423, 0xff, 0x00 },
++ { 0x420, 0x3a, 0x80 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_enable_seq[] = {
++ { 0x420, 0x3a, 0x81 },
++ { 0x423, 0xff, 0x01 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_38[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe },
++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 },
++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_39[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd },
++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 },
++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3c[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe },
++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3d[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd },
++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d },
++};
++
++struct alc298_lg_gram_style_amp_desc {
++ unsigned char nid;
++ const struct alc298_lg_gram_style_seq *init_seq;
++ int init_seq_size;
++};
++
++static const struct alc298_lg_gram_style_amp_desc alc298_lg_gram_style_amps[] = {
++ { 0x38, alc298_lg_gram_style_init_seq_38,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_38) },
++ { 0x39, alc298_lg_gram_style_init_seq_39,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_39) },
++ { 0x3c, alc298_lg_gram_style_init_seq_3c,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3c) },
++ { 0x3d, alc298_lg_gram_style_init_seq_3d,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3d) },
++};
++
++static void alc298_lg_gram_style_enable_amps(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ int i;
++
++ for (i = 0; i < spec->num_speaker_amps; i++) {
++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_enable_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_enable_seq));
++ }
++}
++
++static void alc298_lg_gram_style_disable_amps(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ int i;
++
++ for (i = 0; i < spec->num_speaker_amps; i++) {
++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_disable_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq));
++ }
++}
++
++static void alc298_lg_gram_style_playback_hook(struct hda_pcm_stream *hinfo,
++ struct hda_codec *codec,
++ struct snd_pcm_substream *substream,
++ int action)
++{
++ if (action == HDA_GEN_PCM_ACT_OPEN)
++ alc298_lg_gram_style_enable_amps(codec);
++ if (action == HDA_GEN_PCM_ACT_CLOSE)
++ alc298_lg_gram_style_disable_amps(codec);
++}
++
++static void alc298_lg_gram_style_init_amps(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ int i;
++
++ spec->num_speaker_amps = ARRAY_SIZE(alc298_lg_gram_style_amps);
++
++ for (i = 0; i < spec->num_speaker_amps; i++) {
++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_preinit_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_preinit_seq));
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_disable_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq));
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_amps[i].init_seq,
++ alc298_lg_gram_style_amps[i].init_seq_size);
++ alc_write_coef_idx(codec, 0x89, 0x0);
++ }
++
++ spec->gen.pcm_playback_hook = alc298_lg_gram_style_playback_hook;
++}
++
+ static void alc298_fixup_samsung_amp_v2_2_amps(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -1842,6 +1999,13 @@ static void alc298_fixup_samsung_amp_v2_4_amps(struct hda_codec *codec,
+ alc298_samsung_v2_init_amps(codec, 4);
+ }
+
++static void alc298_fixup_lg_gram_style_14(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PROBE)
++ alc298_lg_gram_style_init_amps(codec);
++}
++
+ static void gpio2_mic_hotkey_event(struct hda_codec *codec,
+ struct hda_jack_callback *event)
+ {
+@@ -3655,6 +3819,7 @@ enum {
+ ALC298_FIXUP_SAMSUNG_AMP,
+ ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS,
+ ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS,
++ ALC298_FIXUP_LG_GRAM_STYLE_14,
+ ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ ALC295_FIXUP_ASUS_MIC_NO_PRESENCE,
+@@ -5341,6 +5506,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc298_fixup_samsung_amp_v2_4_amps
+ },
++ [ALC298_FIXUP_LG_GRAM_STYLE_14] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc298_fixup_lg_gram_style_14
++ },
+ [ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -7244,6 +7413,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1854, 0x0488, "LG gram 16 (16Z90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
+ SND_PCI_QUIRK(0x1854, 0x0489, "LG gram 16 (16Z90R-A)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
+ SND_PCI_QUIRK(0x1854, 0x048a, "LG gram 17 (17ZD90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
++ SND_PCI_QUIRK(0x1854, 0x0490, "LG Gram Style 14 (14Z90RS)", ALC298_FIXUP_LG_GRAM_STYLE_14),
+ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
+ SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x19e5, 0x3212, "Huawei KLV-WX9 ", ALC256_FIXUP_ACER_HEADSET_MIC),
+--
+2.51.0
+
--- /dev/null
+From 9dc1d8fa60274e8de8561ba5c3b50a8b279004b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 11:09:46 +0800
+Subject: ALSA: hda/tas2781: Ignore reset check for SPI device
+
+From: Baojun Xu <baojun.xu@ti.com>
+
+[ Upstream commit 908ef80e31e4d3bd953a0088fe57640cd9ae7b3e ]
+
+In the SPI driver probe, the device should be in the default state, so the
+device status check is not necessary. It should be forced to do the
+firmware download as I2C device.
+
+Signed-off-by: Baojun Xu <baojun.xu@ti.com>
+Link: https://patch.msgid.link/20260211030946.2330-1-baojun.xu@ti.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hda/codecs/side-codecs/tas2781_hda_spi.c | 20 +++++++------------
+ 1 file changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
+index b9a55672bf15d..488e35dac9524 100644
+--- a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
++++ b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
+@@ -634,7 +634,7 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context)
+ struct tasdevice_priv *tas_priv = context;
+ struct tas2781_hda *tas_hda = dev_get_drvdata(tas_priv->dev);
+ struct hda_codec *codec = tas_priv->codec;
+- int ret, val;
++ int ret;
+
+ pm_runtime_get_sync(tas_priv->dev);
+ guard(mutex)(&tas_priv->codec_lock);
+@@ -673,20 +673,14 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context)
+ tas_priv->rcabin.profile_cfg_id = 0;
+
+ tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
+- ret = tasdevice_spi_dev_read(tas_priv, tas_priv->index,
+- TAS2781_REG_CLK_CONFIG, &val);
+- if (ret < 0)
+- goto out;
+
+- if (val == TAS2781_REG_CLK_CONFIG_RESET) {
+- ret = tasdevice_prmg_load(tas_priv, 0);
+- if (ret < 0) {
+- dev_err(tas_priv->dev, "FW download failed = %d\n",
+- ret);
+- goto out;
+- }
+- tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
++ ret = tasdevice_prmg_load(tas_priv, 0);
++ if (ret < 0) {
++ dev_err(tas_priv->dev, "FW download failed = %d\n", ret);
++ goto out;
+ }
++ tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
++
+ if (tas_priv->fmw->nr_programs > 0)
+ tas_priv->tasdevice[tas_priv->index].cur_prog = 0;
+ if (tas_priv->fmw->nr_configurations > 0)
+--
+2.51.0
+
--- /dev/null
+From 7baa187e78c47128cb03ee262ff496d8d171d068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 13:12:11 +0100
+Subject: ALSA: mixer: oss: Add card disconnect checkpoints
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 084d5d44418148662365eced3e126ad1a81ee3e2 ]
+
+ALSA OSS mixer layer calls the kcontrol ops rather individually, and
+pending calls might be not always caught at disconnecting the device.
+
+For avoiding the potential UAF scenarios, add sanity checks of the
+card disconnection at each entry point of OSS mixer accesses. The
+rwsem is taken just before that check, hence the rest context should
+be covered by that properly.
+
+Link: https://patch.msgid.link/20260209121212.171430-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/oss/mixer_oss.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
+index e839a4bb93f81..aa98caaaea3c5 100644
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -525,6 +525,8 @@ static void snd_mixer_oss_get_volume1_vol(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -558,6 +560,8 @@ static void snd_mixer_oss_get_volume1_sw(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -618,6 +622,8 @@ static void snd_mixer_oss_put_volume1_vol(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -655,6 +661,8 @@ static void snd_mixer_oss_put_volume1_sw(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -792,6 +800,8 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
+ if (uinfo == NULL || uctl == NULL)
+ return -ENOMEM;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return -ENODEV;
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+ if (!kctl)
+ return -ENOENT;
+@@ -835,6 +845,8 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
+ if (uinfo == NULL || uctl == NULL)
+ return -ENOMEM;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return -ENODEV;
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+ if (!kctl)
+ return -ENOENT;
+@@ -878,6 +890,8 @@ static int snd_mixer_oss_build_test(struct snd_mixer_oss *mixer, struct slot *sl
+ int err;
+
+ scoped_guard(rwsem_read, &card->controls_rwsem) {
++ if (card->shutdown)
++ return -ENODEV;
+ kcontrol = snd_mixer_oss_test_id(mixer, name, index);
+ if (kcontrol == NULL)
+ return 0;
+@@ -1002,6 +1016,8 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer,
+ if (snd_mixer_oss_build_test_all(mixer, ptr, &slot))
+ return 0;
+ guard(rwsem_read)(&mixer->card->controls_rwsem);
++ if (mixer->card->shutdown)
++ return -ENODEV;
+ kctl = NULL;
+ if (!ptr->index)
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+--
+2.51.0
+
--- /dev/null
+From 32baae18052548c077fc40e8f1306f27f37d3fcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 08:38:29 +0000
+Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
+
+From: Lianqin Hu <hulianqin@vivo.com>
+
+[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ]
+
+Setting up the interface when suspended/resumeing fail on this card.
+Adding a reset and delay quirk will eliminate this problem.
+
+usb 1-1: New USB device found, idVendor=001f, idProduct=0b21
+usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+usb 1-1: Product: AB13X USB Audio
+usb 1-1: Manufacturer: Generic
+usb 1-1: SerialNumber: 20210926172016
+
+Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
+Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 8a646891ebb44..6860b5bd55f1e 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2147,6 +2147,8 @@ struct usb_audio_quirk_flags_table {
+
+ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ /* Device matches */
++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */
++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
+ DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
+ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
+ DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
+--
+2.51.0
+
--- /dev/null
+From c63ec616850a529c3f399429b7fd8b51adfff7e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:07 +0100
+Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ]
+
+At silencing the playback URB packets in the implicit fb mode before
+the actual playback, we blindly assume that the received packets fit
+with the buffer size. But when the setup in the capture stream
+differs from the playback stream (e.g. due to the USB core limitation
+of max packet size), such an inconsistency may lead to OOB writes to
+the buffer, resulting in a crash.
+
+For addressing it, add a sanity check of the transfer buffer size at
+prepare_silent_urb(), and stop the data copy if the received data
+overflows. Also, report back the transfer error properly from there,
+too.
+
+Note that this doesn't fix the root cause of the playback error
+itself, but this merely covers the kernel Oops.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
+Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 39 ++++++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 17 deletions(-)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 6741ce368dd1c..3ac1fbec6327e 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -275,8 +275,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip)
+ return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH;
+ }
+
+-static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+- struct snd_urb_ctx *ctx)
++static int prepare_silent_urb(struct snd_usb_endpoint *ep,
++ struct snd_urb_ctx *ctx)
+ {
+ struct urb *urb = ctx->urb;
+ unsigned int offs = 0;
+@@ -289,28 +289,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+ extra = sizeof(packet_length);
+
+ for (i = 0; i < ctx->packets; ++i) {
+- unsigned int offset;
+- unsigned int length;
+- int counts;
+-
+- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
+- length = counts * ep->stride; /* number of silent bytes */
+- offset = offs * ep->stride + extra * i;
+- urb->iso_frame_desc[i].offset = offset;
++ int length;
++
++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
++ if (length < 0)
++ return length;
++ length *= ep->stride; /* number of silent bytes */
++ if (offs + length + extra > ctx->buffer_size)
++ break;
++ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = length + extra;
+ if (extra) {
+ packet_length = cpu_to_le32(length);
+- memcpy(urb->transfer_buffer + offset,
++ memcpy(urb->transfer_buffer + offs,
+ &packet_length, sizeof(packet_length));
++ offs += extra;
+ }
+- memset(urb->transfer_buffer + offset + extra,
++ memset(urb->transfer_buffer + offs,
+ ep->silence_value, length);
+- offs += counts;
++ offs += length;
+ }
+
+- urb->number_of_packets = ctx->packets;
+- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra;
++ if (!offs)
++ return -EPIPE;
++
++ urb->number_of_packets = i;
++ urb->transfer_buffer_length = offs;
+ ctx->queued = 0;
++ return 0;
+ }
+
+ /*
+@@ -332,8 +338,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep,
+ if (data_subs && ep->prepare_data_urb)
+ return ep->prepare_data_urb(data_subs, urb, in_stream_lock);
+ /* no data provider, so send silence */
+- prepare_silent_urb(ep, ctx);
+- break;
++ return prepare_silent_urb(ep, ctx);
+
+ case SND_USB_ENDPOINT_TYPE_SYNC:
+ if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) {
+--
+2.51.0
+
--- /dev/null
+From 2915bc965a1cb403a6d7a4b8e170b77c1e5930ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jan 2026 16:36:40 -0500
+Subject: ALSA: usb-audio: presonus s18xx uses little-endian
+
+From: fenugrec <fenugrec@mail.com>
+
+[ Upstream commit 3ce03297baff0ba116769044e4594fb324d4a551 ]
+
+Use __le32 types for USB control transfers
+
+Signed-off-by: fenugrec <fenugrec@mail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260111-preso_clean1-v2-1-44b4e5129a75@mail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_s1810c.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
+index 6e09e074c0e7f..93510aa0dc5ef 100644
+--- a/sound/usb/mixer_s1810c.c
++++ b/sound/usb/mixer_s1810c.c
+@@ -82,13 +82,13 @@
+ * mixer and output but a different set for device.
+ */
+ struct s1810c_ctl_packet {
+- u32 a;
+- u32 b;
+- u32 fixed1;
+- u32 fixed2;
+- u32 c;
+- u32 d;
+- u32 e;
++ __le32 a;
++ __le32 b;
++ __le32 fixed1;
++ __le32 fixed2;
++ __le32 c;
++ __le32 d;
++ __le32 e;
+ };
+
+ #define SC1810C_CTL_LINE_SW 0
+@@ -118,7 +118,7 @@ struct s1810c_ctl_packet {
+ * being zero and different f1/f2.
+ */
+ struct s1810c_state_packet {
+- u32 fields[63];
++ __le32 fields[63];
+ };
+
+ #define SC1810C_STATE_48V_SW 58
+@@ -140,14 +140,14 @@ snd_s1810c_send_ctl_packet(struct usb_device *dev, u32 a,
+ struct s1810c_ctl_packet pkt = { 0 };
+ int ret = 0;
+
+- pkt.fixed1 = SC1810C_CMD_F1;
+- pkt.fixed2 = SC1810C_CMD_F2;
++ pkt.fixed1 = __cpu_to_le32(SC1810C_CMD_F1);
++ pkt.fixed2 = __cpu_to_le32(SC1810C_CMD_F2);
+
+- pkt.a = a;
+- pkt.b = b;
+- pkt.c = c;
+- pkt.d = d;
+- pkt.e = e;
++ pkt.a = __cpu_to_le32(a);
++ pkt.b = __cpu_to_le32(b);
++ pkt.c = __cpu_to_le32(c);
++ pkt.d = __cpu_to_le32(d);
++ pkt.e = __cpu_to_le32(e);
+
+ ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
+ SC1810C_CMD_REQ,
+@@ -176,8 +176,8 @@ snd_sc1810c_get_status_field(struct usb_device *dev,
+ struct s1810c_state_packet pkt_in = { { 0 } };
+ int ret = 0;
+
+- pkt_out.fields[SC1810C_STATE_F1_IDX] = SC1810C_SET_STATE_F1;
+- pkt_out.fields[SC1810C_STATE_F2_IDX] = SC1810C_SET_STATE_F2;
++ pkt_out.fields[SC1810C_STATE_F1_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F1);
++ pkt_out.fields[SC1810C_STATE_F2_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F2);
+ ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
+ SC1810C_SET_STATE_REQ,
+ SC1810C_SET_STATE_REQTYPE,
+@@ -197,7 +197,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev,
+ return ret;
+ }
+
+- (*field) = pkt_in.fields[field_idx];
++ (*field) = __le32_to_cpu(pkt_in.fields[field_idx]);
+ (*seqnum)++;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From f711f4da78695b837a2fe02a7dbd857d14bfc911 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:05 +0100
+Subject: ALSA: usb-audio: Update the number of packets properly at receiving
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ]
+
+At receiving the packets from the implicit feedback source, we didn't
+update ctx->packets field but only the ctx->packet_size[] data.
+In exceptional cases, this might lead to unexpectedly superfluous data
+transfer (although this won't happen usually due to the nature of USB
+isochronous transfer). Fix it to update the field properly.
+
+Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index cc15624ecaffe..6741ce368dd1c 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -481,6 +481,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+
+ /* copy over the length information */
+ if (implicit_fb) {
++ ctx->packets = packet->packets;
+ for (i = 0; i < packet->packets; i++)
+ ctx->packet_size[i] = packet->packet_size[i];
+ }
+--
+2.51.0
+
--- /dev/null
+From bdcc305fbad06338be184a460960c5fd0ae00ae8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:03 +0100
+Subject: APEI/GHES: ARM processor Error: don't go past allocated memory
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 87880af2d24e62a84ed19943dbdd524f097172f2 ]
+
+If the BIOS generates a very small ARM Processor Error, or
+an incomplete one, the current logic will fail to deferrence
+
+ err->section_length
+and
+ ctx_info->size
+
+Add checks to avoid that. With such changes, such GHESv2
+records won't cause OOPSes like this:
+
+[ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP
+[ 1.495449] Modules linked in:
+[ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT
+[ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+[ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred
+[ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+[ 1.497199] pc : log_arm_hw_error+0x5c/0x200
+[ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220
+
+0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75).
+70 err_info = (struct cper_arm_err_info *)(err + 1);
+71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num);
+72 ctx_err = (u8 *)ctx_info;
+73
+74 for (n = 0; n < err->context_info_num; n++) {
+75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
+76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
+77 ctx_len += sz;
+78 }
+79
+
+and similar ones while trying to access section_length on an
+error dump with too small size.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 32 ++++++++++++++++++++++++++++----
+ drivers/ras/ras.c | 6 +++++-
+ 2 files changed, 33 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 1b34a708e98a4..42872fdc36bfc 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -561,21 +561,45 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
+ {
+ struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata);
+ int flags = sync ? MF_ACTION_REQUIRED : 0;
++ int length = gdata->error_data_length;
+ char error_type[120];
+ bool queued = false;
+ int sec_sev, i;
+ char *p;
+
+ sec_sev = ghes_severity(gdata->error_severity);
+- log_arm_hw_error(err, sec_sev);
++ if (length >= sizeof(*err)) {
++ log_arm_hw_error(err, sec_sev);
++ } else {
++ pr_warn(FW_BUG "arm error length: %d\n", length);
++ pr_warn(FW_BUG "length is too small\n");
++ pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
++ return false;
++ }
++
+ if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE)
+ return false;
+
+ p = (char *)(err + 1);
++ length -= sizeof(err);
++
+ for (i = 0; i < err->err_info_num; i++) {
+- struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p;
+- bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR;
+- bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR);
++ struct cper_arm_err_info *err_info;
++ bool is_cache, has_pa;
++
++ /* Ensure we have enough data for the error info header */
++ if (length < sizeof(*err_info))
++ break;
++
++ err_info = (struct cper_arm_err_info *)p;
++
++ /* Validate the claimed length before using it */
++ length -= err_info->length;
++ if (length < 0)
++ break;
++
++ is_cache = err_info->type & CPER_ARM_CACHE_ERROR;
++ has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR);
+
+ /*
+ * The field (err_info->error_info & BIT(26)) is fixed to set to
+diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
+index 2a5b5a9fdcb36..03df3db623346 100644
+--- a/drivers/ras/ras.c
++++ b/drivers/ras/ras.c
+@@ -72,7 +72,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
+ ctx_err = (u8 *)ctx_info;
+
+ for (n = 0; n < err->context_info_num; n++) {
+- sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
++ sz = sizeof(struct cper_arm_ctx_info);
++
++ if (sz + (long)ctx_info - (long)err >= err->section_length)
++ sz += ctx_info->size;
++
+ ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
+ ctx_len += sz;
+ }
+--
+2.51.0
+
--- /dev/null
+From eb3ba00e5320795d99e370604e6dff9d9cef44dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:05 +0100
+Subject: APEI/GHES: ensure that won't go past CPER allocated record
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ]
+
+The logic at ghes_new() prevents allocating too large records, by
+checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
+Yet, the allocation is done with the actual number of pages from the
+CPER bios table location, which can be smaller.
+
+Yet, a bad firmware could send data with a different size, which might
+be bigger than the allocated memory, causing an OOPS:
+
+ Unable to handle kernel paging request at virtual address fff00000f9b40000
+ Mem abort info:
+ ESR = 0x0000000096000007
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x07: level 3 translation fault
+ Data abort info:
+ ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+ swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
+ [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
+ Internal error: Oops: 0000000096000007 [#1] SMP
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
+ Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+ Workqueue: kacpi_notify acpi_os_execute_deferred
+ pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+ pc : hex_dump_to_buffer+0x30c/0x4a0
+ lr : hex_dump_to_buffer+0x328/0x4a0
+ sp : ffff800080e13880
+ x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
+ x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
+ x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
+ x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
+ x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
+ x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
+ x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
+ x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
+ x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
+ x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
+ Call trace:
+ hex_dump_to_buffer+0x30c/0x4a0 (P)
+ print_hex_dump+0xac/0x170
+ cper_estatus_print_section+0x90c/0x968
+ cper_estatus_print+0xf0/0x158
+ __ghes_print_estatus+0xa0/0x148
+ ghes_proc+0x1bc/0x220
+ ghes_notify_hed+0x5c/0xb8
+ notifier_call_chain+0x78/0x148
+ blocking_notifier_call_chain+0x4c/0x80
+ acpi_hed_notify+0x28/0x40
+ acpi_ev_notify_dispatch+0x50/0x80
+ acpi_os_execute_deferred+0x24/0x48
+ process_one_work+0x15c/0x3b0
+ worker_thread+0x2d0/0x400
+ kthread+0x148/0x228
+ ret_from_fork+0x10/0x20
+ Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
+ ---[ end trace 0000000000000000 ]---
+
+Prevent that by taking the actual allocated are into account when
+checking for CPER length.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 6 +++++-
+ include/acpi/ghes.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 56107aa002744..1b34a708e98a4 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -29,6 +29,7 @@
+ #include <linux/cper.h>
+ #include <linux/cleanup.h>
+ #include <linux/platform_device.h>
++#include <linux/minmax.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+ #include <linux/vmalloc.h>
+@@ -293,6 +294,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
+ error_block_length = GHES_ESTATUS_MAX_SIZE;
+ }
+ ghes->estatus = kmalloc(error_block_length, GFP_KERNEL);
++ ghes->estatus_length = error_block_length;
+ if (!ghes->estatus) {
+ rc = -ENOMEM;
+ goto err_unmap_status_addr;
+@@ -364,13 +366,15 @@ static int __ghes_check_estatus(struct ghes *ghes,
+ struct acpi_hest_generic_status *estatus)
+ {
+ u32 len = cper_estatus_len(estatus);
++ u32 max_len = min(ghes->generic->error_block_length,
++ ghes->estatus_length);
+
+ if (len < sizeof(*estatus)) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n");
+ return -EIO;
+ }
+
+- if (len > ghes->generic->error_block_length) {
++ if (!len || len > max_len) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n");
+ return -EIO;
+ }
+diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
+index ebd21b05fe6ed..93db60da5934e 100644
+--- a/include/acpi/ghes.h
++++ b/include/acpi/ghes.h
+@@ -21,6 +21,7 @@ struct ghes {
+ struct acpi_hest_generic_v2 *generic_v2;
+ };
+ struct acpi_hest_generic_status *estatus;
++ unsigned int estatus_length;
+ unsigned long flags;
+ union {
+ struct list_head list;
+--
+2.51.0
+
--- /dev/null
+From df42351467818842af6f303d7ec2d320c75e14e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 10:56:33 +0100
+Subject: ARM: 9467/1: mm: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weissschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ]
+
+Restricted pointers ("%pK") were never meant to be used
+through printk(). They can acquire sleeping locks in atomic contexts.
+
+Switch to %px over the more secure %p as this usage is a debugging aid,
+gated behind CONFIG_DEBUG_VIRTUAL and used by WARN().
+
+Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/physaddr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c
+index 3f263c840ebc4..1a37ebfacbba9 100644
+--- a/arch/arm/mm/physaddr.c
++++ b/arch/arm/mm/physaddr.c
+@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x)
+ phys_addr_t __virt_to_phys(unsigned long x)
+ {
+ WARN(!__virt_addr_valid(x),
+- "virt_to_phys used for non-linear address: %pK (%pS)\n",
++ "virt_to_phys used for non-linear address: %px (%pS)\n",
+ (void *)x, (void *)x);
+
+ return __virt_to_phys_nodebug(x);
+--
+2.51.0
+
--- /dev/null
+From 4775cb111db71ce11b588ef2797492a9a43f87fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 17:24:48 +0800
+Subject: arm64: Add support for TSV110 Spectre-BHB mitigation
+
+From: Jinqian Yang <yangjinqian1@huawei.com>
+
+[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ]
+
+The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
+Buffer) attack, which can be exploited to leak information through
+branch prediction side channels. This commit adds the MIDR of TSV110
+to the list for software mitigation.
+
+Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
+Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/proton-pack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
+index 80a580e019c50..b3801f532b10b 100644
+--- a/arch/arm64/kernel/proton-pack.c
++++ b/arch/arm64/kernel/proton-pack.c
+@@ -887,6 +887,7 @@ static u8 spectre_bhb_loop_affected(void)
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ {},
+ };
+ static const struct midr_range spectre_bhb_k24_list[] = {
+--
+2.51.0
+
--- /dev/null
+From ad7ff381a0f470e5f5a4e1343be5bb0542b86e06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:11:56 +0100
+Subject: arm64/ftrace,bpf: Fix partial regs after bpf_prog_run
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 276f3b6daf6024ae2742afd161e7418a5584a660 ]
+
+Mahe reported issue with bpf_override_return helper not working when
+executed from kprobe.multi bpf program on arm.
+
+The problem is that on arm we use alternate storage for pt_regs object
+that is passed to bpf_prog_run and if any register is changed (which
+is the case of bpf_override_return) it's not propagated back to actual
+pt_regs object.
+
+Fixing this by introducing and calling ftrace_partial_regs_update function
+to propagate the values of changed registers (ip and stack).
+
+Reported-by: Mahe Tardy <mahe.tardy@gmail.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/bpf/20260112121157.854473-1-jolsa@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ftrace_regs.h | 25 +++++++++++++++++++++++++
+ kernel/trace/bpf_trace.c | 1 +
+ 2 files changed, 26 insertions(+)
+
+diff --git a/include/linux/ftrace_regs.h b/include/linux/ftrace_regs.h
+index 15627ceea9bcc..386fa48c4a957 100644
+--- a/include/linux/ftrace_regs.h
++++ b/include/linux/ftrace_regs.h
+@@ -33,6 +33,31 @@ struct ftrace_regs;
+ #define ftrace_regs_get_frame_pointer(fregs) \
+ frame_pointer(&arch_ftrace_regs(fregs)->regs)
+
++static __always_inline void
++ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs) { }
++
++#else
++
++/*
++ * ftrace_partial_regs_update - update the original ftrace_regs from regs
++ * @fregs: The ftrace_regs to update from @regs
++ * @regs: The partial regs from ftrace_partial_regs() that was updated
++ *
++ * Some architectures have the partial regs living in the ftrace_regs
++ * structure, whereas other architectures need to make a different copy
++ * of the @regs. If a partial @regs is retrieved by ftrace_partial_regs() and
++ * if the code using @regs updates a field (like the instruction pointer or
++ * stack pointer) it may need to propagate that change to the original @fregs
++ * it retrieved the partial @regs from. Use this function to guarantee that
++ * update happens.
++ */
++static __always_inline void
++ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs)
++{
++ ftrace_regs_set_instruction_pointer(fregs, instruction_pointer(regs));
++ ftrace_regs_set_return_value(fregs, regs_return_value(regs));
++}
++
+ #endif /* HAVE_ARCH_FTRACE_REGS */
+
+ /* This can be overridden by the architectures */
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index e7f1fe44352af..ae64b261de8e3 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2564,6 +2564,7 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
+ old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
+ err = bpf_prog_run(link->link.prog, regs);
+ bpf_reset_run_ctx(old_run_ctx);
++ ftrace_partial_regs_update(fregs, bpf_kprobe_multi_pt_regs_ptr());
+ rcu_read_unlock();
+
+ out:
+--
+2.51.0
+
--- /dev/null
+From 33d110256dbbc9ff2bb9414857689ff4ad93963f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 11:54:21 +0100
+Subject: arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 729a2e8e9ac47099a967567389cc9d73ef4194ca ]
+
+gcc-16 warns about an instance that older compilers did not:
+
+arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_clear':
+arch/arm64/mm/hugetlbpage.c:369:57: error: parameter 'addr' set but not used [-Werror=unused-but-set-parameter=]
+
+The issue here is that __pte_clear() does not actually use its second
+argument, but when CONFIG_ARM64_CONTPTE is enabled it still gets
+updated.
+
+Replace the macro with an inline function to let the compiler see
+the argument getting passed down.
+
+Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Dev Jain <dev.jain@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/pgtable.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 0944e296dd4a4..9016ae8de5c9e 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -175,8 +175,6 @@ static inline pteval_t __phys_to_pte_val(phys_addr_t phys)
+ __pte(__phys_to_pte_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))
+
+ #define pte_none(pte) (!pte_val(pte))
+-#define __pte_clear(mm, addr, ptep) \
+- __set_pte(ptep, __pte(0))
+ #define pte_page(pte) (pfn_to_page(pte_pfn(pte)))
+
+ /*
+@@ -1316,6 +1314,13 @@ static inline bool pud_user_accessible_page(pud_t pud)
+ /*
+ * Atomic pte/pmd modifications.
+ */
++
++static inline void __pte_clear(struct mm_struct *mm,
++ unsigned long addr, pte_t *ptep)
++{
++ __set_pte(ptep, __pte(0));
++}
++
+ static inline int __ptep_test_and_clear_young(struct vm_area_struct *vma,
+ unsigned long address,
+ pte_t *ptep)
+--
+2.51.0
+
--- /dev/null
+From c1f45b9c440d1016f52dc4e1da7e56546314feea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 21:27:21 +0000
+Subject: arm64: tegra: smaug: Add usb-role-switch support
+
+From: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+
+[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ]
+
+The USB2 port on Smaug is configured for OTG operation but lacked the
+required 'usb-role-switch' property, leading to a failed probe and a
+non-functioning USB port. Add the property along with setting the default
+role to host.
+
+Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+index 5aa6afd56cbc6..dfbd1c72388c1 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+@@ -1809,6 +1809,8 @@ usb2-0 {
+ status = "okay";
+ vbus-supply = <&usbc_vbus>;
+ mode = "otg";
++ usb-role-switch;
++ role-switch-default-mode = "host";
+ };
+
+ usb3-0 {
+--
+2.51.0
+
--- /dev/null
+From 85ef07af698e7a72b934727be79e9bc4ff8017b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Feb 2026 16:15:34 +0530
+Subject: ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models
+
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+
+[ Upstream commit 3acf517e1ae05ef66561b7a2782690387ce46e21 ]
+
+This patch adds a quirk to include the codec amplifier function for Lenovo
+models listed in the quirk table.
+
+Note: In these models, the RT722 codec amplifier is excluded, and an
+external amplifier is used instead.
+
+Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://patch.msgid.link/20260218104734.3641481-3-Vijendar.Mukunda@amd.com
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/soc/amd/acp/acp-sdw-legacy-mach.c b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
+index 5a3cfedacbafd..86c534d827448 100644
+--- a/sound/soc/amd/acp/acp-sdw-legacy-mach.c
++++ b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
+@@ -95,6 +95,22 @@ static const struct dmi_system_id soc_sdw_quirk_table[] = {
+ },
+ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR),
+ },
++ {
++ .callback = soc_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YW"),
++ },
++ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR),
++ },
++ {
++ .callback = soc_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YX"),
++ },
++ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR),
++ },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 79948d8a7d0c1b0e08ea7408de7c05ee35cf812d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 17:19:04 +0800
+Subject: ASoC: codecs: max98390: Check return value of
+ devm_gpiod_get_optional() in max98390_i2c_probe()
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ]
+
+The devm_gpiod_get_optional() function may return an error pointer
+(ERR_PTR) in case of a genuine failure during GPIO acquisition,
+not just NULL which indicates the legitimate absence of an optional
+GPIO.
+
+Add an IS_ERR() check after the function call to catch such errors and
+propagate them to the probe function, ensuring the driver fails to load
+safely rather than proceeding with an invalid pointer.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98390.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c
+index a8a282ff9fc5a..b132ef8c1d2c8 100644
+--- a/sound/soc/codecs/max98390.c
++++ b/sound/soc/codecs/max98390.c
+@@ -1073,6 +1073,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c)
+
+ reset_gpio = devm_gpiod_get_optional(&i2c->dev,
+ "reset", GPIOD_OUT_HIGH);
++ if (IS_ERR(reset_gpio))
++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio),
++ "Failed to get reset gpio\n");
+
+ /* Power on device */
+ if (reset_gpio) {
+--
+2.51.0
+
--- /dev/null
+From 1d88a247ef1484c1b49c25018aa7eda9b1d4d8cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jan 2026 00:00:17 +0800
+Subject: ASoC: es8328: Add error unwind in resume
+
+From: Hsieh Hung-En <hungen3108@gmail.com>
+
+[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ]
+
+Handle failures in the resume path by unwinding previously enabled
+resources.
+
+If enabling regulators or syncing the regcache fails, disable regulators
+and unprepare the clock to avoid leaking resources and leaving the device
+in a partially resumed state.
+
+Signed-off-by: Hsieh Hung-En <hungen3108@gmail.com>
+Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index 76159c45e6b52..c0d7ce64b2d96 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -756,17 +756,23 @@ static int es8328_resume(struct snd_soc_component *component)
+ es8328->supplies);
+ if (ret) {
+ dev_err(component->dev, "unable to enable regulators\n");
+- return ret;
++ goto err_clk;
+ }
+
+ regcache_mark_dirty(regmap);
+ ret = regcache_sync(regmap);
+ if (ret) {
+ dev_err(component->dev, "unable to sync regcache\n");
+- return ret;
++ goto err_regulators;
+ }
+
+ return 0;
++
++err_regulators:
++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies);
++err_clk:
++ clk_disable_unprepare(es8328->clk);
++ return ret;
+ }
+
+ static int es8328_component_probe(struct snd_soc_component *component)
+--
+2.51.0
+
--- /dev/null
+From 009b38c02f41db196eb30fc2aafea734b560322a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 05:24:29 +0000
+Subject: ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 84faa91585fa22a161763f2fe8f84a602a196c87 ]
+
+imx_rpmsg_probe() calls snd_soc_find_dai() without holding client_mutex.
+However, snd_soc_find_dai() has lockdep_assert_held(&client_mutex)
+indicating callers must hold this lock, as the function iterates over the
+global component list.
+
+All other callers of snd_soc_find_dai() either hold client_mutex via the
+snd_soc_bind_card() path or use the snd_soc_find_dai_with_mutex() wrapper.
+
+Use snd_soc_find_dai_with_mutex() instead to fix the missing lock
+protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260205052429.4046903-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-rpmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/fsl/imx-rpmsg.c b/sound/soc/fsl/imx-rpmsg.c
+index 7cd3aa4c87060..39b2d64eb410d 100644
+--- a/sound/soc/fsl/imx-rpmsg.c
++++ b/sound/soc/fsl/imx-rpmsg.c
+@@ -145,7 +145,7 @@ static int imx_rpmsg_probe(struct platform_device *pdev)
+ data->dai.ignore_pmdown_time = 1;
+
+ data->dai.cpus->dai_name = pdev->dev.platform_data;
+- cpu_dai = snd_soc_find_dai(data->dai.cpus);
++ cpu_dai = snd_soc_find_dai_with_mutex(data->dai.cpus);
+ if (!cpu_dai) {
+ ret = -EPROBE_DEFER;
+ goto fail;
+--
+2.51.0
+
--- /dev/null
+From 570d65902495faecc97715d0c1de88d6bd6a41fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 15:43:35 +0800
+Subject: ASoC: rt721-sdca: Fix issue of fail to detect OMTP jack type
+
+From: Jack Yu <jack.yu@realtek.com>
+
+[ Upstream commit 5578da7d957fbaf91f6c39ba2363c2d2e4273183 ]
+
+Add related HP-JD settings to fix issue of fail to detect
+OMTP jack type.
+
+Signed-off-by: Jack Yu <jack.yu@realtek.com>
+Link: https://patch.msgid.link/20260210074335.2337830-1-jack.yu@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt721-sdca.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/rt721-sdca.c b/sound/soc/codecs/rt721-sdca.c
+index 5f7b505d54147..53cec09d29085 100644
+--- a/sound/soc/codecs/rt721-sdca.c
++++ b/sound/soc/codecs/rt721-sdca.c
+@@ -245,12 +245,12 @@ static void rt721_sdca_jack_preset(struct rt721_sdca_priv *rt721)
+ regmap_write(rt721->mbq_regmap, 0x5b10007, 0x2000);
+ regmap_write(rt721->mbq_regmap, 0x5B10017, 0x1b0f);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_CBJ_CTRL,
+- RT721_CBJ_A0_GAT_CTRL1, 0x2a02);
++ RT721_CBJ_A0_GAT_CTRL1, 0x2205);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_CAP_PORT_CTRL,
+ RT721_HP_AMP_2CH_CAL4, 0xa105);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL,
+ RT721_UAJ_TOP_TCON14, 0x3b33);
+- regmap_write(rt721->mbq_regmap, 0x310400, 0x3023);
++ regmap_write(rt721->mbq_regmap, 0x310400, 0x3043);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL,
+ RT721_UAJ_TOP_TCON14, 0x3f33);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL,
+--
+2.51.0
+
--- /dev/null
+From 2e002d1a2a70b00a394896ec6af00140fa4e2788 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 17:17:48 +0800
+Subject: ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
+ aggregated
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 08c09899960118ffb01417242e659eb6cc067d6a ]
+
+rt722 is aggregated with rt1320 amp in arl_rt722_l0_rt1320_l2 and it is
+the only audio configuration in the ARL platform. Set .aggregated = 1 to
+represent the fact and avoid unexpected issue.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://patch.msgid.link/20260119091749.1752088-2-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../intel/common/soc-acpi-intel-arl-match.c | 23 +++++++++----------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-arl-match.c b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
+index 6bf7a6250ddc3..c952f7d2b2c0e 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-arl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
+@@ -45,23 +45,22 @@ static const struct snd_soc_acpi_endpoint spk_3_endpoint = {
+ .group_id = 1,
+ };
+
+-/*
+- * RT722 is a multi-function codec, three endpoints are created for
+- * its headset, amp and dmic functions.
+- */
+-static const struct snd_soc_acpi_endpoint rt722_endpoints[] = {
++static const struct snd_soc_acpi_endpoint jack_amp_g1_dmic_endpoints[] = {
++ /* Jack Endpoint */
+ {
+ .num = 0,
+ .aggregated = 0,
+ .group_position = 0,
+ .group_id = 0,
+ },
++ /* Amp Endpoint, work as spk_l_endpoint */
+ {
+ .num = 1,
+- .aggregated = 0,
++ .aggregated = 1,
+ .group_position = 0,
+- .group_id = 0,
++ .group_id = 1,
+ },
++ /* DMIC Endpoint */
+ {
+ .num = 2,
+ .aggregated = 0,
+@@ -229,11 +228,11 @@ static const struct snd_soc_acpi_adr_device rt711_sdca_0_adr[] = {
+ }
+ };
+
+-static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = {
++static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = {
+ {
+ .adr = 0x000030025D072201ull,
+- .num_endpoints = ARRAY_SIZE(rt722_endpoints),
+- .endpoints = rt722_endpoints,
++ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints),
++ .endpoints = jack_amp_g1_dmic_endpoints,
+ .name_prefix = "rt722"
+ }
+ };
+@@ -394,8 +393,8 @@ static const struct snd_soc_acpi_link_adr arl_rt711_l0_rt1316_l3[] = {
+ static const struct snd_soc_acpi_link_adr arl_rt722_l0_rt1320_l2[] = {
+ {
+ .mask = BIT(0),
+- .num_adr = ARRAY_SIZE(rt722_0_single_adr),
+- .adr_d = rt722_0_single_adr,
++ .num_adr = ARRAY_SIZE(rt722_0_agg_adr),
++ .adr_d = rt722_0_agg_adr,
+ },
+ {
+ .mask = BIT(2),
+--
+2.51.0
+
--- /dev/null
+From baa3796008e19924a2b247b4b66889bcb8d32abf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 10:18:32 +0200
+Subject: ASoC: SOF: Intel: hda: Fix NULL pointer dereference
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit 16c589567a956d46a7c1363af3f64de3d420af20 ]
+
+If there's a mismatch between the DAI links in the machine driver and
+the topology, it is possible that the playback/capture widget is not
+set, especially in the case of loopback capture for echo reference
+where we use the dummy DAI link. Return the error when the widget is not
+set to avoid a null pointer dereference like below when the topology is
+broken.
+
+RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]
+
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Mateusz Redzynia <mateuszx.redzynia@intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
+index 883d0d3bae9ec..3c742d5351333 100644
+--- a/sound/soc/sof/intel/hda-dai.c
++++ b/sound/soc/sof/intel/hda-dai.c
+@@ -70,12 +70,22 @@ static const struct hda_dai_widget_dma_ops *
+ hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai)
+ {
+ struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream);
+- struct snd_sof_widget *swidget = w->dobj.private;
++ struct snd_sof_widget *swidget;
+ struct snd_sof_dev *sdev;
+ struct snd_sof_dai *sdai;
+
+- sdev = widget_to_sdev(w);
++ /*
++ * this is unlikely if the topology and the machine driver DAI links match.
++ * But if there's a missing DAI link in topology, this will prevent a NULL pointer
++ * dereference later on.
++ */
++ if (!w) {
++ dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__);
++ return NULL;
++ }
+
++ sdev = widget_to_sdev(w);
++ swidget = w->dobj.private;
+ if (!swidget) {
+ dev_err(sdev->dev, "%s: swidget is NULL\n", __func__);
+ return NULL;
+--
+2.51.0
+
--- /dev/null
+From c229cd51e4cc48889d466a9311e49bf131f418f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 16:39:43 +0200
+Subject: ASoC: SOF: ipc4: Support for sending payload along with
+ LARGE_CONFIG_GET
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit d96cb0b86d6e8bbbbfa425771606f6c1aebc318e ]
+
+There are message types when we would need to send a payload along with
+the LARGE_CONFIG_GET message to provide information to the firmware on
+what data is requested.
+Such cases are the ALSA Kcontrol related messages when the high level
+param_id tells only the type of the control, but the ID/index of the exact
+control is specified in the payload area.
+
+The caller must place the payload for TX before calling the set_get_data()
+and this payload will be sent alongside with the message to the firmware.
+
+The data area will be overwritten by the received data from firmware.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://patch.msgid.link/20251217143945.2667-7-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4.c | 44 ++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 42 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4.c b/sound/soc/sof/ipc4.c
+index a4a090e6724a6..20d723f48fff0 100644
+--- a/sound/soc/sof/ipc4.c
++++ b/sound/soc/sof/ipc4.c
+@@ -15,6 +15,7 @@
+ #include "sof-audio.h"
+ #include "ipc4-fw-reg.h"
+ #include "ipc4-priv.h"
++#include "ipc4-topology.h"
+ #include "ipc4-telemetry.h"
+ #include "ops.h"
+
+@@ -433,6 +434,23 @@ static int sof_ipc4_tx_msg(struct snd_sof_dev *sdev, void *msg_data, size_t msg_
+ return ret;
+ }
+
++static bool sof_ipc4_tx_payload_for_get_data(struct sof_ipc4_msg *tx)
++{
++ /*
++ * Messages that require TX payload with LARGE_CONFIG_GET.
++ * The TX payload is placed into the IPC message data section by caller,
++ * which needs to be copied to temporary buffer since the received data
++ * will overwrite it.
++ */
++ switch (tx->extension & SOF_IPC4_MOD_EXT_MSG_PARAM_ID_MASK) {
++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_SWITCH_CONTROL_PARAM_ID):
++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_ENUM_CONTROL_PARAM_ID):
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+ size_t payload_bytes, bool set)
+ {
+@@ -444,6 +462,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+ struct sof_ipc4_msg tx = {{ 0 }};
+ struct sof_ipc4_msg rx = {{ 0 }};
+ size_t remaining = payload_bytes;
++ void *tx_payload_for_get = NULL;
++ size_t tx_data_size = 0;
+ size_t offset = 0;
+ size_t chunk_size;
+ int ret;
+@@ -469,10 +489,20 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+
+ tx.extension |= SOF_IPC4_MOD_EXT_MSG_FIRST_BLOCK(1);
+
++ if (sof_ipc4_tx_payload_for_get_data(&tx)) {
++ tx_data_size = min(ipc4_msg->data_size, payload_limit);
++ tx_payload_for_get = kmemdup(ipc4_msg->data_ptr, tx_data_size,
++ GFP_KERNEL);
++ if (!tx_payload_for_get)
++ return -ENOMEM;
++ }
++
+ /* ensure the DSP is in D0i0 before sending IPC */
+ ret = snd_sof_dsp_set_power_state(sdev, &target_state);
+- if (ret < 0)
++ if (ret < 0) {
++ kfree(tx_payload_for_get);
+ return ret;
++ }
+
+ /* Serialise IPC TX */
+ mutex_lock(&sdev->ipc->tx_mutex);
+@@ -506,7 +536,15 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+ rx.data_size = chunk_size;
+ rx.data_ptr = ipc4_msg->data_ptr + offset;
+
+- tx_size = 0;
++ if (tx_payload_for_get) {
++ tx_size = tx_data_size;
++ tx.data_size = tx_size;
++ tx.data_ptr = tx_payload_for_get;
++ } else {
++ tx_size = 0;
++ tx.data_size = 0;
++ tx.data_ptr = NULL;
++ }
+ rx_size = chunk_size;
+ }
+
+@@ -553,6 +591,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+
+ mutex_unlock(&sdev->ipc->tx_mutex);
+
++ kfree(tx_payload_for_get);
++
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 7001a16a3a8ed3666b523d3c2159ba4668c3490b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 11:32:50 +0800
+Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ]
+
+Add check for the return value of devm_regmap_init_mmio() and return the
+error if it fails in order to catch the error.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun50i-dmic.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c
+index bab1e29c99887..eddfebe166169 100644
+--- a/sound/soc/sunxi/sun50i-dmic.c
++++ b/sound/soc/sunxi/sun50i-dmic.c
+@@ -358,6 +358,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev)
+
+ host->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+ &sun50i_dmic_regmap_config);
++ if (IS_ERR(host->regmap))
++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap),
++ "failed to initialise regmap\n");
+
+ /* Clocks */
+ host->bus_clk = devm_clk_get(&pdev->dev, "bus");
+--
+2.51.0
+
--- /dev/null
+From cc06c0ed3420044ce1e0f33c6bded35cf814ee52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:08 +0100
+Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ]
+
+This bit is handled by a separate control.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 08c8ec3aeb449..6491e098bd212 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1760,7 +1760,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18),
+
+
+ SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0),
+-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA),
++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX),
+
+ SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0),
+ SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA),
+--
+2.51.0
+
--- /dev/null
+From bdf4036ca323e1bb54ba62622ad87aaedcadbb6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:10 +0100
+Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on
+ plug
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ]
+
+This usually means that a TRS plug with no microphone pin has been plugged
+into a TRRS socket. Cases where a user is plugging in a microphone while
+pressing a button will be handled via incoming interrupt after the user
+releases the button, so the microphone will still be detected once it
+becomes usable.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 6491e098bd212..ab8247ae431f8 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -67,6 +67,8 @@ struct wm8962_priv {
+ struct mutex dsp2_ena_lock;
+ u16 dsp2_ena;
+
++ int mic_status;
++
+ struct delayed_work mic_work;
+ struct snd_soc_jack *jack;
+
+@@ -3077,8 +3079,16 @@ static void wm8962_mic_work(struct work_struct *work)
+ if (reg & WM8962_MICSHORT_STS) {
+ status |= SND_JACK_BTN_0;
+ irq_pol |= WM8962_MICSCD_IRQ_POL;
++
++ /* Don't report a microphone if it's shorted right after
++ * plugging in, as this may be a TRS plug in a TRRS socket.
++ */
++ if (!(wm8962->mic_status & WM8962_MICDET_STS))
++ status = 0;
+ }
+
++ wm8962->mic_status = status;
++
+ snd_soc_jack_report(wm8962->jack, status,
+ SND_JACK_MICROPHONE | SND_JACK_BTN_0);
+
+--
+2.51.0
+
--- /dev/null
+From 8293d58c6ead4d688a2a1de06385f19885fc3dd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:46:22 +0800
+Subject: ata: libata: avoid long timeouts on hot-unplugged SATA DAS
+
+From: Henry Tseng <henrytseng@qnap.com>
+
+[ Upstream commit 151cabd140322205e27dae5c4bbf261ede0056e3 ]
+
+When a SATA DAS enclosure is connected behind a Thunderbolt PCIe
+switch, hot-unplugging the whole enclosure causes pciehp to tear down
+the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and
+START STOP UNIT for the disks.
+
+libata still queues these commands and the AHCI driver tries to access
+the HBA registers even though the PCI channel is already offline. This
+results in a series of timeouts and error recovery attempts, e.g.:
+
+ [ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
+ [ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec)
+ [ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec)
+ [ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec)
+ [ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+ ...
+ [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec)
+ [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec)
+ [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec)
+ [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+
+With this patch applied, the same hot-unplug looks like:
+
+ [ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
+ [ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+ ...
+ [ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+
+In this test setup with two disks, the hot-unplug sequence shrinks from
+about 226 seconds (~3.8 minutes) between the Link Down event and the
+last SYNCHRONIZE CACHE failure to under a second. Without this patch the
+total delay grows roughly with the number of disks, because each disk
+gets its own SYNCHRONIZE CACHE and qc timeout series.
+
+If the underlying PCI device is already gone, these commands cannot
+succeed anyway. Avoid issuing them by introducing
+ata_adapter_is_online(), which checks pci_channel_offline() for
+PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL,
+causing the SCSI layer to fail new commands with DID_BAD_TARGET
+immediately, and from ata_qc_issue() to bail out before touching the
+HBA registers.
+
+Since such failures would otherwise trigger libata error handling,
+ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler().
+When the adapter is offline, libata skips ap->ops->error_handler(ap) and
+completes error handling using the existing path, rather than running
+a full EH sequence against a dead adapter.
+
+With this change, SYNCHRONIZE CACHE and START STOP UNIT commands
+issued during hot-unplug fail quickly once the PCI channel is offline,
+without qc timeout spam or long libata EH delays.
+
+Suggested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Henry Tseng <henrytseng@qnap.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 24 ++++++++++++++++++++++++
+ drivers/ata/libata-eh.c | 3 ++-
+ drivers/ata/libata-scsi.c | 3 +++
+ drivers/ata/libata.h | 1 +
+ 4 files changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index b29067759cc27..1a57560ecc90f 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2358,6 +2358,24 @@ static bool ata_dev_check_adapter(struct ata_device *dev,
+ return false;
+ }
+
++bool ata_adapter_is_online(struct ata_port *ap)
++{
++ struct device *dev;
++
++ if (!ap || !ap->host)
++ return false;
++
++ dev = ap->host->dev;
++ if (!dev)
++ return false;
++
++ if (dev_is_pci(dev) &&
++ pci_channel_offline(to_pci_dev(dev)))
++ return false;
++
++ return true;
++}
++
+ static int ata_dev_config_ncq(struct ata_device *dev,
+ char *desc, size_t desc_sz)
+ {
+@@ -5067,6 +5085,12 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
+ qc->flags |= ATA_QCFLAG_ACTIVE;
+ ap->qc_active |= 1ULL << qc->tag;
+
++ /* Make sure the device is still accessible. */
++ if (!ata_adapter_is_online(ap)) {
++ qc->err_mask |= AC_ERR_HOST_BUS;
++ goto sys_err;
++ }
++
+ /*
+ * We guarantee to LLDs that they will have at least one
+ * non-zero sg if the command is a data command.
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 258e657f3527c..b373cceb95d23 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -752,7 +752,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap)
+ spin_unlock_irqrestore(ap->lock, flags);
+
+ /* invoke EH, skip if unloading or suspended */
+- if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)))
++ if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)) &&
++ ata_adapter_is_online(ap))
+ ap->ops->error_handler(ap);
+ else {
+ /* if unloading, commence suicide */
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 27ad145996052..5dc9586d9724e 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3093,6 +3093,9 @@ ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev)
+ {
+ struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev);
+
++ if (!ata_adapter_is_online(ap))
++ return NULL;
++
+ if (unlikely(!dev || !ata_dev_enabled(dev)))
+ return NULL;
+
+diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
+index 612fe59828180..0002994ddfc9b 100644
+--- a/drivers/ata/libata.h
++++ b/drivers/ata/libata.h
+@@ -94,6 +94,7 @@ extern int atapi_check_dma(struct ata_queued_cmd *qc);
+ extern void swap_buf_le16(u16 *buf, unsigned int buf_words);
+ extern bool ata_phys_link_online(struct ata_link *link);
+ extern bool ata_phys_link_offline(struct ata_link *link);
++bool ata_adapter_is_online(struct ata_port *ap);
+ extern void ata_dev_init(struct ata_device *dev);
+ extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp);
+ extern int sata_link_init_spd(struct ata_link *link);
+--
+2.51.0
+
--- /dev/null
+From f9cdfb4cdb4d532414f7fdf74c743cfdaa121229 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 20:49:30 +0100
+Subject: audit: add fchmodat2() to change attributes class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ]
+
+fchmodat2(), introduced in version 6.6 is currently not in the change
+attribute class of audit. Calling fchmodat2() to change a file
+attribute in the same fashion than chmod() or fchmodat() will bypass
+audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds fchmodat2() to the change attributes class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_change_attr.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h
+index cc840537885fb..ddd90bbe40dfc 100644
+--- a/include/asm-generic/audit_change_attr.h
++++ b/include/asm-generic/audit_change_attr.h
+@@ -26,6 +26,9 @@ __NR_fremovexattr,
+ __NR_fchownat,
+ __NR_fchmodat,
+ #endif
++#ifdef __NR_fchmodat2
++__NR_fchmodat2,
++#endif
+ #ifdef __NR_chown32
+ __NR_chown32,
+ __NR_fchown32,
+--
+2.51.0
+
--- /dev/null
+From 7d39dccc9a96f80a74807ecc0ed226acb39f5c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 09:39:24 +0100
+Subject: audit: add missing syscalls to read class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ]
+
+The "at" variant of getxattr() and listxattr() are missing from the
+audit read class. Calling getxattrat() or listxattrat() on a file to
+read its extended attributes will bypass audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds missing syscalls to the audit read class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_read.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h
+index 7bb7b5a83ae2e..fb9991f53fb6f 100644
+--- a/include/asm-generic/audit_read.h
++++ b/include/asm-generic/audit_read.h
+@@ -4,9 +4,15 @@ __NR_readlink,
+ #endif
+ __NR_quotactl,
+ __NR_listxattr,
++#ifdef __NR_listxattrat
++__NR_listxattrat,
++#endif
+ __NR_llistxattr,
+ __NR_flistxattr,
+ __NR_getxattr,
++#ifdef __NR_getxattrat
++__NR_getxattrat,
++#endif
+ __NR_lgetxattr,
+ __NR_fgetxattr,
+ #ifdef __NR_readlinkat
+--
+2.51.0
+
--- /dev/null
+From 6393575c15d4a1169a806f7faaba18bf0469d1e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 15:29:50 +0100
+Subject: binder: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log. Since commit ad67b74d2469 ("printk: hash
+addresses printed with %p") the regular %p has been improved to avoid
+this issue. Furthermore, restricted pointers ("%pK") were never meant
+to be used through printk(). They can still unintentionally leak raw
+pointers or acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+There are still a few users of %pK left, but these use it through
+seq_file, for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Carlos Llamas <cmllamas@google.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binder.c | 2 +-
+ drivers/android/binder_alloc.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 8e2989fb56a71..a6b3bfe0d9b81 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4523,7 +4523,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ }
+ }
+ binder_debug(BINDER_DEBUG_DEAD_BINDER,
+- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+ proc->pid, thread->pid, (u64)cookie,
+ death);
+ if (death == NULL) {
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 979c96b74cad3..d5ed64543bbf4 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -81,7 +81,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc,
+ new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: add free buffer, size %zd, at %pK\n",
++ "%d: add free buffer, size %zd, at %p\n",
+ alloc->pid, new_buffer_size, new_buffer);
+
+ while (*p) {
+@@ -572,7 +572,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
+ }
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
+ alloc->pid, size, buffer, buffer_size);
+
+ /*
+@@ -748,7 +748,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
+ ALIGN(buffer->extra_buffers_size, sizeof(void *));
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
++ "%d: binder_free_buf %p size %zd buffer_size %zd\n",
+ alloc->pid, buffer, size, buffer_size);
+
+ BUG_ON(buffer->free);
+--
+2.51.0
+
--- /dev/null
+From 11512ea13b9b91785d5b9102d63cc4cbd0677f10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 16:05:22 +0800
+Subject: blk-mq-debugfs: add missing debugfs_mutex in
+ blk_mq_debugfs_register_hctxs()
+
+From: Yu Kuai <yukuai@fnnas.com>
+
+[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ]
+
+In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while
+creating debugfs entries for hctxs. Hence add debugfs_mutex there,
+it's safe because queue is not frozen.
+
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index 4896525b1c054..553d93b88e194 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -686,8 +686,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ unsigned long i;
+
++ mutex_lock(&q->debugfs_mutex);
+ queue_for_each_hw_ctx(q, hctx, i)
+ blk_mq_debugfs_register_hctx(q, hctx);
++ mutex_unlock(&q->debugfs_mutex);
+ }
+
+ void blk_mq_debugfs_unregister_hctxs(struct request_queue *q)
+--
+2.51.0
+
--- /dev/null
+From 656a6cb988461f9a830156d926d5a09890891ab8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 16:19:43 +0800
+Subject: blk-mq-sched: unify elevators checking for async requests
+
+From: Yu Kuai <yukuai@fnnas.com>
+
+[ Upstream commit 1db61b0afdd7e8aa9289c423fdff002603b520b5 ]
+
+bfq and mq-deadline consider sync writes as async requests and only
+reserve tags for sync reads by async_depth, however, kyber doesn't
+consider sync writes as async requests for now.
+
+Consider the case there are lots of dirty pages, and user use fsync to
+flush dirty pages. In this case sched_tags can be exhausted by sync writes
+and sync reads can stuck waiting for tag. Hence let kyber follow what
+mq-deadline and bfq did, and unify async requests checking for all
+elevators.
+
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 2 +-
+ block/blk-mq-sched.h | 5 +++++
+ block/kyber-iosched.c | 2 +-
+ block/mq-deadline.c | 2 +-
+ 4 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 6e54b1d3d8bc2..9e9d081e86bb2 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -697,7 +697,7 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ unsigned int limit, act_idx;
+
+ /* Sync reads have full depth available */
+- if (op_is_sync(opf) && !op_is_write(opf))
++ if (blk_mq_is_sync_read(opf))
+ limit = data->q->nr_requests;
+ else
+ limit = bfqd->async_depths[!!bfqd->wr_busy_queues][op_is_sync(opf)];
+diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
+index 02c40a72e9598..5678e15bd33c4 100644
+--- a/block/blk-mq-sched.h
++++ b/block/blk-mq-sched.h
+@@ -137,4 +137,9 @@ static inline void blk_mq_set_min_shallow_depth(struct request_queue *q,
+ depth);
+ }
+
++static inline bool blk_mq_is_sync_read(blk_opf_t opf)
++{
++ return op_is_sync(opf) && !op_is_write(opf);
++}
++
+ #endif
+diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
+index 18efd6ef2a2b9..e3eaeea62e24d 100644
+--- a/block/kyber-iosched.c
++++ b/block/kyber-iosched.c
+@@ -544,7 +544,7 @@ static void kyber_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ * We use the scheduler tags as per-hardware queue queueing tokens.
+ * Async requests can be limited at this stage.
+ */
+- if (!op_is_sync(opf)) {
++ if (!blk_mq_is_sync_read(opf)) {
+ struct kyber_queue_data *kqd = data->q->elevator->elevator_data;
+
+ data->shallow_depth = kqd->async_depth;
+diff --git a/block/mq-deadline.c b/block/mq-deadline.c
+index 3e3719093aec7..29d00221fbea6 100644
+--- a/block/mq-deadline.c
++++ b/block/mq-deadline.c
+@@ -495,7 +495,7 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ struct deadline_data *dd = data->q->elevator->elevator_data;
+
+ /* Do not throttle synchronous reads. */
+- if (op_is_sync(opf) && !op_is_write(opf))
++ if (blk_mq_is_sync_read(opf))
+ return;
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From c4573599f67ee2142af626241b98466c2d149089 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 11:40:02 +0800
+Subject: block: decouple secure erase size limit from discard size limit
+
+From: Luke Wang <ziniu.wang_1@nxp.com>
+
+[ Upstream commit ee81212f74a57c5d2b56cf504f40d528dac6faaf ]
+
+Secure erase should use max_secure_erase_sectors instead of being limited
+by max_discard_sectors. Separate the handling of REQ_OP_SECURE_ERASE from
+REQ_OP_DISCARD to allow each operation to use its own size limit.
+
+Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 21 +++++++++++++++++----
+ block/blk.h | 6 +++++-
+ 2 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 37864c5d287ef..03b61923cf109 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -158,8 +158,9 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors)
+ return bio;
+ }
+
+-struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+- unsigned *nsegs)
++static struct bio *__bio_split_discard(struct bio *bio,
++ const struct queue_limits *lim, unsigned *nsegs,
++ unsigned int max_sectors)
+ {
+ unsigned int max_discard_sectors, granularity;
+ sector_t tmp;
+@@ -169,8 +170,7 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+
+ granularity = max(lim->discard_granularity >> 9, 1U);
+
+- max_discard_sectors =
+- min(lim->max_discard_sectors, bio_allowed_max_sectors(lim));
++ max_discard_sectors = min(max_sectors, bio_allowed_max_sectors(lim));
+ max_discard_sectors -= max_discard_sectors % granularity;
+ if (unlikely(!max_discard_sectors))
+ return bio;
+@@ -194,6 +194,19 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+ return bio_submit_split(bio, split_sectors);
+ }
+
++struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
++ unsigned *nsegs)
++{
++ unsigned int max_sectors;
++
++ if (bio_op(bio) == REQ_OP_SECURE_ERASE)
++ max_sectors = lim->max_secure_erase_sectors;
++ else
++ max_sectors = lim->max_discard_sectors;
++
++ return __bio_split_discard(bio, lim, nsegs, max_sectors);
++}
++
+ static inline unsigned int blk_boundary_sectors(const struct queue_limits *lim,
+ bool is_atomic)
+ {
+diff --git a/block/blk.h b/block/blk.h
+index 37b9b6a95c11c..06dfb5b670179 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -208,10 +208,14 @@ static inline unsigned int blk_queue_get_max_sectors(struct request *rq)
+ struct request_queue *q = rq->q;
+ enum req_op op = req_op(rq);
+
+- if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE))
++ if (unlikely(op == REQ_OP_DISCARD))
+ return min(q->limits.max_discard_sectors,
+ UINT_MAX >> SECTOR_SHIFT);
+
++ if (unlikely(op == REQ_OP_SECURE_ERASE))
++ return min(q->limits.max_secure_erase_sectors,
++ UINT_MAX >> SECTOR_SHIFT);
++
+ if (unlikely(op == REQ_OP_WRITE_ZEROES))
+ return q->limits.max_write_zeroes_sectors;
+
+--
+2.51.0
+
--- /dev/null
+From 43d6b4807a956ee01fce526fabac9aedb40a33e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:13:04 +0100
+Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU
+
+From: Jacopo Scannella <code@charlie.cat>
+
+[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ]
+
+Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek
+RTL8761BU Bluetooth adapter.
+
+Reference:
+https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth
+
+Signed-off-by: Jacopo Scannella <code@charlie.cat>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index b70cc8d5e0389..7c7955afa8e8a 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -777,6 +777,7 @@ static const struct usb_device_id quirks_table[] = {
+
+ /* Additional Realtek 8723BU Bluetooth devices */
+ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK },
+
+ /* Additional Realtek 8723DE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
+--
+2.51.0
+
--- /dev/null
+From e3975fe399c94a2d3b1824657ed01fdfe8673663 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 15:03:35 +1100
+Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE
+
+From: Shell Chen <w27@sorz.org>
+
+[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ]
+
+Add VID:PID 13d3:3612 to the quirks_table.
+
+This ID pair is found in the Realtek RTL8852CE PCIe module
+in an ASUS TUF A14 2025 (FA401KM) laptop.
+
+Tested on aforementioned laptop.
+
+The device info from /sys/kernel/debug/usb/devices is listed as below.
+
+T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3612 Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=Bluetooth Radio
+S: SerialNumber=00e04c000001
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+
+Signed-off-by: Shell Chen <w27@sorz.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 4c802b0f2f516..b70cc8d5e0389 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -561,6 +561,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
+--
+2.51.0
+
--- /dev/null
+From 263d1ed045df56fb614f3c6218dbdb64a872eafd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 23:22:25 +0300
+Subject: Bluetooth: btusb: Add support for MediaTek7920 0489:e158
+
+From: Bluecross <elantsew.andrew@gmail.com>
+
+[ Upstream commit 2630bcc8343a9d2a38dc1793068e6754b3156811 ]
+
+Add support for MediaTek7920 0489:e158
+
+/sys/kernel/debug/usb/devices reports for that device:
+
+T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 5 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0489 ProdID=e158 Rev= 1.00
+S: Manufacturer=MediaTek Inc.
+S: Product=Wireless_Device
+S: SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
+I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Andrew Elatsev <elantsew.andrew@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index a953fa9af85c6..adc5a686c0f59 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -635,6 +635,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x0489, 0xe158), .driver_info = BTUSB_MEDIATEK |
++ BTUSB_WIDEBAND_SPEECH },
+
+ /* Additional MediaTek MT7921 Bluetooth devices */
+ { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
+--
+2.51.0
+
--- /dev/null
+From 217de738dba79b49ca4315f60fffa3bc49c1a5d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 11:31:29 +0800
+Subject: Bluetooth: btusb: Add USB ID 0489:e112 for Realtek 8851BE
+
+From: Techie Ernie <techieernie@gmail.com>
+
+[ Upstream commit e07094a51ad8faf98ea64320799ce550828e97cd ]
+
+Add USB ID 0489:e112 for the Realtek 8851BE Bluetooth adapter.
+Without this entry, the device is not handled correctly by btusb and Bluetooth fails to initialise.
+Adding the ID enables proper Realtek initialization for Bluetooth to work on various motherboards using this Bluetooth adapter.
+
+The device identifies as:
+ Bus 001 Device XXX: ID 0489:e112 Foxconn / Hon Hai Bluetooth Radio
+
+Tested on Realtek 8851BE. Bluetooth works after this change is made.
+
+Signed-off-by: Techie Ernie <techieernie@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index adc5a686c0f59..4c802b0f2f516 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -521,6 +521,8 @@ static const struct usb_device_id quirks_table[] = {
+ { USB_DEVICE(0x0bda, 0xb850), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x13d3, 0x3600), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x13d3, 0x3601), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x0489, 0xe112), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+
+ /* Realtek 8851BU Bluetooth devices */
+ { USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK |
+--
+2.51.0
+
--- /dev/null
+From 16155747ea694cd53b45e4fa58749e3923728f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:10 +0100
+Subject: Bluetooth: hci_conn: Set link_policy on incoming ACL connections
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d ]
+
+The connection link policy is only set when establishing an outgoing
+ACL connection causing connection idle modes not to be available on
+incoming connections. Move the setting of the link policy to the
+creation of the connection so all ACL connection will use the link
+policy set on the HCI device.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 1 +
+ net/bluetooth/hci_sync.c | 2 --
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 6fc0692abf057..6dbef0cd53037 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -990,6 +990,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t
+ switch (type) {
+ case ACL_LINK:
+ conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
++ conn->link_policy = hdev->link_policy;
+ conn->mtu = hdev->acl_mtu;
+ break;
+ case LE_LINK:
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index f5896c023a9fa..cc1d340a32c62 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -6879,8 +6879,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
+
+ conn->attempt++;
+
+- conn->link_policy = hdev->link_policy;
+-
+ memset(&cp, 0, sizeof(cp));
+ bacpy(&cp.bdaddr, &conn->dst);
+ cp.pscan_rep_mode = 0x02;
+--
+2.51.0
+
--- /dev/null
+From d031bfe41bee480d8c1779df80d55007b203f1f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:09 +0100
+Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ]
+
+hci_conn_enter_active_mode() uses queue_delayed_work() with the
+intention that the work will run after the given timeout. However,
+queue_delayed_work() does nothing if the work is already queued, so
+depending on the link policy we may end up putting the connection
+into idle mode every hdev->idle_timeout ms.
+
+Use mod_delayed_work() instead so the work is queued if not already
+queued, and the timeout is updated otherwise.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 6dbef0cd53037..6a27ac5a751ca 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2592,8 +2592,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
+
+ timer:
+ if (hdev->idle_timeout > 0)
+- queue_delayed_work(hdev->workqueue, &conn->idle_work,
+- msecs_to_jiffies(hdev->idle_timeout));
++ mod_delayed_work(hdev->workqueue, &conn->idle_work,
++ msecs_to_jiffies(hdev->idle_timeout));
+ }
+
+ /* Drop all connection on the device */
+--
+2.51.0
+
--- /dev/null
+From 80c61470a111e9d1fc019d0fe7152ee36dd0285a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 11:37:12 +0800
+Subject: Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT_EN is
+ pulled up by hw
+
+From: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
+
+[ Upstream commit fce1a9244a0f85683be8530e623bc729f24c5067 ]
+
+On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw
+and cannot be controlled by the host. As a result, in case of a firmware
+crash, the host cannot trigger a cold reset. Instead, the BT controller
+performs a warm restart on its own, without reloading the firmware.
+
+This leads to the controller remaining in IBS_WAKE state, while the host
+expects it to be in sleep mode. The mismatch causes HCI reset commands
+to time out. Additionally, the driver does not clear internal flags
+QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence.
+If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode
+due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag
+is not cleared, so only the first SSR generates a coredump.
+
+Tell the driver that the BT controller has undergone a proper restart sequence:
+
+- Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR.
+- Add a 50ms delay to allow the controller to complete its warm reset.
+- Reset tx_idle_timer to prevent the host from entering TX sleep mode.
+- Clear memcoredump_flag to allow multiple coredump captures.
+
+Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set,
+which indicates that BT_EN is defined in DTS and cannot be toggled.
+
+Refer to the comment in include/net/bluetooth/hci.h for details on
+HCI_QUIRK_NON_PERSISTENT_SETUP.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 888176b0faa90..a3c217571c3c4 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -1653,6 +1653,39 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
+ skb_queue_purge(&qca->rx_memdump_q);
+ }
+
++ /*
++ * If the BT chip's bt_en pin is connected to a 3.3V power supply via
++ * hardware and always stays high, driver cannot control the bt_en pin.
++ * As a result, during SSR (SubSystem Restart), QCA_SSR_TRIGGERED and
++ * QCA_IBS_DISABLED flags cannot be cleared, which leads to a reset
++ * command timeout.
++ * Add an msleep delay to ensure controller completes the SSR process.
++ *
++ * Host will not download the firmware after SSR, controller to remain
++ * in the IBS_WAKE state, and the host needs to synchronize with it
++ *
++ * Since the bluetooth chip has been reset, clear the memdump state.
++ */
++ if (!hci_test_quirk(hu->hdev, HCI_QUIRK_NON_PERSISTENT_SETUP)) {
++ /*
++ * When the SSR (SubSystem Restart) duration exceeds 2 seconds,
++ * it triggers host tx_idle_delay, which sets host TX state
++ * to sleep. Reset tx_idle_timer after SSR to prevent
++ * host enter TX IBS_Sleep mode.
++ */
++ mod_timer(&qca->tx_idle_timer, jiffies +
++ msecs_to_jiffies(qca->tx_idle_delay));
++
++ /* Controller reset completion time is 50ms */
++ msleep(50);
++
++ clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
++ clear_bit(QCA_IBS_DISABLED, &qca->flags);
++
++ qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
++ qca->memdump_state = QCA_MEMDUMP_IDLE;
++ }
++
+ clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2a87cc47ada34cda55aa87417028b628a6300faa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 16:30:41 -0800
+Subject: bnxt_en: Allow ntuple filters for drops
+
+From: Joe Damato <joe@dama.to>
+
+[ Upstream commit 61cef6454cfbb9fcdbe41401fb53895f86603081 ]
+
+It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action
+support for ntuple"), bnxt gained support for ntuple filters for packet
+drops.
+
+However, support for this does not seem to work in recent kernels or
+against net-next:
+
+ % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1
+ rmgr: Cannot insert RX class rule: Operation not supported
+ Cannot insert classification rule
+
+The issue is that the existing code uses ethtool_get_flow_spec_ring_vf,
+which will return a non-zero value if the ring_cookie is set to
+RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return
+-EOPNOTSUPP because it thinks the user is trying to set an ntuple filter
+for a vf.
+
+Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC.
+
+After this patch, ntuple filters for drops can be added:
+
+ % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1
+ Added rule with ID 0
+
+ % ethtool -n eth0
+ 44 RX rings available
+ Total 1 rules
+
+ Filter: 0
+ Rule Type: UDP over IPv4
+ Src IP addr: 1.1.1.1 mask: 0.0.0.0
+ Dest IP addr: 0.0.0.0 mask: 255.255.255.255
+ TOS: 0x0 mask: 0xff
+ Src port: 0 mask: 0xffff
+ Dest port: 0 mask: 0xffff
+ Action: Drop
+
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Joe Damato <joe@dama.to>
+Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 41686a6f84b58..df4f0d15dd3d8 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1340,16 +1340,17 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp,
+ struct bnxt_l2_filter *l2_fltr;
+ struct bnxt_flow_masks *fmasks;
+ struct flow_keys *fkeys;
+- u32 idx, ring;
++ u32 idx;
+ int rc;
+- u8 vf;
+
+ if (!bp->vnic_info)
+ return -EAGAIN;
+
+- vf = ethtool_get_flow_spec_ring_vf(fs->ring_cookie);
+- ring = ethtool_get_flow_spec_ring(fs->ring_cookie);
+- if ((fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) || vf)
++ if (fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT))
++ return -EOPNOTSUPP;
++
++ if (fs->ring_cookie != RX_CLS_FLOW_DISC &&
++ ethtool_get_flow_spec_ring_vf(fs->ring_cookie))
+ return -EOPNOTSUPP;
+
+ if (flow_type == IP_USER_FLOW) {
+@@ -1475,7 +1476,7 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp,
+ if (fs->ring_cookie == RX_CLS_FLOW_DISC)
+ new_fltr->base.flags |= BNXT_ACT_DROP;
+ else
+- new_fltr->base.rxq = ring;
++ new_fltr->base.rxq = ethtool_get_flow_spec_ring(fs->ring_cookie);
+ __set_bit(BNXT_FLTR_VALID, &new_fltr->base.state);
+ rc = bnxt_insert_ntp_filter(bp, new_fltr, idx);
+ if (!rc) {
+--
+2.51.0
+
--- /dev/null
+From 4356b82548c68ec996ca434df951b24a2d7ae858 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 08:25:50 +0000
+Subject: bpf: crypto: Use the correct destructor kfunc type
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit b40a5d724f29fc2eed23ff353808a9aae616b48a ]
+
+With CONFIG_CFI enabled, the kernel strictly enforces that indirect
+function calls use a function pointer type that matches the target
+function. I ran into the following type mismatch when running BPF
+self-tests:
+
+ CFI failure at bpf_obj_free_fields+0x190/0x238 (target:
+ bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc)
+ Internal error: Oops - CFI: 00000000f2008228 [#1] SMP
+ ...
+
+As bpf_crypto_ctx_release() is also used in BPF programs and using
+a void pointer as the argument would make the verifier unhappy, add
+a simple stub function with the correct type and register it as the
+destructor kfunc instead.
+
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Tested-by: Viktor Malik <vmalik@redhat.com>
+Link: https://lore.kernel.org/r/20260110082548.113748-7-samitolvanen@google.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/crypto.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/crypto.c b/kernel/bpf/crypto.c
+index 83c4d9943084b..1d024fe7248ac 100644
+--- a/kernel/bpf/crypto.c
++++ b/kernel/bpf/crypto.c
+@@ -261,6 +261,12 @@ __bpf_kfunc void bpf_crypto_ctx_release(struct bpf_crypto_ctx *ctx)
+ call_rcu(&ctx->rcu, crypto_free_cb);
+ }
+
++__bpf_kfunc void bpf_crypto_ctx_release_dtor(void *ctx)
++{
++ bpf_crypto_ctx_release(ctx);
++}
++CFI_NOSEAL(bpf_crypto_ctx_release_dtor);
++
+ static int bpf_crypto_crypt(const struct bpf_crypto_ctx *ctx,
+ const struct bpf_dynptr_kern *src,
+ const struct bpf_dynptr_kern *dst,
+@@ -368,7 +374,7 @@ static const struct btf_kfunc_id_set crypt_kfunc_set = {
+
+ BTF_ID_LIST(bpf_crypto_dtor_ids)
+ BTF_ID(struct, bpf_crypto_ctx)
+-BTF_ID(func, bpf_crypto_ctx_release)
++BTF_ID(func, bpf_crypto_ctx_release_dtor)
+
+ static int __init crypto_kfunc_init(void)
+ {
+--
+2.51.0
+
--- /dev/null
+From 3e2e9a182a291ebb1c2fc3850d8e385f69fd4375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 08:25:51 +0000
+Subject: bpf: net_sched: Use the correct destructor kfunc type
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit c99d97b46631c4bea0c14b7581b7a59214601e63 ]
+
+With CONFIG_CFI enabled, the kernel strictly enforces that indirect
+function calls use a function pointer type that matches the
+target function. As bpf_kfree_skb() signature differs from the
+btf_dtor_kfunc_t pointer type used for the destructor calls in
+bpf_obj_free_fields(), add a stub function with the correct type to
+fix the type mismatch.
+
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20260110082548.113748-8-samitolvanen@google.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/bpf_qdisc.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/sched/bpf_qdisc.c b/net/sched/bpf_qdisc.c
+index adcb618a2bfca..e9bea9890777d 100644
+--- a/net/sched/bpf_qdisc.c
++++ b/net/sched/bpf_qdisc.c
+@@ -202,6 +202,12 @@ __bpf_kfunc void bpf_kfree_skb(struct sk_buff *skb)
+ kfree_skb(skb);
+ }
+
++__bpf_kfunc void bpf_kfree_skb_dtor(void *skb)
++{
++ bpf_kfree_skb(skb);
++}
++CFI_NOSEAL(bpf_kfree_skb_dtor);
++
+ /* bpf_qdisc_skb_drop - Drop an skb by adding it to a deferred free list.
+ * @skb: The skb whose reference to be released and dropped.
+ * @to_free_list: The list of skbs to be dropped.
+@@ -449,7 +455,7 @@ static struct bpf_struct_ops bpf_Qdisc_ops = {
+ .owner = THIS_MODULE,
+ };
+
+-BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb)
++BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb_dtor)
+
+ static int __init bpf_qdisc_kfunc_init(void)
+ {
+--
+2.51.0
+
--- /dev/null
+From 45a6fdde25c22ec3d28d1fb13da344f36ae00ee1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 16:25:43 +0000
+Subject: bpf: Properly mark live registers for indirect jumps
+
+From: Anton Protopopov <a.s.protopopov@gmail.com>
+
+[ Upstream commit d1aab1ca576c90192ba961094d51b0be6355a4d6 ]
+
+For a `gotox rX` instruction the rX register should be marked as used
+in the compute_insn_live_regs() function. Fix this.
+
+Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
+Link: https://lore.kernel.org/r/20260114162544.83253-2-a.s.protopopov@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index e94a02ae3e1cd..dcbf21f61d2e6 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -24292,6 +24292,12 @@ static void compute_insn_live_regs(struct bpf_verifier_env *env,
+ case BPF_JMP32:
+ switch (code) {
+ case BPF_JA:
++ def = 0;
++ if (BPF_SRC(insn->code) == BPF_X)
++ use = dst;
++ else
++ use = 0;
++ break;
+ case BPF_JCOND:
+ def = 0;
+ use = 0;
+--
+2.51.0
+
--- /dev/null
+From acefb303f5ca25685b0ff86f2fdc0dbafc3a2fdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 12:13:57 -0800
+Subject: bpf: Recognize special arithmetic shift in the verifier
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7 ]
+
+cilium bpf_wiregard.bpf.c when compiled with -O1 fails to load
+with the following verifier log:
+
+192: (79) r2 = *(u64 *)(r10 -304) ; R2=pkt(r=40) R10=fp0 fp-304=pkt(r=40)
+...
+227: (85) call bpf_skb_store_bytes#9 ; R0=scalar()
+228: (bc) w2 = w0 ; R0=scalar() R2=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
+229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
+230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
+...
+232: (66) if w2 s> 0xffffffff goto pc+125 ; R2=scalar(smin=umin=umin32=0x80000000,smax=umax=umax32=0xffffff7a,smax32=-134,var_off=(0x80000000; 0x7fffff7a))
+...
+238: (79) r4 = *(u64 *)(r10 -304) ; R4=scalar() R10=fp0 fp-304=scalar()
+239: (56) if w2 != 0xffffff78 goto pc+210 ; R2=0xffffff78 // -136
+...
+258: (71) r1 = *(u8 *)(r4 +0)
+R4 invalid mem access 'scalar'
+
+The error might confuse most bpf authors, since fp-304 slot had 'pkt'
+pointer at insn 192 and became 'scalar' at 238. That happened because
+bpf_skb_store_bytes() clears all packet pointers including those in
+the stack. On the first glance it might look like a bug in the source
+code, since ctx->data pointer should have been reloaded after the call
+to bpf_skb_store_bytes().
+
+The relevant part of cilium source code looks like this:
+
+// bpf/lib/nodeport.h
+int dsr_set_ipip6()
+{
+ if (ctx_adjust_hroom(...))
+ return DROP_INVALID; // -134
+ if (ctx_store_bytes(...))
+ return DROP_WRITE_ERROR; // -141
+ return 0;
+}
+
+bool dsr_fail_needs_reply(int code)
+{
+ if (code == DROP_FRAG_NEEDED) // -136
+ return true;
+ return false;
+}
+
+tail_nodeport_ipv6_dsr()
+{
+ ret = dsr_set_ipip6(...);
+ if (!IS_ERR(ret)) {
+ ...
+ } else {
+ if (dsr_fail_needs_reply(ret))
+ return dsr_reply_icmp6(...);
+ }
+}
+
+The code doesn't have arithmetic shift by 31 and it reloads ctx->data
+every time it needs to access it. So it's not a bug in the source code.
+
+The reason is DAGCombiner::foldSelectCCToShiftAnd() LLVM transformation:
+
+ // If this is a select where the false operand is zero and the compare is a
+ // check of the sign bit, see if we can perform the "gzip trick":
+ // select_cc setlt X, 0, A, 0 -> and (sra X, size(X)-1), A
+ // select_cc setgt X, 0, A, 0 -> and (not (sra X, size(X)-1)), A
+
+The conditional branch in dsr_set_ipip6() and its return values
+are optimized into BPF_ARSH plus BPF_AND:
+
+227: (85) call bpf_skb_store_bytes#9
+228: (bc) w2 = w0
+229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
+230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
+
+after insn 230 the register w2 can only be 0 or -134,
+but the verifier approximates it, since there is no way to
+represent two scalars in bpf_reg_state.
+After fallthough at insn 232 the w2 can only be -134,
+hence the branch at insn
+239: (56) if w2 != -136 goto pc+210
+should be always taken, and trapping insn 258 should never execute.
+LLVM generated correct code, but the verifier follows impossible
+path and rejects valid program. To fix this issue recognize this
+special LLVM optimization and fork the verifier state.
+So after insn 229: (c4) w2 s>>= 31
+the verifier has two states to explore:
+one with w2 = 0 and another with w2 = 0xffffffff
+which makes the verifier accept bpf_wiregard.c
+
+A similar pattern exists were OR operation is used in place of the AND
+operation, the verifier detects that pattern as well by forking the
+state before the OR operation with a scalar in range [-1,0].
+
+Note there are 20+ such patterns in bpf_wiregard.o compiled
+with -O1 and -O2, but they're rarely seen in other production
+bpf programs, so push_stack() approach is not a concern.
+
+Reported-by: Hao Sun <sunhao.th@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Co-developed-by: Puranjay Mohan <puranjay@kernel.org>
+Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
+Link: https://lore.kernel.org/r/20260112201424.816836-2-puranjay@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index f7ca88fe20e75..e94a02ae3e1cd 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -15418,6 +15418,35 @@ static bool is_safe_to_compute_dst_reg_range(struct bpf_insn *insn,
+ }
+ }
+
++static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *insn,
++ struct bpf_reg_state *dst_reg)
++{
++ struct bpf_verifier_state *branch;
++ struct bpf_reg_state *regs;
++ bool alu32;
++
++ if (dst_reg->smin_value == -1 && dst_reg->smax_value == 0)
++ alu32 = false;
++ else if (dst_reg->s32_min_value == -1 && dst_reg->s32_max_value == 0)
++ alu32 = true;
++ else
++ return 0;
++
++ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
++ if (IS_ERR(branch))
++ return PTR_ERR(branch);
++
++ regs = branch->frame[branch->curframe]->regs;
++ if (alu32) {
++ __mark_reg32_known(®s[insn->dst_reg], 0);
++ __mark_reg32_known(dst_reg, -1ull);
++ } else {
++ __mark_reg_known(®s[insn->dst_reg], 0);
++ __mark_reg_known(dst_reg, -1ull);
++ }
++ return 0;
++}
++
+ /* WARNING: This function does calculations on 64-bit values, but the actual
+ * execution may occur on 32-bit values. Therefore, things like bitshifts
+ * need extra checks in the 32-bit case.
+@@ -15480,11 +15509,21 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ scalar_min_max_mul(dst_reg, &src_reg);
+ break;
+ case BPF_AND:
++ if (tnum_is_const(src_reg.var_off)) {
++ ret = maybe_fork_scalars(env, insn, dst_reg);
++ if (ret)
++ return ret;
++ }
+ dst_reg->var_off = tnum_and(dst_reg->var_off, src_reg.var_off);
+ scalar32_min_max_and(dst_reg, &src_reg);
+ scalar_min_max_and(dst_reg, &src_reg);
+ break;
+ case BPF_OR:
++ if (tnum_is_const(src_reg.var_off)) {
++ ret = maybe_fork_scalars(env, insn, dst_reg);
++ if (ret)
++ return ret;
++ }
+ dst_reg->var_off = tnum_or(dst_reg->var_off, src_reg.var_off);
+ scalar32_min_max_or(dst_reg, &src_reg);
+ scalar_min_max_or(dst_reg, &src_reg);
+--
+2.51.0
+
--- /dev/null
+From 50a5fd9e87d75db859f62624a815e45d8566f1fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 18:02:19 +0000
+Subject: bpf: verifier improvement in 32bit shift sign extension pattern
+
+From: Cupertino Miranda <cupertino.miranda@oracle.com>
+
+[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ]
+
+This patch improves the verifier to correctly compute bounds for
+sign extension compiler pattern composed of left shift by 32bits
+followed by a sign right shift by 32bits. Pattern in the verifier was
+limitted to positive value bounds and would reset bound computation for
+negative values. New code allows both positive and negative values for
+sign extension without compromising bound computation and verifier to
+pass.
+
+This change is required by GCC which generate such pattern, and was
+detected in the context of systemd, as described in the following GCC
+bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731
+
+Three new tests were added in verifier_subreg.c.
+
+Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com>
+Signed-off-by: Andrew Pinski <andrew.pinski@oss.qualcomm.com>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Cc: David Faust <david.faust@oracle.com>
+Cc: Jose Marchesi <jose.marchesi@oracle.com>
+Cc: Elena Zannoni <elena.zannoni@oracle.com>
+Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index c4fa2268dbbc5..f7ca88fe20e75 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -15224,21 +15224,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg,
+ u64 umin_val, u64 umax_val)
+ {
+ /* Special case <<32 because it is a common compiler pattern to sign
+- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are
+- * positive we know this shift will also be positive so we can track
+- * bounds correctly. Otherwise we lose all sign bit information except
+- * what we can pick up from var_off. Perhaps we can generalize this
+- * later to shifts of any length.
++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct
++ * because s32 bounds don't flip sign when shifting to the left by
++ * 32bits.
+ */
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0)
++ if (umin_val == 32 && umax_val == 32) {
+ dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32;
+- else
+- dst_reg->smax_value = S64_MAX;
+-
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0)
+ dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32;
+- else
++ } else {
++ dst_reg->smax_value = S64_MAX;
+ dst_reg->smin_value = S64_MIN;
++ }
+
+ /* If we might shift our top bit out, then we know nothing */
+ if (dst_reg->umax_value > 1ULL << (63 - umax_val)) {
+--
+2.51.0
+
--- /dev/null
+From c865dc7c720ef2b61ae15823ac8455172f693670 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 13:12:55 -0800
+Subject: bpftool: Fix dependencies for static build
+
+From: Ihor Solodrai <ihor.solodrai@linux.dev>
+
+[ Upstream commit 08a7491843224f8b96518fbe70d9e48163046054 ]
+
+When building selftests/bpf with EXTRA_LDFLAGS=-static the follwoing
+error happens:
+
+ LINK /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool
+/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-dso_dlfcn.o): in function `dlfcn_globallookup':
+ [...]
+/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_expand_block':
+(.text+0xc64): undefined reference to `uncompress'
+/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_compress_block':
+(.text+0xce4): undefined reference to `compress'
+collect2: error: ld returned 1 exit status
+make[1]: *** [Makefile:252: /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool] Error 1
+make: *** [Makefile:327: /ws/linux/tools/testing/selftests/bpf/tools/sbin/bpftool] Error 2
+make: *** Waiting for unfinished jobs....
+
+This is caused by wrong order of dependencies in the Makefile. Fix it.
+
+Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20260128211255.376933-1-ihor.solodrai@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
+index 586d1b2595d16..fd43e5ea63f38 100644
+--- a/tools/bpf/bpftool/Makefile
++++ b/tools/bpf/bpftool/Makefile
+@@ -130,8 +130,8 @@ include $(FEATURES_DUMP)
+ endif
+ endif
+
+-LIBS = $(LIBBPF) -lelf -lz -lcrypto
+-LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lz -lcrypto
++LIBS = $(LIBBPF) -lelf -lcrypto -lz
++LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lcrypto -lz
+
+ ifeq ($(feature-libelf-zstd),1)
+ LIBS += -lzstd
+--
+2.51.0
+
--- /dev/null
+From 1b8667538cdd103a0461cda5c4f98b65a83f81f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Nov 2025 10:22:16 +1030
+Subject: btrfs: fallback to buffered IO if the data profile has duplication
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 7c2830f00c3e086292c1ee9f27b61efaf8e76c9a ]
+
+[BACKGROUND]
+Inspired by a recent kernel bug report, which is related to direct IO
+buffer modification during writeback, that leads to contents mismatch of
+different RAID1 mirrors.
+
+[CAUSE AND PROBLEMS]
+The root cause is exactly the same explained in commit 968f19c5b1b7
+("btrfs: always fallback to buffered write if the inode requires
+checksum"), that we can not trust direct IO buffer which can be modified
+halfway during writeback.
+
+Unlike data checksum verification, if this happened on inodes without
+data checksum but has the data has extra mirrors, it will lead to
+stealth data mismatch on different mirrors.
+
+This will be way harder to detect without data checksum.
+
+Furthermore for RAID56, we can even have data without checksum and data
+with checksum mixed inside the same full stripe.
+
+In that case if the direct IO buffer got changed halfway for the
+nodatasum part, the data with checksum immediately lost its ability to
+recover, e.g.:
+
+" " = Good old data or parity calculated using good old data
+"X" = Data modified during writeback
+
+ 0 32K 64K
+ Data 1 | | Has csum
+ Data 2 |XXXXXXXXXXXXXXXX | No csum
+ Parity | |
+
+In above case, the parity is calculated using data 1 (has csum, from
+page cache, won't change during writeback), and old data 2 (has no csum,
+direct IO write).
+
+After parity is calculated, but before submission to the storage, direct
+IO buffer of data 2 is modified, causing the range [0, 32K) of data 2
+has a different content.
+
+Now all data is submitted to the storage, and the fs got fully synced.
+
+Then the device of data 1 is lost, has to be rebuilt from data 2 and
+parity. But since the data 2 has some modified data, and the parity is
+calculated using old data, the recovered data is no the same for data 1,
+causing data checksum mismatch.
+
+[FIX]
+Fix the problem by checking the data allocation profile.
+If our data allocation profile is either RAID0 or SINGLE, we can allow
+true zero-copy direct IO and the end user is fully responsible for any
+race.
+
+However this is not going to fix all situations, as it's still possible
+to race with balance where the fs got a new data profile after the data
+allocation profile check.
+But this fix should still greatly reduce the window of the original bug.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=99171
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/direct-io.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/fs/btrfs/direct-io.c b/fs/btrfs/direct-io.c
+index e29ea28ce90b9..3836414cbe371 100644
+--- a/fs/btrfs/direct-io.c
++++ b/fs/btrfs/direct-io.c
+@@ -814,6 +814,8 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from)
+ ssize_t ret;
+ unsigned int ilock_flags = 0;
+ struct iomap_dio *dio;
++ const u64 data_profile = btrfs_data_alloc_profile(fs_info) &
++ BTRFS_BLOCK_GROUP_PROFILE_MASK;
+
+ if (iocb->ki_flags & IOCB_NOWAIT)
+ ilock_flags |= BTRFS_ILOCK_TRY;
+@@ -827,6 +829,16 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from)
+ if (iocb->ki_pos + iov_iter_count(from) <= i_size_read(inode) && IS_NOSEC(inode))
+ ilock_flags |= BTRFS_ILOCK_SHARED;
+
++ /*
++ * If our data profile has duplication (either extra mirrors or RAID56),
++ * we can not trust the direct IO buffer, the content may change during
++ * writeback and cause different contents written to different mirrors.
++ *
++ * Thus only RAID0 and SINGLE can go true zero-copy direct IO.
++ */
++ if (data_profile != BTRFS_BLOCK_GROUP_RAID0 && data_profile != 0)
++ goto buffered;
++
+ relock:
+ ret = btrfs_inode_lock(BTRFS_I(inode), ilock_flags);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From d1d21e463f923d01d656e990f66aa1b7d25d79d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 07:06:40 +0000
+Subject: btrfs: handle user interrupt properly in btrfs_trim_fs()
+
+From: jinbaohong <jinbaohong@synology.com>
+
+[ Upstream commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 ]
+
+When a fatal signal is pending or the process is freezing,
+btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS.
+Currently this is treated as a regular error: the loops continue to the
+next iteration and count it as a block group or device failure.
+
+Instead, break out of the loops immediately and return -ERESTARTSYS to
+userspace without counting it as a failure. Also skip the device loop
+entirely if the block group loop was interrupted.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Robbie Ko <robbieko@synology.com>
+Signed-off-by: jinbaohong <jinbaohong@synology.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 01337e3f2879c..a48ba97bb3694 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6568,6 +6568,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ range->minlen);
+
+ trimmed += group_trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR) {
++ btrfs_put_block_group(cache);
++ break;
++ }
+ if (ret) {
+ bg_failed++;
+ bg_ret = ret;
+@@ -6581,6 +6585,9 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ "failed to trim %llu block group(s), last error %d",
+ bg_failed, bg_ret);
+
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ return ret;
++
+ mutex_lock(&fs_devices->device_list_mutex);
+ list_for_each_entry(device, &fs_devices->devices, dev_list) {
+ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
+@@ -6589,6 +6596,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ ret = btrfs_trim_free_extents(device, &group_trimmed);
+
+ trimmed += group_trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ break;
+ if (ret) {
+ dev_failed++;
+ dev_ret = ret;
+@@ -6602,6 +6611,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ "failed to trim %llu device(s), last error %d",
+ dev_failed, dev_ret);
+ range->len = trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ return ret;
+ if (bg_ret)
+ return bg_ret;
+ return dev_ret;
+--
+2.51.0
+
--- /dev/null
+From 9d519a0b239c8495fe6ca93641f3ce6d6202707a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 22:53:57 +0530
+Subject: btrfs: replace BUG() with error handling in __btrfs_balance()
+
+From: Adarsh Das <adarshdas950@gmail.com>
+
+[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ]
+
+We search with offset (u64)-1 which should never match exactly.
+Previously this was handled with BUG(). Now logs an error
+and return -EUCLEAN.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 645bf98a9571b..4a1dc4720a0ba 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4264,8 +4264,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info)
+ * this shouldn't happen, it means the last relocate
+ * failed
+ */
+- if (ret == 0)
+- BUG(); /* FIXME break ? */
++ if (unlikely(ret == 0)) {
++ btrfs_err(fs_info,
++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx",
++ key.offset);
++ mutex_unlock(&fs_info->reclaim_bgs_lock);
++ ret = -EUCLEAN;
++ goto error;
++ }
+
+ ret = btrfs_previous_item(chunk_root, path, 0,
+ BTRFS_CHUNK_ITEM_KEY);
+--
+2.51.0
+
--- /dev/null
+From 782eb9341785aaf2e230e6494ea090a22832fe8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 18:42:06 +0800
+Subject: ceph: supply snapshot context in ceph_uninline_data()
+
+From: ethanwu <ethanwu@synology.com>
+
+[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ]
+
+The ceph_uninline_data function was missing proper snapshot context
+handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and
+CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate
+snapshot context, which could lead to unnecessary object clone.
+
+Reproducer:
+../src/vstart.sh --new -x --localhost --bluestore
+// turn on cephfs inline data
+./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it
+// allow fs_a client to take snapshot
+./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a'
+// mount cephfs with fuse, since kernel cephfs doesn't support inline write
+ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/
+// bump snapshot seq
+mkdir /mnt/mycephfs/.snap/snap1
+echo "foo" > /mnt/mycephfs/test
+// umount and mount it again using kernel cephfs client
+umount /mnt/mycephfs
+mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf
+echo "bar" >> /mnt/mycephfs/test
+./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000
+
+will see this object does unnecessary clone
+1000000000a.00000000 (seq:2):
+cloneid snaps size overlap
+2 2 4 []
+head - 8
+
+but it's expected to see
+10000000000.00000000 (seq:2):
+cloneid snaps size overlap
+head - 8
+
+since there's no snapshot between these 2 writes
+
+clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't
+pass snap context so object is created with snap seq 0, but later data
+writeback is equipped with snapshot context.
+snap.seq(1) > object snap seq(0), so osd does object clone.
+
+This fix properly acquiring the snapshot context before performing
+write operations.
+
+Signed-off-by: ethanwu <ethanwu@synology.com>
+Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/addr.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index 322ed268f14aa..9faeaf1196c5c 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -2203,6 +2203,7 @@ int ceph_uninline_data(struct file *file)
+ struct ceph_osd_request *req = NULL;
+ struct ceph_cap_flush *prealloc_cf = NULL;
+ struct folio *folio = NULL;
++ struct ceph_snap_context *snapc = NULL;
+ u64 inline_version = CEPH_INLINE_NONE;
+ struct page *pages[1];
+ int err = 0;
+@@ -2230,6 +2231,24 @@ int ceph_uninline_data(struct file *file)
+ if (inline_version == 1) /* initial version, no data */
+ goto out_uninline;
+
++ down_read(&fsc->mdsc->snap_rwsem);
++ spin_lock(&ci->i_ceph_lock);
++ if (__ceph_have_pending_cap_snap(ci)) {
++ struct ceph_cap_snap *capsnap =
++ list_last_entry(&ci->i_cap_snaps,
++ struct ceph_cap_snap,
++ ci_item);
++ snapc = ceph_get_snap_context(capsnap->context);
++ } else {
++ if (!ci->i_head_snapc) {
++ ci->i_head_snapc = ceph_get_snap_context(
++ ci->i_snap_realm->cached_context);
++ }
++ snapc = ceph_get_snap_context(ci->i_head_snapc);
++ }
++ spin_unlock(&ci->i_ceph_lock);
++ up_read(&fsc->mdsc->snap_rwsem);
++
+ folio = read_mapping_folio(inode->i_mapping, 0, file);
+ if (IS_ERR(folio)) {
+ err = PTR_ERR(folio);
+@@ -2245,7 +2264,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 0, 1,
+ CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE,
+- NULL, 0, 0, false);
++ snapc, 0, 0, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+ goto out_unlock;
+@@ -2261,7 +2280,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 1, 3,
+ CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE,
+- NULL, ci->i_truncate_seq,
++ snapc, ci->i_truncate_seq,
+ ci->i_truncate_size, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+@@ -2324,6 +2343,7 @@ int ceph_uninline_data(struct file *file)
+ folio_put(folio);
+ }
+ out:
++ ceph_put_snap_context(snapc);
+ ceph_free_cap_flush(prealloc_cf);
+ doutc(cl, "%llx.%llx inline_version %llu = %d\n",
+ ceph_vinop(inode), inline_version, err);
+--
+2.51.0
+
--- /dev/null
+From ea571d97c3b2578a6e46f4924360eafc5e743b58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 11:00:19 -0500
+Subject: cgroup/cpuset: Don't fail cpuset.cpus change in v2
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 6e6f13f6d5095f3a432da421e78f4d7d51ef39c8 ]
+
+Commit fe8cd2736e75 ("cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE
+until valid partition") introduced a new check to disallow the setting
+of a new cpuset.cpus.exclusive value that is a superset of a sibling's
+cpuset.cpus value so that there will at least be one CPU left in the
+sibling in case the cpuset becomes a valid partition root. This new
+check does have the side effect of failing a cpuset.cpus change that
+make it a subset of a sibling's cpuset.cpus.exclusive value.
+
+With v2, users are supposed to be allowed to set whatever value they
+want in cpuset.cpus without failure. To maintain this rule, the check
+is now restricted to only when cpuset.cpus.exclusive is being changed
+not when cpuset.cpus is changed.
+
+The cgroup-v2.rst doc file is also updated to reflect this change.
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Reviewed-by: Chen Ridong <chenridong@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/admin-guide/cgroup-v2.rst | 8 +++----
+ kernel/cgroup/cpuset.c | 30 ++++++++++++-------------
+ 2 files changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst
+index 0e6c67ac585a0..edcd125d6992f 100644
+--- a/Documentation/admin-guide/cgroup-v2.rst
++++ b/Documentation/admin-guide/cgroup-v2.rst
+@@ -2538,10 +2538,10 @@ Cpuset Interface Files
+ Users can manually set it to a value that is different from
+ "cpuset.cpus". One constraint in setting it is that the list of
+ CPUs must be exclusive with respect to "cpuset.cpus.exclusive"
+- of its sibling. If "cpuset.cpus.exclusive" of a sibling cgroup
+- isn't set, its "cpuset.cpus" value, if set, cannot be a subset
+- of it to leave at least one CPU available when the exclusive
+- CPUs are taken away.
++ and "cpuset.cpus.exclusive.effective" of its siblings. Another
++ constraint is that it cannot be a superset of "cpuset.cpus"
++ of its sibling in order to leave at least one CPU available to
++ that sibling when the exclusive CPUs are taken away.
+
+ For a parent cgroup, any one of its exclusive CPUs can only
+ be distributed to at most one of its child cgroups. Having an
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index 1245418cc8b3b..d779e29a9302d 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -599,33 +599,31 @@ static inline bool cpusets_are_exclusive(struct cpuset *cs1, struct cpuset *cs2)
+
+ /**
+ * cpus_excl_conflict - Check if two cpusets have exclusive CPU conflicts
+- * @cs1: first cpuset to check
+- * @cs2: second cpuset to check
++ * @trial: the trial cpuset to be checked
++ * @sibling: a sibling cpuset to be checked against
++ * @xcpus_changed: set if exclusive_cpus has been set
+ *
+ * Returns: true if CPU exclusivity conflict exists, false otherwise
+ *
+ * Conflict detection rules:
+ * 1. If either cpuset is CPU exclusive, they must be mutually exclusive
+ * 2. exclusive_cpus masks cannot intersect between cpusets
+- * 3. The allowed CPUs of one cpuset cannot be a subset of another's exclusive CPUs
++ * 3. The allowed CPUs of a sibling cpuset cannot be a subset of the new exclusive CPUs
+ */
+-static inline bool cpus_excl_conflict(struct cpuset *cs1, struct cpuset *cs2)
++static inline bool cpus_excl_conflict(struct cpuset *trial, struct cpuset *sibling,
++ bool xcpus_changed)
+ {
+ /* If either cpuset is exclusive, check if they are mutually exclusive */
+- if (is_cpu_exclusive(cs1) || is_cpu_exclusive(cs2))
+- return !cpusets_are_exclusive(cs1, cs2);
++ if (is_cpu_exclusive(trial) || is_cpu_exclusive(sibling))
++ return !cpusets_are_exclusive(trial, sibling);
+
+ /* Exclusive_cpus cannot intersect */
+- if (cpumask_intersects(cs1->exclusive_cpus, cs2->exclusive_cpus))
++ if (cpumask_intersects(trial->exclusive_cpus, sibling->exclusive_cpus))
+ return true;
+
+- /* The cpus_allowed of one cpuset cannot be a subset of another cpuset's exclusive_cpus */
+- if (!cpumask_empty(cs1->cpus_allowed) &&
+- cpumask_subset(cs1->cpus_allowed, cs2->exclusive_cpus))
+- return true;
+-
+- if (!cpumask_empty(cs2->cpus_allowed) &&
+- cpumask_subset(cs2->cpus_allowed, cs1->exclusive_cpus))
++ /* The cpus_allowed of a sibling cpuset cannot be a subset of the new exclusive_cpus */
++ if (xcpus_changed && !cpumask_empty(sibling->cpus_allowed) &&
++ cpumask_subset(sibling->cpus_allowed, trial->exclusive_cpus))
+ return true;
+
+ return false;
+@@ -662,6 +660,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
+ {
+ struct cgroup_subsys_state *css;
+ struct cpuset *c, *par;
++ bool xcpus_changed;
+ int ret = 0;
+
+ rcu_read_lock();
+@@ -718,10 +717,11 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
+ * overlap. exclusive_cpus cannot overlap with each other if set.
+ */
+ ret = -EINVAL;
++ xcpus_changed = !cpumask_equal(cur->exclusive_cpus, trial->exclusive_cpus);
+ cpuset_for_each_child(c, css, par) {
+ if (c == cur)
+ continue;
+- if (cpus_excl_conflict(trial, c))
++ if (cpus_excl_conflict(trial, c, xcpus_changed))
+ goto out;
+ if (mems_excl_conflict(trial, c))
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From de953ffef3650714155785bf30f180aad5897e91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:29 +0100
+Subject: char: tpm: cr50: Remove IRQF_ONESHOT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+
+The flag also prevents force-threading of the primary handler and the
+irq-core will warn about this.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +--
+ drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+index fc6891a0b6936..b48cacacc0664 100644
+--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c
++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+@@ -749,8 +749,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client)
+
+ if (client->irq > 0) {
+ rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler,
+- IRQF_TRIGGER_FALLING | IRQF_ONESHOT |
+- IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
+ dev->driver->name, chip);
+ if (rc < 0) {
+ dev_err(dev, "Failed to probe IRQ %d\n", client->irq);
+diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c
+index f4937280e9406..32920b4cecfb4 100644
+--- a/drivers/char/tpm/tpm_tis_spi_cr50.c
++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c
+@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi)
+ if (spi->irq > 0) {
+ ret = devm_request_irq(&spi->dev, spi->irq,
+ cr50_spi_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ "cr50_spi", cr50_phy);
+ if (ret < 0) {
+ if (ret == -EPROBE_DEFER)
+--
+2.51.0
+
--- /dev/null
+From 316c44c881b55d81739c1314c18c425ccc105fdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:59:01 +0800
+Subject: clk: amlogic: remove potentially unsafe flags from S4 video clocks
+
+From: Chuan Liu <chuan.liu@amlogic.com>
+
+[ Upstream commit 4aca7e92023cac5018b4053bae324450f884c937 ]
+
+The video clocks enci, encp, vdac and hdmitx share the same clock
+source. Adding CLK_SET_RATE_PARENT to the mux may unintentionally change
+the shared parent clock, which could affect other video clocks.
+
+Signed-off-by: Chuan Liu <chuan.liu@amlogic.com>
+Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-3-fe223161fb3f@amlogic.com
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/s4-peripherals.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/clk/meson/s4-peripherals.c b/drivers/clk/meson/s4-peripherals.c
+index 6d69b132d1e1f..bab4f5700de47 100644
+--- a/drivers/clk/meson/s4-peripherals.c
++++ b/drivers/clk/meson/s4-peripherals.c
+@@ -1106,7 +1106,6 @@ static struct clk_regmap s4_cts_enci_sel = {
+ .ops = &clk_regmap_mux_ops,
+ .parent_hws = s4_cts_parents,
+ .num_parents = ARRAY_SIZE(s4_cts_parents),
+- .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+@@ -1122,7 +1121,6 @@ static struct clk_regmap s4_cts_encp_sel = {
+ .ops = &clk_regmap_mux_ops,
+ .parent_hws = s4_cts_parents,
+ .num_parents = ARRAY_SIZE(s4_cts_parents),
+- .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+@@ -1138,7 +1136,6 @@ static struct clk_regmap s4_cts_vdac_sel = {
+ .ops = &clk_regmap_mux_ops,
+ .parent_hws = s4_cts_parents,
+ .num_parents = ARRAY_SIZE(s4_cts_parents),
+- .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+@@ -1169,7 +1166,6 @@ static struct clk_regmap s4_hdmi_tx_sel = {
+ .ops = &clk_regmap_mux_ops,
+ .parent_hws = s4_hdmi_tx_parents,
+ .num_parents = ARRAY_SIZE(s4_hdmi_tx_parents),
+- .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 588debd648e0092198ba626c02917baff0f719e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 14:46:28 -0500
+Subject: clk: microchip: core: correct return value on *_get_parent()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ]
+
+roclk_get_parent() and sclk_get_parent() has the possibility of
+returning -EINVAL, however the framework expects this call to always
+succeed since the return value is unsigned.
+
+If there is no parent map defined, then the current value programmed in
+the hardware is used. Let's use that same value in the case where
+-EINVAL is currently returned.
+
+This index is only used by clk_core_get_parent_by_index(), and it
+validates that it doesn't overflow the number of available parents.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/microchip/clk-core.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c
+index a0163441dfe5c..82f62731fc0ed 100644
+--- a/drivers/clk/microchip/clk-core.c
++++ b/drivers/clk/microchip/clk-core.c
+@@ -283,14 +283,13 @@ static u8 roclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK;
+
+- if (!refo->parent_map)
+- return v;
+-
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (refo->parent_map[i] == v)
+- return i;
++ if (refo->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (refo->parent_map[i] == v)
++ return i;
++ }
+
+- return -EINVAL;
++ return v;
+ }
+
+ static unsigned long roclk_calc_rate(unsigned long parent_rate,
+@@ -817,13 +816,13 @@ static u8 sclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK;
+
+- if (!sclk->parent_map)
+- return v;
++ if (sclk->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (sclk->parent_map[i] == v)
++ return i;
++ }
+
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (sclk->parent_map[i] == v)
+- return i;
+- return -EINVAL;
++ return v;
+ }
+
+ static int sclk_set_parent(struct clk_hw *hw, u8 index)
+--
+2.51.0
+
--- /dev/null
+From 80a08835b9e4797cb2e41c289caca6ad2180c767 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:34:27 +0000
+Subject: clk: renesas: rzg2l: Deassert reset on assert timeout
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 0b0201f259e1158a875c5fd01adf318ae5d32352 ]
+
+If the assert() fails due to timeout error, set the reset register bit
+back to deasserted state. This change is needed especially for handling
+assert error in suspend() callback that expect the device to be in
+operational state in case of failure.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20260108123433.104464-2-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 07909e80bae24..db85b1b43737b 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -1647,6 +1647,7 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
+ u32 mask = BIT(info->resets[id].bit);
+ s8 monbit = info->resets[id].monbit;
+ u32 value = mask << 16;
++ u32 mon;
+ int ret;
+
+ dev_dbg(rcdev->dev, "%s id:%ld offset:0x%x\n",
+@@ -1667,10 +1668,10 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
+ return 0;
+ }
+
+- ret = readl_poll_timeout_atomic(priv->base + reg, value,
+- assert == !!(value & mask), 10, 200);
+- if (ret && !assert) {
+- value = mask << 16;
++ ret = readl_poll_timeout_atomic(priv->base + reg, mon,
++ assert == !!(mon & mask), 10, 200);
++ if (ret) {
++ value ^= mask;
+ writel(value, priv->base + CLK_RST_R(info->resets[id].off));
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2c8c50bb16804151a1d1baf8d9eece02084fc29f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 23:13:41 +0100
+Subject: clocksource/drivers/sh_tmu: Always leave device running after probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ]
+
+The TMU device can be used as both a clocksource and a clockevent
+provider. The driver tries to be smart and power itself on and off, as
+well as enabling and disabling its clock when it's not in operation.
+This behavior is slightly altered if the TMU is used as an early
+platform device in which case the device is left powered on after probe,
+but the clock is still enabled and disabled at runtime.
+
+This has worked for a long time, but recent improvements in PREEMPT_RT
+and PROVE_LOCKING have highlighted an issue. As the TMU registers itself
+as a clockevent provider, clockevents_register_device(), it needs to use
+raw spinlocks internally as this is the context of which the clockevent
+framework interacts with the TMU driver. However in the context of
+holding a raw spinlock the TMU driver can't really manage its power
+state or clock with calls to pm_runtime_*() and clk_*() as these calls
+end up in other platform drivers using regular spinlocks to control
+power and clocks.
+
+This mix of spinlock contexts trips a lockdep warning.
+
+ =============================
+ [ BUG: Invalid wait context ]
+ 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted
+ -----------------------------
+ swapper/0/0 is trying to lock:
+ ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88
+ other info that might help us debug this:
+ context-{5:5}
+ 1 lock held by swapper/0/0:
+ ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0
+ #0: ffff8000817ec298
+ ccree e6601000.crypto: ARM ccree device initialized
+ (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT
+ Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
+ Call trace:
+ show_stack+0x14/0x1c (C)
+ dump_stack_lvl+0x6c/0x90
+ dump_stack+0x14/0x1c
+ __lock_acquire+0x904/0x1584
+ lock_acquire+0x220/0x34c
+ _raw_spin_lock_irqsave+0x58/0x80
+ __pm_runtime_resume+0x38/0x88
+ sh_tmu_clock_event_set_oneshot+0x84/0xd4
+ clockevents_switch_state+0xfc/0x13c
+ tick_broadcast_set_event+0x30/0xa4
+ __tick_broadcast_oneshot_control+0x1e0/0x3a8
+ tick_broadcast_oneshot_control+0x30/0x40
+ cpuidle_enter_state+0x40c/0x680
+ cpuidle_enter+0x30/0x40
+ do_idle+0x1f4/0x280
+ cpu_startup_entry+0x34/0x40
+ kernel_init+0x0/0x130
+ do_one_initcall+0x0/0x230
+ __primary_switched+0x88/0x90
+
+For non-PREEMPT_RT builds this is not really an issue, but for
+PREEMPT_RT builds where normal spinlocks can sleep this might be an
+issue. Be cautious and always leave the power and clock running after
+probe.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/sh_tmu.c | 18 ------------------
+ 1 file changed, 18 deletions(-)
+
+diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
+index beffff81c00f3..3fc6ed9b56300 100644
+--- a/drivers/clocksource/sh_tmu.c
++++ b/drivers/clocksource/sh_tmu.c
+@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start)
+
+ static int __sh_tmu_enable(struct sh_tmu_channel *ch)
+ {
+- int ret;
+-
+- /* enable clock */
+- ret = clk_enable(ch->tmu->clk);
+- if (ret) {
+- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n",
+- ch->index);
+- return ret;
+- }
+-
+ /* make sure channel is disabled */
+ sh_tmu_start_stop_ch(ch, 0);
+
+@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch)
+ if (ch->enable_count++ > 0)
+ return 0;
+
+- pm_runtime_get_sync(&ch->tmu->pdev->dev);
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, true);
+
+ return __sh_tmu_enable(ch);
+@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch)
+
+ /* disable interrupts in TMU block */
+ sh_tmu_write(ch, TCR, TCR_TPSC_CLK4);
+-
+- /* stop clock */
+- clk_disable(ch->tmu->clk);
+ }
+
+ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+ __sh_tmu_disable(ch);
+
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, false);
+- pm_runtime_put(&ch->tmu->pdev->dev);
+ }
+
+ static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta,
+@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
+ goto err_clk_unprepare;
+
+ tmu->rate = clk_get_rate(tmu->clk) / 4;
+- clk_disable(tmu->clk);
+
+ /* Map the memory resource. */
+ ret = sh_tmu_map_memory(tmu);
+@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev)
+ out:
+ if (tmu->has_clockevent || tmu->has_clocksource)
+ pm_runtime_irq_safe(&pdev->dev);
+- else
+- pm_runtime_idle(&pdev->dev);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 64088d046574d10b5d5667bc8d85f92bffbe6650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 12:17:23 +0100
+Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig
+ dependency on OF
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ]
+
+This driver accesses the of_aliases global variable declared in
+linux/of.h and defined in drivers/base/of.c. It requires OF support or
+will cause a link failure. Add the missing Kconfig dependency.
+
+Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index ffcd23668763f..1119fbd52e1c9 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -254,6 +254,7 @@ config KEYSTONE_TIMER
+
+ config INTEGRATOR_AP_TIMER
+ bool "Integrator-AP timer driver" if COMPILE_TEST
++ depends on OF
+ select CLKSRC_MMIO
+ help
+ Enables support for the Integrator-AP timer.
+--
+2.51.0
+
--- /dev/null
+From ad286e3b9bd032d15e0b6036384c98b681748085 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 16:25:35 +0100
+Subject: cpufreq: dt-platdev: Block the driver from probing on more QC
+ platforms
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+[ Upstream commit 7b781899072c5701ef9538c365757ee9ab9c00bd ]
+
+Add a number of QC platforms to the blocklist, they all use either the
+qcom-cpufreq-hw driver.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq-dt-platdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index dc11b62399ad5..47dd76acd31e5 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -169,8 +169,11 @@ static const struct of_device_id blocklist[] __initconst = {
+ { .compatible = "qcom,sdm845", },
+ { .compatible = "qcom,sdx75", },
+ { .compatible = "qcom,sm6115", },
++ { .compatible = "qcom,sm6125", },
++ { .compatible = "qcom,sm6150", },
+ { .compatible = "qcom,sm6350", },
+ { .compatible = "qcom,sm6375", },
++ { .compatible = "qcom,sm7125", },
+ { .compatible = "qcom,sm7225", },
+ { .compatible = "qcom,sm7325", },
+ { .compatible = "qcom,sm8150", },
+--
+2.51.0
+
--- /dev/null
+From 09c04676758fd64260ccf1adcc048412ed2a27bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 18:18:03 +0800
+Subject: crypto: hisilicon/qm - move the barrier before writing to the mailbox
+ register
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit ebf35d8f9368816c930f5d70783a72716fab5e19 ]
+
+Before sending the data via the mailbox to the hardware, to ensure
+that the data accessed by the hardware is the most up-to-date,
+a write barrier should be added before writing to the mailbox register.
+The current memory barrier is placed after writing to the register,
+the barrier order should be modified to be before writing to the register.
+
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index a7c8839180ee7..b92ee2fcb18aa 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -609,9 +609,13 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src)
+ }
+
+ #if IS_ENABLED(CONFIG_ARM64)
++ /*
++ * The dmb oshst instruction ensures that the data in the
++ * mailbox is written before it is sent to the hardware.
++ */
+ asm volatile("ldp %0, %1, %3\n"
+- "stp %0, %1, %2\n"
+ "dmb oshst\n"
++ "stp %0, %1, %2\n"
+ : "=&r" (tmp0),
+ "=&r" (tmp1),
+ "+Q" (*((char __iomem *)fun_base))
+--
+2.51.0
+
--- /dev/null
+From 53afc0557df342f90be0b807dce8b9ebf3120bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:35:05 -0500
+Subject: dlm: fix recovery pending middle conversion
+
+From: Alexander Aring <aahringo@redhat.com>
+
+[ Upstream commit 1416bd508c78bdfdb9ae0b4511369e5581f348ea ]
+
+During a workload involving conversions between lock modes PR and CW,
+lock recovery can create a "conversion deadlock" state between locks
+that have been recovered. When this occurs, kernel warning messages
+are logged, e.g.
+
+ "dlm: WARN: pending deadlock 1e node 0 2 1bf21"
+
+ "dlm: receive_rcom_lock_args 2e middle convert gr 3 rq 2 remote 2 1e"
+
+After this occurs, the deadlocked conversions both appear on the convert
+queue of the resource being locked, and the conversion requests do not
+complete.
+
+Outside of recovery, conversions that would produce a deadlock are
+resolved immediately, and return -EDEADLK. The locks are not placed
+on the convert queue in the deadlocked state.
+
+To fix this problem, an lkb under conversion between PR/CW is rebuilt
+during recovery on a new master's granted queue, with the currently
+granted mode, rather than being rebuilt on the new master's convert
+queue, with the currently granted mode and the newly requested mode.
+The in-progress convert is then resent to the new master after
+recovery, so the conversion deadlock will be processed outside of
+the recovery context and handled as described above.
+
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lock.c | 19 +------------------
+ 1 file changed, 1 insertion(+), 18 deletions(-)
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index be938fdf17d96..c01a291db401b 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -5014,25 +5014,8 @@ void dlm_receive_buffer(const union dlm_packet *p, int nodeid)
+ static void recover_convert_waiter(struct dlm_ls *ls, struct dlm_lkb *lkb,
+ struct dlm_message *ms_local)
+ {
+- if (middle_conversion(lkb)) {
+- log_rinfo(ls, "%s %x middle convert in progress", __func__,
+- lkb->lkb_id);
+-
+- /* We sent this lock to the new master. The new master will
+- * tell us when it's granted. We no longer need a reply, so
+- * use a fake reply to put the lkb into the right state.
+- */
+- hold_lkb(lkb);
+- memset(ms_local, 0, sizeof(struct dlm_message));
+- ms_local->m_type = cpu_to_le32(DLM_MSG_CONVERT_REPLY);
+- ms_local->m_result = cpu_to_le32(to_dlm_errno(-EINPROGRESS));
+- ms_local->m_header.h_nodeid = cpu_to_le32(lkb->lkb_nodeid);
+- _receive_convert_reply(lkb, ms_local, true);
+- unhold_lkb(lkb);
+-
+- } else if (lkb->lkb_rqmode >= lkb->lkb_grmode) {
++ if (middle_conversion(lkb) || lkb->lkb_rqmode >= lkb->lkb_grmode)
+ set_bit(DLM_IFL_RESEND_BIT, &lkb->lkb_iflags);
+- }
+
+ /* lkb->lkb_rqmode < lkb->lkb_grmode shouldn't happen since down
+ conversions are async; there's no reply from the remote master */
+--
+2.51.0
+
--- /dev/null
+From fad76dea505506e503035b0efadd8cc910e4f848 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:35:06 -0500
+Subject: dlm: validate length in dlm_search_rsb_tree
+
+From: Ezrak1e <ezrakiez@gmail.com>
+
+[ Upstream commit 080e5563f878c64e697b89e7439d730d0daad882 ]
+
+The len parameter in dlm_dump_rsb_name() is not validated and comes
+from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can
+cause out-of-bounds write in dlm_search_rsb_tree().
+
+Add length validation to prevent potential buffer overflow.
+
+Signed-off-by: Ezrak1e <ezrakiez@gmail.com>
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lock.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index c01a291db401b..a393ecaf3442a 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -626,7 +626,8 @@ int dlm_search_rsb_tree(struct rhashtable *rhash, const void *name, int len,
+ struct dlm_rsb **r_ret)
+ {
+ char key[DLM_RESNAME_MAXLEN] = {};
+-
++ if (len > DLM_RESNAME_MAXLEN)
++ return -EINVAL;
+ memcpy(key, name, len);
+ *r_ret = rhashtable_lookup_fast(rhash, &key, dlm_rhash_rsb_params);
+ if (*r_ret)
+--
+2.51.0
+
--- /dev/null
+From 96a4a65c3f53acafc3ea9646d953ee2b1216a472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 20:03:50 +0800
+Subject: dm: remove fake timeout to avoid leak request
+
+From: Ding Hui <dinghui@sangfor.com.cn>
+
+[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ]
+
+Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
+blk_mq_complete_request"), drivers are responsible for calling
+blk_should_fake_timeout() at appropriate code paths and opportunities.
+
+However, the dm driver does not implement its own timeout handler and
+relies on the timeout handling of its slave devices.
+
+If an io-timeout-fail error is injected to a dm device, the request
+will be leaked and never completed, causing tasks to hang indefinitely.
+
+Reproduce:
+1. prepare dm which has iscsi slave device
+2. inject io-timeout-fail to dm
+ echo 1 >/sys/class/block/dm-0/io-timeout-fail
+ echo 100 >/sys/kernel/debug/fail_io_timeout/probability
+ echo 10 >/sys/kernel/debug/fail_io_timeout/times
+3. read/write dm
+4. iscsiadm -m node -u
+
+Result: hang task like below
+[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
+[ 862.244133] Tainted: G E 6.19.0-rc1+ #51
+[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000
+[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
+[ 862.245264] Call Trace:
+[ 862.245587] <TASK>
+[ 862.245814] __schedule+0x810/0x15c0
+[ 862.246557] schedule+0x69/0x180
+[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120
+[ 862.247688] elevator_change+0x16d/0x460
+[ 862.247893] elevator_set_none+0x87/0xf0
+[ 862.248798] blk_unregister_queue+0x12e/0x2a0
+[ 862.248995] __del_gendisk+0x231/0x7e0
+[ 862.250143] del_gendisk+0x12f/0x1d0
+[ 862.250339] sd_remove+0x85/0x130 [sd_mod]
+[ 862.250650] device_release_driver_internal+0x36d/0x530
+[ 862.250849] bus_remove_device+0x1dd/0x3f0
+[ 862.251042] device_del+0x38a/0x930
+[ 862.252095] __scsi_remove_device+0x293/0x360
+[ 862.252291] scsi_remove_target+0x486/0x760
+[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
+[ 862.252886] process_one_work+0x633/0xe50
+[ 862.253101] worker_thread+0x6df/0xf10
+[ 862.253647] kthread+0x36d/0x720
+[ 862.254533] ret_from_fork+0x2a6/0x470
+[ 862.255852] ret_from_fork_asm+0x1a/0x30
+[ 862.256037] </TASK>
+
+Remove the blk_should_fake_timeout() check from dm, as dm has no
+native timeout handling and should not attempt to fake timeouts.
+
+Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index a6ca92049c10e..5e08546696145 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -278,8 +278,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error)
+ struct dm_rq_target_io *tio = tio_from_request(rq);
+
+ tio->error = error;
+- if (likely(!blk_should_fake_timeout(rq->q)))
+- blk_mq_complete_request(rq);
++ blk_mq_complete_request(rq);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From e3ebbc6b21394d02f502e28da9a266b355d83106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 04:49:37 +0100
+Subject: dm: replace -EEXIST with -EBUSY
+
+From: Daniel Gomez <da.gomez@samsung.com>
+
+[ Upstream commit b13ef361d47f09b7aecd18e0383ecc83ff61057e ]
+
+The -EEXIST error code is reserved by the module loading infrastructure
+to indicate that a module is already loaded. When a module's init
+function returns -EEXIST, userspace tools like kmod interpret this as
+"module already loaded" and treat the operation as successful, returning
+0 to the user even though the module initialization actually failed.
+
+This follows the precedent set by commit 54416fd76770 ("netfilter:
+conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
+issue in nf_conntrack_helper_register().
+
+Affected modules:
+ * dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache
+ * dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity
+ * dm_queue_length dm_service_time dm_snapshot
+
+Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-exception-store.c | 2 +-
+ drivers/md/dm-log.c | 2 +-
+ drivers/md/dm-path-selector.c | 2 +-
+ drivers/md/dm-target.c | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
+index c3799757bf4a0..88f119a0a2ae0 100644
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -116,7 +116,7 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type)
+ if (!__find_exception_store_type(type->name))
+ list_add(&type->list, &_exception_store_types);
+ else
+- r = -EEXIST;
++ r = -EBUSY;
+ spin_unlock(&_lock);
+
+ return r;
+diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
+index 9d85d045f9d9d..bced5a783ee33 100644
+--- a/drivers/md/dm-log.c
++++ b/drivers/md/dm-log.c
+@@ -121,7 +121,7 @@ int dm_dirty_log_type_register(struct dm_dirty_log_type *type)
+ if (!__find_dirty_log_type(type->name))
+ list_add(&type->list, &_log_types);
+ else
+- r = -EEXIST;
++ r = -EBUSY;
+ spin_unlock(&_lock);
+
+ return r;
+diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c
+index d0b883fabfeb6..2b0ac200f1c02 100644
+--- a/drivers/md/dm-path-selector.c
++++ b/drivers/md/dm-path-selector.c
+@@ -107,7 +107,7 @@ int dm_register_path_selector(struct path_selector_type *pst)
+
+ if (__find_path_selector_type(pst->name)) {
+ kfree(psi);
+- r = -EEXIST;
++ r = -EBUSY;
+ } else
+ list_add(&psi->list, &_path_selectors);
+
+diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
+index 8fede41adec00..1fd41289de367 100644
+--- a/drivers/md/dm-target.c
++++ b/drivers/md/dm-target.c
+@@ -88,7 +88,7 @@ int dm_register_target(struct target_type *tt)
+ if (__find_target_type(tt->name)) {
+ DMERR("%s: '%s' target already registered",
+ __func__, tt->name);
+- rv = -EEXIST;
++ rv = -EBUSY;
+ } else {
+ list_add(&tt->list, &_targets);
+ }
+--
+2.51.0
+
--- /dev/null
+From 0f327379a68744265a8c6ce937a778261fd8df5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 14:36:56 +0100
+Subject: dmaengine: stm32-dma3: use module_platform_driver
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit 0d41ed4ea496fabbb4dc21171e32d9a924c2a661 ]
+
+Without module_platform_driver(), stm32-dma3 doesn't have a
+module_exit procedure. Once stm32-dma3 module is inserted, it
+can't be removed, marked busy.
+Use module_platform_driver() instead of subsys_initcall() to register
+(insmod) and unregister (rmmod) stm32-dma3 driver.
+
+Reviewed-by: Eugen Hristev <eugen.hristev@linaro.org>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251121-dma3_improv-v2-1-76a207b13ea6@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32/stm32-dma3.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/dma/stm32/stm32-dma3.c b/drivers/dma/stm32/stm32-dma3.c
+index 50e7106c5cb73..9500164c8f688 100644
+--- a/drivers/dma/stm32/stm32-dma3.c
++++ b/drivers/dma/stm32/stm32-dma3.c
+@@ -1914,12 +1914,7 @@ static struct platform_driver stm32_dma3_driver = {
+ },
+ };
+
+-static int __init stm32_dma3_init(void)
+-{
+- return platform_driver_register(&stm32_dma3_driver);
+-}
+-
+-subsys_initcall(stm32_dma3_init);
++module_platform_driver(stm32_dma3_driver);
+
+ MODULE_DESCRIPTION("STM32 DMA3 controller driver");
+ MODULE_AUTHOR("Amelie Delaunay <amelie.delaunay@foss.st.com>");
+--
+2.51.0
+
--- /dev/null
+From e3734ce0b27ea8387126f7cd10ac7f16cf8008d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 09:15:03 +0100
+Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix
+ warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ]
+
+m2m_hw_period is initialized only when chan_config->m2m_hw is true. This
+triggers a warning:
+‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized]
+Although m2m_hw_period is only used when chan_config->m2m_hw is true and
+ignored otherwise, initialize it unconditionally to 0.
+
+ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not
+empty. This triggers a warning:
+‘ccr’ may be used uninitialized [-Wmaybe-uninitialized]
+Indeed, it could be used uninitialized if the sg list is empty. Initialize
+it to 0.
+
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Reviewed-by: Clément Le Goffic <legoffic.clement@gmail.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32/stm32-mdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/stm32/stm32-mdma.c b/drivers/dma/stm32/stm32-mdma.c
+index 080c1c725216c..b87d41b234df1 100644
+--- a/drivers/dma/stm32/stm32-mdma.c
++++ b/drivers/dma/stm32/stm32-mdma.c
+@@ -731,7 +731,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan,
+ struct stm32_mdma_chan_config *chan_config = &chan->chan_config;
+ struct scatterlist *sg;
+ dma_addr_t src_addr, dst_addr;
+- u32 m2m_hw_period, ccr, ctcr, ctbr;
++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr;
+ int i, ret = 0;
+
+ if (chan_config->m2m_hw)
+--
+2.51.0
+
--- /dev/null
+From 27e184de45cc6c4e5f30d8348f72aaa0dab815fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:04:48 +0800
+Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst
+
+From: Chen-Yu Tsai <wens@kernel.org>
+
+[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ]
+
+maxburst, as provided by the client, specifies the largest amount of
+data that is allowed to be transferred in one burst. This limit is
+normally provided to avoid a data burst overflowing the target FIFO.
+It does not mean that the DMA engine can only do bursts in that size.
+
+Let the driver pick the largest supported burst length within the
+given limit. This lets the driver work correctly with some clients that
+give a large maxburst value. In particular, the 8250_dw driver will give
+a quarter of the UART's FIFO size as maxburst. On some systems the FIFO
+size is 256 bytes, giving a maxburst of 64 bytes, while the hardware
+only supports bursts of up to 16 bytes.
+
+Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
+index 2215ff877bf7d..f9d876deb1f05 100644
+--- a/drivers/dma/sun6i-dma.c
++++ b/drivers/dma/sun6i-dma.c
+@@ -583,6 +583,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id)
+ return ret;
+ }
+
++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst)
++{
++ if (!maxburst)
++ return 1;
++
++ if (BIT(maxburst) & burst_lengths)
++ return maxburst;
++
++ /* Hardware only does power-of-two bursts. */
++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2)
++ if (BIT(burst) & burst_lengths)
++ return burst;
++
++ return 1;
++}
++
+ static int set_config(struct sun6i_dma_dev *sdev,
+ struct dma_slave_config *sconfig,
+ enum dma_transfer_direction direction,
+@@ -616,15 +632,13 @@ static int set_config(struct sun6i_dma_dev *sdev,
+ return -EINVAL;
+ if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths))
+ return -EINVAL;
+- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths))
+- return -EINVAL;
+- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths))
+- return -EINVAL;
+
+ src_width = convert_buswidth(src_addr_width);
+ dst_width = convert_buswidth(dst_addr_width);
+- dst_burst = convert_burst(dst_maxburst);
+- src_burst = convert_burst(src_maxburst);
++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst);
++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst);
++ dst_burst = convert_burst(dst_burst);
++ src_burst = convert_burst(src_burst);
+
+ *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) |
+ DMA_CHAN_CFG_DST_WIDTH(dst_width);
+--
+2.51.0
+
--- /dev/null
+From ba34d8dffc895c2d5f7874f4d5fdd7307f4ab7b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 11:29:45 +0100
+Subject: driver core: faux: stop using static struct device
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 61b76d07d2b46a86ea91267d36449fc78f8a1f6e ]
+
+faux_bus_root should not have been a static struct device, but rather a
+dynamically created structure so that lockdep and other testing tools do
+not trip over it (as well as being the right thing overall to do.) Fix
+this up by making it properly dynamic.
+
+Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
+Closes: https://lore.kernel.org/lkml/CALbr=LYKJsj6cbrDLA07qioKhWJcRj+gW8=bq5=4ZvpEe2c4Yg@mail.gmail.com/
+Reviewed-by: Danilo Krummrich <dakr@kernel.org>
+Link: https://patch.msgid.link/2026012145-lapping-countless-ef81@gregkh
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/faux.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/base/faux.c b/drivers/base/faux.c
+index 21dd02124231a..23d7258172325 100644
+--- a/drivers/base/faux.c
++++ b/drivers/base/faux.c
+@@ -29,9 +29,7 @@ struct faux_object {
+ };
+ #define to_faux_object(dev) container_of_const(dev, struct faux_object, faux_dev.dev)
+
+-static struct device faux_bus_root = {
+- .init_name = "faux",
+-};
++static struct device *faux_bus_root;
+
+ static int faux_match(struct device *dev, const struct device_driver *drv)
+ {
+@@ -152,7 +150,7 @@ struct faux_device *faux_device_create_with_groups(const char *name,
+ if (parent)
+ dev->parent = parent;
+ else
+- dev->parent = &faux_bus_root;
++ dev->parent = faux_bus_root;
+ dev->bus = &faux_bus_type;
+ dev_set_name(dev, "%s", name);
+ device_set_pm_not_required(dev);
+@@ -236,9 +234,15 @@ int __init faux_bus_init(void)
+ {
+ int ret;
+
+- ret = device_register(&faux_bus_root);
++ faux_bus_root = kzalloc(sizeof(*faux_bus_root), GFP_KERNEL);
++ if (!faux_bus_root)
++ return -ENOMEM;
++
++ dev_set_name(faux_bus_root, "faux");
++
++ ret = device_register(faux_bus_root);
+ if (ret) {
+- put_device(&faux_bus_root);
++ put_device(faux_bus_root);
+ return ret;
+ }
+
+@@ -256,6 +260,6 @@ int __init faux_bus_init(void)
+ bus_unregister(&faux_bus_type);
+
+ error_bus:
+- device_unregister(&faux_bus_root);
++ device_unregister(faux_bus_root);
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From acf34f16560a6617d4acf12ca40279703d7d474c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 08:22:26 -0500
+Subject: drm: Account property blob allocations to memcg
+
+From: Xiao Kan <814091656@qq.com>
+
+[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ]
+
+DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
+property blobs backed by kernel memory.
+
+Currently, the blob data allocation is not accounted to the allocating
+process's memory cgroup, allowing unprivileged users to trigger unbounded
+kernel memory consumption and potentially cause system-wide OOM.
+
+Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
+is properly charged to the caller's memcg. This ensures existing cgroup
+memory limits apply and prevents uncontrolled kernel memory growth without
+introducing additional policy or per-file limits.
+
+Signed-off-by: Xiao Kan <814091656@qq.com>
+Signed-off-by: Xiao Kan <xiao.kan@samsung.com>
+Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
+index 596272149a359..3c88b5fbdf28c 100644
+--- a/drivers/gpu/drm/drm_property.c
++++ b/drivers/gpu/drm/drm_property.c
+@@ -562,7 +562,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
+ if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
+ return ERR_PTR(-EINVAL);
+
+- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT);
+ if (!blob)
+ return ERR_PTR(-ENOMEM);
+
+--
+2.51.0
+
--- /dev/null
+From c6534641600c0a886bd24f5cd1784120d8baba87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 15:52:39 -0500
+Subject: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
+
+From: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+
+[ Upstream commit c979d8db7b0f293111f2e83795ea353c8ed75de9 ]
+
+Trying to access link enc on a dpia link will cause a crash otherwise
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index bbfefc9edd1f1..483217a91029a 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -914,10 +914,10 @@ static void dcn401_enable_stream_calc(
+ pipe_ctx->stream->link->cur_link_settings.lane_count;
+ uint32_t active_total_with_borders;
+
+- if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx))
++ if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) {
+ *dp_hpo_inst = pipe_ctx->stream_res.hpo_dp_stream_enc->inst;
+-
+- *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link);
++ *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link);
++ }
+
+ if (dc_is_tmds_signal(pipe_ctx->stream->signal))
+ dcn401_calculate_dccg_tmds_div_value(pipe_ctx, tmds_div);
+--
+2.51.0
+
--- /dev/null
+From c6db5e3ffc19089c88433aa7b6f7da09d4c0d64a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 10:18:16 +0800
+Subject: drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
+
+From: LinCheng Ku <lincheng.ku@amd.com>
+
+[ Upstream commit cea573a8e1ed83840a2173d153dd68e172849d44 ]
+
+[Why]
+USB-C DisplayPort Alt Mode with concurrent USB data needs lane count
+limitation to prevent incorrect 4-lane DP configuration when only 2 lanes
+are available due to hardware lane sharing between DP and USB3.
+
+[How]
+Query DMUB for Alt Mode status (is_dp_alt_disable, is_usb, is_dp4) in
+dcn32_link_encoder_get_max_link_cap() and cap DP to 2 lanes when USB is
+active on USB-C port. Added inline documentation explaining the USB-C
+lane sharing constraint.
+
+Reviewed-by: PeiChen Huang <peichen.huang@amd.com>
+Signed-off-by: LinCheng Ku <lincheng.ku@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/dc/dio/dcn32/dcn32_dio_link_encoder.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
+index 06907e8a4eda1..ddc736af776c9 100644
+--- a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
+@@ -188,9 +188,18 @@ void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc,
+ if (!query_dp_alt_from_dmub(enc, &cmd))
+ return;
+
+- if (cmd.query_dp_alt.data.is_usb &&
+- cmd.query_dp_alt.data.is_dp4 == 0)
+- link_settings->lane_count = MIN(LANE_COUNT_TWO, link_settings->lane_count);
++ /*
++ * USB-C DisplayPort Alt Mode lane count limitation logic:
++ * When USB and DP share the same USB-C connector, hardware must allocate
++ * some lanes for USB data, limiting DP to maximum 2 lanes instead of 4.
++ * This ensures USB functionality remains available while DP is active.
++ */
++ if (cmd.query_dp_alt.data.is_dp_alt_disable == 0 &&
++ cmd.query_dp_alt.data.is_usb &&
++ cmd.query_dp_alt.data.is_dp4 == 0) {
++ link_settings->lane_count =
++ MIN(LANE_COUNT_TWO, link_settings->lane_count);
++ }
+ }
+
+
+--
+2.51.0
+
--- /dev/null
+From 5a20a86b6ba3f40fa0753d980b13d92a0b818232 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 15:51:42 +0800
+Subject: drm/amd/display: avoid dig reg access timeout on usb4 link training
+ fail
+
+From: Zhongwei <Zhongwei.Zhang@amd.com>
+
+[ Upstream commit 15b1d7b77e9836ff4184093163174a1ef28bbdd7 ]
+
+[Why]
+When usb4 link training fails, the dpia sym clock will be disabled and SYMCLK
+source should be changed back to phy clock. In enable_streams, it is
+assumed that link training succeeded and will switch from refclk to
+phy clock. But phy clk here might not be on. Dig reg access timeout
+will occur.
+
+[How]
+When enable_stream is hit, check if link training failed for usb4.
+If it did, fall back to the ref clock to avoid reg access timeout.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Zhongwei <Zhongwei.Zhang@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+index 56c1ab6c73308..a4025a09a38a3 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -3055,9 +3055,17 @@ void dcn20_enable_stream(struct pipe_ctx *pipe_ctx)
+ dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk);
+ }
+ } else {
+- if (dccg->funcs->enable_symclk_se)
+- dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst,
++ if (dccg->funcs->enable_symclk_se && link_enc) {
++ if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA
++ && link->cur_link_settings.link_rate == LINK_RATE_UNKNOWN
++ && !link->link_status.link_active) {
++ if (dccg->funcs->disable_symclk_se)
++ dccg->funcs->disable_symclk_se(dccg, stream_enc->stream_enc_inst,
+ link_enc->transmitter - TRANSMITTER_UNIPHY_A);
++ } else
++ dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst,
++ link_enc->transmitter - TRANSMITTER_UNIPHY_A);
++ }
+ }
+
+ if (dc->res_pool->dccg->funcs->set_pixel_rate_div)
+--
+2.51.0
+
--- /dev/null
+From aac54cd765600bcb380c38bbe1fbe1f42e4edeae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 14:47:01 +0800
+Subject: drm/amd/display: Avoid updating surface with the same surface under
+ MPO
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ]
+
+[Why & How]
+Although it's dummy updates of surface update for committing stream
+updates, we should not have dummy_updates[j].surface all indicating
+to the same surface under multiple surfaces case. Otherwise,
+copy_surface_update_to_plane() in update_planes_and_stream_state()
+will update to the same surface only.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index c8415a2840567..7db2d1a3784bd 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10724,7 +10724,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
+ continue;
+ }
+ for (j = 0; j < status->plane_count; j++)
+- dummy_updates[j].surface = status->plane_states[0];
++ dummy_updates[j].surface = status->plane_states[j];
+
+ sort(dummy_updates, status->plane_count,
+ sizeof(*dummy_updates), dm_plane_layer_index_cmp, NULL);
+--
+2.51.0
+
--- /dev/null
+From ae5a22b0d49180426f6fa26662b9b1792a081130 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 11:40:06 -0500
+Subject: drm/amd/display: bypass post csc for additional color spaces in dal
+
+From: Clay King <clayking@amd.com>
+
+[ Upstream commit 7d9ec9dc20ecdb1661f4538cd9112cd3d6a5f15a ]
+
+[Why]
+For RGB BT2020 full and limited color spaces, overlay adjustments were
+applied twice (once by MM and once by DAL). This results in incorrect
+colours and a noticeable difference between mpo and non-mpo cases.
+
+[How]
+Add RGB BT2020 full and limited color spaces to list that bypasses post
+csc adjustment.
+
+Reviewed-by: Aric Cyr <aric.cyr@amd.com>
+Signed-off-by: Clay King <clayking@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 21 ++++++++++++++++---
+ .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h | 4 ++++
+ .../amd/display/dc/dpp/dcn401/dcn401_dpp.c | 6 +++---
+ 3 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
+index 4f569cd8a5d61..272ebdd8b9ebd 100644
+--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
+@@ -360,10 +360,10 @@ void dpp3_cnv_setup (
+
+ tbl_entry.color_space = input_color_space;
+
+- if (color_space >= COLOR_SPACE_YCBCR601)
+- select = INPUT_CSC_SELECT_ICSC;
+- else
++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space))
+ select = INPUT_CSC_SELECT_BYPASS;
++ else
++ select = INPUT_CSC_SELECT_ICSC;
+
+ dpp3_program_post_csc(dpp_base, color_space, select,
+ &tbl_entry);
+@@ -1521,3 +1521,18 @@ bool dpp3_construct(
+ return true;
+ }
+
++bool dpp3_should_bypass_post_csc_for_colorspace(enum dc_color_space dc_color_space)
++{
++ switch (dc_color_space) {
++ case COLOR_SPACE_UNKNOWN:
++ case COLOR_SPACE_SRGB:
++ case COLOR_SPACE_XR_RGB:
++ case COLOR_SPACE_SRGB_LIMITED:
++ case COLOR_SPACE_MSREF_SCRGB:
++ case COLOR_SPACE_2020_RGB_FULLRANGE:
++ case COLOR_SPACE_2020_RGB_LIMITEDRANGE:
++ return true;
++ default:
++ return false;
++ }
++}
+diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
+index f236824126e94..2a76105fa9b1c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
+@@ -642,4 +642,8 @@ void dpp3_program_cm_dealpha(
+
+ void dpp3_cm_get_gamut_remap(struct dpp *dpp_base,
+ struct dpp_grph_csc_adjustment *adjust);
++
++bool dpp3_should_bypass_post_csc_for_colorspace(
++ enum dc_color_space dc_color_space);
++
+ #endif /* __DC_HWSS_DCN30_H__ */
+diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
+index 36187f890d5d0..b62bbadb0d440 100644
+--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
+@@ -206,10 +206,10 @@ void dpp401_dpp_setup(
+
+ tbl_entry.color_space = input_color_space;
+
+- if (color_space >= COLOR_SPACE_YCBCR601)
+- select = INPUT_CSC_SELECT_ICSC;
+- else
++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space))
+ select = INPUT_CSC_SELECT_BYPASS;
++ else
++ select = INPUT_CSC_SELECT_ICSC;
+
+ dpp3_program_post_csc(dpp_base, color_space, select,
+ &tbl_entry);
+--
+2.51.0
+
--- /dev/null
+From bd7acb8f1fdbac3fc58005eee8d61028cde38df0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 15:18:50 +0800
+Subject: drm/amd/display: Correct FIXED_VS Link Rate Toggle Condition
+
+From: Jing Zhou <Jing.Zhou@amd.com>
+
+[ Upstream commit 531fe6e0fee85a1bdb5b8223a706fff654ed0a61 ]
+
+[WHY&HOW]
+The condition is only perform toggle if FIXED_VS LTTPR reports
+no IEEE OUI.
+The literal "\x0,\x0,\x0" contains commas changes the
+bytes being compared to {0x00,0x2C,0X00}.
+The correct literal should be "\x00\x00\x00" without commas.
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Jing Zhou <Jing.Zhou@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
+index ce174ce5579c0..6a7c4a59ff4c7 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
+@@ -271,7 +271,7 @@ enum link_training_result dp_perform_fixed_vs_pe_training_sequence(
+ rate = get_dpcd_link_rate(<_settings->link_settings);
+
+ // Only perform toggle if FIXED_VS LTTPR reports no IEEE OUI
+- if (memcmp("\x0,\x0,\x0", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) {
++ if (memcmp("\x00\x00\x00", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) {
+ /* Vendor specific: Toggle link rate */
+ toggle_rate = (rate == 0x6) ? 0xA : 0x6;
+
+--
+2.51.0
+
--- /dev/null
+From ba6ae6b8cecab37a6876f9a76547681c69ac9e67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 17:48:59 -0500
+Subject: drm/amd/display: Disable FEC when powering down encoders
+
+From: Ovidiu Bunea <ovidiu.bunea@amd.com>
+
+[ Upstream commit 8cee62904caf95e5698fa0f2d420f5f22b4dea15 ]
+
+[why & how]
+VBIOS DMCUB FW can enable FEC for capable eDPs, but S/W DC state is
+only updated for link0 when transitioning into OS with driver loaded.
+This causes issues when the eDP is immediately hidden and DIG0 is
+assigned to another link that does not support FEC. Driver will
+attempt to disable FEC but FEC enablement occurs based on the link
+state, which does not have fec_state updated since it is a different
+link. Thus, FEC disablement on DIG0 will get skipped and cause no
+light up.
+
+Reviewed-by: Karen Chen <karen.chen@amd.com>
+Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 7e36c063f0da5..65e66bfc4161c 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -59,6 +59,7 @@
+ #include "dc_state_priv.h"
+ #include "dpcd_defs.h"
+ #include "dsc.h"
++#include "dc_dp_types.h"
+ /* include DCE11 register header files */
+ #include "dce/dce_11_0_d.h"
+ #include "dce/dce_11_0_sh_mask.h"
+@@ -1729,20 +1730,25 @@ static void power_down_encoders(struct dc *dc)
+ int i;
+
+ for (i = 0; i < dc->link_count; i++) {
+- enum signal_type signal = dc->links[i]->connector_signal;
+-
+- dc->link_srv->blank_dp_stream(dc->links[i], false);
++ struct dc_link *link = dc->links[i];
++ struct link_encoder *link_enc = link->link_enc;
++ enum signal_type signal = link->connector_signal;
+
++ dc->link_srv->blank_dp_stream(link, false);
+ if (signal != SIGNAL_TYPE_EDP)
+ signal = SIGNAL_TYPE_NONE;
+
+- if (dc->links[i]->ep_type == DISPLAY_ENDPOINT_PHY)
+- dc->links[i]->link_enc->funcs->disable_output(
+- dc->links[i]->link_enc, signal);
++ if (link->ep_type == DISPLAY_ENDPOINT_PHY)
++ link_enc->funcs->disable_output(link_enc, signal);
++
++ if (link->fec_state == dc_link_fec_enabled) {
++ link_enc->funcs->fec_set_enable(link_enc, false);
++ link_enc->funcs->fec_set_ready(link_enc, false);
++ link->fec_state = dc_link_fec_not_ready;
++ }
+
+- dc->links[i]->link_status.link_active = false;
+- memset(&dc->links[i]->cur_link_settings, 0,
+- sizeof(dc->links[i]->cur_link_settings));
++ link->link_status.link_active = false;
++ memset(&link->cur_link_settings, 0, sizeof(link->cur_link_settings));
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e38585a9cf1b3763ca525630f5ffe552faa0ba86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Nov 2025 11:19:36 +0800
+Subject: drm/amd/display: Don't disable DPCD mst_en if sink connected
+
+From: Peichen Huang <PeiChen.Huang@amd.com>
+
+[ Upstream commit 9aeb31b2456452257ad1ff7ec566f21bab1f3e8a ]
+
+[WHY]
+User may connect mst dock with multi monitors and do quick unplug
+and plug in one of the monitor. This operatioin may create CSN from
+dock to display driver. Then display driver would disable and then enable
+mst link and also disable/enable DPCD mst_en bit in dock RX. However,
+when mst_en bit being disabled, if dock has another CSN message to
+transmit then the message would be removed because of the disabling of
+mst_en. In this case, the message is missing and it ends up no display in
+the replugged monitor.
+
+[HOW]
+Don't disable mst_en bit when link still has sink connected.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Peichen Huang <PeiChen.Huang@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+index b66fbcb0040d6..a084c698ed6ef 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+@@ -1928,7 +1928,7 @@ static void disable_link_dp(struct dc_link *link,
+ link->dc->hwss.edp_power_control(link, false);
+ }
+
+- if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
++ if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST && link->sink_count == 0)
+ /* set the sink to SST mode after disabling the link */
+ enable_mst_on_sink(link, false);
+
+@@ -2079,7 +2079,12 @@ static enum dc_status enable_link_dp(struct dc_state *state,
+ pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT &&
+ link->dc->debug.set_mst_en_for_sst) {
+ enable_mst_on_sink(link, true);
++ } else if (link->dpcd_caps.is_mst_capable &&
++ pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT) {
++ /* disable mst on sink */
++ enable_mst_on_sink(link, false);
+ }
++
+ if (pipe_ctx->stream->signal == SIGNAL_TYPE_EDP) {
+ /*in case it is not on*/
+ if (!link->dc->config.edp_no_power_sequencing)
+@@ -2358,9 +2363,9 @@ void link_set_dpms_off(struct pipe_ctx *pipe_ctx)
+ if (pipe_ctx->stream->sink) {
+ if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL &&
+ pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) {
+- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__,
++ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__,
+ pipe_ctx->stream->sink->edid_caps.display_name,
+- pipe_ctx->stream->signal, link->link_index);
++ pipe_ctx->stream->signal, link->link_index, link->sink_count);
+ }
+ }
+
+@@ -2474,10 +2479,11 @@ void link_set_dpms_on(
+ if (pipe_ctx->stream->sink) {
+ if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL &&
+ pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) {
+- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__,
++ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__,
+ pipe_ctx->stream->sink->edid_caps.display_name,
+ pipe_ctx->stream->signal,
+- link->link_index);
++ link->link_index,
++ link->sink_count);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e9fab2f67bbc2f9b67492e926b04c7a2e03d6621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 11:11:19 -0500
+Subject: drm/amd/display: Ensure link output is disabled in backend reset for
+ PLL_ON
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 4589712e0111352973131bad975023b25569287c ]
+
+[Why]
+We're missing the code to actually disable the link output when we have
+to leave the SYMCLK_ON but the TX remains OFF.
+
+[How]
+Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable
+the link output when the backend is reset.
+
+Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
+index b822f2dffff0e..e9bd43a72ce58 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
+@@ -546,8 +546,22 @@ static void dcn31_reset_back_end_for_pipe(
+ if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass)
+ pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
+ pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
++ /*
++ * TODO - convert symclk_ref_cnts for otg to a bit map to solve
++ * the case where the same symclk is shared across multiple otg
++ * instances
++ */
+ if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal))
+- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0;
++ link->phy_state.symclk_ref_cnts.otg = 0;
++
++ if (pipe_ctx->top_pipe == NULL) {
++ if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) {
++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res);
++
++ link_hwss->disable_link_output(link, &pipe_ctx->link_res, pipe_ctx->stream->signal);
++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF;
++ }
++ }
+
+ set_drr_and_clear_adjust_pending(pipe_ctx, pipe_ctx->stream, NULL);
+
+--
+2.51.0
+
--- /dev/null
+From 281fc1c3cb03fffdc54c3c0d6927d5ad39b3cbc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 17:01:17 -0500
+Subject: drm/amd/display: Fix dsc eDP issue
+
+From: Charlene Liu <Charlene.Liu@amd.com>
+
+[ Upstream commit 878a4b73c11111ff5f820730f59a7f8c6fd59374 ]
+
+[why]
+Need to add function hook check before use
+
+Reviewed-by: Mohit Bawa <mohit.bawa@amd.com>
+Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 39be5a58f837a..7e36c063f0da5 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1790,6 +1790,9 @@ static void disable_vga_and_power_gate_all_controllers(
+ struct timing_generator *tg;
+ struct dc_context *ctx = dc->ctx;
+
++ if (dc->caps.ips_support)
++ return;
++
+ for (i = 0; i < dc->res_pool->timing_generator_count; i++) {
+ tg = dc->res_pool->timing_generators[i];
+
+@@ -1866,13 +1869,16 @@ static void clean_up_dsc_blocks(struct dc *dc)
+ /* disable DSC in OPTC */
+ if (i < dc->res_pool->timing_generator_count) {
+ tg = dc->res_pool->timing_generators[i];
+- tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0);
++ if (tg->funcs->set_dsc_config)
++ tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0);
+ }
+ /* disable DSC in stream encoder */
+ if (i < dc->res_pool->stream_enc_count) {
+ se = dc->res_pool->stream_enc[i];
+- se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0);
+- se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true);
++ if (se->funcs->dp_set_dsc_config)
++ se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0);
++ if (se->funcs->dp_set_dsc_pps_info_packet)
++ se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true);
+ }
+ /* disable DSC block */
+ if (dccg->funcs->set_ref_dscclk)
+--
+2.51.0
+
--- /dev/null
+From 19e8142e1973e82bd19bb4f98818ee7467059069 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:32:42 -0500
+Subject: drm/amd/display: Fix GFX12 family constant checks
+
+From: Matthew Stewart <Matthew.Stewart2@amd.com>
+
+[ Upstream commit bdad08670278829771626ea7b57c4db531e2544f ]
+
+Using >=, <= for checking the family is not always correct.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index a0077fe79ed26..b3cf43eb6e087 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -11616,7 +11616,7 @@ static int dm_check_cursor_fb(struct amdgpu_crtc *new_acrtc,
+ * check tiling flags when the FB doesn't have a modifier.
+ */
+ if (!(fb->flags & DRM_MODE_FB_MODIFIERS)) {
+- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) {
++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) {
+ linear = AMDGPU_TILING_GET(afb->tiling_flags, GFX12_SWIZZLE_MODE) == 0;
+ } else if (adev->family >= AMDGPU_FAMILY_AI) {
+ linear = AMDGPU_TILING_GET(afb->tiling_flags, SWIZZLE_MODE) == 0;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+index 9bb7475e80bad..2ecebf9a00fa4 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+@@ -277,7 +277,7 @@ static int amdgpu_dm_plane_validate_dcc(struct amdgpu_device *adev,
+ if (!dcc->enable)
+ return 0;
+
+- if (adev->family < AMDGPU_FAMILY_GC_12_0_0 &&
++ if (adev->family != AMDGPU_FAMILY_GC_12_0_0 &&
+ format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN)
+ return -EINVAL;
+
+@@ -900,7 +900,7 @@ int amdgpu_dm_plane_fill_plane_buffer_attributes(struct amdgpu_device *adev,
+ upper_32_bits(chroma_addr);
+ }
+
+- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) {
++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) {
+ ret = amdgpu_dm_plane_fill_gfx12_plane_attributes_from_modifiers(adev, afb, format,
+ rotation, plane_size,
+ tiling_info, dcc,
+--
+2.51.0
+
--- /dev/null
+From 1d76456c7f92ce8c74ec136d442383bdd1c8934a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 18:10:31 +0800
+Subject: drm/amd/display: Fix system resume lag issue
+
+From: Tom Chung <chiahsuan.chung@amd.com>
+
+[ Upstream commit 64c94cd9be2e188ed07efeafa6a109bce638c967 ]
+
+[Why]
+System will try to apply idle power optimizations setting during
+system resume. But system power state is still in D3 state, and
+it will cause the idle power optimizations command not actually
+to be sent to DMUB and cause some platforms to go into IPS.
+
+[How]
+Set power state to D0 first before calling the
+dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false)
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index b527d5764b76b..c8415a2840567 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3407,7 +3407,17 @@ static int dm_resume(struct amdgpu_ip_block *ip_block)
+ struct dc_commit_streams_params commit_params = {};
+
+ if (dm->dc->caps.ips_support) {
++ if (!amdgpu_in_reset(adev))
++ mutex_lock(&dm->dc_lock);
++
++ /* Need to set POWER_STATE_D0 first or it will not execute
++ * idle_power_optimizations command to DMUB.
++ */
++ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0);
+ dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false);
++
++ if (!amdgpu_in_reset(adev))
++ mutex_unlock(&dm->dc_lock);
+ }
+
+ if (amdgpu_in_reset(adev)) {
+--
+2.51.0
+
--- /dev/null
+From 6d9174fd27f5744cdf089c34fa24c7685f0adfcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 17:20:31 -0700
+Subject: drm/amd/display: Fix writeback on DCN 3.2+
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit 9ef84a307582a92ef055ef0bd3db10fd8ac75960 ]
+
+[WHAT]
+1. Set no scaling for writeback as they are hardcoded in DCN3.2+.
+2. Set no fast plane update for writeback commits.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index b3cf43eb6e087..b527d5764b76b 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10411,10 +10411,10 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm,
+
+ wb_info->dwb_params.capture_rate = dwb_capture_rate_0;
+
+- wb_info->dwb_params.scaler_taps.h_taps = 4;
+- wb_info->dwb_params.scaler_taps.v_taps = 4;
+- wb_info->dwb_params.scaler_taps.h_taps_c = 2;
+- wb_info->dwb_params.scaler_taps.v_taps_c = 2;
++ wb_info->dwb_params.scaler_taps.h_taps = 1;
++ wb_info->dwb_params.scaler_taps.v_taps = 1;
++ wb_info->dwb_params.scaler_taps.h_taps_c = 1;
++ wb_info->dwb_params.scaler_taps.v_taps_c = 1;
+ wb_info->dwb_params.subsample_position = DWB_INTERSTITIAL_SUBSAMPLING;
+
+ wb_info->mcif_buf_params.luma_pitch = afb->base.pitches[0];
+@@ -11430,6 +11430,8 @@ static bool should_reset_plane(struct drm_atomic_state *state,
+ struct drm_crtc_state *old_crtc_state, *new_crtc_state;
+ struct dm_crtc_state *old_dm_crtc_state, *new_dm_crtc_state;
+ struct amdgpu_device *adev = drm_to_adev(plane->dev);
++ struct drm_connector_state *new_con_state;
++ struct drm_connector *connector;
+ int i;
+
+ /*
+@@ -11440,6 +11442,15 @@ static bool should_reset_plane(struct drm_atomic_state *state,
+ state->allow_modeset)
+ return true;
+
++ /* Check for writeback commit */
++ for_each_new_connector_in_state(state, connector, new_con_state, i) {
++ if (connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK)
++ continue;
++
++ if (new_con_state->writeback_job)
++ return true;
++ }
++
+ if (amdgpu_in_reset(adev) && state->allow_modeset)
+ return true;
+
+--
+2.51.0
+
--- /dev/null
+From 83ab343497dc3faedeef2f1bc6125203bc568b11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Nov 2025 20:58:23 +0000
+Subject: drm/amd/display: Guard FAMS2 configuration updates
+
+From: Dillon Varone <Dillon.Varone@amd.com>
+
+[ Upstream commit 7dedb906cdfec100061daf41f8e54266e975987d ]
+
+[WHY&HOW]
+If DMCUB is not initialized or FAMS2 is not supported, the
+interface should not be called.
+
+Reviewed-by: Sridevi Arvindekar <sridevi.arvindekar@amd.com>
+Signed-off-by: Dillon Varone <Dillon.Varone@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index 77cdd02a41bdd..bbfefc9edd1f1 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -1628,7 +1628,8 @@ void dcn401_unblank_stream(struct pipe_ctx *pipe_ctx,
+ void dcn401_hardware_release(struct dc *dc)
+ {
+ if (!dc->debug.disable_force_pstate_allow_on_hw_release) {
+- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
++ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable)
++ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
+
+ /* If pstate unsupported, or still supported
+ * by firmware, force it supported by dcn
+@@ -1648,7 +1649,9 @@ void dcn401_hardware_release(struct dc *dc)
+ dc->clk_mgr->clks.p_state_change_support = false;
+ dc->clk_mgr->funcs->update_clocks(dc->clk_mgr, dc->current_state, true);
+ }
+- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
++
++ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable)
++ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f31095e2d011bb97e9ef6b0aaaafc10a4075cebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 16:38:50 -0500
+Subject: drm/amd/display: only power down dig on phy endpoints
+
+From: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+
+[ Upstream commit 0839d8d24e6f1fc2587c4a976f44da9fa69ae3d0 ]
+
+This avoids any issues with dpia endpoints
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index 483217a91029a..d4a0961f6b516 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -284,6 +284,8 @@ void dcn401_init_hw(struct dc *dc)
+ for (i = 0; i < dc->link_count; i++) {
+ struct dc_link *link = dc->links[i];
+
++ if (link->ep_type != DISPLAY_ENDPOINT_PHY)
++ continue;
+ if (link->link_enc->funcs->is_dig_enabled &&
+ link->link_enc->funcs->is_dig_enabled(link->link_enc) &&
+ hws->funcs.power_down) {
+--
+2.51.0
+
--- /dev/null
+From 7aae51c37dd75c0ef60e33ccb8058186baf6e434 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 22:05:16 -0700
+Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ]
+
+[Why]
+Shaper programming has high chance to fail on first time after
+power-on or reboot. This can be verified by running IGT's kms_colorop.
+
+[How]
+Always power on the shaper and 3DLUT before programming by
+removing the debug flag of low power mode.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
+index 6f0e017a8ae29..a9d2aa0b5390f 100644
+--- a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
+@@ -724,8 +724,7 @@ bool mpc32_program_shaper(
+ return false;
+ }
+
+- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc)
+- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
+
+ current_mode = mpc32_get_shaper_current(mpc, mpcc_id);
+
+--
+2.51.0
+
--- /dev/null
+From fb4079538dc01ab72b0f9f28716a068b71cb58a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 11:01:38 +0800
+Subject: drm/amd/display: Revert "init dispclk from bootup clock for DCN315"
+
+From: Wang, Sung-huai <Danny.Wang@amd.com>
+
+[ Upstream commit a625dc4989a2affb8f06e7b418bf30e1474b99c1 ]
+
+[Why&How]
+This reverts commit 14bb17cc37e0.
+Due to the change, the display shows garbage on startup.
+
+We have an alternative solution for the original issue:
+d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not")
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Wang, Sung-huai <Danny.Wang@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+index b315ed91e010b..c49268db85f68 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+@@ -138,7 +138,7 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
+ if (dc->work_arounds.skip_clock_update)
+ return;
+
+- clk_mgr_base->clks.zstate_support = new_clocks->zstate_support;
++ display_count = dcn315_get_active_display_cnt_wa(dc, context);
+ /*
+ * if it is safe to lower, but we are already in the lower state, we don't have to do anything
+ * also if safe to lower is false, we just go in the higher state
+@@ -151,7 +151,6 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
+ }
+ /* check that we're not already in lower */
+ if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_LOW_POWER) {
+- display_count = dcn315_get_active_display_cnt_wa(dc, context);
+ /* if we can go lower, go lower */
+ if (display_count == 0) {
+ union display_idle_optimization_u idle_info = { 0 };
+--
+2.51.0
+
--- /dev/null
+From 56272423c6e44dfcf1e016a2f72db13c09dd4eeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:24:01 +0000
+Subject: drm/amdgpu: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for amdgpu.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index a1da3e5812ce3..9342f0b8bab2a 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3469,6 +3469,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((adev->pdev->device == 0x666f) &&
++ (adev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (adev->asic_type == CHIP_OLAND) {
+ if ((adev->pdev->revision == 0xC7) ||
+ (adev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From b9a424a0e19e1fdb3c38b479a7745cc1b986b3c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 10:46:47 +0800
+Subject: drm/amdgpu: add support for HDP IP version 6.1.1
+
+From: Tim Huang <tim.huang@amd.com>
+
+[ Upstream commit e2fd14f579b841f54a9b7162fef15234d8c0627a ]
+
+This initializes HDP IP version 6.1.1.
+
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Tim Huang <tim.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index dd7b2b796427c..54a045a0bda96 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -2995,6 +2995,7 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ case IP_VERSION(6, 0, 0):
+ case IP_VERSION(6, 0, 1):
+ case IP_VERSION(6, 1, 0):
++ case IP_VERSION(6, 1, 1):
+ adev->hdp.funcs = &hdp_v6_0_funcs;
+ break;
+ case IP_VERSION(7, 0, 0):
+--
+2.51.0
+
--- /dev/null
+From a88e7d6b1ac14deb27af0376e5344856cdad5189 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 15:32:01 +0800
+Subject: drm/amdgpu: Adjust usleep_range in fence wait
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ]
+
+Tune the sleep interval in the PSP fence wait loop from 10-100us to
+60-100us.This adjustment results in an overall wait window of 1.2s
+(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations),
+which guarantees that we can retrieve the correct fence value
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index aa7987d0806c6..5f7aa840b2151 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -726,7 +726,7 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ ras_intr = amdgpu_ras_intr_triggered();
+ if (ras_intr)
+ break;
+- usleep_range(10, 100);
++ usleep_range(60, 100);
+ amdgpu_device_invalidate_hdp(psp->adev, NULL);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4aebb578759004586f8352d7efef8f756b3b2dec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 11:46:48 -0500
+Subject: drm/amdgpu: avoid a warning in timedout job handler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74 ]
+
+Only set an error on the fence if the fence is not
+signalled. We can end up with a warning if the
+per queue reset path signals the fence and sets an error
+as part of the reset, but fails to recover.
+
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+index 630af847f29ff..ffc720d189007 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -147,7 +147,8 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job)
+ dev_err(adev->dev, "Ring %s reset failed\n", ring->sched.name);
+ }
+
+- dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
++ if (dma_fence_get_status(&s_job->s_fence->finished) == 0)
++ dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
+
+ if (amdgpu_device_should_recover_gpu(ring->adev)) {
+ struct amdgpu_reset_context reset_context;
+--
+2.51.0
+
--- /dev/null
+From d988398c5d9080ae29d7b8bd653bf8db9e15f7bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 23:15:04 +0800
+Subject: drm/amdgpu: avoid sdma ring reset in sriov
+
+From: Victor Zhao <Victor.Zhao@amd.com>
+
+[ Upstream commit 5cc7bbd9f1b74d9fe2f7ac08d6ba0477e8d2d65f ]
+
+sdma ring reset is not supported in SRIOV. kfd driver does not check
+reset mask, and could queue sdma ring reset during unmap_queues_cpsch.
+
+Avoid the ring reset for sriov.
+
+Signed-off-by: Victor Zhao <Victor.Zhao@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
+index 8b8a04138711c..321310ba2c08e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
+@@ -558,6 +558,9 @@ int amdgpu_sdma_reset_engine(struct amdgpu_device *adev, uint32_t instance_id,
+ struct amdgpu_ring *gfx_ring = &sdma_instance->ring;
+ struct amdgpu_ring *page_ring = &sdma_instance->page;
+
++ if (amdgpu_sriov_vf(adev))
++ return -EOPNOTSUPP;
++
+ mutex_lock(&sdma_instance->engine_reset_mutex);
+
+ if (!caller_handles_kernel_queues) {
+--
+2.51.0
+
--- /dev/null
+From 5c366bd04e405d63154b545f8cce1a10cc047b31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2024 11:07:40 +0800
+Subject: drm/amdgpu: fix NULL pointer issue buffer funcs
+
+From: Likun Gao <Likun.Gao@amd.com>
+
+[ Upstream commit 9877a865d62c9c3e0f4cc369dc9ca9f7f24f5ee9 ]
+
+If SDMA block not enabled, buffer_funcs will not initialize,
+fix the null pointer issue if buffer_funcs not initialized.
+
+Signed-off-by: Likun Gao <Likun.Gao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 53b33a636971a..c052da36aa9c2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3280,7 +3280,8 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
+ if (r)
+ goto init_failed;
+
+- if (adev->mman.buffer_funcs_ring->sched.ready)
++ if (adev->mman.buffer_funcs_ring &&
++ adev->mman.buffer_funcs_ring->sched.ready)
+ amdgpu_ttm_set_buffer_funcs_status(adev, true);
+
+ /* Don't init kfd if whole hive need to be reset during init */
+--
+2.51.0
+
--- /dev/null
+From 9c6679a2798d04e98f26c5fffa46dcf1268e4e0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 15:21:43 +0800
+Subject: drm/amdgpu: fix the calculation of RAS bad page number
+
+From: Tao Zhou <tao.zhou1@amd.com>
+
+[ Upstream commit f752e79d38857011f1293fcb6c810409c3b669ee ]
+
+__amdgpu_ras_restore_bad_pages is responsible for the maintenance of bad
+page number, drop the unnecessary bad page number update in the error
+handling path of add_bad_pages.
+
+Signed-off-by: Tao Zhou <tao.zhou1@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 3fd19859055a5..ca5f99df1ac20 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -3056,8 +3056,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev,
+ /* deal with retire_unit records a time */
+ ret = __amdgpu_ras_convert_rec_array_from_rom(adev,
+ &bps[i], &err_data, nps);
+- if (ret)
+- con->bad_page_num -= adev->umc.retire_unit;
+ i += (adev->umc.retire_unit - 1);
+ } else {
+ break;
+@@ -3070,8 +3068,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev,
+ for (; i < pages; i++) {
+ ret = __amdgpu_ras_convert_rec_from_rom(adev,
+ &bps[i], &err_data, nps);
+- if (ret)
+- con->bad_page_num -= adev->umc.retire_unit;
+ }
+
+ con->eh_data->count_saved = con->eh_data->count;
+--
+2.51.0
+
--- /dev/null
+From d849895366b8a048160e377f523f21bf568e577e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 00:46:23 +0800
+Subject: drm/amdgpu/ras: Move ras data alloc before bad page check
+
+From: Asad Kamal <asad.kamal@amd.com>
+
+[ Upstream commit bd68a1404b6fa2e7e9957b38ba22616faba43e75 ]
+
+In the rare event if eeprom has only invalid address entries,
+allocation is skipped, this causes following NULL pointer issue
+[ 547.103445] BUG: kernel NULL pointer dereference, address: 0000000000000010
+[ 547.118897] #PF: supervisor read access in kernel mode
+[ 547.130292] #PF: error_code(0x0000) - not-present page
+[ 547.141689] PGD 124757067 P4D 0
+[ 547.148842] Oops: 0000 [#1] PREEMPT SMP NOPTI
+[ 547.158504] CPU: 49 PID: 8167 Comm: cat Tainted: G OE 6.8.0-38-generic #38-Ubuntu
+[ 547.177998] Hardware name: Supermicro AS -8126GS-TNMR/H14DSG-OD, BIOS 1.7 09/12/2025
+[ 547.195178] RIP: 0010:amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu]
+[ 547.210375] Code: e8 63 78 82 c0 45 31 d2 45 3b 75 08 48 8b 45 a0 73 44 44 89 f1 48 8b 7d 88 48 89 ca 48 c1 e2 05 48 29 ca 49 8b 4d 00 48 01 d1 <48> 83 79 10 00 74 17 49 63 f2 48 8b 49 08 41 83 c2 01 48 8d 34 76
+[ 547.252045] RSP: 0018:ffa0000067287ac0 EFLAGS: 00010246
+[ 547.263636] RAX: ff11000167c28130 RBX: ff11000127600000 RCX: 0000000000000000
+[ 547.279467] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff11000125b1c800
+[ 547.295298] RBP: ffa0000067287b50 R08: 0000000000000000 R09: 0000000000000000
+[ 547.311129] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
+[ 547.326959] R13: ff11000217b1de00 R14: 0000000000000000 R15: 0000000000000092
+[ 547.342790] FS: 0000746e59d14740(0000) GS:ff11017dfda80000(0000) knlGS:0000000000000000
+[ 547.360744] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 547.373489] CR2: 0000000000000010 CR3: 000000019585e001 CR4: 0000000000f71ef0
+[ 547.389321] PKRU: 55555554
+[ 547.395316] Call Trace:
+[ 547.400737] <TASK>
+[ 547.405386] ? show_regs+0x6d/0x80
+[ 547.412929] ? __die+0x24/0x80
+[ 547.419697] ? page_fault_oops+0x99/0x1b0
+[ 547.428588] ? do_user_addr_fault+0x2ee/0x6b0
+[ 547.438249] ? exc_page_fault+0x83/0x1b0
+[ 547.446949] ? asm_exc_page_fault+0x27/0x30
+[ 547.456225] ? amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu]
+[ 547.470040] ? mas_wr_modify+0xcd/0x140
+[ 547.478548] sysfs_kf_bin_read+0x63/0xb0
+[ 547.487248] kernfs_file_read_iter+0xa1/0x190
+[ 547.496909] kernfs_fop_read_iter+0x25/0x40
+[ 547.506182] vfs_read+0x255/0x390
+
+This also result in space left assigned to negative values.
+Moving data alloc call before bad page check resolves both the issue.
+
+Signed-off-by: Asad Kamal <asad.kamal@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index ca5f99df1ac20..e9ed1a3b135cc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -2892,6 +2892,11 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev,
+ struct ras_err_handler_data *data = con->eh_data;
+
+ for (j = 0; j < count; j++) {
++ if (!data->space_left &&
++ amdgpu_ras_realloc_eh_data_space(adev, data, 256)) {
++ return -ENOMEM;
++ }
++
+ if (amdgpu_ras_check_bad_page_unlock(con,
+ bps[j].retired_page << AMDGPU_GPU_PAGE_SHIFT)) {
+ data->count++;
+@@ -2899,11 +2904,6 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev,
+ continue;
+ }
+
+- if (!data->space_left &&
+- amdgpu_ras_realloc_eh_data_space(adev, data, 256)) {
+- return -ENOMEM;
+- }
+-
+ amdgpu_ras_reserve_page(adev, bps[j].retired_page);
+
+ memcpy(&data->bps[data->count], &(bps[j]),
+--
+2.51.0
+
--- /dev/null
+From 19c459956931aa95ed8f02c781f91103a444a8b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 21:25:20 +0530
+Subject: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence
+ Update and Timeline Management v4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit bd8150a1b3370a9f7761c5814202a3fe5a79f44f ]
+
+This commit simplifies the amdgpu_gem_va_ioctl function, key updates
+include:
+ - Moved the logic for managing the last update fence directly into
+ amdgpu_gem_va_update_vm.
+ - Introduced checks for the timeline point to enable conditional
+ replacement or addition of fences.
+
+v2: Addressed review comments from Christian.
+v3: Updated comments (Christian).
+v4: The previous version selected the fence too early and did not manage its
+ reference correctly, which could lead to stale or freed fences being used.
+ This resulted in refcount underflows and could crash when updating GPU
+ timelines.
+ The fence is now chosen only after the VA mapping work is completed, and its
+ reference is taken safely. After exporting it to the VM timeline syncobj, the
+ driver always drops its local fence reference, ensuring balanced refcounting
+ and avoiding use-after-free on dma_fence.
+
+ Crash signature:
+ [ 205.828135] refcount_t: underflow; use-after-free.
+ [ 205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
+ ...
+ [ 206.074014] Call Trace:
+ [ 206.076488] <TASK>
+ [ 206.078608] amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu]
+ [ 206.084040] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]
+ [ 206.089994] drm_ioctl_kernel+0x86/0xe0 [drm]
+ [ 206.094415] drm_ioctl+0x26e/0x520 [drm]
+ [ 206.098424] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]
+ [ 206.104402] amdgpu_drm_ioctl+0x4b/0x80 [amdgpu]
+ [ 206.109387] __x64_sys_ioctl+0x96/0xe0
+ [ 206.113156] do_syscall_64+0x66/0x2d0
+ ...
+ [ 206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90
+ ...
+ [ 206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0
+ ...
+ [ 206.553405] Call Trace:
+ [ 206.553409] <IRQ>
+ [ 206.553415] ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched]
+ [ 206.553424] dma_fence_signal+0x30/0x60
+ [ 206.553427] drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched]
+ [ 206.553434] dma_fence_signal_timestamp_locked+0x6e/0xe0
+ [ 206.553437] dma_fence_signal+0x30/0x60
+ [ 206.553441] amdgpu_fence_process+0xd8/0x150 [amdgpu]
+ [ 206.553854] sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu]
+ [ 206.554353] edac_mce_amd(E) ee1004(E)
+ [ 206.554270] amdgpu_irq_dispatch+0x150/0x230 [amdgpu]
+ [ 206.554702] amdgpu_ih_process+0x6a/0x180 [amdgpu]
+ [ 206.555101] amdgpu_irq_handler+0x23/0x60 [amdgpu]
+ [ 206.555500] __handle_irq_event_percpu+0x4a/0x1c0
+ [ 206.555506] handle_irq_event+0x38/0x80
+ [ 206.555509] handle_edge_irq+0x92/0x1e0
+ [ 206.555513] __common_interrupt+0x3e/0xb0
+ [ 206.555519] common_interrupt+0x80/0xa0
+ [ 206.555525] </IRQ>
+ [ 206.555527] <TASK>
+ ...
+ [ 206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0
+ ...
+ [ 206.555667] Kernel panic - not syncing: Fatal exception in interrupt
+
+Link: https://patchwork.freedesktop.org/patch/654669/
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Suggested-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 135 ++++++++++++++----------
+ 1 file changed, 82 insertions(+), 53 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+index b7ebae289beab..b5eb45d2905be 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+@@ -112,47 +112,6 @@ amdgpu_gem_update_timeline_node(struct drm_file *filp,
+ return 0;
+ }
+
+-static void
+-amdgpu_gem_update_bo_mapping(struct drm_file *filp,
+- struct amdgpu_bo_va *bo_va,
+- uint32_t operation,
+- uint64_t point,
+- struct dma_fence *fence,
+- struct drm_syncobj *syncobj,
+- struct dma_fence_chain *chain)
+-{
+- struct amdgpu_bo *bo = bo_va ? bo_va->base.bo : NULL;
+- struct amdgpu_fpriv *fpriv = filp->driver_priv;
+- struct amdgpu_vm *vm = &fpriv->vm;
+- struct dma_fence *last_update;
+-
+- if (!syncobj)
+- return;
+-
+- /* Find the last update fence */
+- switch (operation) {
+- case AMDGPU_VA_OP_MAP:
+- case AMDGPU_VA_OP_REPLACE:
+- if (bo && (bo->tbo.base.resv == vm->root.bo->tbo.base.resv))
+- last_update = vm->last_update;
+- else
+- last_update = bo_va->last_pt_update;
+- break;
+- case AMDGPU_VA_OP_UNMAP:
+- case AMDGPU_VA_OP_CLEAR:
+- last_update = fence;
+- break;
+- default:
+- return;
+- }
+-
+- /* Add fence to timeline */
+- if (!point)
+- drm_syncobj_replace_fence(syncobj, last_update);
+- else
+- drm_syncobj_add_point(syncobj, chain, last_update, point);
+-}
+-
+ static vm_fault_t amdgpu_gem_fault(struct vm_fault *vmf)
+ {
+ struct ttm_buffer_object *bo = vmf->vma->vm_private_data;
+@@ -761,16 +720,19 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
+ struct amdgpu_bo_va *bo_va,
+ uint32_t operation)
+ {
+- struct dma_fence *fence = dma_fence_get_stub();
++ struct dma_fence *clear_fence = dma_fence_get_stub();
++ struct dma_fence *last_update = NULL;
+ int r;
+
+ if (!amdgpu_vm_ready(vm))
+- return fence;
++ return clear_fence;
+
+- r = amdgpu_vm_clear_freed(adev, vm, &fence);
++ /* First clear freed BOs and get a fence for that work, if any. */
++ r = amdgpu_vm_clear_freed(adev, vm, &clear_fence);
+ if (r)
+ goto error;
+
++ /* For MAP/REPLACE we also need to update the BO mappings. */
+ if (operation == AMDGPU_VA_OP_MAP ||
+ operation == AMDGPU_VA_OP_REPLACE) {
+ r = amdgpu_vm_bo_update(adev, bo_va, false);
+@@ -778,13 +740,59 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
+ goto error;
+ }
+
++ /* Always update PDEs after we touched the mappings. */
+ r = amdgpu_vm_update_pdes(adev, vm, false);
++ if (r)
++ goto error;
++
++ /*
++ * Decide which fence represents the "last update" for this VM/BO:
++ *
++ * - For MAP/REPLACE we want the PT update fence, which is tracked as
++ * either vm->last_update (for always-valid BOs) or bo_va->last_pt_update
++ * (for per-BO updates).
++ *
++ * - For UNMAP/CLEAR we rely on the fence returned by
++ * amdgpu_vm_clear_freed(), which already covers the page table work
++ * for the removed mappings.
++ */
++ switch (operation) {
++ case AMDGPU_VA_OP_MAP:
++ case AMDGPU_VA_OP_REPLACE:
++ if (bo_va && bo_va->base.bo) {
++ if (amdgpu_vm_is_bo_always_valid(vm, bo_va->base.bo)) {
++ if (vm->last_update)
++ last_update = dma_fence_get(vm->last_update);
++ } else {
++ if (bo_va->last_pt_update)
++ last_update = dma_fence_get(bo_va->last_pt_update);
++ }
++ }
++ break;
++ case AMDGPU_VA_OP_UNMAP:
++ case AMDGPU_VA_OP_CLEAR:
++ if (clear_fence)
++ last_update = dma_fence_get(clear_fence);
++ break;
++ default:
++ break;
++ }
+
+ error:
+ if (r && r != -ERESTARTSYS)
+ DRM_ERROR("Couldn't update BO_VA (%d)\n", r);
+
+- return fence;
++ /*
++ * If we managed to pick a more specific last-update fence, prefer it
++ * over the generic clear_fence and drop the extra reference to the
++ * latter.
++ */
++ if (last_update) {
++ dma_fence_put(clear_fence);
++ return last_update;
++ }
++
++ return clear_fence;
+ }
+
+ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+@@ -810,6 +818,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ uint64_t vm_size;
+ int r = 0;
+
++ /* Validate virtual address range against reserved regions. */
+ if (args->va_address < AMDGPU_VA_RESERVED_BOTTOM) {
+ dev_dbg(dev->dev,
+ "va_address 0x%llx is in reserved area 0x%llx\n",
+@@ -843,6 +852,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ return -EINVAL;
+ }
+
++ /* Validate operation type. */
+ switch (args->operation) {
+ case AMDGPU_VA_OP_MAP:
+ case AMDGPU_VA_OP_UNMAP:
+@@ -866,6 +876,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ abo = NULL;
+ }
+
++ /* Add input syncobj fences (if any) for synchronization. */
+ r = amdgpu_gem_add_input_fence(filp,
+ args->input_fence_syncobj_handles,
+ args->num_syncobj_handles);
+@@ -888,6 +899,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ goto error;
+ }
+
++ /* Resolve the BO-VA mapping for this VM/BO combination. */
+ if (abo) {
+ bo_va = amdgpu_vm_bo_find(&fpriv->vm, abo);
+ if (!bo_va) {
+@@ -900,6 +912,11 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ bo_va = NULL;
+ }
+
++ /*
++ * Prepare the timeline syncobj node if the user requested a VM
++ * timeline update. This only allocates/looks up the syncobj and
++ * chain node; the actual fence is attached later.
++ */
+ r = amdgpu_gem_update_timeline_node(filp,
+ args->vm_timeline_syncobj_out,
+ args->vm_timeline_point,
+@@ -931,18 +948,30 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ default:
+ break;
+ }
++
++ /*
++ * Once the VA operation is done, update the VM and obtain the fence
++ * that represents the last relevant update for this mapping. This
++ * fence can then be exported to the user-visible VM timeline.
++ */
+ if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE) && !adev->debug_vm) {
+ fence = amdgpu_gem_va_update_vm(adev, &fpriv->vm, bo_va,
+ args->operation);
+
+- if (timeline_syncobj)
+- amdgpu_gem_update_bo_mapping(filp, bo_va,
+- args->operation,
+- args->vm_timeline_point,
+- fence, timeline_syncobj,
+- timeline_chain);
+- else
+- dma_fence_put(fence);
++ if (timeline_syncobj && fence) {
++ if (!args->vm_timeline_point) {
++ /* Replace the existing fence when no point is given. */
++ drm_syncobj_replace_fence(timeline_syncobj,
++ fence);
++ } else {
++ /* Attach the last-update fence at a specific point. */
++ drm_syncobj_add_point(timeline_syncobj,
++ timeline_chain,
++ fence,
++ args->vm_timeline_point);
++ }
++ }
++ dma_fence_put(fence);
+
+ }
+
+--
+2.51.0
+
--- /dev/null
+From df161060e87ba844ec9f1d673dc80b1c18bb378c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 17:32:00 +0800
+Subject: drm/amdgpu: return when ras table checksum is error
+
+From: Gangliang Xie <ganglxie@amd.com>
+
+[ Upstream commit 044f8d3b1fac6ac89c560f61415000e6bdab3a03 ]
+
+end the function flow when ras table checksum is error
+
+Signed-off-by: Gangliang Xie <ganglxie@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+index 3eb3fb55ccb05..dafa46a9656ca 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+@@ -1475,10 +1475,12 @@ int amdgpu_ras_eeprom_check(struct amdgpu_ras_eeprom_control *control)
+ }
+
+ res = __verify_ras_table_checksum(control);
+- if (res)
++ if (res) {
+ dev_err(adev->dev,
+ "RAS table incorrect checksum or error:%d\n",
+ res);
++ return -EINVAL;
++ }
+
+ /* Warn if we are at 90% of the threshold or above
+ */
+--
+2.51.0
+
--- /dev/null
+From dacbb8dd5ba9a4a579218e10601a00863b880dd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 15:16:27 +0800
+Subject: drm/amdgpu: Skip loading SDMA_RS64 in VF
+
+From: YuBiao Wang <YuBiao.Wang@amd.com>
+
+[ Upstream commit 39c21b81112321cbe1267b02c77ecd2161ce19aa ]
+
+VFs use the PF SDMA ucode and are unable to load SDMA_RS64.
+
+Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com>
+Signed-off-by: Victor Skvortsov <Victor.Skvortsov@amd.com>
+Reviewed-by: Gavin Wan <gavin.wan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index f96beb96c75cc..38183b4f03dfd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -972,6 +972,7 @@ bool amdgpu_virt_fw_load_skip_check(struct amdgpu_device *adev, uint32_t ucode_i
+ || ucode_id == AMDGPU_UCODE_ID_SDMA5
+ || ucode_id == AMDGPU_UCODE_ID_SDMA6
+ || ucode_id == AMDGPU_UCODE_ID_SDMA7
++ || ucode_id == AMDGPU_UCODE_ID_SDMA_RS64
+ || ucode_id == AMDGPU_UCODE_ID_RLC_G
+ || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL
+ || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM
+--
+2.51.0
+
--- /dev/null
+From acc4d43a037127bb3af6355d902ed0583cf118e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 12:11:49 +0530
+Subject: drm/amdgpu: Skip vcn poison irq release on VF
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 8980be03b3f9a4b58197ef95d3b37efa41a25331 ]
+
+VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid
+call trace during deinitialization.
+
+[ 71.913601] [drm] clean up the vf2pf work item
+[ 71.915088] ------------[ cut here ]------------
+[ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu]
+[ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd
+[ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu
+[ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014
+[ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu]
+[ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 <0f> 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00
+[ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246
+[ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000
+[ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000
+[ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000
+[ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
+[ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000
+[ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0
+[ 71.915800] PKRU: 55555554
+[ 71.915802] Call Trace:
+[ 71.915805] <TASK>
+[ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu]
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+index cebee453871c1..006a154511971 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+@@ -521,7 +521,9 @@ static int vcn_v2_5_hw_fini(struct amdgpu_ip_block *ip_block)
+ RREG32_SOC15(VCN, i, mmUVD_STATUS)))
+ vinst->set_pg_state(vinst, AMD_PG_STATE_GATE);
+
+- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
++ /* VF doesn't enable interrupt operations for RAS */
++ if (!amdgpu_sriov_vf(adev) &&
++ amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
+ amdgpu_irq_put(adev, &vinst->ras_poison_irq, 0);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8a62d0aeeb7992f25b04bb9f25d7decaac269f9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 11:35:57 +0800
+Subject: drm/amdgpu: validate user queue size constraints
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jesse.Zhang <Jesse.Zhang@amd.com>
+
+[ Upstream commit 8079b87c02e531cc91601f72ea8336dd2262fdf1 ]
+
+Add validation to ensure user queue sizes meet hardware requirements:
+- Size must be a power of two for efficient ring buffer wrapping
+- Size must be at least AMDGPU_GPU_PAGE_SIZE to prevent undersized allocations
+
+This prevents invalid configurations that could lead to GPU faults or
+unexpected behavior.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Jesse Zhang <jesse.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+index 8c41951feb437..eef65833a1c99 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+@@ -656,6 +656,17 @@ static int amdgpu_userq_input_args_validate(struct drm_device *dev,
+ drm_file_err(filp, "invalidate userq queue va or size\n");
+ return -EINVAL;
+ }
++
++ if (!is_power_of_2(args->in.queue_size)) {
++ drm_file_err(filp, "Queue size must be a power of 2\n");
++ return -EINVAL;
++ }
++
++ if (args->in.queue_size < AMDGPU_GPU_PAGE_SIZE) {
++ drm_file_err(filp, "Queue size smaller than AMDGPU_GPU_PAGE_SIZE\n");
++ return -EINVAL;
++ }
++
+ if (!args->in.wptr_va || !args->in.rptr_va) {
+ drm_file_err(filp, "invalidate userq queue rptr or wptr\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 6a3e99c5ca1b24981cd0f343a8ea60890dfc2f25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 19:36:56 +0530
+Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in
+ svm_migrate_gart_map()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ]
+
+In svm_migrate_gart_map(), while migrating GART mapping, the number of
+bytes copied for the GART table only accounts for CPU pages. On non-4K
+systems, each CPU page can contain multiple GPU pages, and the GART
+requires one 8-byte PTE per GPU page. As a result, an incorrect size was
+passed to the DMA, causing only a partial update of the GART table.
+
+Fix this function to work correctly on non-4K page-size systems by
+accounting for the number of GPU pages per CPU page when calculating the
+number of bytes to be copied.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index 59a5a3fea65df..ea8377071c390 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -62,7 +62,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, u64 npages,
+ *gart_addr = adev->gmc.gart_start;
+
+ num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8);
+- num_bytes = npages * 8;
++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE;
+
+ r = amdgpu_job_alloc_with_ib(adev, &adev->mman.high_pr,
+ AMDGPU_FENCE_OWNER_UNDEFINED,
+--
+2.51.0
+
--- /dev/null
+From 230da7af6b48b2dee8f968f8a9686be910e66d92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:32:45 -0500
+Subject: drm/amdkfd: Handle GPU reset and drain retry fault race
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 5b57c3c3f22336e8fd5edb7f0fef3c7823f8eac1 ]
+
+Only check and drain IH1 ring if CAM is not enabled.
+
+If GPU is under reset, don't access IH to drain retry fault.
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 49dd0a81114e4..6daa70ace261f 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -33,6 +33,7 @@
+ #include "amdgpu_hmm.h"
+ #include "amdgpu.h"
+ #include "amdgpu_xgmi.h"
++#include "amdgpu_reset.h"
+ #include "kfd_priv.h"
+ #include "kfd_svm.h"
+ #include "kfd_migrate.h"
+@@ -2343,6 +2344,9 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms)
+
+ pr_debug("drain retry fault gpu %d svms %p\n", i, svms);
+
++ if (!down_read_trylock(&pdd->dev->adev->reset_domain->sem))
++ continue;
++
+ amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev,
+ pdd->dev->adev->irq.retry_cam_enabled ?
+ &pdd->dev->adev->irq.ih :
+@@ -2352,6 +2356,7 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms)
+ amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev,
+ &pdd->dev->adev->irq.ih_soft);
+
++ up_read(&pdd->dev->adev->reset_domain->sem);
+
+ pr_debug("drain retry fault gpu %d svms 0x%p done\n", i, svms);
+ }
+@@ -2535,7 +2540,7 @@ svm_range_unmap_from_cpu(struct mm_struct *mm, struct svm_range *prange,
+ adev = pdd->dev->adev;
+
+ /* Check and drain ih1 ring if cam not available */
+- if (adev->irq.ih1.ring_size) {
++ if (!adev->irq.retry_cam_enabled && adev->irq.ih1.ring_size) {
+ ih = &adev->irq.ih1;
+ checkpoint_wptr = amdgpu_ih_get_wptr(adev, ih);
+ if (ih->rptr != checkpoint_wptr) {
+--
+2.51.0
+
--- /dev/null
+From fba3bbde3f178cf15485603921890a6eb810700e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 19:36:54 +0530
+Subject: drm/amdkfd: Relax size checking during queue buffer get
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 42ea9cf2f16b7131cb7302acb3dac510968f8bdc ]
+
+HW-supported EOP buffer sizes are 4K and 32K. On systems that do not
+use 4K pages, the minimum buffer object (BO) allocation size is
+PAGE_SIZE (for example, 64K). During queue buffer acquisition, the driver
+currently checks the allocated BO size against the supported EOP buffer
+size. Since the allocated BO is larger than the expected size, this check
+fails, preventing queue creation.
+
+Relax the strict size validation and allow PAGE_SIZE-sized BOs to be used.
+Only the required 4K region of the buffer will be used as the EOP buffer
+and avoids queue creation failures on non-4K page systems.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Suggested-by: Philip Yang <yangp@amd.com>
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+index 80c4fa2b0975d..2822c90bd7be4 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+@@ -275,8 +275,8 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
+
+ /* EOP buffer is not required for all ASICs */
+ if (properties->eop_ring_buffer_address) {
+- if (properties->eop_ring_buffer_size != topo_dev->node_props.eop_buffer_size) {
+- pr_debug("queue eop bo size 0x%x not equal to node eop buf size 0x%x\n",
++ if (properties->eop_ring_buffer_size < topo_dev->node_props.eop_buffer_size) {
++ pr_debug("queue eop bo size 0x%x is less than node eop buf size 0x%x\n",
+ properties->eop_ring_buffer_size,
+ topo_dev->node_props.eop_buffer_size);
+ err = -EINVAL;
+@@ -284,7 +284,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
+ }
+ err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address,
+ &properties->eop_buf_bo,
+- properties->eop_ring_buffer_size);
++ ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE));
+ if (err)
+ goto out_err_unreserve;
+ }
+--
+2.51.0
+
--- /dev/null
+From 3324a75320e413c337d8d6e7b12962540ad27f98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 11:38:25 +0100
+Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has
+ fractional parts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ]
+
+Don’t reject the commit when the source rectangle has fractional parts.
+This can occur due to scaling: drm_atomic_helper_check_plane_state() calls
+drm_rect_clip_scaled(), which may introduce fractional parts while
+computing the clipped source rectangle. This does not imply the commit is
+invalid, so we should accept it instead of discarding it.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 410ec747cc7e0..caf6deda717ce 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -78,8 +78,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s)
+ return container_of(s, struct atmel_hlcdc_plane_state, base);
+ }
+
+-#define SUBPIXEL_MASK 0xffff
+-
+ static uint32_t rgb_formats[] = {
+ DRM_FORMAT_C8,
+ DRM_FORMAT_XRGB4444,
+@@ -744,24 +742,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p,
+ if (ret || !s->visible)
+ return ret;
+
+- hstate->src_x = s->src.x1;
+- hstate->src_y = s->src.y1;
+- hstate->src_w = drm_rect_width(&s->src);
+- hstate->src_h = drm_rect_height(&s->src);
++ hstate->src_x = s->src.x1 >> 16;
++ hstate->src_y = s->src.y1 >> 16;
++ hstate->src_w = drm_rect_width(&s->src) >> 16;
++ hstate->src_h = drm_rect_height(&s->src) >> 16;
+ hstate->crtc_x = s->dst.x1;
+ hstate->crtc_y = s->dst.y1;
+ hstate->crtc_w = drm_rect_width(&s->dst);
+ hstate->crtc_h = drm_rect_height(&s->dst);
+
+- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) &
+- SUBPIXEL_MASK)
+- return -EINVAL;
+-
+- hstate->src_x >>= 16;
+- hstate->src_y >>= 16;
+- hstate->src_w >>= 16;
+- hstate->src_h >>= 16;
+-
+ hstate->nplanes = fb->format->num_planes;
+ if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 04e70a36b92dcdde49de922397eda328a0309135 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:52 +0200
+Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state
+ callback
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ]
+
+After several commits, the slab memory increases. Some drm_crtc_commit
+objects are not freed. The atomic_destroy_state callback only put the
+framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
+to put all the objects that are no longer needed.
+
+It has been seen after hours of usage of a graphics application or using
+kmemleak:
+
+unreferenced object 0xc63a6580 (size 64):
+ comm "egt_basic", pid 171, jiffies 4294940784
+ hex dump (first 32 bytes):
+ 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.
+ 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.
+ backtrace (crc c25aa925):
+ kmemleak_alloc+0x34/0x3c
+ __kmalloc_cache_noprof+0x150/0x1a4
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 3787db014501e..410ec747cc7e0 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -1204,8 +1204,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
+ state->dscrs[i]->self);
+ }
+
+- if (s->fb)
+- drm_framebuffer_put(s->fb);
++ __drm_atomic_helper_plane_destroy_state(s);
+
+ kfree(state);
+ }
+--
+2.51.0
+
--- /dev/null
+From d70859a81d7a03cb97d8b163c781f02040ed3591 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:53 +0200
+Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ]
+
+The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
+the atmel_hlcdc_plane state structure without properly duplicating the
+drm_plane_state. In particular, state->commit remained set to the old
+state commit, which can lead to a use-after-free in the next
+drm_atomic_commit() call.
+
+Fix this by calling
+__drm_atomic_helper_duplicate_plane_state(), which correctly clones
+the base drm_plane_state (including the ->commit pointer).
+
+It has been seen when closing and re-opening the device node while
+another DRM client (e.g. fbdev) is still attached:
+
+=============================================================================
+BUG kmalloc-64 (Not tainted): Poison overwritten
+-----------------------------------------------------------------------------
+
+0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b
+FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b
+Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0
+pid=29
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_framebuffer_remove+0x4cc/0x5a8
+ drm_mode_rmfb_work_fn+0x6c/0x80
+ process_one_work+0x12c/0x2cc
+ worker_thread+0x2a8/0x400
+ kthread+0xc0/0xdc
+ ret_from_fork+0x14/0x28
+Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0
+pid=169
+ drm_atomic_helper_commit_hw_done+0x100/0x150
+ drm_atomic_helper_commit_tail+0x64/0x8c
+ commit_tail+0x168/0x18c
+ drm_atomic_helper_commit+0x138/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0
+flags=0x200(workingset|zone=0)
+Object 0xc611b340 @offset=832 fp=0xc611b7c0
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index caf6deda717ce..ae8d7b017968d 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -1174,8 +1174,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
+ return NULL;
+ }
+
+- if (copy->base.fb)
+- drm_framebuffer_get(copy->base.fb);
++ __drm_atomic_helper_plane_duplicate_state(p, ©->base);
+
+ return ©->base;
+ }
+--
+2.51.0
+
--- /dev/null
+From 3d20fad597eda2a098f2820a115ac93d1b248e02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 15:16:50 +0530
+Subject: drm/display/dp_mst: Add protection against 0 vcpi
+
+From: Suraj Kandpal <suraj.kandpal@intel.com>
+
+[ Upstream commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa ]
+
+When releasing a timeslot there is a slight chance we may end up
+with the wrong payload mask due to overflow if the delayed_destroy_work
+ends up coming into play after a DP 2.1 monitor gets disconnected
+which causes vcpi to become 0 then we try to make the payload =
+~BIT(vcpi - 1) which is a negative shift. VCPI id should never
+really be 0 hence skip changing the payload mask if VCPI is 0.
+
+Otherwise it leads to
+<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc
+[drm_display_helper]] port ffff888126ce9000 (3)
+<4> [515.287267] -----------[ cut here ]-----------
+<3> [515.287268] UBSAN: shift-out-of-bounds in
+../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36
+<3> [515.287271] shift exponent -1 is negative
+<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G
+S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)
+<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
+<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P
+WIFI, BIOS 1645 03/15/2024
+<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work
+[drm_display_helper]
+<4> [515.287303] Call Trace:
+<4> [515.287304] <TASK>
+<4> [515.287306] dump_stack_lvl+0xc1/0xf0
+<4> [515.287313] dump_stack+0x10/0x20
+<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0
+<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0
+<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d
+[drm_display_helper]
+<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]
+<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0
+<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60
+<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe]
+<4> [515.287740] ? find_held_lock+0x31/0x90
+<4> [515.287747] ? lock_release+0xce/0x2a0
+<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40
+<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140
+<4> [515.287765] drm_atomic_commit+0x6e/0xf0
+<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10
+<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0
+<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0
+<4> [515.287795] ? mutex_lock_nested+0x1b/0x30
+<4> [515.287801] drm_client_modeset_commit+0x26/0x50
+<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110
+<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140
+<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0
+<4> [515.287819] drm_client_hotplug+0x6c/0xf0
+<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0
+<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30
+<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410
+[drm_display_helper]
+<4> [515.287861] process_one_work+0x22b/0x6f0
+<4> [515.287874] worker_thread+0x1e8/0x3d0
+<4> [515.287879] ? __pfx_worker_thread+0x10/0x10
+<4> [515.287882] kthread+0x11c/0x250
+<4> [515.287886] ? __pfx_kthread+0x10/0x10
+<4> [515.287890] ret_from_fork+0x2d7/0x310
+<4> [515.287894] ? __pfx_kthread+0x10/0x10
+<4> [515.287897] ret_from_fork_asm+0x1a/0x30
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303
+Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+index 64e5c176d5cce..be749dcad3b58 100644
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -4572,7 +4572,8 @@ int drm_dp_atomic_release_time_slots(struct drm_atomic_state *state,
+ if (!payload->delete) {
+ payload->pbn = 0;
+ payload->delete = true;
+- topology_state->payload_mask &= ~BIT(payload->vcpi - 1);
++ if (payload->vcpi > 0)
++ topology_state->payload_mask &= ~BIT(payload->vcpi - 1);
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 96866ce621461874bd969d7402258e1a33e46896 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Dec 2025 14:37:28 -0300
+Subject: drm/panel-edp: Add AUO B140QAX01.H panel
+
+From: Val Packett <val@packett.cool>
+
+[ Upstream commit bcd752c706c357229185a330ab450b86236d9031 ]
+
+A 14-inch 2560x1600 60Hz matte touch panel, found on a Dell Latitude 7455
+laptop (second-source with BOE NE14QDM), according to online sources it's
+also found on the Latitude 7440 and some ASUS models.
+
+Raw EDID dump:
+
+00 ff ff ff ff ff ff 00 06 af a4 0b 00 00 00 00
+00 20 01 04 a5 1e 13 78 03 ad f5 a8 54 47 9c 24
+0e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
+01 01 01 01 01 01 f0 68 00 a0 a0 40 2e 60 30 20
+35 00 2d bc 10 00 00 1a f3 53 00 a0 a0 40 2e 60
+30 20 35 00 2d bc 10 00 00 1a 00 00 00 fe 00 36
+39 52 31 57 80 42 31 34 30 51 41 58 00 00 00 00
+00 02 41 21 a8 00 01 00 00 1a 41 0a 20 20 00 a1
+
+Don't have datasheet access, but the same timing as for other panels from
+the same manufacturer works fine.
+
+Signed-off-by: Val Packett <val@packett.cool>
+[dianders: Moved to the right location in the table]
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20251206173739.2222940-1-val@packett.cool
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index aad5838cd700a..6a8a4ebc91e21 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1880,6 +1880,7 @@ static const struct panel_delay delay_80_500_e50_d50 = {
+ */
+ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x04a4, &delay_200_500_e50, "B122UAN01.0"),
++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x0ba4, &delay_200_500_e50, "B140QAX01.H"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x105c, &delay_200_500_e50, "B116XTN01.0"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x1062, &delay_200_500_e50, "B120XAN01.0"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x125c, &delay_200_500_e50, "Unknown"),
+--
+2.51.0
+
--- /dev/null
+From 3216e0a61f3969edfcb15be1ccf1e07b5170ec39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 16:51:34 +0100
+Subject: drm/panel: edp: add BOE NV140WUM-T08 panel
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit 349d4efadc1f831ebc0b872ba1e3a2b7dd58b72b ]
+
+Add powerseq timing info for the BOE NV140WUM-T08 panel used on Lenovo
+Thinkpad T14s gen 6 (Snapdragon X1 Elite) laptops.
+
+edid-decode (hex):
+
+00 ff ff ff ff ff ff 00 09 e5 26 0c 00 00 00 00
+0a 21 01 04 a5 1e 13 78 03 d6 62 99 5e 5a 8e 27
+25 53 58 00 00 00 01 01 01 01 01 01 01 01 01 01
+01 01 01 01 01 01 33 3f 80 dc 70 b0 3c 40 30 20
+36 00 2e bc 10 00 00 1a 00 00 00 fd 00 28 3c 4c
+4c 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42
+4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fe
+00 4e 56 31 34 30 57 55 4d 2d 54 30 38 0a 00 fa
+
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20260105155134.83266-1-johannes.goede@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 6a8a4ebc91e21..d1e68c464e308 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1730,6 +1730,12 @@ static const struct panel_delay delay_200_500_p2e100 = {
+ .prepare_to_enable = 100,
+ };
+
++static const struct panel_delay delay_200_500_p2e200 = {
++ .hpd_absent = 200,
++ .unprepare = 500,
++ .prepare_to_enable = 200,
++};
++
+ static const struct panel_delay delay_200_500_e50 = {
+ .hpd_absent = 200,
+ .unprepare = 500,
+@@ -1974,6 +1980,7 @@ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b56, &delay_200_500_e80, "NT140FHM-N47"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b66, &delay_200_500_e80, "NE140WUM-N6G"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c20, &delay_200_500_e80, "NT140FHM-N47"),
++ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c26, &delay_200_500_p2e200, "NV140WUM-T08"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c93, &delay_200_500_e200, "Unknown"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cb6, &delay_200_500_e200, "NT116WHM-N44"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cf6, &delay_200_500_e200, "NV140WUM-N64"),
+--
+2.51.0
+
--- /dev/null
+From 5c4bbe7d434972032942d64458182648b4a6b8a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 20:09:55 +0800
+Subject: drm/panel: Fix a possible null-pointer dereference in
+ jdi_panel_dsi_remove()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit 95eed73b871111123a8b1d31cb1fce7e902e49ea ]
+
+In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it
+may be NULL:
+
+ if (!jdi)
+ mipi_dsi_detach(dsi);
+
+However, when jdi is NULL, the function does not return and continues by
+calling jdi_panel_disable():
+
+ err = jdi_panel_disable(&jdi->base);
+
+Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can
+lead to a NULL-pointer dereference:
+
+ struct jdi_panel *jdi = to_panel_jdi(panel);
+ backlight_disable(jdi->backlight);
+
+To prevent such a potential NULL-pointer dereference, return early from
+jdi_panel_dsi_remove() when jdi is NULL.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patch.msgid.link/20251218120955.11185-1-islituo@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
+index 23462065d726b..ea975170fafff 100644
+--- a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
++++ b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
+@@ -434,8 +434,10 @@ static void jdi_panel_dsi_remove(struct mipi_dsi_device *dsi)
+ int err;
+
+ /* only detach from host for the DSI-LINK2 interface */
+- if (!jdi)
++ if (!jdi) {
+ mipi_dsi_detach(dsi);
++ return;
++ }
+
+ err = jdi_panel_disable(&jdi->base);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From cc45049654faa19b033d0c6739e54312bbfbb345 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 09:48:35 +0100
+Subject: drm/panthor: Always wait after sending a command to an AS
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+[ Upstream commit d2c6fde56d451ca48a5e03428535ce3dbc8fc910 ]
+
+There's currently no situation where we want to issue a command to an
+AS and not wait for this command to complete. The wait is either
+explicitly done (LOCK, UNLOCK) or it's missing (UPDATE). So let's
+turn write_cmd() into as_send_cmd_and_wait() that has the wait after
+a command is sent.
+
+v2:
+- New patch
+
+v3:
+- Collect R-b
+
+v4:
+- No changes
+
+Reviewed-by: Steven Price <steven.price@arm.com>
+Link: https://patch.msgid.link/20251128084841.3804658-2-boris.brezillon@collabora.com
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_mmu.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
+index 0fd8ffec92dd0..5647a24741095 100644
+--- a/drivers/gpu/drm/panthor/panthor_mmu.c
++++ b/drivers/gpu/drm/panthor/panthor_mmu.c
+@@ -523,27 +523,29 @@ static int wait_ready(struct panthor_device *ptdev, u32 as_nr)
+ return ret;
+ }
+
+-static int write_cmd(struct panthor_device *ptdev, u32 as_nr, u32 cmd)
++static int as_send_cmd_and_wait(struct panthor_device *ptdev, u32 as_nr, u32 cmd)
+ {
+ int status;
+
+ /* write AS_COMMAND when MMU is ready to accept another command */
+ status = wait_ready(ptdev, as_nr);
+- if (!status)
++ if (!status) {
+ gpu_write(ptdev, AS_COMMAND(as_nr), cmd);
++ status = wait_ready(ptdev, as_nr);
++ }
+
+ return status;
+ }
+
+-static void lock_region(struct panthor_device *ptdev, u32 as_nr,
+- u64 region_start, u64 size)
++static int lock_region(struct panthor_device *ptdev, u32 as_nr,
++ u64 region_start, u64 size)
+ {
+ u8 region_width;
+ u64 region;
+ u64 region_end = region_start + size;
+
+ if (!size)
+- return;
++ return 0;
+
+ /*
+ * The locked region is a naturally aligned power of 2 block encoded as
+@@ -566,7 +568,7 @@ static void lock_region(struct panthor_device *ptdev, u32 as_nr,
+
+ /* Lock the region that needs to be updated */
+ gpu_write64(ptdev, AS_LOCKADDR(as_nr), region);
+- write_cmd(ptdev, as_nr, AS_COMMAND_LOCK);
++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_LOCK);
+ }
+
+ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,
+@@ -599,9 +601,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,
+ * power it up
+ */
+
+- lock_region(ptdev, as_nr, iova, size);
+-
+- ret = wait_ready(ptdev, as_nr);
++ ret = lock_region(ptdev, as_nr, iova, size);
+ if (ret)
+ return ret;
+
+@@ -614,10 +614,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,
+ * at the end of the GPU_CONTROL cache flush command, unlike
+ * AS_COMMAND_FLUSH_MEM or AS_COMMAND_FLUSH_PT.
+ */
+- write_cmd(ptdev, as_nr, AS_COMMAND_UNLOCK);
+-
+- /* Wait for the unlock command to complete */
+- return wait_ready(ptdev, as_nr);
++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UNLOCK);
+ }
+
+ static int mmu_hw_do_operation(struct panthor_vm *vm,
+@@ -646,7 +643,7 @@ static int panthor_mmu_as_enable(struct panthor_device *ptdev, u32 as_nr,
+ gpu_write64(ptdev, AS_MEMATTR(as_nr), memattr);
+ gpu_write64(ptdev, AS_TRANSCFG(as_nr), transcfg);
+
+- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE);
++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE);
+ }
+
+ static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr)
+@@ -661,7 +658,7 @@ static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr)
+ gpu_write64(ptdev, AS_MEMATTR(as_nr), 0);
+ gpu_write64(ptdev, AS_TRANSCFG(as_nr), AS_TRANSCFG_ADRMODE_UNMAPPED);
+
+- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE);
++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE);
+ }
+
+ static u32 panthor_mmu_fault_mask(struct panthor_device *ptdev, u32 value)
+--
+2.51.0
+
--- /dev/null
+From e15cd347a67358bb60f7a33e82656b684f78ab10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:26:00 +0000
+Subject: drm/radeon: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for radeon.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 9deb91970d4df..f12227145ef08 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2925,6 +2925,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((rdev->pdev->device == 0x666f) &&
++ (rdev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (rdev->family == CHIP_OLAND) {
+ if ((rdev->pdev->revision == 0xC7) ||
+ (rdev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From 1c8eb40a6557880c37cafa9d6b0917ccb6efa1ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 10:43:18 -0500
+Subject: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for
+ some panels
+
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+
+[ Upstream commit 64aa8b3a60a825134f7d866adf05c024bbe0c24c ]
+
+Since commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L")
+we may get the following kernel panic, for some panels, when rebooting:
+
+ systemd-shutdown[1]: Rebooting.
+ Call trace:
+ ...
+ do_serror+0x28/0x68
+ el1h_64_error_handler+0x34/0x50
+ el1h_64_error+0x6c/0x70
+ rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)
+ mipi_dsi_device_transfer+0x44/0x58
+ mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4
+ ili9881c_unprepare+0x38/0x88
+ drm_panel_unprepare+0xbc/0x108
+
+This happens for panels that need to send MIPI-DSI commands in their
+unprepare() callback. Since the MIPI-DSI interface is stopped at that
+point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.
+
+Fix by moving rzg2l_mipi_dsi_stop() to new callback function
+rzg2l_mipi_dsi_atomic_post_disable().
+
+With this change we now have the correct power-down/stop sequence:
+
+ systemd-shutdown[1]: Rebooting.
+ rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry
+ ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry
+ rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry
+ reboot: Restarting system
+
+Suggested-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Tested-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20260112154333.655352-1-hugo@hugovil.com
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
+index 3b52dfc0ea1e0..b164e3a62cc2f 100644
+--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
+@@ -646,6 +646,13 @@ static void rzg2l_mipi_dsi_atomic_disable(struct drm_bridge *bridge,
+
+ rzg2l_mipi_dsi_stop_video(dsi);
+ rzg2l_mipi_dsi_stop_hs_clock(dsi);
++}
++
++static void rzg2l_mipi_dsi_atomic_post_disable(struct drm_bridge *bridge,
++ struct drm_atomic_state *state)
++{
++ struct rzg2l_mipi_dsi *dsi = bridge_to_rzg2l_mipi_dsi(bridge);
++
+ rzg2l_mipi_dsi_stop(dsi);
+ }
+
+@@ -681,6 +688,7 @@ static const struct drm_bridge_funcs rzg2l_mipi_dsi_bridge_ops = {
+ .atomic_pre_enable = rzg2l_mipi_dsi_atomic_pre_enable,
+ .atomic_enable = rzg2l_mipi_dsi_atomic_enable,
+ .atomic_disable = rzg2l_mipi_dsi_atomic_disable,
++ .atomic_post_disable = rzg2l_mipi_dsi_atomic_post_disable,
+ .mode_valid = rzg2l_mipi_dsi_bridge_mode_valid,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From a5ef082e9f0a036104c2c9d1bc35830ff2ea7711 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 21:03:23 +0800
+Subject: drm/v3d: Set DMA segment size to avoid debug warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ]
+
+When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
+kernel occasionally reports a segment size mismatch. This is because
+'max_seg_size' is not set. The kernel defaults to 64K. setting
+'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
+from complaining about the over-mapping of the V3D segment length.
+
+DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device
+ claims to support [len=8290304] [max=65536]
+WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388
+CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1
+Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : debug_dma_map_sg+0x330/0x388
+lr : debug_dma_map_sg+0x330/0x388
+sp : ffff8000829a3ac0
+x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000
+x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000
+x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002
+x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff
+x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573
+x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000
+x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c
+x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001
+x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280
+Call trace:
+ debug_dma_map_sg+0x330/0x388
+ __dma_map_sg_attrs+0xc0/0x278
+ dma_map_sgtable+0x30/0x58
+ drm_gem_shmem_get_pages_sgt+0xb4/0x140
+ v3d_bo_create_finish+0x28/0x130 [v3d]
+ v3d_create_bo_ioctl+0x54/0x180 [v3d]
+ drm_ioctl_kernel+0xc8/0x140
+ drm_ioctl+0x2d4/0x4d8
+
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
+index c5a3bbbc74c5c..f4da7a94e4016 100644
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -377,6 +377,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ if (ret)
+ goto clk_disable;
+
++ dma_set_max_seg_size(&pdev->dev, UINT_MAX);
++
+ v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH);
+
+ ident1 = V3D_READ(V3D_HUB_IDENT1);
+--
+2.51.0
+
--- /dev/null
+From a088685e24ef2d431b04c5deb4b0491e7414bf09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 17:25:02 -0800
+Subject: drm/xe: Covert return of -EBUSY to -ENOMEM in VM bind IOCTL
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit 6028f59620927aee2e15a424004012ae05c50684 ]
+
+xe_vma_userptr_pin_pages can return -EBUSY but -EBUSY has special
+meaning in VM bind IOCTLs that user fence is pending that is attached to
+the VMA. Convert -EBUSY to -ENOMEM in this case as -EBUSY in practice
+means we are low or out of memory.
+
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+Link: https://patch.msgid.link/20251122012502.382587-2-matthew.brost@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_vm.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
+index 145cd9ffa36b3..2444800d0fd35 100644
+--- a/drivers/gpu/drm/xe/xe_vm.c
++++ b/drivers/gpu/drm/xe/xe_vm.c
+@@ -2422,8 +2422,17 @@ static struct xe_vma *new_vma(struct xe_vm *vm, struct drm_gpuva_op_map *op,
+ if (IS_ERR(vma))
+ return vma;
+
+- if (xe_vma_is_userptr(vma))
++ if (xe_vma_is_userptr(vma)) {
+ err = xe_vma_userptr_pin_pages(to_userptr_vma(vma));
++ /*
++ * -EBUSY has dedicated meaning that a user fence
++ * attached to the VMA is busy, in practice
++ * xe_vma_userptr_pin_pages can only fail with -EBUSY if
++ * we are low on memory so convert this to -ENOMEM.
++ */
++ if (err == -EBUSY)
++ err = -ENOMEM;
++ }
+ }
+ if (err) {
+ prep_vma_destroy(vm, vma, false);
+--
+2.51.0
+
--- /dev/null
+From de91bb4c7bff70b969dd6dd27a9fcfd3e70c1ddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Nov 2025 08:44:01 -0800
+Subject: drm/xe/ggtt: Use scope-based runtime pm
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit 8a579f4b2476fd1df07e2bca9fedc82a39a56a65 ]
+
+Switch the GGTT code to scope-based runtime PM for consistency with
+other parts of the driver.
+
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://patch.msgid.link/20251118164338.3572146-51-matthew.d.roper@intel.com
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_ggtt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_ggtt.c b/drivers/gpu/drm/xe/xe_ggtt.c
+index 20d9171bd3d0a..2f96983a66b6e 100644
+--- a/drivers/gpu/drm/xe/xe_ggtt.c
++++ b/drivers/gpu/drm/xe/xe_ggtt.c
+@@ -365,9 +365,8 @@ static void ggtt_node_remove_work_func(struct work_struct *work)
+ delayed_removal_work);
+ struct xe_device *xe = tile_to_xe(node->ggtt->tile);
+
+- xe_pm_runtime_get(xe);
++ guard(xe_pm_runtime)(xe);
+ ggtt_node_remove(node);
+- xe_pm_runtime_put(xe);
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From 3926df04d7cc8a8324094ff9d0077cb87252c5b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 17:27:35 -0800
+Subject: drm/xe: Only toggle scheduling in TDR if GuC is running
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit dd1ef5e2456558876244795bb22a4d90cb24f160 ]
+
+If the firmware is not running during TDR (e.g., when the driver is
+unloading), there's no need to toggle scheduling in the GuC. In such
+cases, skip this step.
+
+v4:
+ - Bail on wait UC not running (Niranjana)
+
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
+Link: https://patch.msgid.link/20260110012739.2888434-4-matthew.brost@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_submit.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index 474789bf6506f..ecee50d827108 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1298,7 +1298,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
+ if (exec_queue_reset(q))
+ err = -EIO;
+
+- if (!exec_queue_destroyed(q)) {
++ if (!exec_queue_destroyed(q) && xe_uc_fw_is_running(&guc->fw)) {
+ /*
+ * Wait for any pending G2H to flush out before
+ * modifying state
+@@ -1330,6 +1330,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
+ */
+ smp_rmb();
+ ret = wait_event_timeout(guc->ct.wq,
++ !xe_uc_fw_is_running(&guc->fw) ||
+ !exec_queue_pending_disable(q) ||
+ xe_guc_read_stopped(guc), HZ * 5);
+ if (!ret || xe_guc_read_stopped(guc)) {
+--
+2.51.0
+
--- /dev/null
+From d909dcd2524d67af3265ace3ef560373a972af9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 13:26:28 +0530
+Subject: drm/xe/vm: Skip ufence association for CPU address mirror VMA during
+ MAP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+
+[ Upstream commit 7f08cc5b3cc3bf6416f8b55bff906f67ed75637d ]
+
+The MAP operation for a CPU address mirror VMA does not require ufence
+association because such mappings are not GPU-synchronized and do not
+participate in GPU job completion signaling.
+
+Remove the unnecessary ufence addition for this case to avoid -EBUSY
+failure in check_ufence of unbind ops.
+
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20251125075628.1182481-6-himal.prasad.ghimiray@intel.com
+Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_vm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
+index 2444800d0fd35..59ff911f8aad0 100644
+--- a/drivers/gpu/drm/xe/xe_vm.c
++++ b/drivers/gpu/drm/xe/xe_vm.c
+@@ -3179,7 +3179,8 @@ static void op_add_ufence(struct xe_vm *vm, struct xe_vma_op *op,
+ {
+ switch (op->base.op) {
+ case DRM_GPUVA_OP_MAP:
+- vma_add_ufence(op->map.vma, ufence);
++ if (!xe_vma_is_cpu_addr_mirror(op->map.vma))
++ vma_add_ufence(op->map.vma, ufence);
+ break;
+ case DRM_GPUVA_OP_REMAP:
+ if (op->remap.prev)
+--
+2.51.0
+
--- /dev/null
+From 58b77d9b991d775706ba65904e885be82d74f4e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 15:38:23 +0530
+Subject: drm/xe/xe3_lpg: Apply Wa_16028005424
+
+From: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
+
+[ Upstream commit 9d94c1cf6ef938abd4b849b66f8eab11e3c537ef ]
+
+Applied Wa_16028005424 to Graphics version from 30.00 to 30.05
+
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
+Link: https://patch.msgid.link/20251121100822.20076-2-balasubramani.vivekanandan@intel.com
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/regs/xe_guc_regs.h | 3 +++
+ drivers/gpu/drm/xe/xe_wa.c | 5 +++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/regs/xe_guc_regs.h b/drivers/gpu/drm/xe/regs/xe_guc_regs.h
+index 2118f7dec287f..87984713dd126 100644
+--- a/drivers/gpu/drm/xe/regs/xe_guc_regs.h
++++ b/drivers/gpu/drm/xe/regs/xe_guc_regs.h
+@@ -90,6 +90,9 @@
+ #define GUC_SEND_INTERRUPT XE_REG(0xc4c8)
+ #define GUC_SEND_TRIGGER REG_BIT(0)
+
++#define GUC_INTR_CHICKEN XE_REG(0xc50c)
++#define DISABLE_SIGNALING_ENGINES REG_BIT(1)
++
+ #define GUC_BCS_RCS_IER XE_REG(0xc550)
+ #define GUC_VCS2_VCS1_IER XE_REG(0xc554)
+ #define GUC_WD_VECS_IER XE_REG(0xc558)
+diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c
+index 2a2e9f2c09163..89472b7362c22 100644
+--- a/drivers/gpu/drm/xe/xe_wa.c
++++ b/drivers/gpu/drm/xe/xe_wa.c
+@@ -15,6 +15,7 @@
+
+ #include "regs/xe_engine_regs.h"
+ #include "regs/xe_gt_regs.h"
++#include "regs/xe_guc_regs.h"
+ #include "regs/xe_regs.h"
+ #include "xe_device_types.h"
+ #include "xe_force_wake.h"
+@@ -315,6 +316,10 @@ static const struct xe_rtp_entry_sr gt_was[] = {
+ XE_RTP_ACTIONS(SET(VDBOX_CGCTL3F10(0), RAMDFTUNIT_CLKGATE_DIS)),
+ XE_RTP_ENTRY_FLAG(FOREACH_ENGINE),
+ },
++ { XE_RTP_NAME("16028005424"),
++ XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3005)),
++ XE_RTP_ACTIONS(SET(GUC_INTR_CHICKEN, DISABLE_SIGNALING_ENGINES))
++ },
+ };
+
+ static const struct xe_rtp_entry_sr engine_was[] = {
+--
+2.51.0
+
--- /dev/null
+From 6c45b0becaf62960905b853dea0722e5d5c6e8df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 21:15:37 +0800
+Subject: EDAC/igen6: Add more Intel Panther Lake-H SoCs support
+
+From: Lili Li <lili.li@intel.com>
+
+[ Upstream commit 4c36e6106997b6ad8f4a279b4bdbca3ed6f53c6c ]
+
+Add more Intel Panther Lake-H SoC compute die IDs for EDAC support.
+
+Signed-off-by: Lili Li <lili.li@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Reviewed-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Link: https://patch.msgid.link/20251124131537.3633983-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/igen6_edac.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c
+index 2fc59f9eed691..9202e6e2daf4e 100644
+--- a/drivers/edac/igen6_edac.c
++++ b/drivers/edac/igen6_edac.c
+@@ -274,6 +274,16 @@ static struct work_struct ecclog_work;
+ #define DID_PTL_H_SKU1 0xb000
+ #define DID_PTL_H_SKU2 0xb001
+ #define DID_PTL_H_SKU3 0xb002
++#define DID_PTL_H_SKU4 0xb003
++#define DID_PTL_H_SKU5 0xb004
++#define DID_PTL_H_SKU6 0xb005
++#define DID_PTL_H_SKU7 0xb008
++#define DID_PTL_H_SKU8 0xb011
++#define DID_PTL_H_SKU9 0xb014
++#define DID_PTL_H_SKU10 0xb015
++#define DID_PTL_H_SKU11 0xb028
++#define DID_PTL_H_SKU12 0xb029
++#define DID_PTL_H_SKU13 0xb02a
+
+ /* Compute die IDs for Wildcat Lake with IBECC */
+ #define DID_WCL_SKU1 0xfd00
+@@ -636,6 +646,16 @@ static struct pci_device_id igen6_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU1), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU2), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU3), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU4), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU5), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU6), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU7), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU8), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU9), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU10), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU11), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU12), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU13), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_WCL_SKU1), (kernel_ulong_t)&wcl_cfg },
+ { },
+ };
+--
+2.51.0
+
--- /dev/null
+From d4f0164115efdcae0d06fd979cbdebff3ea300c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 14:54:56 +0800
+Subject: EDAC/igen6: Add two Intel Amston Lake SoCs support
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 41ca2155d62b0b0d217f59e1bce18362d0c2446f ]
+
+Intel Amston Lake SoCs with IBECC (In-Band ECC) capability share the same
+IBECC registers as Alder Lake-N SoCs. Add two new compute die IDs for
+Amston Lake SoC products to enable EDAC support.
+
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Jianfeng Gao <jianfeng.gao@intel.com>
+Link: https://patch.msgid.link/20251124065457.3630949-2-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/igen6_edac.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c
+index 9202e6e2daf4e..463bbcd484c3c 100644
+--- a/drivers/edac/igen6_edac.c
++++ b/drivers/edac/igen6_edac.c
+@@ -246,6 +246,8 @@ static struct work_struct ecclog_work;
+
+ /* Compute did IDs for Amston Lake with IBECC */
+ #define DID_ASL_SKU1 0x464a
++#define DID_ASL_SKU2 0x4646
++#define DID_ASL_SKU3 0x4652
+
+ /* Compute die IDs for Raptor Lake-P with IBECC */
+ #define DID_RPL_P_SKU1 0xa706
+@@ -628,6 +630,8 @@ static struct pci_device_id igen6_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, DID_ADL_N_SKU12), (kernel_ulong_t)&adl_n_cfg },
+ { PCI_VDEVICE(INTEL, DID_AZB_SKU1), (kernel_ulong_t)&adl_n_cfg },
+ { PCI_VDEVICE(INTEL, DID_ASL_SKU1), (kernel_ulong_t)&adl_n_cfg },
++ { PCI_VDEVICE(INTEL, DID_ASL_SKU2), (kernel_ulong_t)&adl_n_cfg },
++ { PCI_VDEVICE(INTEL, DID_ASL_SKU3), (kernel_ulong_t)&adl_n_cfg },
+ { PCI_VDEVICE(INTEL, DID_RPL_P_SKU1), (kernel_ulong_t)&rpl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_RPL_P_SKU2), (kernel_ulong_t)&rpl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_RPL_P_SKU3), (kernel_ulong_t)&rpl_p_cfg },
+--
+2.51.0
+
--- /dev/null
+From af117a617d63cbcb12d09966bfece4ef0dd82307 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:06 +0100
+Subject: EFI/CPER: don't dump the entire memory region
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ]
+
+The current logic at cper_print_fw_err() doesn't check if the
+error record length is big enough to handle offset. On a bad firmware,
+if the ofset is above the actual record, length -= offset will
+underflow, making it dump the entire memory.
+
+The end result can be:
+
+ - the logic taking a lot of time dumping large regions of memory;
+ - data disclosure due to the memory dumps;
+ - an OOPS, if it tries to dump an unmapped memory region.
+
+Fix it by checking if the section length is too small before doing
+a hex dump.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 322c6bdefb611..d58ff956a699c 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -560,6 +560,11 @@ static void cper_print_fw_err(const char *pfx,
+ } else {
+ offset = sizeof(*fw_err);
+ }
++ if (offset > length) {
++ printk("%s""error section length is too small: offset=%d, length=%d\n",
++ pfx, offset, length);
++ return;
++ }
+
+ buf += offset;
+ length -= offset;
+--
+2.51.0
+
--- /dev/null
+From 6309d5edb98a9c213d1e0c076757c3a92ad3eca9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:04 +0100
+Subject: EFI/CPER: don't go past the ARM processor CPER record buffer
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ]
+
+There's a logic inside GHES/CPER to detect if the section_length
+is too small, but it doesn't detect if it is too big.
+
+Currently, if the firmware receives an ARM processor CPER record
+stating that a section length is big, kernel will blindly trust
+section_length, producing a very long dump. For instance, a 67
+bytes record with ERR_INFO_NUM set 46198 and section length
+set to 854918320 would dump a lot of data going a way past the
+firmware memory-mapped area.
+
+Fix it by adding a logic to prevent it to go past the buffer
+if ERR_INFO_NUM is too big, making it report instead:
+
+ [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+ [Hardware Error]: event severity: recoverable
+ [Hardware Error]: Error 0, type: recoverable
+ [Hardware Error]: section_type: ARM processor error
+ [Hardware Error]: MIDR: 0xff304b2f8476870a
+ [Hardware Error]: section length: 854918320, CPER size: 67
+ [Hardware Error]: section length is too big
+ [Hardware Error]: firmware-generated error record is incorrect
+ [Hardware Error]: ERR_INFO_NUM is 46198
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject and changelog tweaks ]
+Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper-arm.c | 12 ++++++++----
+ drivers/firmware/efi/cper.c | 3 ++-
+ include/linux/cper.h | 3 ++-
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
+index 76542a53e2027..b21cb1232d820 100644
+--- a/drivers/firmware/efi/cper-arm.c
++++ b/drivers/firmware/efi/cper-arm.c
+@@ -226,7 +226,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
+ }
+
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc)
++ const struct cper_sec_proc_arm *proc,
++ u32 length)
+ {
+ int i, len, max_ctx_type;
+ struct cper_arm_err_info *err_info;
+@@ -238,9 +239,12 @@ void cper_print_proc_arm(const char *pfx,
+
+ len = proc->section_length - (sizeof(*proc) +
+ proc->err_info_num * (sizeof(*err_info)));
+- if (len < 0) {
+- printk("%ssection length: %d\n", pfx, proc->section_length);
+- printk("%ssection length is too small\n", pfx);
++
++ if (len < 0 || proc->section_length > length) {
++ printk("%ssection length: %d, CPER size: %d\n",
++ pfx, proc->section_length, length);
++ printk("%ssection length is too %s\n", pfx,
++ (len < 0) ? "small" : "big");
+ printk("%sfirmware-generated error record is incorrect\n", pfx);
+ printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num);
+ return;
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index d58ff956a699c..d4dc69693ece4 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -664,7 +664,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata
+
+ printk("%ssection_type: ARM processor error\n", newpfx);
+ if (gdata->error_data_length >= sizeof(*arm_err))
+- cper_print_proc_arm(newpfx, arm_err);
++ cper_print_proc_arm(newpfx, arm_err,
++ gdata->error_data_length);
+ else
+ goto err_section_too_small;
+ #endif
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index 5b1236d8c65bb..440b35e459e53 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -595,7 +595,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *,
+ const char *cper_mem_err_unpack(struct trace_seq *,
+ struct cper_mem_err_compact *);
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc);
++ const struct cper_sec_proc_arm *proc,
++ u32 length);
+ void cper_print_proc_ia(const char *pfx,
+ const struct cper_sec_proc_ia *proc);
+ int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg);
+--
+2.51.0
+
--- /dev/null
+From a3b657cc006e5874eb1a68b51815db573081dfc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:41 +0800
+Subject: ext4: mark group add fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ]
+
+Fast commits only log operations that have dedicated replay support.
+Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group
+descriptor metadata without going through the fast commit tracking
+paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+ext4_ioctl_group_add() adds new block groups.
+This forces those transactions to fall back to a full commit,
+ensuring that the filesystem geometry updates are captured by the
+normal journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_ADD safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted
+ filesystem and checked the resize ineligible reason:
+ ./group_add_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows "Resize": > 0.
+3. Fsynced a file on the resized filesystem and verified that the fast
+ commit stats report at least one ineligible commit:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+ shows fc stats ineligible > 0.
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 3dec26c939fde..d26914fa0cb46 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -966,6 +966,7 @@ static long ext4_ioctl_group_add(struct file *file,
+
+ err = ext4_group_add(sb, input);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From 17a4445bd475ea3d6ed49e18b4ab06fdbede6478 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:42 +0800
+Subject: ext4: mark group extend fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ]
+
+Fast commits only log operations that have dedicated replay support.
+EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last
+block group and updates the same on-disk metadata without going
+through the fast commit tracking paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+EXT4_IOC_GROUP_EXTEND grows the filesystem.
+This forces those transactions to fall back to a full commit,
+ensuring that the group extension changes are captured by the normal
+journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_EXTEND safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Extended the filesystem to the end of the last block group using a
+ helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem
+ and checked fc_info:
+ ./group_extend_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows the "Resize" ineligible reason increased.
+3. Fsynced a file on the resized filesystem and confirmed that the fast
+ commit ineligible counter incremented for the resize transaction:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index d26914fa0cb46..acc28aa5744b1 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1612,6 +1612,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+
+ err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE,
++ NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From 736e8445dd3523e5a232ed6b2b3be32412d66ab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 21:31:16 +0800
+Subject: ext4: move ext4_percpu_param_init() before ext4_mb_init()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 270564513489d98b721a1e4a10017978d5213bff ]
+
+When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the
+`DOUBLE_CHECK` macro defined, the following panic is triggered:
+
+==================================================================
+EXT4-fs error (device vdc): ext4_validate_block_bitmap:423:
+ comm mount: bg 0: bad block bitmap checksum
+BUG: unable to handle page fault for address: ff110000fa2cc000
+PGD 3e01067 P4D 3e02067 PUD 0
+Oops: Oops: 0000 [#1] SMP NOPTI
+CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W
+ 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none)
+RIP: 0010:percpu_counter_add_batch+0x13/0xa0
+Call Trace:
+ <TASK>
+ ext4_mark_group_bitmap_corrupted+0xcb/0xe0
+ ext4_validate_block_bitmap+0x2a1/0x2f0
+ ext4_read_block_bitmap+0x33/0x50
+ mb_group_bb_bitmap_alloc+0x33/0x80
+ ext4_mb_add_groupinfo+0x190/0x250
+ ext4_mb_init_backend+0x87/0x290
+ ext4_mb_init+0x456/0x640
+ __ext4_fill_super+0x1072/0x1680
+ ext4_fill_super+0xd3/0x280
+ get_tree_bdev_flags+0x132/0x1d0
+ vfs_get_tree+0x29/0xd0
+ vfs_cmd_create+0x59/0xe0
+ __do_sys_fsconfig+0x4f6/0x6b0
+ do_syscall_64+0x50/0x1f0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+==================================================================
+
+This issue can be reproduced using the following commands:
+ mkfs.ext4 -F -q -b 1024 /dev/sda 5G
+ tune2fs -O quota,project /dev/sda
+ mount /dev/sda /tmp/test
+
+With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads
+and validates the block bitmap. When the validation fails,
+ext4_mark_group_bitmap_corrupted() attempts to update
+sbi->s_freeclusters_counter. However, this percpu_counter has not been
+initialized yet at this point, which leads to the panic described above.
+
+Fix this by moving the execution of ext4_percpu_param_init() to occur
+before ext4_mb_init(), ensuring the per-CPU counters are initialized
+before they are used.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 4ef5590c73fda..b5774f4101045 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5565,6 +5565,10 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ clear_opt2(sb, MB_OPTIMIZE_SCAN);
+ }
+
++ err = ext4_percpu_param_init(sbi);
++ if (err)
++ goto failed_mount5;
++
+ err = ext4_mb_init(sb);
+ if (err) {
+ ext4_msg(sb, KERN_ERR, "failed to initialize mballoc (%d)",
+@@ -5580,10 +5584,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ sbi->s_journal->j_commit_callback =
+ ext4_journal_commit_callback;
+
+- err = ext4_percpu_param_init(sbi);
+- if (err)
+- goto failed_mount6;
+-
+ if (ext4_has_feature_flex_bg(sb))
+ if (!ext4_fill_flex_info(sb)) {
+ ext4_msg(sb, KERN_ERR,
+@@ -5665,8 +5665,8 @@ failed_mount8: __maybe_unused
+ failed_mount6:
+ ext4_mb_release(sb);
+ ext4_flex_groups_free(sbi);
+- ext4_percpu_param_destroy(sbi);
+ failed_mount5:
++ ext4_percpu_param_destroy(sbi);
+ ext4_ext_release(sb);
+ ext4_release_system_zone(sb);
+ failed_mount4a:
+--
+2.51.0
+
--- /dev/null
+From 25767a59309cf1548efa5412067b67cd7d62b5c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 11:55:35 +0530
+Subject: ext4: propagate flags to convert_initialized_extent()
+
+From: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+
+[ Upstream commit 3fffa44b6ebf65be92a562a5063303979385a1c9 ]
+
+Currently, ext4_zero_range passes EXT4_EX_NOCACHE flag to avoid caching
+extents however this is not respected by convert_initialized_extent().
+Hence, modify it to accept flags from the caller and to pass the flags
+on to other extent manipulation functions it calls. This makes
+sure the NOCACHE flag is respected throughout the code path.
+
+Also, we no longer explicitly pass CONVERT_UNWRITTEN as the caller takes
+care of this.
+
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Link: https://patch.msgid.link/07008fbb14db727fddcaf4c30e2346c49f6c8fe0.1769149131.git.ojaswin@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 7338f93313b61..88187fddc6424 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3853,6 +3853,7 @@ static struct ext4_ext_path *
+ convert_initialized_extent(handle_t *handle, struct inode *inode,
+ struct ext4_map_blocks *map,
+ struct ext4_ext_path *path,
++ int flags,
+ unsigned int *allocated)
+ {
+ struct ext4_extent *ex;
+@@ -3878,11 +3879,11 @@ convert_initialized_extent(handle_t *handle, struct inode *inode,
+
+ if (ee_block != map->m_lblk || ee_len > map->m_len) {
+ path = ext4_split_convert_extents(handle, inode, map, path,
+- EXT4_GET_BLOCKS_CONVERT_UNWRITTEN, NULL);
++ flags, NULL);
+ if (IS_ERR(path))
+ return path;
+
+- path = ext4_find_extent(inode, map->m_lblk, path, 0);
++ path = ext4_find_extent(inode, map->m_lblk, path, flags);
+ if (IS_ERR(path))
+ return path;
+ depth = ext_depth(inode);
+@@ -4294,7 +4295,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
+ if ((!ext4_ext_is_unwritten(ex)) &&
+ (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN)) {
+ path = convert_initialized_extent(handle,
+- inode, map, path, &allocated);
++ inode, map, path, flags, &allocated);
+ if (IS_ERR(path))
+ err = PTR_ERR(path);
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From 89616dc39d731697db210f88e8273ca6b1b2acae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 09:45:16 +0800
+Subject: ext4: use reserved metadata blocks when splitting extent on endio
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit 01942af95ab6c9d98e64ae01fdc243a03e4b973f ]
+
+When performing buffered writes, we may need to split and convert an
+unwritten extent into a written one during the end I/O process. However,
+we do not reserve space specifically for these metadata changes, we only
+reserve 2% of space or 4096 blocks. To address this, we use
+EXT4_GET_BLOCKS_PRE_IO to potentially split extents in advance and
+EXT4_GET_BLOCKS_METADATA_NOFAIL to utilize reserved space if necessary.
+
+These two approaches can reduce the likelihood of running out of space
+and losing data. However, these methods are merely best efforts, we
+could still run out of space, and there is not much difference between
+converting an extent during the writeback process and the end I/O
+process, it won't increase the risk of losing data if we postpone the
+conversion.
+
+Therefore, also use EXT4_GET_BLOCKS_METADATA_NOFAIL in
+ext4_convert_unwritten_extents_endio() to prepare for the buffered I/O
+iomap conversion, which may perform extent conversion during the end I/O
+process.
+
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Link: https://patch.msgid.link/20260105014522.1937690-2-yi.zhang@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index ae7f2d6b32e32..7338f93313b61 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3805,6 +3805,8 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode,
+ * illegal.
+ */
+ if (ee_block != map->m_lblk || ee_len > map->m_len) {
++ int flags = EXT4_GET_BLOCKS_CONVERT |
++ EXT4_GET_BLOCKS_METADATA_NOFAIL;
+ #ifdef CONFIG_EXT4_DEBUG
+ ext4_warning(inode->i_sb, "Inode (%ld) finished: extent logical block %llu,"
+ " len %u; IO logical block %llu, len %u",
+@@ -3812,7 +3814,7 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode,
+ (unsigned long long)map->m_lblk, map->m_len);
+ #endif
+ path = ext4_split_convert_extents(handle, inode, map, path,
+- EXT4_GET_BLOCKS_CONVERT, NULL);
++ flags, NULL);
+ if (IS_ERR(path))
+ return path;
+
+--
+2.51.0
+
--- /dev/null
+From a6da2bdfb5b3130e074031be33c2a5d83c63996f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 11:16:56 +0800
+Subject: firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 9fda364cb78c8b9e1abe4029f877300c94655742 ]
+
+ffa_init() maps the Rx/Tx buffers via ffa_rxtx_map() but on the
+partition setup failure path it never unmaps them.
+
+Add the missing ffa_rxtx_unmap() call in the error path so that
+the Rx/Tx buffers are properly released before freeing the backing
+pages.
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Message-Id: <20251210031656.56194-1-lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
+index c501c3104b3a4..11a702e7f641c 100644
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -2093,6 +2093,7 @@ static int __init ffa_init(void)
+
+ pr_err("failed to setup partitions\n");
+ ffa_notifications_cleanup();
++ ffa_rxtx_unmap(drv_info->vm_id);
+ free_pages:
+ if (drv_info->tx_buffer)
+ free_pages_exact(drv_info->tx_buffer, rxtx_bufsz);
+--
+2.51.0
+
--- /dev/null
+From f4fe45158e3136487a99db6772430c66260d9435 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 13:11:24 +0100
+Subject: fix it87_wdt early reboot by reporting running timer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ]
+
+Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87
+wdt enabled by the firmware and a broken BIOS option that does not
+allow to change the time or turn it off. As this makes installing
+Linux rather difficult, change the it87_wdt to report it running to
+the watchdog core.
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/it87_wdt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
+index 3b8488c86a2f3..1d9f8591f38d8 100644
+--- a/drivers/watchdog/it87_wdt.c
++++ b/drivers/watchdog/it87_wdt.c
+@@ -188,6 +188,12 @@ static void _wdt_update_timeout(unsigned int t)
+ superio_outb(t >> 8, WDTVALMSB);
+ }
+
++/* Internal function, should be called after superio_select(GPIO) */
++static bool _wdt_running(void)
++{
++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB));
++}
++
+ static int wdt_update_timeout(unsigned int t)
+ {
+ int ret;
+@@ -374,6 +380,12 @@ static int __init it87_wdt_init(void)
+ }
+ }
+
++ /* wdt already left running by firmware? */
++ if (_wdt_running()) {
++ pr_info("Left running by firmware.\n");
++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status);
++ }
++
+ superio_exit();
+
+ if (timeout < 1 || timeout > max_units * 60) {
+--
+2.51.0
+
--- /dev/null
+From f8d0c4b07d9471e79681210c6ee013aa6c6ae89e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 16:58:48 +0100
+Subject: fpga: of-fpga-region: Fail if any bridge is missing
+
+From: Romain Gantois <romain.gantois@bootlin.com>
+
+[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ]
+
+When parsing the region bridge list from the "fpga-bridges" device tree
+property, the of-fpga-region driver will silently ignore bridges which fail
+to be obtained, for example due to a missing bridge driver or invalid
+phandle.
+
+This can lead to hardware issues if a region bridge stays coupled when
+partial programming is performed.
+
+Fail if any of the bridges specified in "fpga-bridges" cannot be obtained.
+
+Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
+Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com
+Reviewed-by: Xu Yilun <yilun.xu@intel.com>
+Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/of-fpga-region.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
+index 43db4bb77138a..caa091224dc54 100644
+--- a/drivers/fpga/of-fpga-region.c
++++ b/drivers/fpga/of-fpga-region.c
+@@ -83,7 +83,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np)
+ * done with the bridges.
+ *
+ * Return: 0 for success (even if there are no bridges specified)
+- * or -EBUSY if any of the bridges are in use.
++ * or an error code if any of the bridges are not available.
+ */
+ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ {
+@@ -130,10 +130,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ ®ion->bridge_list);
+ of_node_put(br);
+
+- /* If any of the bridges are in use, give up */
+- if (ret == -EBUSY) {
++ /* If any of the bridges are not available, give up */
++ if (ret) {
+ fpga_bridges_put(®ion->bridge_list);
+- return -EBUSY;
++ return ret;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 711716d16f2bbd13e51940424d39966b9e64bb96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 18:42:11 +0530
+Subject: fs/buffer: add alert in try_to_free_buffers() for folios without
+ buffers
+
+From: Deepakkumar Karn <dkarn@redhat.com>
+
+[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ]
+
+try_to_free_buffers() can be called on folios with no buffers attached
+when filemap_release_folio() is invoked on a folio belonging to a mapping
+with AS_RELEASE_ALWAYS set but no release_folio operation defined.
+
+In such cases, folio_needs_release() returns true because of the
+AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This
+causes try_to_free_buffers() to call drop_buffers() on a folio with no
+buffers, leading to a null pointer dereference.
+
+Adding a check in try_to_free_buffers() to return early if the folio has no
+buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.
+This provides defensive hardening.
+
+Signed-off-by: Deepakkumar Karn <dkarn@redhat.com>
+Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/buffer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 6a8752f7bbedb..b6b477ff7b75d 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2948,6 +2948,10 @@ bool try_to_free_buffers(struct folio *folio)
+ if (folio_test_writeback(folio))
+ return false;
+
++ /* Misconfigured folio check */
++ if (WARN_ON_ONCE(!folio_buffers(folio)))
++ return true;
++
+ if (mapping == NULL) { /* can this still happen? */
+ ret = drop_buffers(folio, &buffers_to_free);
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From d0e5b7def9a78cab508de704b2e43266fab97820 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 16:07:32 +0100
+Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in
+ ntfs_read_run_nb_ra()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ]
+
+When ntfs_read_run_nb_ra() is invoked with run == NULL the code later
+assumes run is valid and may call run_get_entry(NULL, ...), and also
+uses clen/idx without initializing them. Smatch reported uninitialized
+variable warnings and this can lead to undefined behaviour. This patch
+fixes it.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fsntfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index ef0177b5c6cb0..83df92df1ee0c 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -1252,6 +1252,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run,
+
+ } while (len32);
+
++ if (!run) {
++ err = -EINVAL;
++ goto out;
++ }
++
++ /* Get next fragment to read. */
+ vcn_next = vcn + clen;
+ if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) ||
+ vcn != vcn_next) {
+--
+2.51.0
+
--- /dev/null
+From 293bc2f0bcef9807d6027a709be25f2df2c4906a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 19:59:59 +0900
+Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed dentry in the ntfs3 filesystem can cause the kernel to hang
+during the lookup operations. By setting the HAS_SUB_NODE flag in an
+INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the
+VCN pointer, an attacker can cause the indx_find() function to repeatedly
+read the same block, allocating 4 KB of memory each time. The kernel lacks
+VCN loop detection and depth limits, causing memory exhaustion and an OOM
+crash.
+
+This patch adds a return value check for fnd_push() to prevent a memory
+exhaustion vulnerability caused by infinite loops. When the index exceeds the
+size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()
+function checks this return value and stops processing, preventing further
+memory allocation.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 6d1bf890929d9..050b3709e0204 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1190,7 +1190,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni,
+ return -EINVAL;
+ }
+
+- fnd_push(fnd, node, e);
++ err = fnd_push(fnd, node, e);
++
++ if (err) {
++ put_indx_node(node);
++ return err;
++ }
+ }
+
+ *entry = e;
+--
+2.51.0
+
--- /dev/null
+From c55dac9624cffe791ba89c5b8107bb040088a6ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 14:27:48 +0300
+Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ]
+
+Do not keep preallocated clusters for sparsed and compressed files.
+Preserving preallocation in these cases causes fsx failures when running
+with sparse files and preallocation enabled.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index f0ff85b7d76dc..5a7675112e7b8 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -448,8 +448,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type,
+
+ is_ext = is_attr_ext(attr_b);
+ align = sbi->cluster_size;
+- if (is_ext)
++ if (is_ext) {
+ align <<= attr_b->nres.c_unit;
++ keep_prealloc = false;
++ }
+
+ old_valid = le64_to_cpu(attr_b->nres.valid_size);
+ old_size = le64_to_cpu(attr_b->nres.data_size);
+--
+2.51.0
+
--- /dev/null
+From 271d9d90ae64143f19d4a44d035a039a6c96a873 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:09 +0900
+Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
+ metadata
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an attribute header
+indicates an empty run list, while directory entries reference it as
+containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way
+to represent an empty run list, and run_unpack() correctly handles this by
+checking if evcn + 1 equals svcn and returning early without parsing any run
+data. However, this creates a problem when there is metadata inconsistency,
+where the attribute header claims to be empty (evcn=-1) but the caller
+expects to read actual data. When run_unpack() immediately returns success
+upon seeing this condition, it leaves the runs_tree uninitialized with
+run->runs as a NULL. The calling function attr_load_runs_range() assumes
+that a successful return means that the runs were loaded and sets clen to 0,
+expecting the next run_lookup_entry() call to succeed. Because runs_tree
+remains uninitialized, run_lookup_entry() continues to fail, and the loop
+increments vcn by zero (vcn += 0), leading to an infinite loop.
+
+This patch adds a retry counter to detect when run_lookup_entry() fails
+consecutively after attr_load_runs_vcn(). If the run is still not found on
+the second attempt, it indicates corrupted metadata and returns -EINVAL,
+preventing the Denial-of-Service (DoS) vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index eced9013a8818..f0ff85b7d76dc 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -1354,19 +1354,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type,
+ CLST vcn;
+ CLST vcn_last = (to - 1) >> cluster_bits;
+ CLST lcn, clen;
+- int err;
++ int err = 0;
++ int retry = 0;
+
+ for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) {
+ if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) {
++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */
++ err = -EINVAL;
++ break;
++ }
+ err = attr_load_runs_vcn(ni, type, name, name_len, run,
+ vcn);
+ if (err)
+- return err;
++ break;
++
+ clen = 0; /* Next run_lookup_entry(vcn) must be success. */
++ retry++;
+ }
++ else
++ retry = 0;
+ }
+
+- return 0;
++ return err;
+ }
+
+ #ifdef CONFIG_NTFS3_LZX_XPRESS
+--
+2.51.0
+
--- /dev/null
+From 3b12d716b43f16bcc279502db47f3c7537489bd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:46 +0900
+Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
+indicates a zero data size while the driver allocates memory for it.
+
+When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
+to zero, it still allocates memory because of al_aligned(0). This creates an
+inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
+non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
+list exists and enumerates only the primary MFT record. When it finds
+ATTR_LIST, the code reloads it and restarts the enumeration, repeating
+indefinitely. The mount operation never completes, hanging the kernel thread.
+
+This patch adds validation to ensure that data_size is non-zero before memory
+allocation. When a zero-sized ATTR_LIST is detected, the function returns
+-EINVAL, preventing a DoS vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrlist.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
+index a4d74bed74fab..098bd7e8c3d64 100644
+--- a/fs/ntfs3/attrlist.c
++++ b/fs/ntfs3/attrlist.c
+@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+
+ if (!attr->non_res) {
+ lsize = le32_to_cpu(attr->res.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ /* attr is resident: lsize < record_size (1K or 4K) */
+ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+ u16 run_off = le16_to_cpu(attr->nres.run_off);
+
+ lsize = le64_to_cpu(attr->nres.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
+
+ run_init(&ni->attr_list.run);
+
+--
+2.51.0
+
--- /dev/null
+From 41507582feda27059805e6f26d511bc5f68b9e84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 20:38:07 +0000
+Subject: gendwarfksyms: Fix build on 32-bit hosts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit ddc54f912a551f6eb0bbcfc3880f45fe27a252cb ]
+
+We have interchangeably used unsigned long for some of the types
+defined in elfutils, assuming they're always 64-bit. This obviously
+fails when building gendwarfksyms on 32-bit hosts. Fix the types.
+
+Reported-by: Michal Suchánek <msuchanek@suse.de>
+Closes: https://lore.kernel.org/linux-modules/aRcxzPxtJblVSh1y@kitsune.suse.cz/
+Tested-by: Michal Suchánek <msuchanek@suse.de>
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gendwarfksyms/dwarf.c | 4 +++-
+ scripts/gendwarfksyms/symbols.c | 5 +++--
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/scripts/gendwarfksyms/dwarf.c b/scripts/gendwarfksyms/dwarf.c
+index 3538a7d9cb070..e76d732f5f602 100644
+--- a/scripts/gendwarfksyms/dwarf.c
++++ b/scripts/gendwarfksyms/dwarf.c
+@@ -750,6 +750,7 @@ static void process_enumerator_type(struct state *state, struct die *cache,
+ Dwarf_Die *die)
+ {
+ bool overridden = false;
++ unsigned long override;
+ Dwarf_Word value;
+
+ if (stable) {
+@@ -761,7 +762,8 @@ static void process_enumerator_type(struct state *state, struct die *cache,
+ return;
+
+ overridden = kabi_get_enumerator_value(
+- state->expand.current_fqn, cache->fqn, &value);
++ state->expand.current_fqn, cache->fqn, &override);
++ value = override;
+ }
+
+ process_list_comma(state, cache);
+diff --git a/scripts/gendwarfksyms/symbols.c b/scripts/gendwarfksyms/symbols.c
+index ecddcb5ffcdfb..42cd27c9cec4f 100644
+--- a/scripts/gendwarfksyms/symbols.c
++++ b/scripts/gendwarfksyms/symbols.c
+@@ -3,6 +3,7 @@
+ * Copyright (C) 2024 Google LLC
+ */
+
++#include <inttypes.h>
+ #include "gendwarfksyms.h"
+
+ #define SYMBOL_HASH_BITS 12
+@@ -242,7 +243,7 @@ static void elf_for_each_global(int fd, elf_symbol_callback_t func, void *arg)
+ error("elf_getdata failed: %s", elf_errmsg(-1));
+
+ if (shdr->sh_entsize != sym_size)
+- error("expected sh_entsize (%lu) to be %zu",
++ error("expected sh_entsize (%" PRIu64 ") to be %zu",
+ shdr->sh_entsize, sym_size);
+
+ nsyms = shdr->sh_size / shdr->sh_entsize;
+@@ -292,7 +293,7 @@ static void set_symbol_addr(struct symbol *sym, void *arg)
+ hash_add(symbol_addrs, &sym->addr_hash,
+ symbol_addr_hash(&sym->addr));
+
+- debug("%s -> { %u, %lx }", sym->name, sym->addr.section,
++ debug("%s -> { %u, %" PRIx64 " }", sym->name, sym->addr.section,
+ sym->addr.address);
+ } else if (sym->addr.section != addr->section ||
+ sym->addr.address != addr->address) {
+--
+2.51.0
+
--- /dev/null
+From de366e3e6ba69a82358ac971dc00e9b6082747f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 22:37:27 +0800
+Subject: genirq/cpuhotplug: Notify about affinity changes breaking the
+ affinity mask
+
+From: Imran Khan <imran.f.khan@oracle.com>
+
+[ Upstream commit dd9f6d30c64001ca4dde973ac04d8d155e856743 ]
+
+During CPU offlining the interrupts affined to that CPU are moved to other
+online CPUs, which might break the original affinity mask if the outgoing
+CPU was the last online CPU in that mask. This change is not propagated to
+irq_desc::affinity_notify(), which leaves users of the affinity notifier
+mechanism with stale information.
+
+Avoid this by scheduling affinity change notification work for interrupts
+that were affined to the CPU being offlined, if the new target CPU is not
+part of the original affinity mask.
+
+Since irq_set_affinity_locked() uses the same logic to schedule affinity
+change notification work, split out this logic into a dedicated function
+and use that at both places.
+
+[ tglx: Removed the EXPORT(), removed the !SMP stub, moved the prototype,
+ added a lockdep assert instead of a comment, fixed up coding style
+ and name space. Polished and clarified the change log ]
+
+Signed-off-by: Imran Khan <imran.f.khan@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260113143727.1041265-1-imran.f.khan@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/cpuhotplug.c | 6 ++++--
+ kernel/irq/internals.h | 2 +-
+ kernel/irq/manage.c | 26 ++++++++++++++++++--------
+ 3 files changed, 23 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c
+index 755346ea98196..cd5689e383b00 100644
+--- a/kernel/irq/cpuhotplug.c
++++ b/kernel/irq/cpuhotplug.c
+@@ -177,9 +177,11 @@ void irq_migrate_all_off_this_cpu(void)
+ bool affinity_broken;
+
+ desc = irq_to_desc(irq);
+- scoped_guard(raw_spinlock, &desc->lock)
++ scoped_guard(raw_spinlock, &desc->lock) {
+ affinity_broken = migrate_one_irq(desc);
+-
++ if (affinity_broken && desc->affinity_notify)
++ irq_affinity_schedule_notify_work(desc);
++ }
+ if (affinity_broken) {
+ pr_debug_ratelimited("IRQ %u: no longer affine to CPU%u\n",
+ irq, smp_processor_id());
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index 0164ca48da59e..5568ed3a8b852 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -135,6 +135,7 @@ extern bool irq_can_set_affinity_usr(unsigned int irq);
+
+ extern int irq_do_set_affinity(struct irq_data *data,
+ const struct cpumask *dest, bool force);
++extern void irq_affinity_schedule_notify_work(struct irq_desc *desc);
+
+ #ifdef CONFIG_SMP
+ extern int irq_setup_affinity(struct irq_desc *desc);
+@@ -142,7 +143,6 @@ extern int irq_setup_affinity(struct irq_desc *desc);
+ static inline int irq_setup_affinity(struct irq_desc *desc) { return 0; }
+ #endif
+
+-
+ #define for_each_action_of_desc(desc, act) \
+ for (act = desc->action; act; act = act->next)
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 400856abf6721..c09751b7a0c49 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -347,6 +347,21 @@ static bool irq_set_affinity_deactivated(struct irq_data *data,
+ return true;
+ }
+
++/**
++ * irq_affinity_schedule_notify_work - Schedule work to notify about affinity change
++ * @desc: Interrupt descriptor whose affinity changed
++ */
++void irq_affinity_schedule_notify_work(struct irq_desc *desc)
++{
++ lockdep_assert_held(&desc->lock);
++
++ kref_get(&desc->affinity_notify->kref);
++ if (!schedule_work(&desc->affinity_notify->work)) {
++ /* Work was already scheduled, drop our extra ref */
++ kref_put(&desc->affinity_notify->kref, desc->affinity_notify->release);
++ }
++}
++
+ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
+ bool force)
+ {
+@@ -367,14 +382,9 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
+ irq_copy_pending(desc, mask);
+ }
+
+- if (desc->affinity_notify) {
+- kref_get(&desc->affinity_notify->kref);
+- if (!schedule_work(&desc->affinity_notify->work)) {
+- /* Work was already scheduled, drop our extra ref */
+- kref_put(&desc->affinity_notify->kref,
+- desc->affinity_notify->release);
+- }
+- }
++ if (desc->affinity_notify)
++ irq_affinity_schedule_notify_work(desc);
++
+ irqd_set(data, IRQD_AFFINITY_SET);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From e2b0d0ed0cd526caf69d2f8748922c5179d6d242 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 15:52:57 +0100
+Subject: gfs2: fiemap page fault fix
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ]
+
+In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode
+glock. This can lead to recursive glock taking if the fiemap buffer is
+memory mapped to the same inode and accessing it triggers a page fault.
+
+Fix by disabling page faults for iomap_fiemap() and faulting in the
+buffer by hand if necessary.
+
+Fixes xfstest generic/742.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/inode.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index 63d9fe7464344..03dd54fb7e8c8 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -2192,6 +2192,14 @@ static int gfs2_getattr(struct mnt_idmap *idmap,
+ return 0;
+ }
+
++static bool fault_in_fiemap(struct fiemap_extent_info *fi)
++{
++ struct fiemap_extent __user *dest = fi->fi_extents_start;
++ size_t size = sizeof(*dest) * fi->fi_extents_max;
++
++ return fault_in_safe_writeable((char __user *)dest, size) == 0;
++}
++
+ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ u64 start, u64 len)
+ {
+@@ -2201,14 +2209,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+
+ inode_lock_shared(inode);
+
++retry:
+ ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh);
+ if (ret)
+ goto out;
+
++ pagefault_disable();
+ ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops);
++ pagefault_enable();
+
+ gfs2_glock_dq_uninit(&gh);
+
++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) {
++ fieinfo->fi_extents_mapped = 0;
++ goto retry;
++ }
++
+ out:
+ inode_unlock_shared(inode);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 2c7081f10b6de31211908b00235534d612a20d36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:26:26 +0800
+Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ]
+
+Use module_platform_driver() to replace module_platform_driver_probe().
+The former utilizes platform_driver_register(), which allows the driver to
+defer probing when it doesn't acquire the necessary resources due to probe
+order. In contrast, the latter uses __platform_driver_probe(), which
+includes the comment "Note that this is incompatible with deferred
+probing." Since our SGPIO driver requires access to the clock resource, the
+former is more suitable.
+
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed-sgpio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
+index 7622f9e9f54af..318cd0e397416 100644
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -516,7 +516,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = {
+
+ MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table);
+
+-static int __init aspeed_sgpio_probe(struct platform_device *pdev)
++static int aspeed_sgpio_probe(struct platform_device *pdev)
+ {
+ u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask;
+ const struct aspeed_sgpio_pdata *pdata;
+@@ -611,11 +611,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ }
+
+ static struct platform_driver aspeed_sgpio_driver = {
++ .probe = aspeed_sgpio_probe,
+ .driver = {
+ .name = KBUILD_MODNAME,
+ .of_match_table = aspeed_sgpio_of_table,
+ },
+ };
+
+-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe);
++module_platform_driver(aspeed_sgpio_driver);
+ MODULE_DESCRIPTION("Aspeed Serial GPIO Driver");
+--
+2.51.0
+
--- /dev/null
+From e03caac652425004ae786cfc3da37c8c635301c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 08:39:35 +0100
+Subject: gpio: pca953x: Add support for TCAL6408 TCAL6416
+
+From: Jan Remmet <j.remmet@phytec.de>
+
+[ Upstream commit a30a9cb9bca4296d25f253619883e7013b6be158 ]
+
+TCAL6408 and TCAL6416 supports latchable inputs and maskable interrupt.
+Tested on a TCAL6416, checked datasheets for the TCAL6408.
+
+They use the same programming model ad the NXP PCAL64xx, but
+support a lower supply power (1.08V to 3.6V) compared to PCAL
+(1.65V to 5.5V)
+
+Datasheet: https://www.ti.com/lit/ds/symlink/tcal6408.pdf
+Datasheet: https://www.ti.com/lit/ds/symlink/tcal6416.pdf
+
+Signed-off-by: Jan Remmet <j.remmet@phytec.de>
+Link: https://lore.kernel.org/r/20251216-wip-jremmet-tcal6416rtw-v2-3-6516d98a9836@phytec.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/Kconfig | 4 ++--
+ drivers/gpio/gpio-pca953x.c | 6 ++++++
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
+index e053524c5e35f..4d644dcecad93 100644
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -1194,11 +1194,11 @@ config GPIO_PCA953X
+
+ 8 bits: max7310, max7315, pca6107, pca9534, pca9538, pca9554,
+ pca9556, pca9557, pca9574, tca6408, tca9554, xra1202,
+- pcal6408, pcal9554b, tca9538
++ pcal6408, pcal9554b, tca9538, tcal6408
+
+ 16 bits: max7312, max7313, pca9535, pca9539, pca9555, pca9575,
+ tca6416, pca6416, pcal6416, pcal9535, pcal9555a, max7318,
+- tca9539
++ tca9539, tcal6416
+
+ 18 bits: tca6418
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 34cadce9b3101..f7daeadaea57c 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -126,6 +126,9 @@ static const struct i2c_device_id pca953x_id[] = {
+ { "tca9539", 16 | PCA953X_TYPE | PCA_INT, },
+ { "tca9554", 8 | PCA953X_TYPE | PCA_INT, },
+ { "xra1202", 8 | PCA953X_TYPE },
++
++ { "tcal6408", 8 | PCA953X_TYPE | PCA_LATCH_INT, },
++ { "tcal6416", 16 | PCA953X_TYPE | PCA_LATCH_INT, },
+ { }
+ };
+ MODULE_DEVICE_TABLE(i2c, pca953x_id);
+@@ -1466,6 +1469,9 @@ static const struct of_device_id pca953x_dt_ids[] = {
+ { .compatible = "ti,tca9538", .data = OF_953X( 8, PCA_INT), },
+ { .compatible = "ti,tca9539", .data = OF_953X(16, PCA_INT), },
+
++ { .compatible = "ti,tcal6408", .data = OF_953X( 8, PCA_LATCH_INT), },
++ { .compatible = "ti,tcal6416", .data = OF_953X(16, PCA_LATCH_INT), },
++
+ { .compatible = "onnn,cat9554", .data = OF_953X( 8, PCA_INT), },
+ { .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), },
+ { .compatible = "onnn,pca9655", .data = OF_953X(16, PCA_INT), },
+--
+2.51.0
+
--- /dev/null
+From 88cd0c204a70eb26fb0946a415dbf3d08e4e506b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 07:45:55 +0000
+Subject: gpu/panel-edp: add AUO panel entry for B140HAN06.4
+
+From: Alexey Klimov <alexey.klimov@linaro.org>
+
+[ Upstream commit 2976aeb0de77da599ad37691963efbdcb07435ce ]
+
+Add an eDP panel entry for AUO B140HAN06.4 that is also used in
+some variants of Lenovo Flex 5G with Qcom SC8180 SoC.
+
+The raw edid of the panel is:
+
+00 ff ff ff ff ff ff 00 06 af 3d 64 00 00 00 00
+2b 1d 01 04 a5 1f 11 78 03 b8 1a a6 54 4a 9b 26
+0e 52 55 00 00 00 01 01 01 01 01 01 01 01 01 01
+01 01 01 01 01 01 14 37 80 b8 70 38 24 40 10 10
+3e 00 35 ae 10 00 00 18 10 2c 80 b8 70 38 24 40
+10 10 3e 00 35 ae 10 00 00 18 00 00 00 fe 00 41
+55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe
+00 42 31 34 30 48 41 4e 30 36 2e 34 20 0a 00 eb
+
+I do not have access to the datasheet and but it is tested on above
+mentioned laptop for a few weeks and seems to work just fine with
+timing info of similar panels.
+
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20251203074555.690613-1-alexey.klimov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 62435e3cd9f4d..aad5838cd700a 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1903,6 +1903,7 @@ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x635c, &delay_200_500_e50, "B116XAN06.3"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x639c, &delay_200_500_e50, "B140HAK02.7"),
++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x643d, &delay_200_500_e50, "B140HAN06.4"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x723c, &delay_200_500_e50, "B140XTN07.2"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x73aa, &delay_200_500_e50, "B116XTN02.3"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x8594, &delay_200_500_e50, "B133UAN01.0"),
+--
+2.51.0
+
--- /dev/null
+From 91a4fdce42b95bcf89c66b16101be9e02926d0d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 04:57:17 +0000
+Subject: gro: change the BUG_ON() in gro_pull_from_frag0()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ]
+
+Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE()
+
+$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2
+add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116)
+Function old new delta
+gro_try_pull_from_frag0 - 196 +196
+napi_gro_frags 771 929 +158
+__pfx_gro_try_pull_from_frag0 - 16 +16
+__pfx_gro_pull_from_frag0 16 - -16
+dev_gro_receive 1514 1464 -50
+gro_pull_from_frag0 188 - -188
+Total: Before=22565899, After=22566015, chg +0.00%
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/gro.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/gro.c b/net/core/gro.c
+index 482fa7d7f5981..ef61695fbdbb6 100644
+--- a/net/core/gro.c
++++ b/net/core/gro.c
+@@ -417,7 +417,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow)
+ {
+ struct skb_shared_info *pinfo = skb_shinfo(skb);
+
+- BUG_ON(skb->end - skb->tail < grow);
++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow);
+
+ memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
+
+--
+2.51.0
+
--- /dev/null
+From b22b6e64e267772b74c478792cf0931a364b1ee3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 16:00:55 -0800
+Subject: hfsplus: fix volume corruption issue for generic/480
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit bea4429eb30190c59b5ac7c8ff6c90176c7c110f ]
+
+The xfstests' test-case generic/480 leaves HFS+ volume
+in corrupted state:
+
+sudo ./check generic/480
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.17.0-rc1+ #4 SMP PREEMPT_DYNAMIC Wed Oct 1 15:02:44 PDT 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/480 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
+(see XFSTESTS-2/xfstests-dev/results//generic/480.full for details)
+
+Ran: generic/480
+Failures: generic/480
+Failed 1 of 1 tests
+
+sudo fsck.hfsplus -d /dev/loop51
+** /dev/loop51
+Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+Executing fsck_hfs (version 540.1-Linux).
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+Incorrect number of file hard links
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+invalid VHB nextCatalogID
+Volume header needs minor repair
+(2, 0)
+Verify Status: VIStat = 0x8000, ABTStat = 0x0000 EBTStat = 0x0000
+CBTStat = 0x0000 CatStat = 0x00000002
+** Repairing volume.
+Incorrect flags for file hard link (id = 19)
+(It should be 0x22 instead of 0x2)
+Incorrect flags for file inode (id = 18)
+(It should be 0x22 instead of 0x2)
+first link ID=0 is < 16 for fileinode=18
+Error getting first link ID for inode = 18 (result=2)
+Invalid first link in hard link chain (id = 18)
+(It should be 19 instead of 0)
+Indirect node 18 needs link count adjustment
+(It should be 1 instead of 2)
+** Rechecking volume.
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled was repaired successfully.
+
+The generic/480 test executes such steps on final phase:
+
+"Now remove of the links of our file and create
+a new file with the same name and in the same
+parent directory, and finally fsync this new file."
+
+unlink $SCRATCH_MNT/testdir/bar
+touch $SCRATCH_MNT/testdir/bar
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/testdir/bar
+
+"Simulate a power failure and mount the filesystem
+to check that replaying the fsync log/journal
+succeeds, that is the mount operation does not fail."
+
+_flakey_drop_and_remount
+
+The key issue in HFS+ logic is that hfsplus_link(),
+hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(),
+and hfsplus_mknod() methods don't call
+hfsplus_cat_write_inode() for the case of modified
+inode objects. As a result, even if hfsplus_file_fsync()
+is trying to flush the dirty Catalog File, but because of
+not calling hfsplus_cat_write_inode() not all modified
+inodes save the new state into Catalog File's records.
+Finally, simulation of power failure results in inconsistent
+state of Catalog File and FSCK tool reports about
+volume corruption.
+
+This patch adds calling of hfsplus_cat_write_inode()
+method for modified inodes in hfsplus_link(),
+hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(),
+and hfsplus_mknod() methods. Also, it adds debug output
+in several methods.
+
+sudo ./check generic/480
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/480 16s ... 16s
+Ran: generic/480
+Passed all 1 tests
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20251205000054.3670326-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/dir.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
+ fs/hfsplus/inode.c | 5 +++++
+ 2 files changed, 50 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
+index cadf0b5f93422..ca5f74a140ec1 100644
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -313,6 +313,9 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
+ if (!S_ISREG(inode->i_mode))
+ return -EPERM;
+
++ hfs_dbg("src_dir->i_ino %lu, dst_dir->i_ino %lu, inode->i_ino %lu\n",
++ src_dir->i_ino, dst_dir->i_ino, inode->i_ino);
++
+ mutex_lock(&sbi->vh_mutex);
+ if (inode->i_ino == (u32)(unsigned long)src_dentry->d_fsdata) {
+ for (;;) {
+@@ -332,7 +335,7 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
+ cnid = sbi->next_cnid++;
+ src_dentry->d_fsdata = (void *)(unsigned long)cnid;
+ res = hfsplus_create_cat(cnid, src_dir,
+- &src_dentry->d_name, inode);
++ &src_dentry->d_name, inode);
+ if (res)
+ /* panic? */
+ goto out;
+@@ -350,6 +353,21 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
+ mark_inode_dirty(inode);
+ sbi->file_count++;
+ hfsplus_mark_mdb_dirty(dst_dir->i_sb);
++
++ res = hfsplus_cat_write_inode(src_dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(dst_dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(sbi->hidden_dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(inode);
++
+ out:
+ mutex_unlock(&sbi->vh_mutex);
+ return res;
+@@ -367,6 +385,9 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry)
+ if (HFSPLUS_IS_RSRC(inode))
+ return -EPERM;
+
++ hfs_dbg("dir->i_ino %lu, inode->i_ino %lu\n",
++ dir->i_ino, inode->i_ino);
++
+ mutex_lock(&sbi->vh_mutex);
+ cnid = (u32)(unsigned long)dentry->d_fsdata;
+ if (inode->i_ino == cnid &&
+@@ -408,6 +429,15 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry)
+ inode_set_ctime_current(inode);
+ mark_inode_dirty(inode);
+ out:
++ if (!res) {
++ res = hfsplus_cat_write_inode(dir);
++ if (!res) {
++ res = hfsplus_cat_write_inode(sbi->hidden_dir);
++ if (!res)
++ res = hfsplus_cat_write_inode(inode);
++ }
++ }
++
+ mutex_unlock(&sbi->vh_mutex);
+ return res;
+ }
+@@ -429,6 +459,8 @@ static int hfsplus_rmdir(struct inode *dir, struct dentry *dentry)
+ inode_set_ctime_current(inode);
+ hfsplus_delete_inode(inode);
+ mark_inode_dirty(inode);
++
++ res = hfsplus_cat_write_inode(dir);
+ out:
+ mutex_unlock(&sbi->vh_mutex);
+ return res;
+@@ -465,6 +497,12 @@ static int hfsplus_symlink(struct mnt_idmap *idmap, struct inode *dir,
+
+ hfsplus_instantiate(dentry, inode, inode->i_ino);
+ mark_inode_dirty(inode);
++
++ res = hfsplus_cat_write_inode(dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(inode);
+ goto out;
+
+ out_err:
+@@ -506,6 +544,12 @@ static int hfsplus_mknod(struct mnt_idmap *idmap, struct inode *dir,
+
+ hfsplus_instantiate(dentry, inode, inode->i_ino);
+ mark_inode_dirty(inode);
++
++ res = hfsplus_cat_write_inode(dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(inode);
+ goto out;
+
+ failed_mknod:
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 7ae6745ca7ae1..c762bf909d1aa 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -328,6 +328,9 @@ int hfsplus_file_fsync(struct file *file, loff_t start, loff_t end,
+ struct hfsplus_vh *vhdr = sbi->s_vhdr;
+ int error = 0, error2;
+
++ hfs_dbg("inode->i_ino %lu, start %llu, end %llu\n",
++ inode->i_ino, start, end);
++
+ error = file_write_and_wait_range(file, start, end);
+ if (error)
+ return error;
+@@ -616,6 +619,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ hfsplus_cat_entry entry;
+ int res = 0;
+
++ hfs_dbg("inode->i_ino %lu\n", inode->i_ino);
++
+ if (HFSPLUS_IS_RSRC(inode))
+ main_inode = HFSPLUS_I(inode)->rsrc_inode;
+
+--
+2.51.0
+
--- /dev/null
+From d66074ecf8359c40fc6fffa7b4d51fd7a2342c84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Dec 2025 19:58:22 -0800
+Subject: hfsplus: fix volume corruption issue for generic/498
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ]
+
+The xfstests' test-case generic/498 leaves HFS+ volume
+in corrupted state:
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
+(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details)
+
+Ran: generic/498
+Failures: generic/498
+Failed 1 of 1 tests
+
+sudo fsck.hfsplus -d /dev/loop51
+** /dev/loop51
+Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+Executing fsck_hfs (version 540.1-Linux).
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+Invalid leaf record count
+(It should be 16 instead of 2)
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
+CBTStat = 0x8000 CatStat = 0x00000000
+** Repairing volume.
+** Rechecking volume.
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled was repaired successfully.
+
+The generic/498 test executes such steps on final phase:
+
+mkdir $SCRATCH_MNT/A
+mkdir $SCRATCH_MNT/B
+mkdir $SCRATCH_MNT/A/C
+touch $SCRATCH_MNT/B/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo
+
+ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A
+
+"Simulate a power failure and mount the filesystem
+to check that what we explicitly fsync'ed exists."
+
+_flakey_drop_and_remount
+
+The FSCK tool complains about "Invalid leaf record count".
+HFS+ b-tree header contains leaf_count field is updated
+by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert()
+is involved into hard link creation process. However,
+modified in-core leaf_count field is stored into HFS+
+b-tree header by hfs_btree_write() method. But,
+unfortunately, hfs_btree_write() hasn't been called
+by hfsplus_cat_write_inode() and hfsplus_file_fsync()
+stores not fully consistent state of the Catalog File's
+b-tree.
+
+This patch adds calling hfs_btree_write() method in
+the hfsplus_cat_write_inode() with the goal of
+storing consistent state of Catalog File's b-tree.
+Finally, it makes FSCK tool happy.
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 33s ... 31s
+Ran: generic/498
+Passed all 1 tests
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/inode.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index c762bf909d1aa..6153e5cc6eb65 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -615,6 +615,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ int hfsplus_cat_write_inode(struct inode *inode)
+ {
+ struct inode *main_inode = inode;
++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree;
+ struct hfs_find_data fd;
+ hfsplus_cat_entry entry;
+ int res = 0;
+@@ -627,7 +628,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ if (!main_inode->i_nlink)
+ return 0;
+
+- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd))
++ if (hfs_find_init(tree, &fd))
+ /* panic? */
+ return -EIO;
+
+@@ -692,6 +693,15 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags);
+ out:
+ hfs_find_exit(&fd);
++
++ if (!res) {
++ res = hfs_btree_write(tree);
++ if (res) {
++ pr_err("b-tree write err: %d, ino %lu\n",
++ res, inode->i_ino);
++ }
++ }
++
+ return res;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 03f978ac5edb2ac18727c771330eeb50621bb1b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 18:39:33 +0900
+Subject: hfsplus: pretend special inodes as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index 67a7a2a093476..bb819ae608fd9 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -53,6 +53,12 @@ static int hfsplus_system_read_inode(struct inode *inode)
+ return -EIO;
+ }
+
++ /*
++ * Assign a dummy file type, for may_open() requires that
++ * an inode has a valid file type.
++ */
++ inode->i_mode = S_IFREG;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 664457398612faee3da7d5d689f0a7e85467cf3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 06:06:23 +0000
+Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple
+ keyboards
+
+From: Joey Bednar <linux@joeybednar.com>
+
+[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ]
+
+The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium
+Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX
+KN85 Keyboard" to the list of non-apple keyboards fixes the function
+keys.
+
+Signed-off-by: Joey Bednar <linux@joeybednar.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 57da4f86a9fa7..233e367cce1d1 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -354,6 +354,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+ };
+
+ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
++ { "SONiX KN85 Keyboard" },
+ { "SONiX USB DEVICE" },
+ { "SONiX AK870 PRO" },
+ { "Keychron" },
+--
+2.51.0
+
--- /dev/null
+From 1726dc8bab514f3cae432a720b9ee0358968477f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 12:56:09 +0900
+Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
+
+From: David Phillips <david@profile.sh>
+
+[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ]
+
+New model in the ELECOM HUGE trackball line that has 8 buttons but the
+report descriptor specifies only 5. The HUGE Plus supports connecting via
+Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable.
+Each connection type reports a different device id, 01AA for cable,
+01AB for USB dongle, and 01AC for Bluetooth.
+
+This patch adds these device IDs and applies the fixups similar to the
+other ELECOM devices to get all 8 buttons working for all 3 connection
+types.
+
+For reference, the usbhid-dump output:
+001:013:001:DESCRIPTOR 1769085639.598405
+ 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01
+ 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01
+ 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10
+ 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06
+ 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0
+ C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01
+ 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01
+ 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03
+ 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00
+ A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81
+ 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26
+ FF 00 75 08 95 07 B1 02 C0
+
+Signed-off-by: David Phillips <david@profile.sh>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-elecom.c | 16 ++++++++++++++++
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 3 +++
+ 4 files changed, 23 insertions(+)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 04420a713be08..03ad8b5c29a4d 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -369,6 +369,7 @@ config HID_ELECOM
+ - EX-G Trackballs (M-XT3DRBK, M-XT3URBK)
+ - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ - HUGE Plus Trackball (M-HT1MRBK)
+
+ config HID_ELO
+ tristate "ELO USB 4000/4500 touchscreen"
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index 2003d2dcda7cc..37d88ce57f671 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -5,6 +5,7 @@
+ * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK)
+ * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ * - HUGE Plus Trackball (M-HT1MRBK)
+ *
+ * Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
+ * Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
+@@ -123,12 +124,25 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
+ break;
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC:
++ /*
++ * Report descriptor format:
++ * 24: button bit count
++ * 28: padding bit count
++ * 22: button report size
++ * 16: button usage maximum
++ */
++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8);
++ break;
+ }
+ return rdesc;
+ }
+
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+@@ -142,6 +156,8 @@ static const struct hid_device_id elecom_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, elecom_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 240fcff0ca71e..f5715cf9468fc 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -466,6 +466,9 @@
+ #define USB_DEVICE_ID_ELECOM_M_HT1URBK_019B 0x019b
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac
+
+ #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34
+ #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 11438039cdb7f..3217e436c052c 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -420,6 +420,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC) },
+@@ -432,6 +433,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_ELO)
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
+--
+2.51.0
+
--- /dev/null
+From 7984ea50a6dd5ee90d63d55845064f278e8cf511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 17:40:41 +0800
+Subject: HID: i2c-hid: Add FocalTech FT8112
+
+From: Daniel Peng <Daniel_Peng@pegatron.corp-partner.google.com>
+
+[ Upstream commit 3d9586f1f90c9101b1abf5b0e9d70ca45f5f16db ]
+
+Information for touchscreen model HKO/RB116AS01-2 as below:
+- HID :FTSC1000
+- slave address:0X38
+- Interface:HID over I2C
+- Touch control lC:FT8112
+- I2C ID: PNP0C50
+
+Signed-off-by: Daniel Peng <Daniel_Peng@pegatron.corp-partner.google.com>
+Acked-by: Jiri Kosina <jkosina@suse.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20251117094041.300083-2-Daniel_Peng@pegatron.corp-partner.google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-of-elan.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+index 0215f217f6d86..b81fcc6ff49ee 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c
++++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+@@ -168,6 +168,13 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = {
+ .power_after_backlight = true,
+ };
+
++static const struct elan_i2c_hid_chip_data focaltech_ft8112_chip_data = {
++ .post_power_delay_ms = 10,
++ .post_gpio_reset_on_delay_ms = 150,
++ .hid_descriptor_address = 0x0001,
++ .main_supply_name = "vcc33",
++};
++
+ static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = {
+ .post_power_delay_ms = 1,
+ .post_gpio_reset_on_delay_ms = 200,
+@@ -191,6 +198,7 @@ static const struct elan_i2c_hid_chip_data ilitek_ili2901_chip_data = {
+ static const struct of_device_id elan_i2c_hid_of_match[] = {
+ { .compatible = "elan,ekth6915", .data = &elan_ekth6915_chip_data },
+ { .compatible = "elan,ekth6a12nay", .data = &elan_ekth6a12nay_chip_data },
++ { .compatible = "focaltech,ft8112", .data = &focaltech_ft8112_chip_data },
+ { .compatible = "ilitek,ili9882t", .data = &ilitek_ili9882t_chip_data },
+ { .compatible = "ilitek,ili2901", .data = &ilitek_ili2901_chip_data },
+ { }
+--
+2.51.0
+
--- /dev/null
+From 68d45120ba307fa40f50fb511bc6134930c05cca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 13:12:02 +0100
+Subject: HID: logitech-hidpp: Add support for Logitech K980
+
+From: Bastien Nocera <hadess@hadess.net>
+
+[ Upstream commit af4fe07a9d963a72438ade96cf090e84b3399d0c ]
+
+Add support for the solar-charging Logitech K980 keyboard, over
+Bluetooth. Bolt traffic doesn't get routed through logitech-dj, so
+this code isn't triggered when Bolt is used.
+
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 9b612f62d0fba..d117cf0b6de04 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -4665,6 +4665,8 @@ static const struct hid_device_id hidpp_devices[] = {
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb037) },
+ { /* MX Anywhere 3SB mouse over Bluetooth */
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) },
++ { /* Slim Solar+ K980 Keyboard over Bluetooth */
++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 9ae6d7eb872bd9f26414131b55e98666be383528 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 09:57:05 +0100
+Subject: HID: multitouch: add eGalaxTouch EXC3188 support
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ]
+
+Add support for the for the EXC3188 touchscreen from eGalaxy.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 3965a58926f1c..240fcff0ca71e 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -437,6 +437,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
+
+ #define USB_VENDOR_ID_EDIFIER 0x2d99
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 1763809177c4a..4dcb1d43df27a 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2202,6 +2202,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
++ { .driver_data = MT_CLS_EGALAX_SERIAL,
++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) },
+ { .driver_data = MT_CLS_EGALAX,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
+--
+2.51.0
+
--- /dev/null
+From 55d4f803e766c999659c85ed63d049391d35f4d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 21:35:47 -0500
+Subject: HID: multitouch: add quirks for Lenovo Yoga Book 9i
+
+From: Brian Howard <blhoward2@gmail.com>
+
+[ Upstream commit 822bc5b3744b0b2c2c9678aa1d80b2cf04fdfabf ]
+
+The Lenovo Yoga Book 9i is a dual-screen laptop, with a single composite
+USB device providing both touch and tablet interfaces for both screens.
+All inputs report through a single device, differentiated solely by report
+numbers. As there is no way for udev to differentiate the inputs based on
+USB vendor/product ID or interface numbers, custom naming is required to
+match against for downstream configuration. A firmware bug also results
+in an erroneous InRange message report being received after the stylus
+leaves proximity, blocking later touch events. Add required quirks for
+Gen 8 to Gen 10 models, including a new quirk providing for custom input
+device naming and dropping erroneous InRange reports.
+
+Signed-off-by: Brian Howard <blhoward2@gmail.com>
+Tested-by: Brian Howard <blhoward2@gmail.com>
+Tested-by: Kris Fredrick <linux.baguette800@slmail.me>
+Reported-by: Andrei Shumailov <gentoo1993@gmail.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220386
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 72 ++++++++++++++++++++++++++++++++++++
+ 2 files changed, 73 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index b75d9d2f4dc73..3965a58926f1c 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -840,6 +840,7 @@
+ #define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5
+ #define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe
+ #define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae
++#define USB_DEVICE_ID_LENOVO_YOGABOOK9I 0x6161
+ #define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E 0x600e
+ #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d
+ #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index a0c1ad5acb670..1763809177c4a 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -76,6 +76,7 @@ MODULE_LICENSE("GPL");
+ #define MT_QUIRK_DISABLE_WAKEUP BIT(21)
+ #define MT_QUIRK_ORIENTATION_INVERT BIT(22)
+ #define MT_QUIRK_APPLE_TOUCHBAR BIT(23)
++#define MT_QUIRK_YOGABOOK9I BIT(24)
+
+ #define MT_INPUTMODE_TOUCHSCREEN 0x02
+ #define MT_INPUTMODE_TOUCHPAD 0x03
+@@ -229,6 +230,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app);
+ #define MT_CLS_RAZER_BLADE_STEALTH 0x0112
+ #define MT_CLS_SMART_TECH 0x0113
+ #define MT_CLS_APPLE_TOUCHBAR 0x0114
++#define MT_CLS_YOGABOOK9I 0x0115
+ #define MT_CLS_SIS 0x0457
+
+ #define MT_DEFAULT_MAXCONTACT 10
+@@ -425,6 +427,14 @@ static const struct mt_class mt_classes[] = {
+ .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
+ MT_QUIRK_ALWAYS_VALID |
+ MT_QUIRK_CONTACT_CNT_ACCURATE,
++ },
++ { .name = MT_CLS_YOGABOOK9I,
++ .quirks = MT_QUIRK_ALWAYS_VALID |
++ MT_QUIRK_FORCE_MULTI_INPUT |
++ MT_QUIRK_SEPARATE_APP_REPORT |
++ MT_QUIRK_HOVERING |
++ MT_QUIRK_YOGABOOK9I,
++ .export_all_inputs = true
+ },
+ { }
+ };
+@@ -1566,6 +1576,38 @@ static void mt_report(struct hid_device *hid, struct hid_report *report)
+ if (rdata && rdata->is_mt_collection)
+ return mt_touch_report(hid, rdata);
+
++ /* Lenovo Yoga Book 9i requires consuming and dropping certain bogus reports */
++ if (rdata && rdata->application &&
++ (rdata->application->quirks & MT_QUIRK_YOGABOOK9I)) {
++
++ bool all_zero_report = true;
++
++ for (int f = 0; f < report->maxfield && all_zero_report; f++) {
++ struct hid_field *fld = report->field[f];
++
++ for (int i = 0; i < fld->report_count; i++) {
++ unsigned int usage = fld->usage[i].hid;
++
++ if (usage == HID_DG_INRANGE ||
++ usage == HID_DG_TIPSWITCH ||
++ usage == HID_DG_BARRELSWITCH ||
++ usage == HID_DG_BARRELSWITCH2 ||
++ usage == HID_DG_CONTACTID ||
++ usage == HID_DG_TILT_X ||
++ usage == HID_DG_TILT_Y) {
++
++ if (fld->value[i] != 0) {
++ all_zero_report = false;
++ break;
++ }
++ }
++ }
++ }
++
++ if (all_zero_report)
++ return;
++ }
++
+ if (field && field->hidinput && field->hidinput->input)
+ input_sync(field->hidinput->input);
+ }
+@@ -1762,6 +1804,30 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ break;
+ }
+
++ /* Lenovo Yoga Book 9i requires custom naming to allow differentiation in udev */
++ if (hi->report && td->mtclass.quirks & MT_QUIRK_YOGABOOK9I) {
++ switch (hi->report->id) {
++ case 48:
++ suffix = "Touchscreen Top";
++ break;
++ case 56:
++ suffix = "Touchscreen Bottom";
++ break;
++ case 20:
++ suffix = "Stylus Top";
++ break;
++ case 40:
++ suffix = "Stylus Bottom";
++ break;
++ case 80:
++ suffix = "Emulated Touchpad";
++ break;
++ default:
++ suffix = "";
++ break;
++ }
++ }
++
+ if (suffix) {
+ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
+ "%s %s", hdev->name, suffix);
+@@ -2267,6 +2333,12 @@ static const struct hid_device_id mt_devices[] = {
+ USB_VENDOR_ID_LENOVO,
+ USB_DEVICE_ID_LENOVO_X12_TAB2) },
+
++ /* Lenovo Yoga Book 9i */
++ { .driver_data = MT_CLS_YOGABOOK9I,
++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
++ USB_VENDOR_ID_LENOVO,
++ USB_DEVICE_ID_LENOVO_YOGABOOK9I) },
++
+ /* Logitech devices */
+ { .driver_data = MT_CLS_NSMU,
+ HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8,
+--
+2.51.0
+
--- /dev/null
+From 4a03c893d8dab4aa08306f712b50a50dd81cbdc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Nov 2025 19:46:14 +0100
+Subject: HID: pidff: Do not set out of range trigger button
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+
+[ Upstream commit e01a029654f7fb67d7151365410aa22be4e63dbe ]
+
+Some games (mainly observed with Kylotonn's WRC Serises) set trigger
+button to a random value, or always the same one, out of range.
+I observed 307 and other values but, for example, my Moza R9 only
+exposes 128 buttons AND it's trigger button field is 8-bit. This causes
+errors to appear in dmesg.
+
+Only set the trigger button and trigger interval in the trigger button
+is in range of the field.
+
+Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/usbhid/hid-pidff.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
+index 95377c5f63356..a4e700b40ba9b 100644
+--- a/drivers/hid/usbhid/hid-pidff.c
++++ b/drivers/hid/usbhid/hid-pidff.c
+@@ -523,9 +523,19 @@ static void pidff_set_effect_report(struct pidff_device *pidff,
+ pidff_set_duration(&pidff->set_effect[PID_DURATION],
+ effect->replay.length);
+
+- pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = effect->trigger.button;
+- pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT],
+- effect->trigger.interval);
++ /* Some games set this to random values that can be out of range */
++ s32 trigger_button_max =
++ pidff->set_effect[PID_TRIGGER_BUTTON].field->logical_maximum;
++ if (effect->trigger.button <= trigger_button_max) {
++ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] =
++ effect->trigger.button;
++ pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT],
++ effect->trigger.interval);
++ } else {
++ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = 0;
++ pidff->set_effect[PID_TRIGGER_REPEAT_INT].value[0] = 0;
++ }
++
+ pidff->set_effect[PID_GAIN].value[0] =
+ pidff->set_effect[PID_GAIN].field->logical_maximum;
+
+--
+2.51.0
+
--- /dev/null
+From 7767ed3c26ba0d671db83d4b0c194fb421a362ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 10:02:05 +0800
+Subject: hisi_acc_vfio_pci: fix the queue parameter anomaly issue
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit c3cbc276c2a33b04fc78a86cdb2ddce094cb3614 ]
+
+When the number of QPs initialized by the device, as read via vft, is zero,
+it indicates either an abnormal device configuration or an abnormal read
+result.
+Returning 0 directly in this case would allow the live migration operation
+to complete successfully, leading to incorrect parameter configuration after
+migration and preventing the service from recovering normal functionality.
+Therefore, in such situations, an error should be returned to roll back the
+live migration operation.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/20260122020205.2884497-5-liulongfang@huawei.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+index c7559f1d4e2f2..5950ae5222476 100644
+--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+@@ -407,7 +407,7 @@ static int vf_qm_check_match(struct hisi_acc_vf_core_device *hisi_acc_vdev,
+ ret = qm_get_vft(vf_qm, &vf_qm->qp_base);
+ if (ret <= 0) {
+ dev_err(dev, "failed to get vft qp nums\n");
+- return ret;
++ return ret < 0 ? ret : -EINVAL;
+ }
+
+ if (ret != vf_data->qp_num) {
+--
+2.51.0
+
--- /dev/null
+From 56acaa527970ecb05b92df76ef9478848fc0517d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 10:02:04 +0800
+Subject: hisi_acc_vfio_pci: resolve duplicate migration states
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit 8c6ac1730a977234dff74cc1753b4a953f59be7b ]
+
+In special scenarios involving duplicate migrations, after the
+first migration is completed, if the original VF device is used
+again and then migrated to another destination, the state indicating
+data migration completion for the VF device is not reset.
+This results in the second migration to the destination being skipped
+without performing data migration.
+After the modification, it ensures that a complete data migration
+is performed after the subsequent migration.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/20260122020205.2884497-4-liulongfang@huawei.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+index ed2ae035deb16..c7559f1d4e2f2 100644
+--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+@@ -1529,6 +1529,7 @@ static int hisi_acc_vfio_pci_open_device(struct vfio_device *core_vdev)
+ }
+ hisi_acc_vdev->mig_state = VFIO_DEVICE_STATE_RUNNING;
+ hisi_acc_vdev->dev_opened = true;
++ hisi_acc_vdev->match_done = 0;
+ mutex_unlock(&hisi_acc_vdev->open_mutex);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1e81d75bd7ffd4fe1142ca7d41ea5a4f2e905f9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 10:02:03 +0800
+Subject: hisi_acc_vfio_pci: update status after RAS error
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ]
+
+After a RAS error occurs on the accelerator device, the accelerator
+device will be reset. The live migration state will be abnormal
+after reset, and the original state needs to be restored during
+the reset process.
+Therefore, reset processing needs to be performed in a live
+migration scenario.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+index 5950ae5222476..f141f21566c52 100644
+--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+@@ -1196,8 +1196,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev)
+ if (hisi_acc_vdev->set_reset_flag)
+ clear_bit(QM_RESETTING, &qm->misc_ctl);
+
+- if (hisi_acc_vdev->core_device.vdev.migration_flags !=
+- VFIO_MIGRATION_STOP_COPY)
++ if (!hisi_acc_vdev->core_device.vdev.mig_ops)
+ return;
+
+ mutex_lock(&hisi_acc_vdev->state_mutex);
+--
+2.51.0
+
--- /dev/null
+From 9eefa716a75a0b95871a2c00ca286f5a28d384c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jan 2026 01:06:10 +0100
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7080
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 46c3e87a79179454f741f797c274dd25f5c6125e ]
+
+The Dell OptiPlex 7080 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/16
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Acked-by: Pali Rohár <pali@kernel.org>
+Link: https://lore.kernel.org/r/20260104000654.6406-1-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index f3d484a9f708b..768690a597f4d 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1325,6 +1325,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "MP061"),
+ },
+ },
++ {
++ .ident = "Dell OptiPlex 7080",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7080"),
++ },
++ },
+ {
+ .ident = "Dell OptiPlex 7060",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 3faa1ac56d3472507ccceaace6a746e2af5457e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 21:51:48 +0800
+Subject: hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child
+
+From: Felix Gu <gu_0233@qq.com>
+
+[ Upstream commit 2954ce672b7623478c1cfeb69e6a6e4042a3656e ]
+
+When calling of_parse_phandle_with_args(), the caller is responsible
+to call of_node_put() to release the reference of device node.
+In emc2305_of_parse_pwm_child, it does not release the reference,
+causing a resource leak.
+
+Signed-off-by: Felix Gu <gu_0233@qq.com>
+Link: https://lore.kernel.org/r/tencent_738BA80BBF28F3440301EEE6F9E470165105@qq.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/emc2305.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c
+index ceae96c07ac45..67e82021da210 100644
+--- a/drivers/hwmon/emc2305.c
++++ b/drivers/hwmon/emc2305.c
+@@ -578,6 +578,7 @@ static int emc2305_of_parse_pwm_child(struct device *dev,
+ data->pwm_output_mask |= EMC2305_OPEN_DRAIN << ch;
+ }
+
++ of_node_put(args.np);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4da5fb5dc8d2742d545287cdd57e09d1e28ff79b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 13:10:40 +0800
+Subject: hwmon: (f71882fg) Add F81968 support
+
+From: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+
+[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ]
+
+Add hardware monitoring support for the Fintek F81968 Super I/O chip.
+It is fully compatible with F81866.
+
+Several products share compatibility with the F81866. To better distinguish
+between them, ensure that the Product ID is displayed when the device is
+probed.
+
+Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/f71882fg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
+index df83f9866fbcf..204059d2de6cd 100644
+--- a/drivers/hwmon/f71882fg.c
++++ b/drivers/hwmon/f71882fg.c
+@@ -51,6 +51,7 @@
+ #define SIO_F81866_ID 0x1010 /* Chipset ID */
+ #define SIO_F71858AD_ID 0x0903 /* Chipset ID */
+ #define SIO_F81966_ID 0x1502 /* Chipset ID */
++#define SIO_F81968_ID 0x1806 /* Chipset ID */
+
+ #define REGION_LENGTH 8
+ #define ADDR_REG_OFFSET 5
+@@ -2570,6 +2571,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ break;
+ case SIO_F81866_ID:
+ case SIO_F81966_ID:
++ case SIO_F81968_ID:
+ sio_data->type = f81866a;
+ break;
+ default:
+@@ -2599,9 +2601,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */
+
+ err = address;
+- pr_info("Found %s chip at %#x, revision %d\n",
++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n",
+ f71882fg_names[sio_data->type], (unsigned int)address,
+- (int)superio_inb(sioaddr, SIO_REG_DEVREV));
++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid);
+ exit:
+ superio_exit(sioaddr);
+ return err;
+--
+2.51.0
+
--- /dev/null
+From 9bb15b055ca18bbca6cb35f42977325846dc7f00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 09:09:42 +1100
+Subject: hwmon: (nct6683) Add customer ID for ASRock Z590 Taichi
+
+From: Anj Duvnjak <avian@extremenerds.net>
+
+[ Upstream commit c0fa7879c9850bd4597740a79d4fac5ebfcf69cc ]
+
+Add support for customer ID 0x1621 found on ASRock Z590 Taichi
+boards using the Nuvoton NCT6686D embedded controller.
+
+This allows the driver to instantiate without requiring the
+force=1 module parameter.
+
+Tested on two separate ASRock Z590 Taichi boards, both with
+EC firmware version 1.0 build 01/25/21.
+
+Signed-off-by: Anj Duvnjak <avian@extremenerds.net>
+Link: https://lore.kernel.org/r/20251222220942.10762-1-avian@extremenerds.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hwmon/nct6683.rst | 1 +
+ drivers/hwmon/nct6683.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/Documentation/hwmon/nct6683.rst b/Documentation/hwmon/nct6683.rst
+index 3e549ba95a15a..45eec9dd349aa 100644
+--- a/Documentation/hwmon/nct6683.rst
++++ b/Documentation/hwmon/nct6683.rst
+@@ -65,6 +65,7 @@ AMD BC-250 NCT6686D EC firmware version 1.0 build 07/28/21
+ ASRock X570 NCT6683D EC firmware version 1.0 build 06/28/19
+ ASRock X670E NCT6686D EC firmware version 1.0 build 05/19/22
+ ASRock B650 Steel Legend WiFi NCT6686D EC firmware version 1.0 build 11/09/23
++ASRock Z590 Taichi NCT6686D EC firmware version 1.0 build 01/25/21
+ MSI B550 NCT6687D EC firmware version 1.0 build 05/07/20
+ MSI X670-P NCT6687D EC firmware version 0.0 build 09/27/22
+ MSI X870E NCT6687D EC firmware version 0.0 build 11/13/24
+diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
+index 6cda35388b24c..4a83804140386 100644
+--- a/drivers/hwmon/nct6683.c
++++ b/drivers/hwmon/nct6683.c
+@@ -181,6 +181,7 @@ superio_exit(int ioreg)
+ #define NCT6683_CUSTOMER_ID_ASROCK2 0xe1b
+ #define NCT6683_CUSTOMER_ID_ASROCK3 0x1631
+ #define NCT6683_CUSTOMER_ID_ASROCK4 0x163e
++#define NCT6683_CUSTOMER_ID_ASROCK5 0x1621
+
+ #define NCT6683_REG_BUILD_YEAR 0x604
+ #define NCT6683_REG_BUILD_MONTH 0x605
+@@ -1242,6 +1243,8 @@ static int nct6683_probe(struct platform_device *pdev)
+ break;
+ case NCT6683_CUSTOMER_ID_ASROCK4:
+ break;
++ case NCT6683_CUSTOMER_ID_ASROCK5:
++ break;
+ default:
+ if (!force)
+ return -ENODEV;
+--
+2.51.0
+
--- /dev/null
+From 180f421066fe7fd628612c6f2fd67abe019d09d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 17:53:14 +0200
+Subject: hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
+
+From: Denis Pauk <pauk.denis@gmail.com>
+
+[ Upstream commit 246167b17c14e8a5142368ac6457e81622055e0a ]
+
+Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's
+no use of it because of resource conflict with WMI method.
+
+Add the board to the WMI monitoring list.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807
+Signed-off-by: Denis Pauk <pauk.denis@gmail.com>
+Tested-by: Marcus <shoes2ga@gmail.com>
+Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775-platform.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c
+index 407945d2cd6a8..0b529a542b0d4 100644
+--- a/drivers/hwmon/nct6775-platform.c
++++ b/drivers/hwmon/nct6775-platform.c
+@@ -1357,6 +1357,7 @@ static const char * const asus_msi_boards[] = {
+ "Pro WS W680-ACE IPMI",
+ "Pro WS W790-ACE",
+ "Pro WS W790E-SAGE SE",
++ "Pro WS WRX90E-SAGE SE",
+ "ProArt B650-CREATOR",
+ "ProArt B660-CREATOR D4",
+ "ProArt B760-CREATOR D4",
+--
+2.51.0
+
--- /dev/null
+From 0bec6b1783fa13ffa6ae8d4cbe503bb651d972f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 21:54:15 +0800
+Subject: hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin
+
+From: Felix Gu <gu_0233@qq.com>
+
+[ Upstream commit 4923bbff0bcffe488b3aa76829c829bd15b02585 ]
+
+When calling of_parse_phandle_with_args(), the caller is responsible
+to call of_node_put() to release the reference of device node.
+In nct7363_present_pwm_fanin, it does not release the reference,
+causing a resource leak.
+
+Signed-off-by: Felix Gu <gu_0233@qq.com>
+Link: https://lore.kernel.org/r/tencent_9717645269E4C07D3D131F52201E12E5E10A@qq.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct7363.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/nct7363.c b/drivers/hwmon/nct7363.c
+index e13ab918b1abe..56ac42e4a8653 100644
+--- a/drivers/hwmon/nct7363.c
++++ b/drivers/hwmon/nct7363.c
+@@ -351,6 +351,7 @@ static int nct7363_present_pwm_fanin(struct device *dev,
+ if (ret)
+ return ret;
+
++ of_node_put(args.np);
+ if (args.args[0] >= NCT7363_PWM_COUNT)
+ return -EINVAL;
+ data->pwm_mask |= BIT(args.args[0]);
+--
+2.51.0
+
--- /dev/null
+From 882d26b27a999771c0b92ab3204cd7b29e620745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:44 +0100
+Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ]
+
+The unpacked union within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value'
+ is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)'
+ and is usually due to 'struct hv_kvp_exchg_msg_value' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 361 | union {
+ | ^
+
+With the recent changes to compile-test the UAPI headers in more cases,
+this warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warning.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/hyperv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h
+index aaa502a7bff46..1749b35ab2c21 100644
+--- a/include/uapi/linux/hyperv.h
++++ b/include/uapi/linux/hyperv.h
+@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value {
+ __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE];
+ __u32 value_u32;
+ __u64 value_u64;
+- };
++ } __attribute__((packed));
+ } __attribute__((packed));
+
+ struct hv_kvp_msg_enumerate {
+--
+2.51.0
+
--- /dev/null
+From d3d1c195d3a86d05160a5d7b5d4813ae7a9331cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:08:51 -0500
+Subject: i3c: master: svc: Initialize 'dev' to NULL in
+ svc_i3c_master_ibi_isr()
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ]
+
+Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add
+a NULL check in the error path.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index e70a64f2a32fa..93531cb216d16 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -496,8 +496,8 @@ static int svc_i3c_master_handle_ibi_won(struct svc_i3c_master *master, u32 msta
+ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
+ {
+ struct svc_i3c_i2c_dev_data *data;
++ struct i3c_dev_desc *dev = NULL;
+ unsigned int ibitype, ibiaddr;
+- struct i3c_dev_desc *dev;
+ u32 status, val;
+ int ret;
+
+@@ -590,7 +590,7 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
+ * for the slave to interrupt again.
+ */
+ if (svc_i3c_master_error(master)) {
+- if (master->ibi.tbq_slot) {
++ if (master->ibi.tbq_slot && dev) {
+ data = i3c_dev_get_master_data(dev);
+ i3c_generic_ibi_recycle_slot(data->ibi_pool,
+ master->ibi.tbq_slot);
+--
+2.51.0
+
--- /dev/null
+From 95c40a9340250362b5d1a1f33f46ef71a09322b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 09:26:42 +0200
+Subject: i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 78f63ae4a82db173f93adca462e63d11ba06b126 ]
+
+The MIPI I3C HCI specification does not define reset values for
+RING_OPERATION1 fields, and some controllers (e.g., Intel) do not clear
+them during a software reset. Ensure the ring pointers are explicitly
+set to zero during bus initialization to avoid inconsistent state.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260113072702.16268-2-adrian.hunter@intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/dma.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
+index c401a9425cdc5..951abfea5a6fd 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
+@@ -342,6 +342,14 @@ static int hci_dma_init(struct i3c_hci *hci)
+ rh_reg_write(INTR_SIGNAL_ENABLE, regval);
+
+ ring_ready:
++ /*
++ * The MIPI I3C HCI specification does not document reset values for
++ * RING_OPERATION1 fields and some controllers (e.g. Intel controllers)
++ * do not reset the values, so ensure the ring pointers are set to zero
++ * here.
++ */
++ rh_reg_write(RING_OPERATION1, 0);
++
+ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE |
+ RING_CTRL_RUN_STOP);
+ }
+--
+2.51.0
+
--- /dev/null
+From 019a12e2224ddc6fcba4da82fd55e3018a58f86b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 18:44:07 +0200
+Subject: i3c: mipi-i3c-hci: Stop reading Extended Capabilities if capability
+ ID is 0
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 0818e4aa8fdeeed5973e0a8faeddc9da599fc897 ]
+
+Extended Capability ID value 0 is special. It signifies the end of the
+list. Stop reading Extended Capabilities if capability ID is 0.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260106164416.67074-3-adrian.hunter@intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/ext_caps.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c
+index 7714f00ea9cc0..533a495e14c86 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c
++++ b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c
+@@ -272,7 +272,7 @@ int i3c_hci_parse_ext_caps(struct i3c_hci *hci)
+ cap_length = FIELD_GET(CAP_HEADER_LENGTH, cap_header);
+ dev_dbg(&hci->master.dev, "id=0x%02x length=%d",
+ cap_id, cap_length);
+- if (!cap_length)
++ if (!cap_id || !cap_length)
+ break;
+ if (curr_cap + cap_length * 4 >= end) {
+ dev_err(&hci->master.dev,
+--
+2.51.0
+
--- /dev/null
+From 3d04e5e7b2c8fde0f7058087c8c3d5b008b6b63f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 05:45:19 +0000
+Subject: iio: bmi270_i2c: Add MODULE_DEVICE_TABLE for BMI260/270
+
+From: Derek J. Clark <derekjohn.clark@gmail.com>
+
+[ Upstream commit f69b5ac682dbc61e6aca806c22ce2ae74d598e45 ]
+
+Currently BMI260 & BMI270 devices do not automatically load this
+driver. To fix this, add missing MODULE_DEVICE_TABLE for the i2c,
+acpi, and of device tables so the driver will load when the hardware
+is detected.
+
+Tested on my OneXPlayer F1 Pro.
+
+Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bmi270/bmi270_i2c.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iio/imu/bmi270/bmi270_i2c.c b/drivers/iio/imu/bmi270/bmi270_i2c.c
+index b909a421ad017..b92da4e0776fa 100644
+--- a/drivers/iio/imu/bmi270/bmi270_i2c.c
++++ b/drivers/iio/imu/bmi270/bmi270_i2c.c
+@@ -37,6 +37,7 @@ static const struct i2c_device_id bmi270_i2c_id[] = {
+ { "bmi270", (kernel_ulong_t)&bmi270_chip_info },
+ { }
+ };
++MODULE_DEVICE_TABLE(i2c, bmi270_i2c_id);
+
+ static const struct acpi_device_id bmi270_acpi_match[] = {
+ /* GPD Win Mini, Aya Neo AIR Pro, OXP Mini Pro, etc. */
+@@ -45,12 +46,14 @@ static const struct acpi_device_id bmi270_acpi_match[] = {
+ { "BMI0260", (kernel_ulong_t)&bmi260_chip_info },
+ { }
+ };
++MODULE_DEVICE_TABLE(acpi, bmi270_acpi_match);
+
+ static const struct of_device_id bmi270_of_match[] = {
+ { .compatible = "bosch,bmi260", .data = &bmi260_chip_info },
+ { .compatible = "bosch,bmi270", .data = &bmi270_chip_info },
+ { }
+ };
++MODULE_DEVICE_TABLE(of, bmi270_of_match);
+
+ static struct i2c_driver bmi270_i2c_driver = {
+ .driver = {
+--
+2.51.0
+
--- /dev/null
+From e3bd5e66ce624365d6d2c6661fc7fe326b943fed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:38 +0100
+Subject: iio: magnetometer: Remove IRQF_ONESHOT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+The force-threading functionality is required on PREEMPT_RT because the
+handler is using locks with can sleep on PREEMPT_RT.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index 3fd0171e5d69b..d30315ad85ded 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -581,7 +581,7 @@ static int ak8975_setup_irq(struct ak8975_data *data)
+ irq = gpiod_to_irq(data->eoc_gpiod);
+
+ rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ dev_name(&client->dev), data);
+ if (rc < 0) {
+ dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc);
+--
+2.51.0
+
--- /dev/null
+From c986bc64925cc5e89fb5e1777024649b3769bebf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:36 +0100
+Subject: iio: Use IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ]
+
+The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke
+other interrupt handler and this supposed to happen from within the
+hardirq.
+
+Use IRQF_NO_THREAD to forbid forced-threading.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/bma180.c | 5 +++--
+ drivers/iio/adc/ad7766.c | 2 +-
+ drivers/iio/gyro/itg3200_buffer.c | 8 +++-----
+ drivers/iio/light/si1145.c | 2 +-
+ 4 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
+index 8925f5279e627..7bc6761f51354 100644
+--- a/drivers/iio/accel/bma180.c
++++ b/drivers/iio/accel/bma180.c
+@@ -986,8 +986,9 @@ static int bma180_probe(struct i2c_client *client)
+ }
+
+ ret = devm_request_irq(dev, client->irq,
+- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING,
+- "bma180_event", data->trig);
++ iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "bma180_event", data->trig);
+ if (ret) {
+ dev_err(dev, "unable to request IRQ\n");
+ goto err_trigger_free;
+diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c
+index 4d570383ef025..1e6bfe8765ab3 100644
+--- a/drivers/iio/adc/ad7766.c
++++ b/drivers/iio/adc/ad7766.c
+@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi)
+ * don't enable the interrupt to avoid extra load on the system
+ */
+ ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq,
+- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD,
+ dev_name(&spi->dev),
+ ad7766->trig);
+ if (ret < 0)
+diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
+index a624400a239cb..cf97adfa97274 100644
+--- a/drivers/iio/gyro/itg3200_buffer.c
++++ b/drivers/iio/gyro/itg3200_buffer.c
+@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev)
+ if (!st->trig)
+ return -ENOMEM;
+
+- ret = request_irq(st->i2c->irq,
+- &iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_RISING,
+- "itg3200_data_rdy",
+- st->trig);
++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "itg3200_data_rdy", st->trig);
+ if (ret)
+ goto error_free_trig;
+
+diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c
+index f8eb251eca8dc..ef0abc4499b74 100644
+--- a/drivers/iio/light/si1145.c
++++ b/drivers/iio/light/si1145.c
+@@ -1248,7 +1248,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev)
+
+ ret = devm_request_irq(&client->dev, client->irq,
+ iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_FALLING,
++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD,
+ "si1145_irq",
+ trig);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From b901bfeeb6a96413d3903e1e691ad17e4fca4114 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 15:54:06 +0100
+Subject: include: uapi: netfilter_bridge.h: Cover for musl libc
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ]
+
+Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
+zero. To avoid struct redefinition errors, user space is therefore
+supposed to include netinet/if_ether.h before (or instead of)
+linux/if_ether.h. To relieve them from this burden, include the libc
+header here if not building for kernel space.
+
+Reported-by: Alyssa Ross <hi@alyssa.is>
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter_bridge.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 1610fdbab98df..ad520d3e9df8f 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -5,6 +5,10 @@
+ /* bridge-specific defines for netfilter.
+ */
+
++#ifndef __KERNEL__
++#include <netinet/if_ether.h> /* for __UAPI_DEF_ETHHDR if defined */
++#endif
++
+ #include <linux/in.h>
+ #include <linux/netfilter.h>
+ #include <linux/if_ether.h>
+--
+2.51.0
+
--- /dev/null
+From 5ce5a34ba154aba802ffc6e860b0c368930c6870 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 09:53:43 -0700
+Subject: io_uring/timeout: annotate data race in io_flush_timeouts()
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 42b12cb5fd4554679bac06bbdd05dc8b643bcc42 ]
+
+syzbot correctly reports this as a KCSAN race, as ctx->cached_cq_tail
+should be read under ->uring_lock. This isn't immediately feasible in
+io_flush_timeouts(), but as long as we read a stable value, that should
+be good enough. If two io-wq threads compete on this value, then they
+will both end up calling io_flush_timeouts() and at least one of them
+will see the correct value.
+
+Reported-by: syzbot+6c48db7d94402407301e@syzkaller.appspotmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/timeout.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/timeout.c b/io_uring/timeout.c
+index 17e3aab0af367..cd42316d0f3c0 100644
+--- a/io_uring/timeout.c
++++ b/io_uring/timeout.c
+@@ -129,7 +129,7 @@ __cold void io_flush_timeouts(struct io_ring_ctx *ctx)
+ u32 seq;
+
+ raw_spin_lock_irq(&ctx->timeout_lock);
+- seq = ctx->cached_cq_tail - atomic_read(&ctx->cq_timeouts);
++ seq = READ_ONCE(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts);
+
+ list_for_each_entry_safe(timeout, tmp, &ctx->timeout_list, list) {
+ struct io_kiocb *req = cmd_to_io_kiocb(timeout);
+--
+2.51.0
+
--- /dev/null
+From 5f14236cefc0730088dad53e4966fcb5153c9e4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 14:39:40 +0000
+Subject: iommu/amd: move wait_on_sem() out of spinlock
+
+From: Ankit Soni <Ankit.Soni@amd.com>
+
+[ Upstream commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf ]
+
+With iommu.strict=1, the existing completion wait path can cause soft
+lockups under stressed environment, as wait_on_sem() busy-waits under the
+spinlock with interrupts disabled.
+
+Move the completion wait in iommu_completion_wait() out of the spinlock.
+wait_on_sem() only polls the hardware-updated cmd_sem and does not require
+iommu->lock, so holding the lock during the busy wait unnecessarily
+increases contention and extends the time with interrupts disabled.
+
+Signed-off-by: Ankit Soni <Ankit.Soni@amd.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 30dd482fe0953..3f2b687947dba 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -1156,7 +1156,12 @@ static int wait_on_sem(struct amd_iommu *iommu, u64 data)
+ {
+ int i = 0;
+
+- while (*iommu->cmd_sem != data && i < LOOP_TIMEOUT) {
++ /*
++ * cmd_sem holds a monotonically non-decreasing completion sequence
++ * number.
++ */
++ while ((__s64)(READ_ONCE(*iommu->cmd_sem) - data) < 0 &&
++ i < LOOP_TIMEOUT) {
+ udelay(1);
+ i += 1;
+ }
+@@ -1401,14 +1406,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+
+ ret = __iommu_queue_command_sync(iommu, &cmd, false);
++ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++
+ if (ret)
+- goto out_unlock;
++ return ret;
+
+ ret = wait_on_sem(iommu, data);
+
+-out_unlock:
+- raw_spin_unlock_irqrestore(&iommu->lock, flags);
+-
+ return ret;
+ }
+
+@@ -3088,13 +3092,18 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+ ret = __iommu_queue_command_sync(iommu, &cmd, true);
+ if (ret)
+- goto out;
++ goto out_err;
+ ret = __iommu_queue_command_sync(iommu, &cmd2, false);
+ if (ret)
+- goto out;
++ goto out_err;
++ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++
+ wait_on_sem(iommu, data);
+-out:
++ return;
++
++out_err:
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++ return;
+ }
+
+ static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data)
+--
+2.51.0
+
--- /dev/null
+From 3dd3ccaafea5d287da053d08c89378b93fb74bce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 15:30:38 +0000
+Subject: iommu/amd: serialize sequence allocation under concurrent TLB
+ invalidations
+
+From: Ankit Soni <Ankit.Soni@amd.com>
+
+[ Upstream commit 9e249c48412828e807afddc21527eb734dc9bd3d ]
+
+With concurrent TLB invalidations, completion wait randomly gets timed out
+because cmd_sem_val was incremented outside the IOMMU spinlock, allowing
+CMD_COMPL_WAIT commands to be queued out of sequence and breaking the
+ordering assumption in wait_on_sem().
+Move the cmd_sem_val increment under iommu->lock so completion sequence
+allocation is serialized with command queuing.
+And remove the unnecessary return.
+
+Fixes: d2a0cac10597 ("iommu/amd: move wait_on_sem() out of spinlock")
+
+Tested-by: Srikanth Aithal <sraithal@amd.com>
+Reported-by: Srikanth Aithal <sraithal@amd.com>
+Signed-off-by: Ankit Soni <Ankit.Soni@amd.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/amd_iommu_types.h | 2 +-
+ drivers/iommu/amd/init.c | 2 +-
+ drivers/iommu/amd/iommu.c | 18 ++++++++++++------
+ 3 files changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
+index a698a2e7ce2a6..b0d919cd1a8fb 100644
+--- a/drivers/iommu/amd/amd_iommu_types.h
++++ b/drivers/iommu/amd/amd_iommu_types.h
+@@ -791,7 +791,7 @@ struct amd_iommu {
+
+ u32 flags;
+ volatile u64 *cmd_sem;
+- atomic64_t cmd_sem_val;
++ u64 cmd_sem_val;
+ /*
+ * Track physical address to directly use it in build_completion_wait()
+ * and avoid adding any special checks and handling for kdump.
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 53afb1cb0a6fc..76efd74124b33 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -1879,7 +1879,7 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h,
+ iommu->pci_seg = pci_seg;
+
+ raw_spin_lock_init(&iommu->lock);
+- atomic64_set(&iommu->cmd_sem_val, 0);
++ iommu->cmd_sem_val = 0;
+
+ /* Add IOMMU to internal data structures */
+ list_add_tail(&iommu->list, &amd_iommu_list);
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 3f2b687947dba..4beef73139611 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -1386,6 +1386,12 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd)
+ return iommu_queue_command_sync(iommu, cmd, true);
+ }
+
++static u64 get_cmdsem_val(struct amd_iommu *iommu)
++{
++ lockdep_assert_held(&iommu->lock);
++ return ++iommu->cmd_sem_val;
++}
++
+ /*
+ * This function queues a completion wait command into the command
+ * buffer of an IOMMU
+@@ -1400,11 +1406,11 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
+ if (!iommu->need_sync)
+ return 0;
+
+- data = atomic64_inc_return(&iommu->cmd_sem_val);
+- build_completion_wait(&cmd, iommu, data);
+-
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+
++ data = get_cmdsem_val(iommu);
++ build_completion_wait(&cmd, iommu, data);
++
+ ret = __iommu_queue_command_sync(iommu, &cmd, false);
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
+
+@@ -3086,10 +3092,11 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
+ return;
+
+ build_inv_irt(&cmd, devid);
+- data = atomic64_inc_return(&iommu->cmd_sem_val);
+- build_completion_wait(&cmd2, iommu, data);
+
+ raw_spin_lock_irqsave(&iommu->lock, flags);
++ data = get_cmdsem_val(iommu);
++ build_completion_wait(&cmd2, iommu, data);
++
+ ret = __iommu_queue_command_sync(iommu, &cmd, true);
+ if (ret)
+ goto out_err;
+@@ -3103,7 +3110,6 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
+
+ out_err:
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
+- return;
+ }
+
+ static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data)
+--
+2.51.0
+
--- /dev/null
+From 47ae6ff32e4dde21214f27da42b73ef9e14103db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 13:28:57 -0800
+Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
+
+From: Alexander Grest <Alexander.Grest@microsoft.com>
+
+[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ]
+
+The SMMU CMDQ lock is highly contentious when there are multiple CPUs
+issuing commands and the queue is nearly full.
+
+The lock has the following states:
+ - 0: Unlocked
+ - >0: Shared lock held with count
+ - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters
+ - INT_MIN: Exclusive lock held, no shared waiters
+
+When multiple CPUs are polling for space in the queue, they attempt to
+grab the exclusive lock to update the cons pointer from the hardware. If
+they fail to get the lock, they will spin until either the cons pointer
+is updated by another CPU.
+
+The current code allows the possibility of shared lock starvation
+if there is a constant stream of CPUs trying to grab the exclusive lock.
+This leads to severe latency issues and soft lockups.
+
+Consider the following scenario where CPU1's attempt to acquire the
+shared lock is starved by CPU2 and CPU0 contending for the exclusive
+lock.
+
+CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock`
+--------------------------------------------------------------------------
+trylock() //takes | | | 0
+ | shared_lock() | | INT_MIN
+ | fetch_inc() | | INT_MIN
+ | no return | | INT_MIN + 1
+ | spins // VAL >= 0 | | INT_MIN + 1
+unlock() | spins... | | INT_MIN + 1
+set_release(0) | spins... | | 0 see[NOTE]
+(done) | (sees 0) | trylock() // takes | 0
+ | *exits loop* | cmpxchg(0, INT_MIN) | 0
+ | | *cuts in* | INT_MIN
+ | cmpxchg(0, 1) | | INT_MIN
+ | fails // != 0 | | INT_MIN
+ | spins // VAL >= 0 | | INT_MIN
+ | *starved* | | INT_MIN
+
+[NOTE] The current code resets the exclusive lock to 0 regardless of the
+state of the lock. This causes two problems:
+1. It opens the possibility of back-to-back exclusive locks and the
+ downstream effect of starving shared lock.
+2. The count of shared lock waiters are lost.
+
+To mitigate this, we release the exclusive lock by only clearing the sign
+bit while retaining the shared lock waiter count as a way to avoid
+starving the shared lock waiters.
+
+Also deleted cmpxchg loop while trying to acquire the shared lock as it
+is not needed. The waiters can see the positive lock count and proceed
+immediately after the exclusive lock is released.
+
+Exclusive lock is not starved in that submitters will try exclusive lock
+first when new spaces become available.
+
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Alexander Grest <Alexander.Grest@microsoft.com>
+Signed-off-by: Jacob Pan <jacob.pan@linux.microsoft.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++-------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+index 9780f40ba3e65..b4f757e1f105f 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+@@ -487,20 +487,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
+ */
+ static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq)
+ {
+- int val;
+-
+ /*
+- * We can try to avoid the cmpxchg() loop by simply incrementing the
+- * lock counter. When held in exclusive state, the lock counter is set
+- * to INT_MIN so these increments won't hurt as the value will remain
+- * negative.
++ * When held in exclusive state, the lock counter is set to INT_MIN
++ * so these increments won't hurt as the value will remain negative.
++ * The increment will also signal the exclusive locker that there are
++ * shared waiters.
+ */
+ if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0)
+ return;
+
+- do {
+- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0);
+- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val);
++ /*
++ * Someone else is holding the lock in exclusive state, so wait
++ * for them to finish. Since we already incremented the lock counter,
++ * no exclusive lock can be acquired until we finish. We don't need
++ * the return value since we only care that the exclusive lock is
++ * released (i.e. the lock counter is non-negative).
++ * Once the exclusive locker releases the lock, the sign bit will
++ * be cleared and our increment will make the lock counter positive,
++ * allowing us to proceed.
++ */
++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0);
+ }
+
+ static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq)
+@@ -527,9 +533,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq)
+ __ret; \
+ })
+
++/*
++ * Only clear the sign bit when releasing the exclusive lock this will
++ * allow any shared_lock() waiters to proceed without the possibility
++ * of entering the exclusive lock in a tight loop.
++ */
+ #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \
+ ({ \
+- atomic_set_release(&cmdq->lock, 0); \
++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \
+ local_irq_restore(flags); \
+ })
+
+--
+2.51.0
+
--- /dev/null
+From 7e51782b4025b68937111da0622e4ac31125c8db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 04:35:24 +0000
+Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ]
+
+syzbot reported that struct fib_alias.fa_state can be
+modified locklessly by RCU readers. [0]
+
+Let's use READ_ONCE()/WRITE_ONCE() properly.
+
+[0]:
+BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup
+
+write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0:
+ fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline]
+ fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1:
+ fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline]
+ fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+value changed: 0x00 -> 0x01
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
+
+Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/fib_lookup.h | 6 ++++--
+ net/ipv4/fib_trie.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
+index f9b9e26c32c19..0b72796dd1ad3 100644
+--- a/net/ipv4/fib_lookup.h
++++ b/net/ipv4/fib_lookup.h
+@@ -28,8 +28,10 @@ struct fib_alias {
+ /* Don't write on fa_state unless needed, to keep it shared on all cpus */
+ static inline void fib_alias_accessed(struct fib_alias *fa)
+ {
+- if (!(fa->fa_state & FA_S_ACCESSED))
+- fa->fa_state |= FA_S_ACCESSED;
++ u8 fa_state = READ_ONCE(fa->fa_state);
++
++ if (!(fa_state & FA_S_ACCESSED))
++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED);
+ }
+
+ /* Exported by fib_semantics.c */
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 7e2c17fec3fc4..1308213791f19 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1280,7 +1280,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
+ new_fa->fa_dscp = fa->fa_dscp;
+ new_fa->fa_info = fi;
+ new_fa->fa_type = cfg->fc_type;
+- state = fa->fa_state;
++ state = READ_ONCE(fa->fa_state);
+ new_fa->fa_state = state & ~FA_S_ACCESSED;
+ new_fa->fa_slen = fa->fa_slen;
+ new_fa->tb_id = tb->tb_id;
+@@ -1745,7 +1745,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb,
+
+ fib_remove_alias(t, tp, l, fa_to_delete);
+
+- if (fa_to_delete->fa_state & FA_S_ACCESSED)
++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED)
+ rt_cache_flush(cfg->fc_nlinfo.nl_net);
+
+ fib_release_info(fa_to_delete->fa_info);
+--
+2.51.0
+
--- /dev/null
+From 3259511fa674937c85d5794677347cb457205c05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 17:22:47 +0000
+Subject: ipv4: igmp: annotate data-races around idev->mr_maxdelay
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit e4faaf65a75f650ac4366ddff5dabb826029ca5a ]
+
+idev->mr_maxdelay is read and written locklessly,
+add READ_ONCE()/WRITE_ONCE() annotations.
+
+While we are at it, make this field an u32.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/inetdevice.h | 2 +-
+ net/ipv4/igmp.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index 5730ba6b1cfaf..dccbeb25f7014 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -38,11 +38,11 @@ struct in_device {
+ struct ip_mc_list *mc_tomb;
+ unsigned long mr_v1_seen;
+ unsigned long mr_v2_seen;
+- unsigned long mr_maxdelay;
+ unsigned long mr_qi; /* Query Interval */
+ unsigned long mr_qri; /* Query Response Interval */
+ unsigned char mr_qrv; /* Query Robustness Variable */
+ unsigned char mr_gq_running;
++ u32 mr_maxdelay;
+ u32 mr_ifc_count;
+ struct timer_list mr_gq_timer; /* general query timer */
+ struct timer_list mr_ifc_timer; /* interface change timer */
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 7182f1419c2a4..0adc993c211d7 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -227,7 +227,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
+
+ static void igmp_gq_start_timer(struct in_device *in_dev)
+ {
+- int tv = get_random_u32_below(in_dev->mr_maxdelay);
++ int tv = get_random_u32_below(READ_ONCE(in_dev->mr_maxdelay));
+ unsigned long exp = jiffies + tv + 2;
+
+ if (in_dev->mr_gq_running &&
+@@ -1009,7 +1009,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
+ if (!max_delay)
+ max_delay = 1; /* can't mod w/ 0 */
+- in_dev->mr_maxdelay = max_delay;
++ WRITE_ONCE(in_dev->mr_maxdelay, max_delay);
+
+ /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently
+ * received value was zero, use the default or statically
+--
+2.51.0
+
--- /dev/null
+From e4aaf6cb6bc66b9e115e6360046ef7ffd4df70e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:37 +0000
+Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ]
+
+Add missing READ_ONCE() when reading sysctl values.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ipv6.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index f0936df7567e3..7e984e75f3345 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -1010,11 +1010,11 @@ static inline int ip6_default_np_autolabel(struct net *net)
+ #if IS_ENABLED(CONFIG_IPV6)
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_policy;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy);
+ }
+ static inline u32 ip6_multipath_hash_fields(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_fields;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields);
+ }
+ #else
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+--
+2.51.0
+
--- /dev/null
+From bb132ce3c22498c77e294b0b3960b1e243c655ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:41 +0000
+Subject: ipv6: annotate data-races in net/ipv6/route.c
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f062e8e25102324364aada61b8283356235bc3c1 ]
+
+sysctls are read while their values can change,
+add READ_ONCE() annotations.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-9-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index e3a260a5564ba..cd229974b7974 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2895,7 +2895,7 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu)
+
+ dst_metric_set(&rt->dst, RTAX_MTU, mtu);
+ rt->rt6i_flags |= RTF_MODIFIED;
+- rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
++ rt6_update_expires(rt, READ_ONCE(net->ipv6.sysctl.ip6_rt_mtu_expires));
+ }
+
+ static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
+@@ -3256,8 +3256,8 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
+ rcu_read_lock();
+
+ net = dst_dev_net_rcu(dst);
+- if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
+- mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
++ mtu = max_t(unsigned int, mtu,
++ READ_ONCE(net->ipv6.sysctl.ip6_rt_min_advmss));
+
+ rcu_read_unlock();
+
+@@ -3359,10 +3359,10 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
+ static void ip6_dst_gc(struct dst_ops *ops)
+ {
+ struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
+- int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
+- int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
+- int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
+- unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
++ int rt_min_interval = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_min_interval);
++ int rt_elasticity = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_elasticity);
++ int rt_gc_timeout = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_timeout);
++ unsigned long rt_last_gc = READ_ONCE(net->ipv6.ip6_rt_last_gc);
+ unsigned int val;
+ int entries;
+
+@@ -5008,7 +5008,7 @@ void rt6_sync_down_dev(struct net_device *dev, unsigned long event)
+ };
+ struct net *net = dev_net(dev);
+
+- if (net->ipv6.sysctl.skip_notify_on_dev_down)
++ if (READ_ONCE(net->ipv6.sysctl.skip_notify_on_dev_down))
+ fib6_clean_all_skip_notify(net, fib6_ifdown, &arg);
+ else
+ fib6_clean_all(net, fib6_ifdown, &arg);
+@@ -6408,6 +6408,7 @@ void fib6_rt_update(struct net *net, struct fib6_info *rt,
+ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,
+ bool offload, bool trap, bool offload_failed)
+ {
++ u8 fib_notify_on_flag_change;
+ struct sk_buff *skb;
+ int err;
+
+@@ -6419,8 +6420,9 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,
+ WRITE_ONCE(f6i->offload, offload);
+ WRITE_ONCE(f6i->trap, trap);
+
++ fib_notify_on_flag_change = READ_ONCE(net->ipv6.sysctl.fib_notify_on_flag_change);
+ /* 2 means send notifications only if offload_failed was changed. */
+- if (net->ipv6.sysctl.fib_notify_on_flag_change == 2 &&
++ if (fib_notify_on_flag_change == 2 &&
+ READ_ONCE(f6i->offload_failed) == offload_failed)
+ return;
+
+@@ -6432,7 +6434,7 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,
+ */
+ return;
+
+- if (!net->ipv6.sysctl.fib_notify_on_flag_change)
++ if (!fib_notify_on_flag_change)
+ return;
+
+ skb = nlmsg_new(rt6_nlmsg_size(f6i), GFP_KERNEL);
+@@ -6529,7 +6531,7 @@ static int ipv6_sysctl_rtcache_flush(const struct ctl_table *ctl, int write,
+ return ret;
+
+ net = (struct net *)ctl->extra1;
+- delay = net->ipv6.sysctl.flush_delay;
++ delay = READ_ONCE(net->ipv6.sysctl.flush_delay);
+ fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 4855836bda620f1442a76923e1869d0d4310c902 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:38 +0000
+Subject: ipv6: annotate data-races over sysctl.flowlabel_reflect
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5ade47c974b46eb2a1279185962a0ffa15dc5450 ]
+
+Add missing READ_ONCE() when reading ipv6.sysctl.flowlabel_reflect,
+as its value can be changed under us.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-6-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/af_inet6.c | 4 ++--
+ net/ipv6/icmp.c | 3 ++-
+ net/ipv6/tcp_ipv6.c | 3 ++-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index 0e8f48835869c..3709f213d33de 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -224,8 +224,8 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
+ inet6_set_bit(MC6_LOOP, sk);
+ inet6_set_bit(MC6_ALL, sk);
+ np->pmtudisc = IPV6_PMTUDISC_WANT;
+- inet6_assign_bit(REPFLOW, sk, net->ipv6.sysctl.flowlabel_reflect &
+- FLOWLABEL_REFLECT_ESTABLISHED);
++ inet6_assign_bit(REPFLOW, sk, READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
++ FLOWLABEL_REFLECT_ESTABLISHED);
+ sk->sk_ipv6only = net->ipv6.sysctl.bindv6only;
+ sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash);
+
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index 35b32dcf581ff..54ad4c7578679 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -757,7 +757,8 @@ static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb)
+ tmp_hdr.icmp6_type = type;
+
+ memset(&fl6, 0, sizeof(fl6));
+- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
++ FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
+ fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb));
+
+ fl6.flowi6_proto = IPPROTO_ICMPV6;
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 59c4977a811a0..2e07dba293b41 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1131,7 +1131,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb,
+ txhash = inet_twsk(sk)->tw_txhash;
+ }
+ } else {
+- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_TCP_RESET)
++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
++ FLOWLABEL_REFLECT_TCP_RESET)
+ label = ip6_flowlabel(ipv6h);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a71f67f532cdca28c74f05c595d2fee24cdbbd7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:40 +0000
+Subject: ipv6: exthdrs: annotate data-race over multiple sysctl
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ]
+
+Following four sysctls can change under us, add missing READ_ONCE().
+
+- ipv6.sysctl.max_dst_opts_len
+- ipv6.sysctl.max_dst_opts_cnt
+- ipv6.sysctl.max_hbh_opts_len
+- ipv6.sysctl.max_hbh_opts_cnt
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/exthdrs.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index a23eb8734e151..54088fa0c09d0 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -314,7 +314,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_dst_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len))
+ goto fail_and_free;
+
+ opt->lastopt = opt->dst1 = skb_network_header_len(skb);
+@@ -322,7 +322,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ dstbuf = opt->dst1;
+ #endif
+
+- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) {
++ if (ip6_parse_tlv(false, skb,
++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ #if IS_ENABLED(CONFIG_IPV6_MIP6)
+@@ -1049,11 +1050,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len))
+ goto fail_and_free;
+
+ opt->flags |= IP6SKB_HOPBYHOP;
+- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) {
++ if (ip6_parse_tlv(true, skb,
++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ opt->nhoff = sizeof(struct ipv6hdr);
+--
+2.51.0
+
--- /dev/null
+From 0f4e6f187b5f431babfd56046d28030a87e6c5c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:07:40 +0800
+Subject: irqchip/riscv-imsic: Add a CPU pm notifier to restore the IMSIC on
+ exit
+
+From: Nick Hu <nick.hu@sifive.com>
+
+[ Upstream commit f48b4bd0915bf61ac12b8c65c7939ebd03bc8abf ]
+
+The IMSIC might be reset when the system enters a low power state, but on
+exit nothing restores the registers, which prevents interrupt delivery.
+
+Solve this by registering a CPU power management notifier, which restores
+the IMSIC on exit.
+
+Signed-off-by: Nick Hu <nick.hu@sifive.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Reviewed-by: Cyan Yang <cyan.yang@sifive.com>
+Reviewed-by: Anup Patel <anup@brainfault.org>
+Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
+Link: https://patch.msgid.link/20251202-preserve-aplic-imsic-v3-1-1844fbf1fe92@sifive.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-riscv-imsic-early.c | 39 ++++++++++++++++++++-----
+ 1 file changed, 31 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/irqchip/irq-riscv-imsic-early.c b/drivers/irqchip/irq-riscv-imsic-early.c
+index 2c4c682627b8c..d1727c343c38f 100644
+--- a/drivers/irqchip/irq-riscv-imsic-early.c
++++ b/drivers/irqchip/irq-riscv-imsic-early.c
+@@ -7,6 +7,7 @@
+ #define pr_fmt(fmt) "riscv-imsic: " fmt
+ #include <linux/acpi.h>
+ #include <linux/cpu.h>
++#include <linux/cpu_pm.h>
+ #include <linux/export.h>
+ #include <linux/interrupt.h>
+ #include <linux/init.h>
+@@ -128,14 +129,8 @@ static void imsic_handle_irq(struct irq_desc *desc)
+ chained_irq_exit(chip, desc);
+ }
+
+-static int imsic_starting_cpu(unsigned int cpu)
++static void imsic_hw_states_init(void)
+ {
+- /* Mark per-CPU IMSIC state as online */
+- imsic_state_online();
+-
+- /* Enable per-CPU parent interrupt */
+- enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq));
+-
+ /* Setup IPIs */
+ imsic_ipi_starting_cpu();
+
+@@ -147,6 +142,18 @@ static int imsic_starting_cpu(unsigned int cpu)
+
+ /* Enable local interrupt delivery */
+ imsic_local_delivery(true);
++}
++
++static int imsic_starting_cpu(unsigned int cpu)
++{
++ /* Mark per-CPU IMSIC state as online */
++ imsic_state_online();
++
++ /* Enable per-CPU parent interrupt */
++ enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq));
++
++ /* Initialize the IMSIC registers to enable the interrupt delivery */
++ imsic_hw_states_init();
+
+ return 0;
+ }
+@@ -162,6 +169,22 @@ static int imsic_dying_cpu(unsigned int cpu)
+ return 0;
+ }
+
++static int imsic_pm_notifier(struct notifier_block *self, unsigned long cmd, void *v)
++{
++ switch (cmd) {
++ case CPU_PM_EXIT:
++ /* Initialize the IMSIC registers to enable the interrupt delivery */
++ imsic_hw_states_init();
++ break;
++ }
++
++ return NOTIFY_OK;
++}
++
++static struct notifier_block imsic_pm_notifier_block = {
++ .notifier_call = imsic_pm_notifier,
++};
++
+ static int __init imsic_early_probe(struct fwnode_handle *fwnode)
+ {
+ struct irq_domain *domain;
+@@ -199,7 +222,7 @@ static int __init imsic_early_probe(struct fwnode_handle *fwnode)
+ cpuhp_setup_state(CPUHP_AP_IRQ_RISCV_IMSIC_STARTING, "irqchip/riscv/imsic:starting",
+ imsic_starting_cpu, imsic_dying_cpu);
+
+- return 0;
++ return cpu_pm_register_notifier(&imsic_pm_notifier_block);
+ }
+
+ static int __init imsic_early_dt_init(struct device_node *node, struct device_node *parent)
+--
+2.51.0
+
--- /dev/null
+From f404281c8e3cb4add36a0f2c28ddd1644cc93078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 19:38:01 +0800
+Subject: jfs: Add missing set_freezable() for freezable kthread
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ]
+
+The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(),
+causing it to remain non-freezable by default. This prevents proper
+freezing during system suspend.
+
+Add set_freezable() to make the thread freezable as intended.
+
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_logmgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
+index b343c5ea11592..5b1c5da041630 100644
+--- a/fs/jfs/jfs_logmgr.c
++++ b/fs/jfs/jfs_logmgr.c
+@@ -2311,6 +2311,7 @@ int jfsIOWait(void *arg)
+ {
+ struct lbuf *bp;
+
++ set_freezable();
+ do {
+ spin_lock_irq(&log_redrive_lock);
+ while ((bp = log_redrive_list)) {
+--
+2.51.0
+
--- /dev/null
+From c6a7f8a206b8fa7e6c58b634e55005a5916c81cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 13:22:12 +0100
+Subject: jfs: nlink overflow in jfs_rename
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ]
+
+If nlink is maximal for a directory (-1) and inside that directory you
+perform a rename for some child directory (not moving from the parent),
+then the nlink of the first directory is first incremented and later
+decremented. Normally this is fine, but when nlink = -1 this causes a
+wrap around to 0, and then drop_nlink issues a warning.
+
+After applying the patch syzbot no longer issues any warnings. I also
+ran some basic fs tests to look for any regressions.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
+Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/namei.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
+index 65a218eba8faf..7879c049632b3 100644
+--- a/fs/jfs/namei.c
++++ b/fs/jfs/namei.c
+@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ jfs_err("jfs_rename: dtInsert returned -EIO");
+ goto out_tx;
+ }
+- if (S_ISDIR(old_ip->i_mode))
++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
+ inc_nlink(new_dir);
+ }
+ /*
+@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ goto out_tx;
+ }
+ if (S_ISDIR(old_ip->i_mode)) {
+- drop_nlink(old_dir);
++ if (new_ip || old_dir != new_dir)
++ drop_nlink(old_dir);
++
+ if (old_dir != new_dir) {
+ /*
+ * Change inode number of parent for moved directory
+--
+2.51.0
+
--- /dev/null
+From 6e5f11b40f09962aec3cf7a39a4cde162c60a927 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 14:20:22 +0530
+Subject: kselftest/kublk: include message in _Static_assert for C11
+ compatibility
+
+From: Clint George <clintbgeorge@gmail.com>
+
+[ Upstream commit 3e6ad272bb8b3199bad952e7b077102af2d8df03 ]
+
+Add descriptive message in the _Static_assert to comply with the C11
+standard requirement to prevent compiler from throwing out error. The
+compiler throws an error when _Static_assert is used without a message as
+that is a C23 extension.
+
+[] Testing:
+The diff between before and after of running the kselftest test of the
+module shows no regression on system with x86 architecture
+
+[] Error log:
+~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk$ make LLVM=1 W=1
+ CC kublk
+In file included from kublk.c:6:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from null.c:3:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from file_backed.c:3:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from common.c:3:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from stripe.c:3:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from fault_inject.c:11:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+make: *** [../lib.mk:225: ~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk/kublk] Error 1
+
+Link: https://lore.kernel.org/r/20251215085022.7642-1-clintbgeorge@gmail.com
+Signed-off-by: Clint George <clintbgeorge@gmail.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ublk/kublk.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ublk/kublk.h b/tools/testing/selftests/ublk/kublk.h
+index 1b8833a400643..39839c711c797 100644
+--- a/tools/testing/selftests/ublk/kublk.h
++++ b/tools/testing/selftests/ublk/kublk.h
+@@ -220,7 +220,7 @@ static inline __u64 build_user_data(unsigned tag, unsigned op,
+ unsigned tgt_data, unsigned q_id, unsigned is_target_io)
+ {
+ /* we only have 7 bits to encode q_id */
+- _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
++ _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7, "UBLK_MAX_QUEUES_SHIFT must be <= 7");
+ assert(!(tag >> 16) && !(op >> 8) && !(tgt_data >> 16) && !(q_id >> 7));
+
+ return tag | (op << 16) | (tgt_data << 24) |
+--
+2.51.0
+
--- /dev/null
+From e1a757e542bda69486513a0d7a4aedaf7b09a5ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 16:30:50 +0200
+Subject: libceph: define and enforce CEPH_MAX_KEY_LEN
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ]
+
+When decoding the key, verify that the key material would fit into
+a fixed-size buffer in process_auth_done() and generally has a sane
+length.
+
+The new CEPH_MAX_KEY_LEN check replaces the existing check for a key
+with no key material which is a) not universal since CEPH_CRYPTO_NONE
+has to be excluded and b) doesn't provide much value since a smaller
+than needed key is just as invalid as no key -- this has to be handled
+elsewhere anyway.
+
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/crypto.c | 8 +++++---
+ net/ceph/crypto.h | 2 +-
+ net/ceph/messenger_v2.c | 2 +-
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
+index 01b2ce1e8fc06..5601732cf4faa 100644
+--- a/net/ceph/crypto.c
++++ b/net/ceph/crypto.c
+@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf)
+ return -ENOTSUPP;
+ }
+
+- if (!key->len)
+- return -EINVAL;
+-
+ key->key = kmemdup(buf, key->len, GFP_NOIO);
+ if (!key->key) {
+ ret = -ENOMEM;
+@@ -83,6 +80,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
+ ceph_decode_copy(p, &key->created, sizeof(key->created));
+ key->len = ceph_decode_16(p);
+ ceph_decode_need(p, end, key->len, bad);
++ if (key->len > CEPH_MAX_KEY_LEN) {
++ pr_err("secret too big %d\n", key->len);
++ return -EINVAL;
++ }
++
+ ret = set_secret(key, *p);
+ memzero_explicit(*p, key->len);
+ *p += key->len;
+diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h
+index 23de29fc613cf..a20bad6d1e964 100644
+--- a/net/ceph/crypto.h
++++ b/net/ceph/crypto.h
+@@ -5,7 +5,7 @@
+ #include <linux/ceph/types.h>
+ #include <linux/ceph/buffer.h>
+
+-#define CEPH_KEY_LEN 16
++#define CEPH_MAX_KEY_LEN 16
+ #define CEPH_MAX_CON_SECRET_LEN 64
+
+ /*
+diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
+index 061eaa047f765..b67f2b582bc76 100644
+--- a/net/ceph/messenger_v2.c
++++ b/net/ceph/messenger_v2.c
+@@ -2361,7 +2361,7 @@ static int process_auth_reply_more(struct ceph_connection *con,
+ */
+ static int process_auth_done(struct ceph_connection *con, void *p, void *end)
+ {
+- u8 session_key_buf[CEPH_KEY_LEN + 16];
++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16];
+ u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16];
+ u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16);
+ u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16);
+--
+2.51.0
+
--- /dev/null
+From 24e1b649a45929a13c96ecd4ec10bf59a9961b9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:09:18 -0800
+Subject: libperf build: Always place libperf includes first
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ]
+
+When building tools/perf the CFLAGS can contain a directory for the
+installed headers.
+
+As the headers may be being installed while building libperf.a this can
+cause headers to be partially installed and found in the include path
+while building an object file for libperf.a.
+
+The installed header may reference other installed headers that are
+missing given the partial nature of the install and then the build fails
+with a missing header file.
+
+Avoid this by ensuring the libperf source headers are always first in
+the CFLAGS.
+
+Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index 7fbb50b74c00b..5c64122bf5374 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -51,9 +51,9 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
++override CFLAGS := $(INCLUDES) $(CFLAGS)
+ override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+-override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += $(EXTRA_CFLAGS)
+--
+2.51.0
+
--- /dev/null
+From 8900937d94f412696b0fcdf86ae9f30fd68c518d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 16:36:32 -0500
+Subject: libsubcmd: Fix null intersection case in exclude_cmds()
+
+From: Sri Jayaramappa <sjayaram@akamai.com>
+
+[ Upstream commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8 ]
+
+When there is no exclusion occurring from the cmds list - for example -
+cmds contains ["read-vdso32"] and excludes contains ["archive"] - the
+main loop completes with ci == cj == 0. In the original code the loop
+processing the remaining elements in the list was conditional:
+
+ if (ci != cj) { ...}
+
+So we end up in the assertion loop since ci < cmds->cnt and we
+incorrectly try to assert the list elements to be NULL and fail with
+the following error
+
+ help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+Fix this by moving the if (ci != cj) check inside of a broader loop.
+If ci != cj, left shift the list elements, as before, and then
+unconditionally advance the ci and cj indicies which also covers the
+ci == cj case.
+
+Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()")
+Reviewed-by: Guilherme Amadio <amadio@gentoo.org>
+Signed-off-by: Sri Jayaramappa <sjayaram@akamai.com>
+Tested-by: Guilherme Amadio <amadio@gentoo.org>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: Joshua Hunt <johunt@akamai.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index ddaeb4eb3e249..db94aa685b73b 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -97,11 +97,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ ei++;
+ }
+ }
+- if (ci != cj) {
+- while (ci < cmds->cnt) {
+- cmds->names[cj++] = cmds->names[ci];
+- cmds->names[ci++] = NULL;
++ while (ci < cmds->cnt) {
++ if (ci != cj) {
++ cmds->names[cj] = cmds->names[ci];
++ cmds->names[ci] = NULL;
+ }
++ ci++;
++ cj++;
+ }
+ for (ci = cj; ci < cmds->cnt; ci++)
+ assert(cmds->names[ci] == NULL);
+--
+2.51.0
+
--- /dev/null
+From e668f65c6bc53f811672b6c75dc3bc0523e504bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Dec 2025 21:04:01 +0900
+Subject: m68k: nommu: fix memmove() with differently aligned src and dest for
+ 68000
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ]
+
+68000 has different alignment needs to 68020+.
+memcpy() checks if the destination is aligned and does a smaller copy
+to fix the alignment and then critically for 68000 it checks if the
+source is still unaligned and if it is reverts to smaller copies.
+
+memmove() does not currently do the second part and malfunctions if
+one of the pointers is aligned and the other isn't.
+
+This is apparently getting triggered by printk. If I put breakpoints
+into the new checks added by this commit the first hit looks like this:
+
+memmove (n=205, src=0x2f3971 <printk_shared_pbufs+205>, dest=0x2f3980 <printk_shared_pbufs+220>) at arch/m68k/lib/memmove.c:82
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Signed-off-by: Greg Ungerer <gerg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/lib/memmove.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c
+index 6519f7f349f66..e33f00b02e4c0 100644
+--- a/arch/m68k/lib/memmove.c
++++ b/arch/m68k/lib/memmove.c
+@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *cdest++ = *csrc++;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *--cdest = *--csrc;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+--
+2.51.0
+
--- /dev/null
+From 84e0ccb9bc3da79b632bdb71ee92d0774f9d753a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:24 +0100
+Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ]
+
+request_threaded_irq() is invoked with a primary and a secondary handler
+and no flags are passed. The primary handler is the same as
+irq_default_primary_handler() so there is no need to have an identical
+copy.
+
+The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt
+source is not masked while the threaded handler is active. This means,
+especially on LEVEL typed interrupt lines, the interrupt can fire again
+before the threaded handler had a chance to run.
+
+Use the default primary interrupt handler by specifying NULL and set
+IRQF_ONESHOT so the interrupt source is masked until the secondary handler
+is done.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index 41f79e51d9e5a..4255fefc3a5a0 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset)
+
+ /* ====== FlexRM interrupt handler ===== */
+
+-static irqreturn_t flexrm_irq_event(int irq, void *dev_id)
+-{
+- /* We only have MSI for completions so just wakeup IRQ thread */
+- /* Ring related errors will be informed via completion descriptors */
+-
+- return IRQ_WAKE_THREAD;
+-}
+-
+ static irqreturn_t flexrm_irq_thread(int irq, void *dev_id)
+ {
+ flexrm_process_completions(dev_id);
+@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan)
+ ret = -ENODEV;
+ goto fail_free_cmpl_memory;
+ }
+- ret = request_threaded_irq(ring->irq,
+- flexrm_irq_event,
+- flexrm_irq_thread,
+- 0, dev_name(ring->mbox->dev), ring);
++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread,
++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring);
+ if (ret) {
+ dev_err(ring->mbox->dev,
+ "failed to request ring%d IRQ\n", ring->num);
+--
+2.51.0
+
--- /dev/null
+From 7940f3bb9604c10e78ea5f3286652311e48ebc23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 16:00:54 +0800
+Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP
+
+From: Jacky Bai <ping.bai@nxp.com>
+
+[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ]
+
+In current imx-mailbox driver, the MU IRQ is configured with
+'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow,
+the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx:
+fix wakeup failure from freeze mode"), if the MU IRQ is triggered after
+the priv->suspended flag has been set, the system suspend will be
+aborted.
+
+On i.MX7ULP platform, certain drivers that depend on rpmsg may need
+to send rpmsg request and receive an acknowledgment from the remote
+core during the late_suspend stage. Early suspend abort is not
+expected, and the i.MX7ULP already has additional hardware and
+software to make sure the system can be wakeup from freeze mode
+correctly when MU IRQ is trigger.
+
+Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the
+early abort when doing suspend.
+
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/imx-mailbox.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
+index 6778afc64a048..003f9236c35e0 100644
+--- a/drivers/mailbox/imx-mailbox.c
++++ b/drivers/mailbox/imx-mailbox.c
+@@ -122,6 +122,7 @@ struct imx_mu_dcfg {
+ u32 xRR; /* Receive Register0 */
+ u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */
+ u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */
++ bool skip_suspend_flag;
+ };
+
+ #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x))))
+@@ -988,6 +989,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = {
+ .xRR = 0x40,
+ .xSR = {0x60, 0x60, 0x60, 0x60},
+ .xCR = {0x64, 0x64, 0x64, 0x64, 0x64},
++ .skip_suspend_flag = true,
+ };
+
+ static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = {
+@@ -1071,7 +1073,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev)
+ priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = true;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = true;
+
+ return 0;
+ }
+@@ -1094,7 +1097,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev)
+ imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = false;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = false;
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 997f9a86e3e129575a9c1e286365089c0577635c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 13:49:22 +0000
+Subject: mailbox: mchp-ipc-sbi: fix out-of-bounds access in
+ mchp_ipc_get_cluster_aggr_irq()
+
+From: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+
+[ Upstream commit f7c330a8c83c9b0332fd524097eaf3e69148164d ]
+
+The cluster_cfg array is dynamically allocated to hold per-CPU
+configuration structures, with its size based on the number of online
+CPUs. Previously, this array was indexed using hartid, which may be
+non-contiguous or exceed the bounds of the array, leading to
+out-of-bounds access.
+Switch to using cpuid as the index, as it is guaranteed to be within
+the valid range provided by for_each_online_cpu().
+
+Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mailbox-mchp-ipc-sbi.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+index a6e52009a4245..d444491a584e8 100644
+--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c
++++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+@@ -180,20 +180,20 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data)
+ /* Find out the hart that originated the irq */
+ for_each_online_cpu(i) {
+ hartid = cpuid_to_hartid_map(i);
+- if (irq == ipc->cluster_cfg[hartid].irq)
++ if (irq == ipc->cluster_cfg[i].irq)
+ break;
+ }
+
+ status_msg.cluster = hartid;
+- memcpy(ipc->cluster_cfg[hartid].buf_base, &status_msg, sizeof(struct mchp_ipc_status));
++ memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status));
+
+- ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[hartid].buf_base_addr);
++ ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr);
+ if (ret < 0) {
+ dev_err_ratelimited(ipc->dev, "could not get IHC irq status ret=%d\n", ret);
+ return IRQ_HANDLED;
+ }
+
+- memcpy(&status_msg, ipc->cluster_cfg[hartid].buf_base, sizeof(struct mchp_ipc_status));
++ memcpy(&status_msg, ipc->cluster_cfg[i].buf_base, sizeof(struct mchp_ipc_status));
+
+ /*
+ * Iterate over each bit set in the IHC interrupt status register (IRQ_STATUS) to identify
+@@ -385,21 +385,21 @@ static int mchp_ipc_get_cluster_aggr_irq(struct mchp_ipc_sbi_mbox *ipc)
+ if (ret <= 0)
+ continue;
+
+- ipc->cluster_cfg[hartid].irq = ret;
+- ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[hartid].irq,
++ ipc->cluster_cfg[cpuid].irq = ret;
++ ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[cpuid].irq,
+ mchp_ipc_cluster_aggr_isr, IRQF_SHARED,
+ "miv-ihc-irq", ipc);
+ if (ret)
+ return ret;
+
+- ipc->cluster_cfg[hartid].buf_base = devm_kmalloc(ipc->dev,
+- sizeof(struct mchp_ipc_status),
+- GFP_KERNEL);
++ ipc->cluster_cfg[cpuid].buf_base = devm_kmalloc(ipc->dev,
++ sizeof(struct mchp_ipc_status),
++ GFP_KERNEL);
+
+- if (!ipc->cluster_cfg[hartid].buf_base)
++ if (!ipc->cluster_cfg[cpuid].buf_base)
+ return -ENOMEM;
+
+- ipc->cluster_cfg[hartid].buf_base_addr = __pa(ipc->cluster_cfg[hartid].buf_base);
++ ipc->cluster_cfg[cpuid].buf_base_addr = __pa(ipc->cluster_cfg[cpuid].buf_base);
+
+ irq_found = true;
+ }
+--
+2.51.0
+
--- /dev/null
+From 146a5d6efbba6e201a66b8fcefef146e6896734e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 10:33:59 +0000
+Subject: mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch
+ warnings
+
+From: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+
+[ Upstream commit bc4d17e495cd3b02bcb2e10f575763a5ff31f80b ]
+
+Fix uninitialized symbol 'hartid' warning in mchp_ipc_cluster_aggr_isr()
+by introducing a 'found' flag to track whether the IRQ matches any
+online hart. If no match is found, return IRQ_NONE.
+
+Also fix other smatch warnings by removing dead code in
+mchp_ipc_startup() and by returning -ENODEV in dev_err_probe() if the
+Microchip SBI extension is not found.
+
+Fixes below smatch warnings:
+drivers/mailbox/mailbox-mchp-ipc-sbi.c:187 mchp_ipc_cluster_aggr_isr() error: uninitialized symbol 'hartid'.
+drivers/mailbox/mailbox-mchp-ipc-sbi.c:324 mchp_ipc_startup() warn: ignoring unreachable code.
+drivers/mailbox/mailbox-mchp-ipc-sbi.c:422 mchp_ipc_probe() warn: passing zero to 'dev_err_probe'
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512171533.CDLdScMY-lkp@intel.com/
+Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mailbox-mchp-ipc-sbi.c | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+index d444491a584e8..b87bf2fb4b9b9 100644
+--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c
++++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+@@ -174,17 +174,21 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data)
+ struct mchp_ipc_msg ipc_msg;
+ struct mchp_ipc_status status_msg;
+ int ret;
+- unsigned long hartid;
+ u32 i, chan_index, chan_id;
++ bool found = false;
+
+ /* Find out the hart that originated the irq */
+ for_each_online_cpu(i) {
+- hartid = cpuid_to_hartid_map(i);
+- if (irq == ipc->cluster_cfg[i].irq)
++ if (irq == ipc->cluster_cfg[i].irq) {
++ found = true;
+ break;
++ }
+ }
+
+- status_msg.cluster = hartid;
++ if (unlikely(!found))
++ return IRQ_NONE;
++
++ status_msg.cluster = cpuid_to_hartid_map(i);
+ memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status));
+
+ ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr);
+@@ -321,13 +325,6 @@ static int mchp_ipc_startup(struct mbox_chan *chan)
+ goto fail_free_buf_msg_rx;
+ }
+
+- if (ret) {
+- dev_err(ipc->dev, "failed to register interrupt(s)\n");
+- goto fail_free_buf_msg_rx;
+- }
+-
+- return ret;
+-
+ fail_free_buf_msg_rx:
+ kfree(chan_info->msg_buf_rx);
+ fail_free_buf_msg_tx:
+@@ -419,7 +416,7 @@ static int mchp_ipc_probe(struct platform_device *pdev)
+
+ ret = sbi_probe_extension(SBI_EXT_MICROCHIP_TECHNOLOGY);
+ if (ret <= 0)
+- return dev_err_probe(dev, ret, "Microchip SBI extension not detected\n");
++ return dev_err_probe(dev, -ENODEV, "Microchip SBI extension not detected\n");
+
+ ipc = devm_kzalloc(dev, sizeof(*ipc), GFP_KERNEL);
+ if (!ipc)
+--
+2.51.0
+
--- /dev/null
+From 82bc39b54627771008e4f34ccd28587885db36aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 14:07:40 +0000
+Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ]
+
+The PCC code currently specifies IRQF_ONESHOT if the interrupt could
+potentially be shared but doesn't actually use request_threaded_irq() and
+the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is
+never relevant. Since commit aef30c8d569c ("genirq: Warn about using
+IRQF_ONESHOT without a threaded handler") specifying it has resulted in a
+WARN_ON(), fix this by removing IRQF_ONESHOT.
+
+Reported-by: Aishwarya TCV <Aishwarya.TCV@arm.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/pcc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
+index 0e0a66359d4c3..713022aed2e2f 100644
+--- a/drivers/mailbox/pcc.c
++++ b/drivers/mailbox/pcc.c
+@@ -459,7 +459,7 @@ static int pcc_startup(struct mbox_chan *chan)
+
+ if (pchan->plat_irq > 0) {
+ irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ?
+- IRQF_SHARED | IRQF_ONESHOT : 0;
++ IRQF_SHARED : 0;
+ rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq,
+ irqflags, MBOX_IRQ_NAME, chan);
+ if (unlikely(rc)) {
+--
+2.51.0
+
--- /dev/null
+From a5209ed15507b3de1f56587b5fa7040eefa200be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:36 +0100
+Subject: mailbox: sprd: clear delivery flag before handling TX done
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ]
+
+If there are any pending messages in the mailbox queue, they are sent
+as soon as a TX done event arrives from the driver. This may trigger a
+new delivery interrupt while the previous one is still being handled.
+If the delivery status is cleared after this, the interrupt is lost.
+To prevent this from happening, clear the delivery status immediately
+after checking it and before any new messages are sent.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index c1a5fe6cc8771..46d0c34177ab9 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -166,6 +166,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ return IRQ_NONE;
+ }
+
++ /* Clear FIFO delivery and overflow status first */
++ writel(fifo_sts &
++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
++ priv->inbox_base + SPRD_MBOX_FIFO_RST);
++
+ while (send_sts) {
+ id = __ffs(send_sts);
+ send_sts &= (send_sts - 1);
+@@ -181,11 +186,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ mbox_chan_txdone(chan, 0);
+ }
+
+- /* Clear FIFO delivery and overflow status */
+- writel(fifo_sts &
+- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
+- priv->inbox_base + SPRD_MBOX_FIFO_RST);
+-
+ /* Clear irq status */
+ writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS);
+
+--
+2.51.0
+
--- /dev/null
+From a1caa8ec4748880a25d73138c1f3eac66381ac7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:38 +0100
+Subject: mailbox: sprd: mask interrupts that are not handled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ]
+
+To reduce the amount of spurious interrupts, disable the interrupts that
+are not handled in this driver.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index ee8539dfcef54..c1a5fe6cc8771 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -243,21 +243,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan)
+ /* Select outbox FIFO mode and reset the outbox FIFO status */
+ writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST);
+
+- /* Enable inbox FIFO overflow and delivery interrupt */
+- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ);
++ /* Enable inbox FIFO delivery interrupt */
++ val = SPRD_INBOX_FIFO_IRQ_MASK;
++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ;
+ writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable outbox FIFO not empty interrupt */
+- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ val = SPRD_OUTBOX_FIFO_IRQ_MASK;
+ val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable supplementary outbox as the fundamental one */
+ if (priv->supp_base) {
+ writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST);
+- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 716fa2a0045158aef5e4481b80d503a0f2d540a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 14:59:03 +0000
+Subject: md-cluster: fix NULL pointer dereference in process_metadata_update
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ]
+
+The function process_metadata_update() blindly dereferences the 'thread'
+pointer (acquired via rcu_dereference_protected) within the wait_event()
+macro.
+
+While the code comment states "daemon thread must exist", there is a valid
+race condition window during the MD array startup sequence (md_run):
+
+1. bitmap_load() is called, which invokes md_cluster_ops->join().
+2. join() starts the "cluster_recv" thread (recv_daemon).
+3. At this point, recv_daemon is active and processing messages.
+4. However, mddev->thread (the main MD thread) is not initialized until
+ later in md_run().
+
+If a METADATA_UPDATED message is received from a remote node during this
+specific window, process_metadata_update() will be called while
+mddev->thread is still NULL, leading to a kernel panic.
+
+To fix this, we must validate the 'thread' pointer. If it is NULL, we
+release the held lock (no_new_dev_lockres) and return early, safely
+ignoring the update request as the array is not yet fully ready to
+process it.
+
+Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-cluster.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index 11f1e91d387d8..896279988dfd5 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -549,8 +549,13 @@ static void process_metadata_update(struct mddev *mddev, struct cluster_msg *msg
+
+ dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_CR);
+
+- /* daemaon thread must exist */
+ thread = rcu_dereference_protected(mddev->thread, true);
++ if (!thread) {
++ pr_warn("md-cluster: Received metadata update but MD thread is not ready\n");
++ dlm_unlock_sync(cinfo->no_new_dev_lockres);
++ return;
++ }
++
+ wait_event(thread->wqueue,
+ (got_lock = mddev_trylock(mddev)) ||
+ test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state));
+--
+2.51.0
+
--- /dev/null
+From e1c839c82f8cbbbc7317a26aa919d62650e77b84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 18:52:21 +0100
+Subject: md raid: fix hang when stopping arrays with metadata through dm-raid
+
+From: Heinz Mauelshagen <heinzm@redhat.com>
+
+[ Upstream commit cefcb9297fbdb6d94b61787b4f8d84f55b741470 ]
+
+When using device-mapper's dm-raid target, stopping a RAID array can cause
+the system to hang under specific conditions.
+
+This occurs when:
+
+- A dm-raid managed device tree is suspended from top to bottom
+ (the top-level RAID device is suspended first, followed by its
+ underlying metadata and data devices)
+
+- The top-level RAID device is then removed
+
+Removing the top-level device triggers a hang in the following sequence:
+the dm-raid destructor calls md_stop(), which tries to flush the
+write-intent bitmap by writing to the metadata sub-devices. However, these
+devices are already suspended, making them unable to complete the write-intent
+operations and causing an indefinite block.
+
+Fix:
+
+- Prevent bitmap flushing when md_stop() is called from dm-raid
+destructor context
+ and avoid a quiescing/unquescing cycle which could also cause I/O
+
+- Still allow write-intent bitmap flushing when called from dm-raid
+suspend context
+
+This ensures that RAID array teardown can complete successfully even when the
+underlying devices are in a suspended state.
+
+This second patch uses md_is_rdwr() to distinguish between suspend and
+destructor paths as elaborated on above.
+
+Link: https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index e04ddcb03981c..92ec4be20db85 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6716,13 +6716,15 @@ static void __md_stop_writes(struct mddev *mddev)
+ {
+ timer_delete_sync(&mddev->safemode_timer);
+
+- if (mddev->pers && mddev->pers->quiesce) {
+- mddev->pers->quiesce(mddev, 1);
+- mddev->pers->quiesce(mddev, 0);
+- }
++ if (md_is_rdwr(mddev) || !mddev_is_dm(mddev)) {
++ if (mddev->pers && mddev->pers->quiesce) {
++ mddev->pers->quiesce(mddev, 1);
++ mddev->pers->quiesce(mddev, 0);
++ }
+
+- if (md_bitmap_enabled(mddev, true))
+- mddev->bitmap_ops->flush(mddev);
++ if (md_bitmap_enabled(mddev, true))
++ mddev->bitmap_ops->flush(mddev);
++ }
+
+ if (md_is_rdwr(mddev) &&
+ ((!mddev->in_sync && !mddev_is_clustered(mddev)) ||
+--
+2.51.0
+
--- /dev/null
+From 9209a6b832e6790c30730c602cfcd78e586aca53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 15:29:57 +0100
+Subject: media: adv7180: fix frame interval in progressive mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ]
+
+The ADV7280-M may internally convert interlaced video input to
+progressive video. If this mode is enabled, the ADV7280-M delivers
+progressive video frames at the field rate of 50 fields per second (PAL)
+or 60 fields per second (NTSC).
+
+Fix the reported frame interval if progressive video is enabled.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 378f4e6af12cb..5cbc973df684d 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -507,6 +507,13 @@ static int adv7180_get_frame_interval(struct v4l2_subdev *sd,
+ fi->interval.denominator = 25;
+ }
+
++ /*
++ * If the de-interlacer is active, the chip produces full video frames
++ * at the field rate.
++ */
++ if (state->field == V4L2_FIELD_NONE)
++ fi->interval.denominator *= 2;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a2fcf5ee6d4062189a75f49c069ff53c7058b326 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 11:02:22 +0800
+Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
+
+From: Ming Qian <ming.qian@oss.nxp.com>
+
+[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ]
+
+The V4L2_DEC_CMD_START command may be used to handle the dynamic source
+change, which will triggers an implicit decoder drain.
+The last_buffer_dequeued flag is set in the implicit decoder drain,
+so driver need to clear it to continue the following decoding flow.
+
+Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vdec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
+index 32eef2fd1f2a9..6b63e8ca0cb40 100644
+--- a/drivers/media/platform/amphion/vdec.c
++++ b/drivers/media/platform/amphion/vdec.c
+@@ -726,6 +726,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd
+ switch (cmd->cmd) {
+ case V4L2_DEC_CMD_START:
+ vdec_cmd_start(inst);
++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx));
+ break;
+ case V4L2_DEC_CMD_STOP:
+ vdec_cmd_stop(inst);
+--
+2.51.0
+
--- /dev/null
+From bfd6fee0038d98a19cb5974a05f4ba1bb61f5da3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 15:46:17 -0500
+Subject: media: chips-media: wave5: Fix conditional in start_streaming
+
+From: Brandon Brnich <b-brnich@ti.com>
+
+[ Upstream commit b4e26c6fc1b3c225caf80d4a95c6f9fcbe959e17 ]
+
+When STREAMON(CAP) is called after STREAMON(OUT), the driver was failing to
+switch states from VPU_INST_STATE_OPEN to VPU_INST_STATE_INIT_SEQ and
+VPU_INST_STATE_PIC_RUN because the capture queue streaming boolean had not
+yet been set to true. This led to a hang in the encoder since the state
+was stuck in VPU_INST_STATE_OPEN. During the second call to
+start_streaming, the sequence initialization and frame buffer allocation
+should occur.
+
+Signed-off-by: Brandon Brnich <b-brnich@ti.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+index 94fb5d7c87021..a11f0f7c7d7b0 100644
+--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+@@ -1367,7 +1367,8 @@ static int wave5_vpu_enc_start_streaming(struct vb2_queue *q, unsigned int count
+ if (ret)
+ goto return_buffers;
+ }
+- if (inst->state == VPU_INST_STATE_OPEN && m2m_ctx->cap_q_ctx.q.streaming) {
++ if (inst->state == VPU_INST_STATE_OPEN &&
++ (m2m_ctx->cap_q_ctx.q.streaming || q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) {
+ ret = initialize_sequence(inst);
+ if (ret) {
+ dev_warn(inst->dev->dev, "Sequence not found: %d\n", ret);
+--
+2.51.0
+
--- /dev/null
+From a8354ee16a3265af482680e0cb2f1ad88bf6a908 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 15:46:18 -0500
+Subject: media: chips-media: wave5: Process ready frames when CMD_STOP sent to
+ Encoder
+
+From: Brandon Brnich <b-brnich@ti.com>
+
+[ Upstream commit 5da0380de41439ed64ed9a5218850db38544e315 ]
+
+CMD_STOP being sent to encoder before last job is executed by device_run
+can lead to an occasional dropped frame. Ensure that remaining ready
+buffers are drained by making a call to v4l2_m2m_try_schedule.
+
+Signed-off-by: Brandon Brnich <b-brnich@ti.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+index a11f0f7c7d7b0..a254830e4009e 100644
+--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+@@ -649,6 +649,8 @@ static int wave5_vpu_enc_encoder_cmd(struct file *file, void *fh, struct v4l2_en
+
+ m2m_ctx->last_src_buf = v4l2_m2m_last_src_buf(m2m_ctx);
+ m2m_ctx->is_draining = true;
++
++ v4l2_m2m_try_schedule(m2m_ctx);
+ break;
+ case V4L2_ENC_CMD_START:
+ break;
+--
+2.51.0
+
--- /dev/null
+From a13c66ce8f5bbe04184ab59f6da986589e3a035c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 15:46:47 +0800
+Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ]
+
+Add release_mem_region() if ioremap() fails to release the memory
+region obtained by cx25821_get_resources().
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index 6627fa9166d30..a7336be444748 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
+
+ if (!dev->lmmio) {
+ CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n");
++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0));
+ cx25821_iounmap(dev);
+ return -ENOMEM;
+ }
+--
+2.51.0
+
--- /dev/null
+From 959363a64916da001e91203cf2278d8bc4c9e9a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 08:57:35 +0200
+Subject: media: dvb-core: dmxdevfilter must always flush bufs
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ]
+
+Currently the buffers are being filled until full, which works fine
+for the transport stream, but not when reading sections, those have
+to be returned to userspace immediately, otherwise dvbv5-scan will
+just wait forever.
+
+Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether
+the buffer must be flushed or wait until it is full.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dmxdev.c | 8 ++++----
+ drivers/media/dvb-core/dvb_vb2.c | 5 +++--
+ include/media/dvb_vb2.h | 6 ++++--
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index 151177e5a06d8..8a9cca6da3e0e 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -397,11 +397,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
+ if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) {
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, true);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, true);
+ } else {
+ ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer,
+ buffer1, buffer1_len);
+@@ -452,10 +452,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
+
+ if (dvb_vb2_is_streaming(ctx)) {
+ ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, false);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, false);
+ } else {
+ if (buffer->error) {
+ spin_unlock(&dmxdevfilter->dev->lock);
+diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c
+index 29edaaff7a5c9..7444bbc2f24d9 100644
+--- a/drivers/media/dvb-core/dvb_vb2.c
++++ b/drivers/media/dvb-core/dvb_vb2.c
+@@ -249,7 +249,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx)
+
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags)
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush)
+ {
+ unsigned long flags = 0;
+ void *vbuf = NULL;
+@@ -306,7 +307,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ }
+ }
+
+- if (ctx->nonblocking && ctx->buf) {
++ if (flush && ctx->buf) {
+ vb2_set_plane_payload(&ctx->buf->vb, 0, ll);
+ vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE);
+ list_del(&ctx->buf->list);
+diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h
+index 8cb88452cd6c2..0fbbfc65157e6 100644
+--- a/include/media/dvb_vb2.h
++++ b/include/media/dvb_vb2.h
+@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx)
+ return 0;
+ };
+ #define dvb_vb2_is_streaming(ctx) (0)
+-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0)
++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0)
+
+ static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx,
+ struct file *file,
+@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx);
+ * @buffer_flags:
+ * pointer to buffer flags as defined by &enum dmx_buffer_flags.
+ * can be NULL.
++ * @flush: flush the buffer, even if it isn't full.
+ */
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags);
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush);
+
+ /**
+ * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV
+--
+2.51.0
+
--- /dev/null
+From 31804f47c723e3f4cc1ebcc9cb1a848663de7c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 23:55:31 +0200
+Subject: media: ipu6: Always close firmware stream
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 2b08b7007e55bd1793a58478d3ecea4fd95849a5 ]
+
+Close the firmware stream even when disabling a stream on an upstream
+sub-device fails. This allows the firmware to release resources related to
+a stream that is stopped in any case.
+
+Suggested-by: Bingbu Cao <bingbu.cao@linux.intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
+Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
+Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+index e1815faeb80d7..b96ae563b82f0 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+@@ -1022,11 +1022,10 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state,
+ sd->name, r_pad->index, stream_mask);
+ ret = v4l2_subdev_disable_streams(sd, r_pad->index,
+ stream_mask);
+- if (ret) {
++ if (ret)
+ dev_err(dev, "stream off %s failed with %d\n", sd->name,
+ ret);
+- return ret;
+- }
++
+ close_streaming_firmware(av);
+ } else {
+ ret = start_stream_firmware(av, bl);
+--
+2.51.0
+
--- /dev/null
+From 242349a023f90a15576be7f4370b6a3ff2a5cc67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 00:05:38 +0200
+Subject: media: ipu6: Close firmware streams on streaming enable failure
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 5925a92cc70d10c7d3124923c36da09b9c1a6eeb ]
+
+When enabling streaming fails, the stream is stopped in firmware but not
+closed. Do this to release resources on firmware side.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
+Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
+Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+index f3f3bc0615e5d..e1815faeb80d7 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+@@ -1052,6 +1052,7 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state,
+
+ out_media_entity_stop_streaming_firmware:
+ stop_streaming_firmware(av);
++ close_streaming_firmware(av);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 4d71803cbc28105f1e189f8407ca03b3bb2d2c46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 14:14:22 +0200
+Subject: media: ipu6: Ensure stream_mutex is acquired when dealing with node
+ list
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 779bdaad2abf718fb8116839e818e58852874b4d ]
+
+The ipu6 isys driver maintains the list of video buffer queues related to
+a stream (in ipu6 context streams on the same CSI-2 virtual channel) and
+this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs.
+Ensure the common mutex is acquired when accessing the linked list, i.e.
+the isys device context's stream_mutex.
+
+Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard()
+while at it as the error handling becomes more simple this way.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-queue.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
+index aa2cf7287477c..8f05987cdb4e7 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
+@@ -3,6 +3,7 @@
+ * Copyright (C) 2013--2024 Intel Corporation
+ */
+ #include <linux/atomic.h>
++#include <linux/cleanup.h>
+ #include <linux/bug.h>
+ #include <linux/device.h>
+ #include <linux/list.h>
+@@ -201,6 +202,8 @@ static int buffer_list_get(struct ipu6_isys_stream *stream,
+ unsigned long flags;
+ unsigned long buf_flag = IPU6_ISYS_BUFFER_LIST_FL_INCOMING;
+
++ lockdep_assert_held(&stream->mutex);
++
+ bl->nbufs = 0;
+ INIT_LIST_HEAD(&bl->head);
+
+@@ -294,9 +297,8 @@ static int ipu6_isys_stream_start(struct ipu6_isys_video *av,
+ struct ipu6_isys_buffer_list __bl;
+ int ret;
+
+- mutex_lock(&stream->isys->stream_mutex);
++ guard(mutex)(&stream->isys->stream_mutex);
+ ret = ipu6_isys_video_set_streaming(av, 1, bl);
+- mutex_unlock(&stream->isys->stream_mutex);
+ if (ret)
+ goto out_requeue;
+
+@@ -637,10 +639,10 @@ static void stop_streaming(struct vb2_queue *q)
+ mutex_lock(&av->isys->stream_mutex);
+ if (stream->nr_streaming == stream->nr_queues && stream->streaming)
+ ipu6_isys_video_set_streaming(av, 0, NULL);
++ list_del(&aq->node);
+ mutex_unlock(&av->isys->stream_mutex);
+
+ stream->nr_streaming--;
+- list_del(&aq->node);
+ stream->streaming = 0;
+ mutex_unlock(&stream->mutex);
+
+--
+2.51.0
+
--- /dev/null
+From d0db485901710a4133daee2c9db8b51b6c65ae40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 14:16:16 -0500
+Subject: media: mediatek: vcodec: Don't try to decode 422/444 VP9
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 3e92d7e4935084ecdbdc88880cc4688618ae1557 ]
+
+This is not supported by the hardware and trying to decode
+these leads to LAT timeout errors.
+
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
+index d873159b9b306..9eef3ff2b1278 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
+@@ -502,6 +502,12 @@ static int mtk_vdec_s_ctrl(struct v4l2_ctrl *ctrl)
+ mtk_v4l2_vdec_err(ctx, "VP9: bit_depth:%d", frame->bit_depth);
+ return -EINVAL;
+ }
++
++ if (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
++ !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)) {
++ mtk_v4l2_vdec_err(ctx, "VP9: only 420 subsampling is supported");
++ return -EINVAL;
++ }
+ break;
+ case V4L2_CID_STATELESS_AV1_SEQUENCE:
+ seq = (struct v4l2_ctrl_av1_sequence *)hdr_ctrl->p_new.p;
+--
+2.51.0
+
--- /dev/null
+From d1154a2a38aae39b8a2a3595db783d335b1917af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 18:03:03 +0100
+Subject: media: mt9m114: Avoid a reset low spike during probe()
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit 84359d0a5e3afce5e3e3b6562efadff690614d5b ]
+
+mt9m114_probe() requests the reset GPIO in output low state:
+
+ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+
+and then almost immediately afterwards calls mt9m114_power_on() which does:
+
+ gpiod_set_value(sensor->reset, 1);
+ fsleep(duration);
+ gpiod_set_value(sensor->reset, 0);
+
+which means that if the reset pin was high before this code runs that
+it will very briefly be driven low because of passing GPIOD_OUT_LOW when
+requesting the GPIO only to be driven high again possibly directly after
+that. Such a very brief driving low of the reset pin may put the chip in
+a confused state.
+
+Request the GPIO in high (reset the chip) state instead to avoid this,
+turning the initial gpiod_set_value() in mt9m114_power_on() into a no-op.
+and the fsleep() ensures that it will stay high long enough to properly
+reset the chip.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9m114.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c
+index 51ebbe7ae9969..554f25071cca6 100644
+--- a/drivers/media/i2c/mt9m114.c
++++ b/drivers/media/i2c/mt9m114.c
+@@ -2434,7 +2434,7 @@ static int mt9m114_probe(struct i2c_client *client)
+ goto error_ep_free;
+ }
+
+- sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
++ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(sensor->reset)) {
+ ret = PTR_ERR(sensor->reset);
+ dev_err_probe(dev, ret, "Failed to get reset GPIO\n");
+--
+2.51.0
+
--- /dev/null
+From f5e1b1a77a43f83e33820e01460a7cd136bbad7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 18:03:10 +0100
+Subject: media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit 437e1f6a960035166495a5117aacbc596115eeb6 ]
+
+With IPU# bridges, endpoints may only be created when the IPU bridge is
+initialized. This may happen after the sensor driver's first probe().
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9m114.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c
+index 554f25071cca6..b1325e2cd1321 100644
+--- a/drivers/media/i2c/mt9m114.c
++++ b/drivers/media/i2c/mt9m114.c
+@@ -2360,11 +2360,17 @@ static int mt9m114_parse_dt(struct mt9m114 *sensor)
+ struct fwnode_handle *ep;
+ int ret;
+
++ /*
++ * On ACPI systems the fwnode graph can be initialized by a bridge
++ * driver, which may not have probed yet. Wait for this.
++ *
++ * TODO: Return an error once bridge driver code will have moved
++ * to the ACPI core.
++ */
+ ep = fwnode_graph_get_next_endpoint(fwnode, NULL);
+- if (!ep) {
+- dev_err(&sensor->client->dev, "No endpoint found\n");
+- return -EINVAL;
+- }
++ if (!ep)
++ return dev_err_probe(&sensor->client->dev, -EPROBE_DEFER,
++ "waiting for fwnode graph endpoint\n");
+
+ sensor->bus_cfg.bus_type = V4L2_MBUS_UNKNOWN;
+ ret = v4l2_fwnode_endpoint_alloc_parse(ep, &sensor->bus_cfg);
+--
+2.51.0
+
--- /dev/null
+From 9cc4b40fb5e17a91a0d41517d9654f1cfbd3d9e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 15:26:40 +0200
+Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ]
+
+The isp_video_mbus_to_pix/pix_to_mbus functions did not take
+the last empty entry { 0, } of the formats array into account.
+
+As a result, isp_video_mbus_to_pix would accept code 0 and
+isp_video_pix_to_mbus would select code 0 if no match was found.
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index 0e7f0bf2b3463..68e6a24be5614 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video,
+ pix->width = mbus->width;
+ pix->height = mbus->height;
+
+- for (i = 0; i < ARRAY_SIZE(formats); ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
+ if (formats[i].code == mbus->code)
+ break;
+ }
+
+- if (WARN_ON(i == ARRAY_SIZE(formats)))
++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1))
+ return 0;
+
+ min_bpl = pix->width * formats[i].bpp;
+@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix,
+ /* Skip the last format in the loop so that it will be selected if no
+ * match is found.
+ */
+- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) {
+ if (formats[i].pixelformat == pix->pixelformat)
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From ab194ab90bb68a0134757aeccb69a81d6d18b679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 17:09:18 +0200
+Subject: media: omap3isp: isppreview: always clamp in preview_try_format()
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ]
+
+If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't
+clamped. Just always clamp.
+
+This fixes a v4l2-compliance error:
+
+ fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
+ fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
+test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c
+index e383a57654de8..5c492b31b5160 100644
+--- a/drivers/media/platform/ti/omap3isp/isppreview.c
++++ b/drivers/media/platform/ti/omap3isp/isppreview.c
+@@ -1742,22 +1742,17 @@ static void preview_try_format(struct isp_prev_device *prev,
+
+ switch (pad) {
+ case PREV_PAD_SINK:
+- /* When reading data from the CCDC, the input size has already
+- * been mangled by the CCDC output pad so it can be accepted
+- * as-is.
+- *
+- * When reading data from memory, clamp the requested width and
+- * height. The TRM doesn't specify a minimum input height, make
++ /*
++ * Clamp the requested width and height.
++ * The TRM doesn't specify a minimum input height, make
+ * sure we got enough lines to enable the noise filter and color
+ * filter array interpolation.
+ */
+- if (prev->input == PREVIEW_INPUT_MEMORY) {
+- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
+- preview_max_out_width(prev));
+- fmt->height = clamp_t(u32, fmt->height,
+- PREV_MIN_IN_HEIGHT,
+- PREV_MAX_IN_HEIGHT);
+- }
++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
++ preview_max_out_width(prev));
++ fmt->height = clamp_t(u32, fmt->height,
++ PREV_MIN_IN_HEIGHT,
++ PREV_MAX_IN_HEIGHT);
+
+ fmt->colorspace = V4L2_COLORSPACE_SRGB;
+
+--
+2.51.0
+
--- /dev/null
+From 3299db9fc64fe678aeea7b16a88723f2f48393f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 09:21:53 +0200
+Subject: media: omap3isp: set initial format
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ]
+
+Initialize the v4l2_format to a default. Empty formats are
+not allowed in V4L2, so this fixes v4l2-compliance issues:
+
+ fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height
+test VIDIOC_G_FMT: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index 68e6a24be5614..eb33a776f27c9 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -1288,6 +1288,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = {
+ static int isp_video_open(struct file *file)
+ {
+ struct isp_video *video = video_drvdata(file);
++ struct v4l2_mbus_framefmt fmt;
+ struct isp_video_fh *handle;
+ struct vb2_queue *queue;
+ int ret = 0;
+@@ -1330,6 +1331,13 @@ static int isp_video_open(struct file *file)
+
+ memset(&handle->format, 0, sizeof(handle->format));
+ handle->format.type = video->type;
++ handle->format.fmt.pix.width = 720;
++ handle->format.fmt.pix.height = 480;
++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY;
++ handle->format.fmt.pix.field = V4L2_FIELD_NONE;
++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt);
++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix);
+ handle->timeperframe.denominator = 1;
+
+ handle->video = video;
+--
+2.51.0
+
--- /dev/null
+From f88a343fd26c0a0b2bc2991d4d8a35063bb9479c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 19:24:19 +0100
+Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex
+
+From: Szymon Wilczek <szymonwilczek@gmx.com>
+
+[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ]
+
+When pvr2_send_request_ex() submits a write URB successfully but fails to
+submit the read URB (e.g. returns -ENOMEM), it returns immediately without
+waiting for the write URB to complete. Since the driver reuses the same
+URB structure, a subsequent call to pvr2_send_request_ex() attempts to
+submit the still-active write URB, triggering a 'URB submitted while
+active' warning in usb_submit_urb().
+
+Fix this by ensuring the write URB is unlinked and waited upon if the read
+URB submission fails.
+
+Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
+Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com>
+Acked-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index b32bb906a9de2..5807734ae26c6 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -3709,6 +3709,11 @@ status);
+ "Failed to submit read-control URB status=%d",
+ status);
+ hdw->ctl_read_pend_flag = 0;
++ if (hdw->ctl_write_pend_flag) {
++ usb_unlink_urb(hdw->ctl_write_urb);
++ while (hdw->ctl_write_pend_flag)
++ wait_for_completion(&hdw->ctl_done);
++ }
+ goto done;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 0e29d027e59c709d4a8c586db1cf839dfbce0df4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Oct 2025 17:02:27 +0300
+Subject: media: qcom: camss: Do not enable cpas fast ahb clock for SM8550 VFE
+ lite
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit a89e490ba3551823511588b7b3828d67f8b82954 ]
+
+The clock is needed to stream images over a full VFE IP on SM8550 CAMSS,
+and it should not be enabled, when an image stream is routed over any of
+two lite VFE IPs on the SoC.
+
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
+index 2fbcd0e343aac..fc838b3d22038 100644
+--- a/drivers/media/platform/qcom/camss/camss.c
++++ b/drivers/media/platform/qcom/camss/camss.c
+@@ -2561,12 +2561,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = {
+ /* VFE3 lite */
+ {
+ .regulators = {},
+- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb",
++ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb",
+ "vfe_lite", "cpas_ife_lite", "camnoc_axi" },
+ .clock_rate = { { 0 },
+ { 80000000 },
+ { 300000000, 400000000 },
+- { 300000000, 400000000 },
+ { 400000000, 480000000 },
+ { 300000000, 400000000 },
+ { 300000000, 400000000 } },
+@@ -2583,12 +2582,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = {
+ /* VFE4 lite */
+ {
+ .regulators = {},
+- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb",
++ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb",
+ "vfe_lite", "cpas_ife_lite", "camnoc_axi" },
+ .clock_rate = { { 0 },
+ { 80000000 },
+ { 300000000, 400000000 },
+- { 300000000, 400000000 },
+ { 400000000, 480000000 },
+ { 300000000, 400000000 },
+ { 300000000, 400000000 } },
+--
+2.51.0
+
--- /dev/null
+From 738c6923be178e11cdc16cbcb12d062392b2142d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 12:11:42 -0500
+Subject: media: rkisp1: Fix filter mode register configuration
+
+From: Rui Wang <rui.wang@ideasonboard.com>
+
+[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ]
+
+The rkisp1_flt_config() function performs an initial direct write to
+RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA
+bit, which clears the filter enable bit in the hardware.
+
+The subsequent read/modify/write sequence then reads back the register
+with the enable bit already cleared and cannot restore it, resulting in
+the filter being inadvertently disabled.
+
+Remove the redundant direct write. The read/modify/write sequence alone
+correctly preserves the existing enable bit state while updating the
+DNR mode and filter configuration bits.
+
+Signed-off-by: Rui Wang <rui.wang@ideasonboard.com>
+Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+index f1585f8fa0f47..1c90b1810fcb9 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+@@ -409,12 +409,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params,
+ rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT,
+ arg->lum_weight);
+
+- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE,
+- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) |
+- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) |
+- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) |
+- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1));
+-
+ /* avoid to override the old enable value */
+ filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE);
+ filt_mode &= RKISP1_CIF_ISP_FLT_ENA;
+--
+2.51.0
+
--- /dev/null
+From 463cd9cdb3b1b352fc3bdf39d3ff6dedc4839ab9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:00:35 -0800
+Subject: media: solo6x10: Check for out of bounds chip_id
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ]
+
+Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
+(literal "1" is an "int") could end up being shifted beyond 32 bits,
+so instrumentation was added (and due to the double is_tw286x() call
+seen via inlining), Clang decides the second one must now be undefined
+behavior and elides the rest of the function[1]. This is a known problem
+with Clang (that is still being worked on), but we can avoid the entire
+problem by actually checking the existing max chip ID, and now there is
+no runtime instrumentation added at all since everything is known to be
+within bounds.
+
+Additionally use an unsigned value for the shift to remove the
+instrumentation even without the explicit bounds checking.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
+Suggested-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: fix checkpatch warning for is_tw286x]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+index 1b7c22a9bc94f..8f53946c67928 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c
++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = {
+ 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0,
+ };
+
+-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id)))
++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id))))
+
+ static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off,
+ u8 tw_off)
+@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ if (val > 255 || val < 0)
+ return -ERANGE;
+
+@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ switch (ctrl) {
+ case V4L2_CID_SHARPNESS:
+ /* Only 286x has sharpness */
+--
+2.51.0
+
--- /dev/null
+From 295afd91a38fe7586c45c476783856dc2d5727d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 23:04:00 +0200
+Subject: media: uvcvideo: Create an ID namespace for streaming output
+ terminals
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 3d9f32e02c2ed85338be627de672e2b81b88a836 ]
+
+Some devices, such as the Grandstream GUV3100 and the LSK Meeting Eye
+for Business & Home, exhibit entity ID collisions between units and
+streaming output terminals.
+
+The UVC specification requires unit and terminal IDs to be unique, and
+uses the ID to reference entities:
+
+- In control requests, to identify the target entity
+- In the UVC units and terminals descriptors' bSourceID field, to
+ identify source entities
+- In the UVC input header descriptor's bTerminalLink, to identify the
+ terminal associated with a streaming interface
+
+Entity ID collisions break accessing controls and make the graph
+description in the UVC descriptors ambiguous. However, collisions where
+one of the entities is a streaming output terminal and the other entity
+is not a streaming terminal are less severe. Streaming output terminals
+have no controls, and, as they are the final entity in pipelines, they
+are never referenced in descriptors as source entities. They are
+referenced by ID only from innput header descriptors, which by
+definition only reference streaming terminals.
+
+For these reasons, we can work around the collision by giving streaming
+output terminals their own ID namespace. Do so by setting bit
+UVC_TERM_OUTPUT (15) in the uvc_entity.id field, which is normally never
+set as the ID is a 8-bit value.
+
+This ID change doesn't affect the entity name in the media controller
+graph as the name isn't constructed from the ID, so there should not be
+any impact on the uAPI.
+
+Although this change handles some ID collisions automagically, keep
+printing an error in uvc_alloc_new_entity() when a camera has invalid
+descriptors. Hopefully this message will help vendors fix their invalid
+descriptors.
+
+This new method of handling ID collisions includes a revert of commit
+758dbc756aad ("media: uvcvideo: Use heuristic to find stream entity")
+that attempted to fix the problem urgently due to regression reports.
+
+Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Lili Orosz <lily@floofy.city>
+Co-developed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patch.msgid.link/20251113210400.28618-1-laurent.pinchart@ideasonboard.com
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 54 ++++++++++++++++++------------
+ drivers/media/usb/uvc/uvcvideo.h | 3 +-
+ 2 files changed, 35 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index ee4f54d683496..aa3e8d295e0f5 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -165,28 +165,17 @@ static struct uvc_entity *uvc_entity_by_reference(struct uvc_device *dev,
+ return NULL;
+ }
+
+-static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id)
++static struct uvc_streaming *uvc_stream_for_terminal(struct uvc_device *dev,
++ struct uvc_entity *term)
+ {
+- struct uvc_streaming *stream, *last_stream;
+- unsigned int count = 0;
++ u16 id = UVC_HARDWARE_ENTITY_ID(term->id);
++ struct uvc_streaming *stream;
+
+ list_for_each_entry(stream, &dev->streams, list) {
+- count += 1;
+- last_stream = stream;
+ if (stream->header.bTerminalLink == id)
+ return stream;
+ }
+
+- /*
+- * If the streaming entity is referenced by an invalid ID, notify the
+- * user and use heuristics to guess the correct entity.
+- */
+- if (count == 1 && id == UVC_INVALID_ENTITY_ID) {
+- dev_warn(&dev->intf->dev,
+- "UVC non compliance: Invalid USB header. The streaming entity has an invalid ID, guessing the correct one.");
+- return last_stream;
+- }
+-
+ return NULL;
+ }
+
+@@ -823,10 +812,12 @@ static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type,
+ }
+
+ /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */
+- if (uvc_entity_by_id(dev, id)) {
+- dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id);
++ if (uvc_entity_by_id(dev, UVC_HARDWARE_ENTITY_ID(id)))
++ dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n",
++ UVC_HARDWARE_ENTITY_ID(id));
++
++ if (uvc_entity_by_id(dev, id))
+ id = UVC_INVALID_ENTITY_ID;
+- }
+
+ extra_size = roundup(extra_size, sizeof(*entity->pads));
+ if (num_pads)
+@@ -982,6 +973,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+ struct usb_host_interface *alts = dev->intf->cur_altsetting;
+ unsigned int i, n, p, len;
+ const char *type_name;
++ unsigned int id;
+ u16 type;
+
+ switch (buffer[2]) {
+@@ -1120,8 +1112,28 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+ return 0;
+ }
+
++ id = buffer[3];
++
++ /*
++ * Some devices, such as the Grandstream GUV3100, exhibit entity
++ * ID collisions between units and streaming output terminals.
++ * Move streaming output terminals to their own ID namespace by
++ * setting bit UVC_TERM_OUTPUT (15), above the ID's 8-bit value.
++ * The bit is ignored in uvc_stream_for_terminal() when looking
++ * up the streaming interface for the terminal.
++ *
++ * This hack is safe to enable unconditionally, as the ID is not
++ * used for any other purpose (streaming output terminals have
++ * no controls and are never referenced as sources in UVC
++ * descriptors). Other types output terminals can have controls,
++ * so limit usage of this separate namespace to streaming output
++ * terminals.
++ */
++ if (type & UVC_TT_STREAMING)
++ id |= UVC_TERM_OUTPUT;
++
+ term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
+- buffer[3], 1, 0);
++ id, 1, 0);
+ if (IS_ERR(term))
+ return PTR_ERR(term);
+
+@@ -2118,8 +2130,8 @@ static int uvc_register_terms(struct uvc_device *dev,
+ if (UVC_ENTITY_TYPE(term) != UVC_TT_STREAMING)
+ continue;
+
+- stream = uvc_stream_by_id(dev, term->id);
+- if (stream == NULL) {
++ stream = uvc_stream_for_terminal(dev, term);
++ if (!stream) {
+ dev_info(&dev->intf->dev,
+ "No streaming interface found for terminal %u.",
+ term->id);
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index ed7bad31f75ca..3f2e832025e71 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -41,7 +41,8 @@
+ #define UVC_EXT_GPIO_UNIT 0x7ffe
+ #define UVC_EXT_GPIO_UNIT_ID 0x100
+
+-#define UVC_INVALID_ENTITY_ID 0xffff
++#define UVC_HARDWARE_ENTITY_ID(id) ((id) & 0xff)
++#define UVC_INVALID_ENTITY_ID 0xffff
+
+ /* ------------------------------------------------------------------------
+ * Driver specific constants.
+--
+2.51.0
+
--- /dev/null
+From c8b57d476367c807a590461dc4e867f4304b44fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 13:48:40 +0200
+Subject: media: v4l2-async: Fix error handling on steps after finding a match
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 7345d6d356336c448d6b9230ed8704f39679fd12 ]
+
+Once an async connection is found to be matching with an fwnode, a
+sub-device may be registered (in case it wasn't already), its bound
+operation is called, ancillary links are created, the async connection
+is added to the sub-device's list of connections and removed from the
+global waiting connection list. Further on, the sub-device's possible own
+notifier is searched for possible additional matches.
+
+Fix these specific issues:
+
+- If v4l2_async_match_notify() failed before the sub-notifier handling,
+ the async connection was unbound and its entry removed from the
+ sub-device's async connection list. The latter part was also done in
+ v4l2_async_match_notify().
+
+- The async connection's sd field was only set after creating ancillary
+ links in v4l2_async_match_notify(). It was however dereferenced in
+ v4l2_async_unbind_subdev_one(), which was called on error path of
+ v4l2_async_match_notify() failure.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Tested-by: "Yew, Chang Ching" <chang.ching.yew@intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-async.c | 45 +++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
+index ee884a8221fbd..1c08bba9ecb91 100644
+--- a/drivers/media/v4l2-core/v4l2-async.c
++++ b/drivers/media/v4l2-core/v4l2-async.c
+@@ -343,7 +343,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ struct v4l2_subdev *sd,
+ struct v4l2_async_connection *asc)
+ {
+- struct v4l2_async_notifier *subdev_notifier;
+ bool registered = false;
+ int ret;
+
+@@ -389,6 +388,25 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ dev_dbg(notifier_dev(notifier), "v4l2-async: %s bound (ret %d)\n",
+ dev_name(sd->dev), ret);
+
++ return 0;
++
++err_call_unbind:
++ v4l2_async_nf_call_unbind(notifier, sd, asc);
++ list_del(&asc->asc_subdev_entry);
++
++err_unregister_subdev:
++ if (registered)
++ v4l2_device_unregister_subdev(sd);
++
++ return ret;
++}
++
++static int
++v4l2_async_nf_try_subdev_notifier(struct v4l2_async_notifier *notifier,
++ struct v4l2_subdev *sd)
++{
++ struct v4l2_async_notifier *subdev_notifier;
++
+ /*
+ * See if the sub-device has a notifier. If not, return here.
+ */
+@@ -404,16 +422,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ subdev_notifier->parent = notifier;
+
+ return v4l2_async_nf_try_all_subdevs(subdev_notifier);
+-
+-err_call_unbind:
+- v4l2_async_nf_call_unbind(notifier, sd, asc);
+- list_del(&asc->asc_subdev_entry);
+-
+-err_unregister_subdev:
+- if (registered)
+- v4l2_device_unregister_subdev(sd);
+-
+- return ret;
+ }
+
+ /* Test all async sub-devices in a notifier for a match. */
+@@ -445,6 +453,10 @@ v4l2_async_nf_try_all_subdevs(struct v4l2_async_notifier *notifier)
+ if (ret < 0)
+ return ret;
+
++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
++ if (ret < 0)
++ return ret;
++
+ /*
+ * v4l2_async_match_notify() may lead to registering a
+ * new notifier and thus changing the async subdevs
+@@ -829,7 +841,11 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module)
+ ret = v4l2_async_match_notify(notifier, v4l2_dev, sd,
+ asc);
+ if (ret)
+- goto err_unbind;
++ goto err_unlock;
++
++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
++ if (ret)
++ goto err_unbind_one;
+
+ ret = v4l2_async_nf_try_complete(notifier);
+ if (ret)
+@@ -853,9 +869,10 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module)
+ if (subdev_notifier)
+ v4l2_async_nf_unbind_all_subdevs(subdev_notifier);
+
+- if (asc)
+- v4l2_async_unbind_subdev_one(notifier, asc);
++err_unbind_one:
++ v4l2_async_unbind_subdev_one(notifier, asc);
+
++err_unlock:
+ mutex_unlock(&list_lock);
+
+ sd->owner = NULL;
+--
+2.51.0
+
--- /dev/null
+From 35daa065bc0bc044036eb0ddca18b1007f85dfb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 19:21:50 +0200
+Subject: mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit cefd793fa17de708d043adab50e7f96f414b0f1d ]
+
+Add Intel Nova Lake-S LPSS PCI IDs.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20260113172151.48062-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 8d92c895d3aef..713a5bfb1a3c2 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -437,6 +437,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_spi_info },
+ { PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_spi_info },
+ { PCI_VDEVICE(INTEL, 0x5aee), (kernel_ulong_t)&bxt_uart_info },
++ /* NVL-S */
++ { PCI_VDEVICE(INTEL, 0x6e28), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x6e29), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x6e2a), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x6e2b), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x6e4c), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e4d), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e4e), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e4f), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e5c), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x6e5e), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x6e7a), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e7b), (kernel_ulong_t)&ehl_i2c_info },
+ /* ARL-H */
+ { PCI_VDEVICE(INTEL, 0x7725), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x7726), (kernel_ulong_t)&bxt_uart_info },
+--
+2.51.0
+
--- /dev/null
+From a9b822148209f0dad52f65bb062329af6f171ef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 16:39:47 +0100
+Subject: minix: Add required sanity checking to minix_check_superblock()
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ]
+
+The fs/minix implementation of the minix filesystem does not currently
+support any other value for s_log_zone_size than 0. This is also the
+only value supported in util-linux; see mkfs.minix.c line 511. In
+addition, this patch adds some sanity checking for the other minix
+superblock fields, and moves the minix_blocks_needed() checks for the
+zmap and imap also to minix_check_super_block().
+
+This also closes a related syzbot bug report.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/inode.c | 50 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 29 insertions(+), 21 deletions(-)
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 32db676127a9e..7bdd240ea1584 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -154,10 +154,38 @@ static int minix_reconfigure(struct fs_context *fc)
+ static bool minix_check_superblock(struct super_block *sb)
+ {
+ struct minix_sb_info *sbi = minix_sb(sb);
++ unsigned long block;
+
+- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
++ if (sbi->s_log_zone_size != 0) {
++ printk("minix-fs error: zone size must equal block size. "
++ "s_log_zone_size > 0 is not supported.\n");
++ return false;
++ }
++
++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
++ sbi->s_firstdatazone >= sbi->s_nzones)
+ return false;
+
++ /* Apparently minix can create filesystems that allocate more blocks for
++ * the bitmaps than needed. We simply ignore that, but verify it didn't
++ * create one with not enough blocks and bail out if so.
++ */
++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize);
++ if (sbi->s_imap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "imap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
++ block = minix_blocks_needed(
++ (sbi->s_nzones - sbi->s_firstdatazone + 1),
++ sb->s_blocksize);
++ if (sbi->s_zmap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "zmap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
+ /*
+ * s_max_size must not exceed the block mapping limitation. This check
+ * is only needed for V1 filesystems, since V2/V3 support an extra level
+@@ -277,26 +305,6 @@ static int minix_fill_super(struct super_block *s, struct fs_context *fc)
+ minix_set_bit(0,sbi->s_imap[0]->b_data);
+ minix_set_bit(0,sbi->s_zmap[0]->b_data);
+
+- /* Apparently minix can create filesystems that allocate more blocks for
+- * the bitmaps than needed. We simply ignore that, but verify it didn't
+- * create one with not enough blocks and bail out if so.
+- */
+- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
+- if (sbi->s_imap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "imap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+- block = minix_blocks_needed(
+- (sbi->s_nzones - sbi->s_firstdatazone + 1),
+- s->s_blocksize);
+- if (sbi->s_zmap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "zmap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+ /* set up enough so that it can read an inode */
+ s->s_op = &minix_sops;
+ s->s_time_min = 0;
+--
+2.51.0
+
--- /dev/null
+From d4e5ac4c1a146b9507f9de9943793735b59de2f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 09:40:06 +0000
+Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ]
+
+The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which
+is a valid index - so add a check for this.
+
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mach-loongson64/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h
+index 3414a1fd17835..89bb4deab98a6 100644
+--- a/arch/mips/include/asm/mach-loongson64/topology.h
++++ b/arch/mips/include/asm/mach-loongson64/topology.h
+@@ -7,7 +7,7 @@
+ #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2)
+
+ extern cpumask_t __node_cpumask[];
+-#define cpumask_of_node(node) (&__node_cpumask[node])
++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node])
+
+ struct pci_bus;
+ extern int pcibus_to_node(struct pci_bus *);
+--
+2.51.0
+
--- /dev/null
+From b4eae75042391b67967eb142a1ca3bfad7c17f51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 14:36:37 +0800
+Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ]
+
+In the function bcm_vk_read(), the pointer entry is checked, indicating
+that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
+following code may cause null-pointer dereferences:
+
+ struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+ set_msg_id(&tmp_msg, entry->usr_msg_id);
+ tmp_msg.size = entry->to_h_blks - 1;
+
+To prevent these possible null-pointer dereferences, copy to_h_msg,
+usr_msg_id, and to_h_blks from iter into temporary variables, and return
+these temporary variables to the application instead of accessing them
+through a potentially NULL entry.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Reviewed-by: Scott Branden <scott.branden@broadcom.com>
+Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
+index 1f42d1d5a630a..665a3888708ac 100644
+--- a/drivers/misc/bcm-vk/bcm_vk_msg.c
++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
+@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ struct device *dev = &vk->pdev->dev;
+ struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan;
+ struct bcm_vk_wkent *entry = NULL, *iter;
++ struct vk_msg_blk tmp_msg;
++ u32 tmp_usr_msg_id;
++ u32 tmp_blks;
+ u32 q_num;
+ u32 rsp_length;
+
+@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ entry = iter;
+ } else {
+ /* buffer not big enough */
++ tmp_msg = iter->to_h_msg[0];
++ tmp_usr_msg_id = iter->usr_msg_id;
++ tmp_blks = iter->to_h_blks;
+ rc = -EMSGSIZE;
+ }
+ goto read_loop_exit;
+@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file,
+
+ bcm_vk_free_wkent(dev, entry);
+ } else if (rc == -EMSGSIZE) {
+- struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+-
+ /*
+ * in this case, return just the first block, so
+ * that app knows what size it is looking for.
+ */
+- set_msg_id(&tmp_msg, entry->usr_msg_id);
+- tmp_msg.size = entry->to_h_blks - 1;
++ set_msg_id(&tmp_msg, tmp_usr_msg_id);
++ tmp_msg.size = tmp_blks - 1;
+ if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) {
+ dev_err(dev, "Error return 1st block in -EMSGSIZE\n");
+ rc = -EFAULT;
+--
+2.51.0
+
--- /dev/null
+From b196e8f7b5e5fa0ac253dda3ede8f681abd9a4da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 11:48:24 +0100
+Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
+
+From: Markus Perkins <markus@notsyncing.net>
+
+[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ]
+
+commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66
+compatible strings") added support for 93xx56 and 93xx66 eeproms, but
+didn't take into account that the write enable/disable + erase all
+commands are hardcoded for the 6-bit address of the 93xx46.
+
+This commit fixes the command word generation by increasing the number
+of shifts as the address field grows, keeping the command intact.
+
+Also, the check for 8-bit or 16-bit mode is no longer required as this
+is already taken into account in the edev->addrlen field.
+
+Signed-off-by: Markus Perkins <markus@notsyncing.net>
+Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index 9cae6f530679b..5230e910a1d11 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -45,6 +45,7 @@ struct eeprom_93xx46_platform_data {
+ #define OP_START 0x4
+ #define OP_WRITE (OP_START | 0x1)
+ #define OP_READ (OP_START | 0x2)
++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */
+ #define ADDR_EWDS 0x00
+ #define ADDR_ERAL 0x20
+ #define ADDR_EWEN 0x30
+@@ -191,10 +192,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1;
+- else
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS);
++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+@@ -328,10 +326,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= ADDR_ERAL << 1;
+- else
+- cmd_addr |= ADDR_ERAL;
++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+--
+2.51.0
+
--- /dev/null
+From 0c6221f9d1cf94e3982d05552c1fb722ff9be335 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Dec 2025 18:22:43 +0800
+Subject: misc: ti_fpc202: fix a potential memory leak in probe function
+
+From: Felix Gu <gu_0233@qq.com>
+
+[ Upstream commit dad9f13d967b4e53e8eaf5f9c690f8e778ad9802 ]
+
+Use for_each_child_of_node_scoped() to simplify the code and ensure the
+device node reference is automatically released when the loop scope
+ends.
+
+Signed-off-by: Felix Gu <gu_0233@qq.com>
+Reviewed-by: Romain Gantois <romain.gantois@bootlin.com>
+Link: https://patch.msgid.link/tencent_FA1AC670F5CF49873F88A44424F866994A08@qq.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/ti_fpc202.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c
+index 7964e46c74482..8eb2b5ac98506 100644
+--- a/drivers/misc/ti_fpc202.c
++++ b/drivers/misc/ti_fpc202.c
+@@ -309,7 +309,6 @@ static void fpc202_remove_port(struct fpc202_priv *priv, int port_id)
+ static int fpc202_probe(struct i2c_client *client)
+ {
+ struct device *dev = &client->dev;
+- struct device_node *i2c_handle;
+ struct fpc202_priv *priv;
+ int ret, port_id;
+
+@@ -357,7 +356,7 @@ static int fpc202_probe(struct i2c_client *client)
+
+ bitmap_zero(priv->probed_ports, FPC202_NUM_PORTS);
+
+- for_each_child_of_node(dev->of_node, i2c_handle) {
++ for_each_child_of_node_scoped(dev->of_node, i2c_handle) {
+ ret = of_property_read_u32(i2c_handle, "reg", &port_id);
+ if (ret) {
+ if (ret == -EINVAL)
+--
+2.51.0
+
--- /dev/null
+From 591b763310385a36ec35e531196cf2475415f6e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 13:13:30 +0100
+Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ]
+
+Building a size optimized ppc64 kernel (-Os), gcc emits more FP
+save/restore symbols, that the linker generates on demand into the
+.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c,
+too. They are needed for the amdgpu in-kernel floating point support.
+
+MODPOST Module.symvers
+ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many)
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 47c8aa2a69392..133dfa16308a3 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -602,6 +602,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
+ /* Special register function linked on all modules during final link of .ko */
+ if (strstarts(symname, "_restgpr0_") ||
+ strstarts(symname, "_savegpr0_") ||
++ strstarts(symname, "_restgpr1_") ||
++ strstarts(symname, "_savegpr1_") ||
++ strstarts(symname, "_restfpr_") ||
++ strstarts(symname, "_savefpr_") ||
+ strstarts(symname, "_restvr_") ||
+ strstarts(symname, "_savevr_") ||
+ strcmp(symname, ".TOC.") == 0)
+--
+2.51.0
+
--- /dev/null
+From 8259b6e6da0e4aca5c6edd25c5b86389918b29d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 16:53:37 +0000
+Subject: most: core: fix resource leak in most_register_interface error paths
+
+From: Navaneeth K <knavaneeth786@gmail.com>
+
+[ Upstream commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 ]
+
+The function most_register_interface() did not correctly release resources
+if it failed early (before registering the device). In these cases, it
+returned an error code immediately, leaking the memory allocated for the
+interface.
+
+Fix this by initializing the device early via device_initialize() and
+calling put_device() on all error paths.
+
+The most_register_interface() is expected to call put_device() on
+error which frees the resources allocated in the caller. The
+put_device() either calls release_mdev() or dim2_release(),
+depending on the caller.
+
+Switch to using device_add() instead of device_register() to handle
+the split initialization.
+
+Acked-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://patch.msgid.link/20251127165337.19172-1-knavaneeth786@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/most/core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/most/core.c b/drivers/most/core.c
+index da319d108ea1d..6277e6702ca8c 100644
+--- a/drivers/most/core.c
++++ b/drivers/most/core.c
+@@ -1286,15 +1286,19 @@ int most_register_interface(struct most_interface *iface)
+ !iface->poison_channel || (iface->num_channels > MAX_CHANNELS))
+ return -EINVAL;
+
++ device_initialize(iface->dev);
++
+ id = ida_alloc(&mdev_id, GFP_KERNEL);
+ if (id < 0) {
+ dev_err(iface->dev, "Failed to allocate device ID\n");
++ put_device(iface->dev);
+ return id;
+ }
+
+ iface->p = kzalloc(sizeof(*iface->p), GFP_KERNEL);
+ if (!iface->p) {
+ ida_free(&mdev_id, id);
++ put_device(iface->dev);
+ return -ENOMEM;
+ }
+
+@@ -1304,7 +1308,7 @@ int most_register_interface(struct most_interface *iface)
+ iface->dev->bus = &mostbus;
+ iface->dev->groups = interface_attr_groups;
+ dev_set_drvdata(iface->dev, iface);
+- if (device_register(iface->dev)) {
++ if (device_add(iface->dev)) {
+ dev_err(iface->dev, "Failed to register interface device\n");
+ kfree(iface->p);
+ put_device(iface->dev);
+--
+2.51.0
+
--- /dev/null
+From 8dd3528ec275597fa6be52dbf2bcf2d2ad9aac96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 12:41:31 +0100
+Subject: mshv: clear eventfd counter on irqfd shutdown
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Carlos López <clopez@suse.de>
+
+[ Upstream commit 2b4246153e2184e3a3b4edc8cc35337d7a2455a6 ]
+
+While unhooking from the irqfd waitqueue, clear the internal eventfd
+counter by using eventfd_ctx_remove_wait_queue() instead of
+remove_wait_queue(), preventing potential spurious interrupts. This
+removes the need to store a pointer into the workqueue, as the eventfd
+already keeps track of it.
+
+This mimicks what other similar subsystems do on their equivalent paths
+with their irqfds (KVM, Xen, ACRN support, etc).
+
+Signed-off-by: Carlos López <clopez@suse.de>
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/mshv_eventfd.c | 5 ++---
+ drivers/hv/mshv_eventfd.h | 1 -
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hv/mshv_eventfd.c b/drivers/hv/mshv_eventfd.c
+index 05d643f54f45a..40b7179fee805 100644
+--- a/drivers/hv/mshv_eventfd.c
++++ b/drivers/hv/mshv_eventfd.c
+@@ -244,12 +244,13 @@ static void mshv_irqfd_shutdown(struct work_struct *work)
+ {
+ struct mshv_irqfd *irqfd =
+ container_of(work, struct mshv_irqfd, irqfd_shutdown);
++ u64 cnt;
+
+ /*
+ * Synchronize with the wait-queue and unhook ourselves to prevent
+ * further events.
+ */
+- remove_wait_queue(irqfd->irqfd_wqh, &irqfd->irqfd_wait);
++ eventfd_ctx_remove_wait_queue(irqfd->irqfd_eventfd_ctx, &irqfd->irqfd_wait, &cnt);
+
+ if (irqfd->irqfd_resampler) {
+ mshv_irqfd_resampler_shutdown(irqfd);
+@@ -368,8 +369,6 @@ static void mshv_irqfd_queue_proc(struct file *file, wait_queue_head_t *wqh,
+ struct mshv_irqfd *irqfd =
+ container_of(polltbl, struct mshv_irqfd, irqfd_polltbl);
+
+- irqfd->irqfd_wqh = wqh;
+-
+ /*
+ * TODO: Ensure there isn't already an exclusive, priority waiter, e.g.
+ * that the irqfd isn't already bound to another partition. Only the
+diff --git a/drivers/hv/mshv_eventfd.h b/drivers/hv/mshv_eventfd.h
+index 332e7670a3442..464c6b81ab336 100644
+--- a/drivers/hv/mshv_eventfd.h
++++ b/drivers/hv/mshv_eventfd.h
+@@ -32,7 +32,6 @@ struct mshv_irqfd {
+ struct mshv_lapic_irq irqfd_lapic_irq;
+ struct hlist_node irqfd_hnode;
+ poll_table irqfd_polltbl;
+- wait_queue_head_t *irqfd_wqh;
+ wait_queue_entry_t irqfd_wait;
+ struct work_struct irqfd_shutdown;
+ struct mshv_irqfd_resampler *irqfd_resampler;
+--
+2.51.0
+
--- /dev/null
+From 0a51fa38af4f69fe8d6a09f48065a2dd7b38974b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 17:28:09 +0100
+Subject: myri10ge: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ]
+
+While compile testing on less common architectures, I noticed that gcc-10 on
+s390 finds a bug that all other configurations seem to miss:
+
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized]
+ 391 | buf->data0 = htonl(data->data0);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+ | ^~~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized]
+ 393 | buf->data2 = htonl(data->data2);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+
+It would be nice to understand how to make other compilers catch this as
+well, but for the moment I'll just shut up the warning by fixing the
+undefined behavior in this driver.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index 7be30a8df2685..2f0cdbd4e2ac9 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
+
+ /* probe for IPv6 TSO support */
+ mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE,
+ &cmd, 0);
+ if (status == 0) {
+@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp,
+ | (addr[2] << 8) | addr[3]);
+
+ cmd.data1 = ((addr[4] << 8) | (addr[5]));
++ cmd.data2 = 0;
+
+ status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0);
+ return status;
+@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause)
+ int status, ctl;
+
+ ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, 0);
+
+ if (status) {
+@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic)
+ int status, ctl;
+
+ ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC;
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic);
+ if (status)
+ netdev_err(mgp->dev, "Failed to set promisc mode\n");
+@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss)
+ /* get ring sizes */
+ slice = ss - mgp->ss;
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
+ tx_ring_size = cmd.data0;
+ cmd.data0 = slice;
+@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice)
+ status = 0;
+ if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) {
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET,
+ &cmd, 0);
+ ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *)
+ (mgp->sram + cmd.data0);
+ }
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET,
+ &cmd, 0);
+ ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *)
+@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev)
+ if (mgp->num_slices > 1) {
+ cmd.data0 = mgp->num_slices;
+ cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE;
++ cmd.data2 = 0;
+ if (mgp->dev->real_num_tx_queues > 1)
+ cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES,
+@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev)
+
+ /* now give firmware buffers sizes, and MTU */
+ cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0);
+ cmd.data0 = mgp->small_bytes;
+ status |=
+@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev)
+ static int myri10ge_close(struct net_device *dev)
+ {
+ struct myri10ge_priv *mgp = netdev_priv(dev);
+- struct myri10ge_cmd cmd;
+ int status, old_down_cnt;
+ int i;
+
+@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev)
+
+ netif_tx_stop_all_queues(dev);
+ if (mgp->rebooted == 0) {
++ struct myri10ge_cmd cmd;
++
+ old_down_cnt = mgp->down_cnt;
+ mb();
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status =
+ myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0);
+ if (status)
+@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev)
+
+ /* Disable multicast filtering */
+
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1);
+ if (err != 0) {
+ netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n",
+--
+2.51.0
+
--- /dev/null
+From 21ebc80fee90399bb6d46a7f5af9718cf19244c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:47:55 +0800
+Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits
+
+From: Jijie Shao <shaojijie@huawei.com>
+
+[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ]
+
+Currently, HCLGE_FD_AD_QID has only 10 bits and supports a
+maximum of 1023 queues. However, there are actually scenarios
+where the queue_id exceeds 1023.
+
+This patch adds an additional bit to HCLGE_FD_AD_QID to ensure
+that queue_id greater than 1023 are supported.
+
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++--
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 416e02e7b995f..bc333d8710ac1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd {
+
+ #define HCLGE_FD_AD_DROP_B 0
+ #define HCLGE_FD_AD_DIRECT_QID_B 1
+-#define HCLGE_FD_AD_QID_S 2
+-#define HCLGE_FD_AD_QID_M GENMASK(11, 2)
++#define HCLGE_FD_AD_QID_L_S 2
++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2)
+ #define HCLGE_FD_AD_USE_COUNTER_B 12
+ #define HCLGE_FD_AD_COUNTER_NUM_S 13
+ #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)
+@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd {
+ #define HCLGE_FD_AD_TC_OVRD_B 16
+ #define HCLGE_FD_AD_TC_SIZE_S 17
+ #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17)
++#define HCLGE_FD_AD_QID_H_B 21
+
+ struct hclge_fd_ad_config_cmd {
+ u8 stage;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 5cc5ee9dcd982..54d0a9ba7879b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5679,11 +5679,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc,
+ hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M,
+ HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size);
+ }
++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B,
++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0);
+ ad_data <<= 32;
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B,
+ action->forward_to_direct_queue);
+- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S,
++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S,
+ action->queue_id);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter);
+ hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M,
+--
+2.51.0
+
--- /dev/null
+From 8a9aab7b3019c201a08d03040c9e3ceff42d7195 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:57:20 -0700
+Subject: net/rds: Clear reconnect pending bit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ]
+
+When canceling the reconnect worker, care must be taken to reset the
+reconnect-pending bit. If the reconnect worker has not yet been
+scheduled before it is canceled, the reconnect-pending bit will stay
+on forever.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index ad8027e6f54ef..dbfea6fa11260 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -429,6 +429,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ * to the conn hash, so we never trigger a reconnect on this
+ * conn - the reconnect is always triggered by the active peer. */
+ cancel_delayed_work_sync(&cp->cp_conn_w);
++
++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags);
+ rcu_read_lock();
+ if (!hlist_unhashed(&conn->c_hash_node)) {
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From d3e99b140de5a0b0f8d906104cdbc6e7cda80f51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 22:52:12 -0700
+Subject: net/rds: No shortcut out of RDS_CONN_ERROR
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ]
+
+RDS connections carry a state "rds_conn_path::cp_state"
+and transitions from one state to another and are conditional
+upon an expected state: "rds_conn_path_transition."
+
+There is one exception to this conditionality, which is
+"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"
+regardless of what state the condition is currently in.
+
+But as soon as a connection enters state "RDS_CONN_ERROR",
+the connection handling code expects it to go through the
+shutdown-path.
+
+The RDS/TCP multipath changes added a shortcut out of
+"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"
+via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").
+
+A subsequent "rds_tcp_reset_callbacks" can then transition
+the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.
+
+That'll trip up "rds_conn_init_shutdown", which was
+never adjusted to handle "RDS_CONN_RESETTING" and subsequently
+drops the connection with the dreaded "DR_INV_CONN_STATE",
+which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever.
+
+So we do two things here:
+
+a) Don't shortcut "RDS_CONN_ERROR", but take the longer
+ path through the shutdown code.
+
+b) Add "RDS_CONN_RESETTING" to the expected states in
+ "rds_conn_init_shutdown" so that we won't error out
+ and get stuck, if we ever hit weird state transitions
+ like this again."
+
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ net/rds/tcp_listen.c | 5 -----
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 68bc88cce84ec..ad8027e6f54ef 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -382,6 +382,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ if (!rds_conn_path_transition(cp, RDS_CONN_UP,
+ RDS_CONN_DISCONNECTING) &&
+ !rds_conn_path_transition(cp, RDS_CONN_ERROR,
++ RDS_CONN_DISCONNECTING) &&
++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING,
+ RDS_CONN_DISCONNECTING)) {
+ rds_conn_path_error(cp,
+ "shutdown called in state %d\n",
+diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
+index 91e34af3fe5d5..65c5425a02de4 100644
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -59,9 +59,6 @@ void rds_tcp_keepalive(struct socket *sock)
+ * socket and force a reconneect from smaller -> larger ip addr. The reason
+ * we special case cp_index 0 is to allow the rds probe ping itself to itself
+ * get through efficiently.
+- * Since reconnects are only initiated from the node with the numerically
+- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side
+- * by moving them to CONNECTING in this function.
+ */
+ static
+ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+@@ -86,8 +83,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+ struct rds_conn_path *cp = &conn->c_path[i];
+
+ if (rds_conn_path_transition(cp, RDS_CONN_DOWN,
+- RDS_CONN_CONNECTING) ||
+- rds_conn_path_transition(cp, RDS_CONN_ERROR,
+ RDS_CONN_CONNECTING)) {
+ return cp->cp_transport_data;
+ }
+--
+2.51.0
+
--- /dev/null
+From 361607e9d32f85d01d280f36bc2dea7a90877c32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 18:00:44 +0100
+Subject: net: sfp: add quirk for Lantech 8330-265D
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 86a8e8e0ddbc3d14c799536eb888180b84d002f3 ]
+
+Similar to Lantech 8330-262D-E, the Lantech 8330-265D also reports
+2500MBd instead of 3125MBd.
+
+Also, all 8330-265D report normal RX_LOS in EEPROM, but some signal
+inverted RX_LOS. We therefore need to ignore RX_LOS on these modules.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Link: https://patch.msgid.link/20260128170044.15576-1-kabel@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/sfp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 3e023723887c4..43aefdd8b70f7 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -532,9 +532,13 @@ static const struct sfp_quirk sfp_quirks[] = {
+ SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex,
+ sfp_fixup_ignore_tx_fault),
+
+- // Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report
+- // 2500MBd NRZ in their EEPROM
++ // Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but
++ // incorrectly report 2500MBd NRZ in their EEPROM.
++ // Some 8330-265D modules have inverted LOS, while all of them report
++ // normal LOS in EEPROM. Therefore we need to ignore LOS entirely.
+ SFP_QUIRK_S("Lantech", "8330-262D-E", sfp_quirk_2500basex),
++ SFP_QUIRK("Lantech", "8330-265D", sfp_quirk_2500basex,
++ sfp_fixup_ignore_los),
+
+ SFP_QUIRK_S("UBNT", "UF-INSTANT", sfp_quirk_ubnt_uf_instant),
+
+--
+2.51.0
+
--- /dev/null
+From 510eca0c19200a9476127f3b178d496b93efdcdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 09:59:49 +0800
+Subject: net: usb: r8152: fix transmit queue timeout
+
+From: Mingj Ye <insyelu@gmail.com>
+
+[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ]
+
+When the TX queue length reaches the threshold, the netdev watchdog
+immediately detects a TX queue timeout.
+
+This patch updates the trans_start timestamp of the transmit queue
+on every asynchronous USB URB submission along the transmit path,
+ensuring that the network watchdog accurately reflects ongoing
+transmission activity.
+
+Signed-off-by: Mingj Ye <insyelu@gmail.com>
+Reviewed-by: Hayes Wang <hayeswang@realtek.com>
+Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 6a43054d5171f..da8de7b1a4891 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -2449,6 +2449,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
+ ret = usb_submit_urb(agg->urb, GFP_ATOMIC);
+ if (ret < 0)
+ usb_autopm_put_interface_async(tp->intf);
++ else
++ netif_trans_update(tp->netdev);
+
+ out_tx_fill:
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 6c9ca99cc8c3b30f83f82059a1bd18a9cf24cfe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:39:09 -0800
+Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter
+
+From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+
+[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ]
+
+Several registers referenced in this driver's source code do not
+actually exist (they are not writable and read as zero in my testing).
+They exist in this driver because it originated as a copy of the dm9601
+driver. Notably, these include the multicast filter registers - this
+causes the driver to not support multicast packets correctly. Remove
+the multicast filter code and register definitions. Instead, set the
+chip to receive all multicast filter packets when any multicast
+addresses are in the list.
+
+Reviewed-by: Simon Horman <horms@kernel.org> (from v1)
+Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/Kconfig | 1 -
+ drivers/net/usb/sr9700.c | 25 ++++---------------------
+ drivers/net/usb/sr9700.h | 7 +------
+ 3 files changed, 5 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index 856e648d804e0..da0f6a138f4fc 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -319,7 +319,6 @@ config USB_NET_DM9601
+ config USB_NET_SR9700
+ tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
+ depends on USB_USBNET
+- select CRC32
+ help
+ This option adds support for CoreChip-sz SR9700 based USB 1.1
+ 10/100 Ethernet adapters.
+diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
+index 820c4c5069792..a5d364fbc3639 100644
+--- a/drivers/net/usb/sr9700.c
++++ b/drivers/net/usb/sr9700.c
+@@ -18,7 +18,6 @@
+ #include <linux/ethtool.h>
+ #include <linux/mii.h>
+ #include <linux/usb.h>
+-#include <linux/crc32.h>
+ #include <linux/usb/usbnet.h>
+
+ #include "sr9700.h"
+@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = {
+ static void sr9700_set_multicast(struct net_device *netdev)
+ {
+ struct usbnet *dev = netdev_priv(netdev);
+- /* We use the 20 byte dev->data for our 8 byte filter buffer
+- * to avoid allocating memory that is tricky to free later
+- */
+- u8 *hashes = (u8 *)&dev->data;
+ /* rx_ctl setting : enable, disable_long, disable_crc */
+ u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG;
+
+- memset(hashes, 0x00, SR_MCAST_SIZE);
+- /* broadcast address */
+- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG;
+- if (netdev->flags & IFF_PROMISC) {
++ if (netdev->flags & IFF_PROMISC)
+ rx_ctl |= RCR_PRMSC;
+- } else if (netdev->flags & IFF_ALLMULTI ||
+- netdev_mc_count(netdev) > SR_MCAST_MAX) {
+- rx_ctl |= RCR_RUNT;
+- } else if (!netdev_mc_empty(netdev)) {
+- struct netdev_hw_addr *ha;
+-
+- netdev_for_each_mc_addr(ha, netdev) {
+- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26;
+- hashes[crc >> 3] |= 1 << (crc & 0x7);
+- }
+- }
++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev))
++ /* The chip has no multicast filter */
++ rx_ctl |= RCR_ALL;
+
+- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes);
+ sr_write_reg_async(dev, SR_RCR, rx_ctl);
+ }
+
+diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
+index ea2b4de621c86..c479908f7d823 100644
+--- a/drivers/net/usb/sr9700.h
++++ b/drivers/net/usb/sr9700.h
+@@ -104,9 +104,7 @@
+ #define WCR_LINKEN (1 << 5)
+ /* Physical Address Reg */
+ #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */
+-/* Multicast Address Reg */
+-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */
+-/* 0x1e unused */
++/* 0x16 --> 0x1E unused */
+ /* Phy Reset Reg */
+ #define SR_PRR 0x1F
+ #define PRR_PHY_RST (1 << 0)
+@@ -161,9 +159,6 @@
+ /* parameters */
+ #define SR_SHARE_TIMEOUT 1000
+ #define SR_EEPROM_LEN 256
+-#define SR_MCAST_SIZE 8
+-#define SR_MCAST_ADDR_FLAG 0x80
+-#define SR_MCAST_MAX 64
+ #define SR_TX_OVERHEAD 2 /* 2bytes header */
+ #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */
+
+--
+2.51.0
+
--- /dev/null
+From c7e68af6df1277395f3af1eaf18f9ad81d9e99a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 10:26:46 +0800
+Subject: net: wwan: mhi: Add network support for Foxconn T99W760
+
+From: Slark Xiao <slark_xiao@163.com>
+
+[ Upstream commit 915a5f60ad947e8dd515d2cc77a96a14dffb3f15 ]
+
+T99W760 is designed based on Qualcomm SDX35 chip. It use similar
+architecture with SDX72/SDX75 chip. So we need to assign initial
+link id for this device to make sure network available.
+
+Signed-off-by: Slark Xiao <slark_xiao@163.com>
+Link: https://patch.msgid.link/20260105022646.10630-1-slark_xiao@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/mhi_wwan_mbim.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
+index f8bc9a39bfa30..1d7e3ad900c12 100644
+--- a/drivers/net/wwan/mhi_wwan_mbim.c
++++ b/drivers/net/wwan/mhi_wwan_mbim.c
+@@ -98,7 +98,8 @@ static struct mhi_mbim_link *mhi_mbim_get_link_rcu(struct mhi_mbim_context *mbim
+ static int mhi_mbim_get_link_mux_id(struct mhi_controller *cntrl)
+ {
+ if (strcmp(cntrl->name, "foxconn-dw5934e") == 0 ||
+- strcmp(cntrl->name, "foxconn-t99w640") == 0)
++ strcmp(cntrl->name, "foxconn-t99w640") == 0 ||
++ strcmp(cntrl->name, "foxconn-t99w760") == 0)
+ return WDS_BIND_MUX_DATA_PORT_MUX_ID;
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 77072fd573b91547438697899b975207278b08b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Dec 2025 20:53:51 +0900
+Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler
+
+From: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+
+[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ]
+
+The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
+ ("netfilter: conntrack: introduce clash resolution on insertion race"),
+sets allow_clash=true in the UDP/UDPLITE protocol handler
+but does not set it in the generic protocol handler.
+
+As a result, packets composed of connectionless protocols at each layer,
+such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
+
+To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.
+
+Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_generic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
+index e831637bc8ca8..cb260eb3d012c 100644
+--- a/net/netfilter/nf_conntrack_proto_generic.c
++++ b/net/netfilter/nf_conntrack_proto_generic.c
+@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net)
+ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
+ {
+ .l4proto = 255,
++ .allow_clash = true,
+ #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ .ctnl_timeout = {
+ .nlattr_to_obj = generic_timeout_nlattr_to_obj,
+--
+2.51.0
+
--- /dev/null
+From a4a9cfaa4ae8bc70259012650750b1b7f4a7172a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 12:30:42 +0100
+Subject: netfilter: xt_tcpmss: check remaining length before reading optlen
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ]
+
+Quoting reporter:
+ In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
+ op[i+1] directly without validating the remaining option length.
+
+ If the last byte of the option field is not EOL/NOP (0/1), the code attempts
+ to index op[i+1]. In the case where i + 1 == optlen, this causes an
+ out-of-bounds read, accessing memory past the optlen boundary
+ (either reading beyond the stack buffer _opt or the
+ following payload).
+
+Reported-by: sungzii <sungzii@pm.me>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_tcpmss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
+index 37704ab017992..0d32d4841cb32 100644
+--- a/net/netfilter/xt_tcpmss.c
++++ b/net/netfilter/xt_tcpmss.c
+@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ return (mssval >= info->mss_min &&
+ mssval <= info->mss_max) ^ info->invert;
+ }
+- if (op[i] < 2)
++ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i+1] ? : 1;
+--
+2.51.0
+
--- /dev/null
+From a6848d32e66e9f00fedcc718a5688be0024a735b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jan 2026 14:03:04 +0530
+Subject: netfs: when subreq is marked for retry, do not check if it faced an
+ error
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+[ Upstream commit 82e8885bd7633a36ee9050e6d7f348a4155eed5f ]
+
+The *_subreq_terminated functions today only process the NEED_RETRY
+flag when the subreq was successful or failed with EAGAIN error.
+However, there could be other retriable errors for network filesystems.
+
+Avoid this by processing the NEED_RETRY irrespective of the error
+code faced by the subreq. If it was specifically marked for retry,
+the error code must not matter.
+
+Acked-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/read_collect.c | 10 ++++++++++
+ fs/netfs/read_retry.c | 4 ++--
+ fs/netfs/write_collect.c | 8 ++++----
+ fs/netfs/write_issue.c | 1 +
+ 4 files changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c
+index 7a0ffa675fb17..137f0e28a44c5 100644
+--- a/fs/netfs/read_collect.c
++++ b/fs/netfs/read_collect.c
+@@ -546,6 +546,15 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq)
+ }
+ }
+
++ /* If need retry is set, error should not matter unless we hit too many
++ * retries. Pause the generation of new subreqs
++ */
++ if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
++ trace_netfs_rreq(rreq, netfs_rreq_trace_set_pause);
++ set_bit(NETFS_RREQ_PAUSE, &rreq->flags);
++ goto skip_error_checks;
++ }
++
+ if (unlikely(subreq->error < 0)) {
+ trace_netfs_failure(rreq, subreq, subreq->error, netfs_fail_read);
+ if (subreq->source == NETFS_READ_FROM_CACHE) {
+@@ -559,6 +568,7 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq)
+ set_bit(NETFS_RREQ_PAUSE, &rreq->flags);
+ }
+
++skip_error_checks:
+ trace_netfs_sreq(subreq, netfs_sreq_trace_terminated);
+ netfs_subreq_clear_in_progress(subreq);
+ netfs_put_subrequest(subreq, netfs_sreq_trace_put_terminated);
+diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c
+index b99e84a8170af..7793ba5e3e8fc 100644
+--- a/fs/netfs/read_retry.c
++++ b/fs/netfs/read_retry.c
+@@ -12,6 +12,7 @@
+ static void netfs_reissue_read(struct netfs_io_request *rreq,
+ struct netfs_io_subrequest *subreq)
+ {
++ subreq->error = 0;
+ __clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
+ __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
+ netfs_stat(&netfs_n_rh_retry_read_subreq);
+@@ -242,8 +243,7 @@ static void netfs_retry_read_subrequests(struct netfs_io_request *rreq)
+ subreq = list_next_entry(subreq, rreq_link);
+ abandon:
+ list_for_each_entry_from(subreq, &stream->subrequests, rreq_link) {
+- if (!subreq->error &&
+- !test_bit(NETFS_SREQ_FAILED, &subreq->flags) &&
++ if (!test_bit(NETFS_SREQ_FAILED, &subreq->flags) &&
+ !test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags))
+ continue;
+ subreq->error = -ENOMEM;
+diff --git a/fs/netfs/write_collect.c b/fs/netfs/write_collect.c
+index cbf3d9194c7bf..61eab34ea67ef 100644
+--- a/fs/netfs/write_collect.c
++++ b/fs/netfs/write_collect.c
+@@ -492,11 +492,11 @@ void netfs_write_subrequest_terminated(void *_op, ssize_t transferred_or_error)
+
+ if (IS_ERR_VALUE(transferred_or_error)) {
+ subreq->error = transferred_or_error;
+- if (subreq->error == -EAGAIN)
+- set_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags);
+- else
++ /* if need retry is set, error should not matter */
++ if (!test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
+ set_bit(NETFS_SREQ_FAILED, &subreq->flags);
+- trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write);
++ trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write);
++ }
+
+ switch (subreq->source) {
+ case NETFS_WRITE_TO_CACHE:
+diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
+index dd8743bc8d7fe..34894da5a23ec 100644
+--- a/fs/netfs/write_issue.c
++++ b/fs/netfs/write_issue.c
+@@ -250,6 +250,7 @@ void netfs_reissue_write(struct netfs_io_stream *stream,
+ iov_iter_truncate(&subreq->io_iter, size);
+
+ subreq->retry_count++;
++ subreq->error = 0;
+ __clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
+ __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
+ netfs_stat(&netfs_n_wh_retry_write_subreq);
+--
+2.51.0
+
--- /dev/null
+From 95a6108176a411b77b4828dad297d15e78723adb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 19:11:39 +0800
+Subject: nfc: nxp-nci: remove interrupt trigger type
+
+From: Carl Lee <carl.lee@amd.com>
+
+[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ]
+
+For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and
+active high, not edge-triggered.
+
+Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail
+to trigger correctly.
+
+Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured
+via Device Tree.
+
+Signed-off-by: Carl Lee <carl.lee@amd.com>
+Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index 049662ffdf972..6a5ce8ff91f0b 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -305,7 +305,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client)
+
+ r = request_threaded_irq(client->irq, NULL,
+ nxp_nci_i2c_irq_thread_fn,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_ONESHOT,
+ NXP_NCI_I2C_DRIVER_NAME, phy);
+ if (r < 0)
+ nfc_err(&client->dev, "Unable to register IRQ handler\n");
+--
+2.51.0
+
--- /dev/null
+From 4855979c7a8dbc26dcaaf4d32553e4dfc31dd7b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:18 -0800
+Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]
+
+Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
+This patch protects against invalid index out of bounds access to mw_sizes
+When invalid access print message to user that configuration is not valid.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index f851397b65d6e..f15ebab138144 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev)
+ for (i = 0; i < sndev->nr_lut_mw; i++) {
+ int idx = sndev->nr_direct_mw + i;
+
++ if (idx >= MAX_MWS) {
++ dev_err(&sndev->stdev->dev,
++ "Total number of MW cannot be bigger than %d", MAX_MWS);
++ break;
++ }
++
+ sndev->self_shared->mw_sizes[idx] = LUT_SIZE;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 0b125a09384f70d45ac1790839eff2aa1c5f7031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:17 -0800
+Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]
+
+Number of MW LUTs depends on NTB configuration and can be set to zero,
+in such scenario rounddown_pow_of_two will cause undefined behaviour and
+should not be performed.
+This patch ensures that rounddown_pow_of_two is called on valid value.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index f15ebab138144..0536521fa6ccc 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+ sndev->mmio_self_ctrl);
+
+ sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries);
+- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
++ if (sndev->nr_lut_mw)
++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n",
+ sndev->nr_direct_mw, sndev->nr_lut_mw);
+@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+
+ sndev->peer_nr_lut_mw =
+ ioread16(&sndev->mmio_peer_ctrl->lut_table_entries);
+- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
++ if (sndev->peer_nr_lut_mw)
++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n",
+ sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw);
+--
+2.51.0
+
--- /dev/null
+From 2a752bf3d59f3fbeb083a73464ad433c23a044df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:15:04 -0500
+Subject: ntfs: ->d_compare() must not block
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit ca2a04e84af79596e5cd9cfe697d5122ec39c8ce ]
+
+... so don't use __getname() there. Switch it (and ntfs_d_hash(), while
+we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash()
+almost certainly can do with smaller allocations, but let ntfs folks
+deal with that - keep the allocation size as-is for now.
+
+Stop abusing names_cachep in ntfs, period - various uses of that thing
+in there have nothing to do with pathnames; just use k[mz]alloc() and
+be done with that. For now let's keep sizes as-in, but AFAICS none of
+the users actually want PATH_MAX.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/dir.c | 5 ++---
+ fs/ntfs3/fsntfs.c | 4 ++--
+ fs/ntfs3/inode.c | 13 ++++++-------
+ fs/ntfs3/namei.c | 17 ++++++++---------
+ fs/ntfs3/xattr.c | 5 ++---
+ 5 files changed, 20 insertions(+), 24 deletions(-)
+
+diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
+index 1b5c865a0339a..460df046482c7 100644
+--- a/fs/ntfs3/dir.c
++++ b/fs/ntfs3/dir.c
+@@ -424,8 +424,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
+ if (!dir_emit_dots(file, ctx))
+ return 0;
+
+- /* Allocate PATH_MAX bytes. */
+- name = __getname();
++ name = kmalloc(PATH_MAX, GFP_KERNEL);
+ if (!name)
+ return -ENOMEM;
+
+@@ -503,7 +502,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
+
+ out:
+
+- __putname(name);
++ kfree(name);
+ put_indx_node(node);
+
+ if (err == 1) {
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index 5ae910e9ecbda..ef0177b5c6cb0 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -2640,7 +2640,7 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len)
+ u32 uni_bytes;
+ struct ntfs_inode *ni = sbi->volume.ni;
+ /* Allocate PATH_MAX bytes. */
+- struct cpu_str *uni = __getname();
++ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL);
+
+ if (!uni)
+ return -ENOMEM;
+@@ -2684,6 +2684,6 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len)
+ err = _ni_write_inode(&ni->vfs_inode, 0);
+
+ out:
+- __putname(uni);
++ kfree(uni);
+ return err;
+ }
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index 164fd63dff40d..205baa791f998 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -1279,7 +1279,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,
+ fa |= FILE_ATTRIBUTE_READONLY;
+
+ /* Allocate PATH_MAX bytes. */
+- new_de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
++ new_de = kzalloc(PATH_MAX, GFP_KERNEL);
+ if (!new_de) {
+ err = -ENOMEM;
+ goto out1;
+@@ -1699,7 +1699,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,
+ ntfs_mark_rec_free(sbi, ino, false);
+
+ out2:
+- __putname(new_de);
++ kfree(new_de);
+ kfree(rp);
+
+ out1:
+@@ -1720,7 +1720,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry)
+ struct NTFS_DE *de;
+
+ /* Allocate PATH_MAX bytes. */
+- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
++ de = kzalloc(PATH_MAX, GFP_KERNEL);
+ if (!de)
+ return -ENOMEM;
+
+@@ -1734,7 +1734,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry)
+
+ err = ni_add_name(ntfs_i(d_inode(dentry->d_parent)), ni, de);
+ out:
+- __putname(de);
++ kfree(de);
+ return err;
+ }
+
+@@ -1757,8 +1757,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry)
+ if (ntfs_is_meta_file(sbi, ni->mi.rno))
+ return -EINVAL;
+
+- /* Allocate PATH_MAX bytes. */
+- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
++ de = kzalloc(PATH_MAX, GFP_KERNEL);
+ if (!de)
+ return -ENOMEM;
+
+@@ -1794,7 +1793,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry)
+
+ out:
+ ni_unlock(ni);
+- __putname(de);
++ kfree(de);
+ return err;
+ }
+
+diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
+index 82c8ae56beee6..612923d93f4dc 100644
+--- a/fs/ntfs3/namei.c
++++ b/fs/ntfs3/namei.c
+@@ -68,7 +68,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
+ u32 flags)
+ {
+ struct ntfs_inode *ni = ntfs_i(dir);
+- struct cpu_str *uni = __getname();
++ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL);
+ struct inode *inode;
+ int err;
+
+@@ -85,7 +85,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
+ inode = dir_search_u(dir, uni, NULL);
+ ni_unlock(ni);
+ }
+- __putname(uni);
++ kfree(uni);
+ }
+
+ /*
+@@ -303,8 +303,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,
+ return err;
+ }
+
+- /* Allocate PATH_MAX bytes. */
+- de = __getname();
++ de = kmalloc(PATH_MAX, GFP_KERNEL);
+ if (!de)
+ return -ENOMEM;
+
+@@ -349,7 +348,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,
+ ni_unlock(ni);
+ ni_unlock(dir_ni);
+ out:
+- __putname(de);
++ kfree(de);
+ return err;
+ }
+
+@@ -407,7 +406,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)
+ /*
+ * Try slow way with current upcase table
+ */
+- uni = kmem_cache_alloc(names_cachep, GFP_NOWAIT);
++ uni = kmalloc(PATH_MAX, GFP_NOWAIT);
+ if (!uni)
+ return -ENOMEM;
+
+@@ -429,7 +428,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)
+ err = 0;
+
+ out:
+- kmem_cache_free(names_cachep, uni);
++ kfree(uni);
+ return err;
+ }
+
+@@ -468,7 +467,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1,
+ * Try slow way with current upcase table
+ */
+ sbi = dentry->d_sb->s_fs_info;
+- uni1 = __getname();
++ uni1 = kmalloc(PATH_MAX, GFP_NOWAIT);
+ if (!uni1)
+ return -ENOMEM;
+
+@@ -498,7 +497,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1,
+ ret = !ntfs_cmp_names_cpu(uni1, uni2, sbi->upcase, false) ? 0 : 1;
+
+ out:
+- __putname(uni1);
++ kfree(uni1);
+ return ret;
+ }
+
+diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
+index e519e21596a70..142ecb3847e59 100644
+--- a/fs/ntfs3/xattr.c
++++ b/fs/ntfs3/xattr.c
+@@ -556,8 +556,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+ if (unlikely(is_bad_ni(ni)))
+ return ERR_PTR(-EINVAL);
+
+- /* Allocate PATH_MAX bytes. */
+- buf = __getname();
++ buf = kmalloc(PATH_MAX, GFP_KERNEL);
+ if (!buf)
+ return ERR_PTR(-ENOMEM);
+
+@@ -588,7 +587,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+ if (!IS_ERR(acl))
+ set_cached_acl(inode, type, acl);
+
+- __putname(buf);
++ kfree(buf);
+
+ return acl;
+ }
+--
+2.51.0
+
--- /dev/null
+From b3d7865bff31f02fc8cbef47e6790f46ec64ec6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 15:43:07 +0100
+Subject: ntfs3: fix circular locking dependency in run_unpack_ex
+
+From: Szymon Wilczek <swilczek.lx@gmail.com>
+
+[ Upstream commit 08ce2fee1b869ecbfbd94e0eb2630e52203a2e03 ]
+
+Syzbot reported a circular locking dependency between wnd->rw_lock
+(sbi->used.bitmap) and ni->file.run_lock.
+
+The deadlock scenario:
+1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock.
+2. run_unpack_ex() takes wnd->rw_lock then tries to acquire
+ ni->file.run_lock inside ntfs_refresh_zone().
+
+This creates an AB-BA deadlock.
+
+Fix this by using down_read_trylock() instead of down_read() when
+acquiring run_lock in run_unpack_ex(). If the lock is contended,
+skip ntfs_refresh_zone() - the MFT zone will be refreshed on the
+next MFT operation. This breaks the circular dependency since we
+never block waiting for run_lock while holding wnd->rw_lock.
+
+Reported-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com
+Tested-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=d27edf9f96ae85939222
+Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/run.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
+index 5df55e4adbb11..21decc2922823 100644
+--- a/fs/ntfs3/run.c
++++ b/fs/ntfs3/run.c
+@@ -1124,11 +1124,14 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+ struct rw_semaphore *lock =
+ is_mounted(sbi) ? &sbi->mft.ni->file.run_lock :
+ NULL;
+- if (lock)
+- down_read(lock);
+- ntfs_refresh_zone(sbi);
+- if (lock)
+- up_read(lock);
++ if (lock) {
++ if (down_read_trylock(lock)) {
++ ntfs_refresh_zone(sbi);
++ up_read(lock);
++ }
++ } else {
++ ntfs_refresh_zone(sbi);
++ }
+ }
+ up_write(&wnd->rw_lock);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 7521bb2b2e36c8607e03ed068d09c4f538f804f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 18:21:47 +0530
+Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ]
+
+NIX SQ manager sticky mode is known to cause stalls when multiple SQs
+share an SMQ and transmit concurrently. Additionally, PSE may deadlock
+on transitions between sticky and non-sticky transmissions. There is
+also a credit drop issue observed when certain condition clocks are
+gated.
+
+work around these hardware errata by:
+- Disabling SQM sticky operation:
+ - Clear TM6 (bit 15)
+ - Clear TM11 (bit 14)
+- Disabling sticky → non-sticky transition path that can deadlock PSE:
+ - Clear TM5 (bit 23)
+- Preventing credit drops by keeping the control-flow clock enabled:
+ - Set TM9 (bit 21)
+
+These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this
+configuration the SQM/PSE maintain forward progress under load without
+credit loss, at the cost of disabling sticky optimizations.
+
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index 828316211b245..c9c65ac69ead8 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -4932,12 +4932,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw)
+ /* Set chan/link to backpressure TL3 instead of TL2 */
+ rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
+
+- /* Disable SQ manager's sticky mode operation (set TM6 = 0)
++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0)
+ * This sticky mode is known to cause SQ stalls when multiple
+- * SQs are mapped to same SMQ and transmitting pkts at a time.
++ * SQs are mapped to same SMQ and transmitting pkts simultaneously.
++ * NIX PSE may deadlock when there are any sticky to non-sticky
++ * transmission. Hence disable it (TM5 = 0).
+ */
+ cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
+- cfg &= ~BIT_ULL(15);
++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23));
++ /* NIX may drop credits when condition clocks are turned off.
++ * Hence enable control flow clk (set TM9 = 1).
++ */
++ cfg |= BIT_ULL(21);
+ rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
+
+ ltdefs = rvu->kpu.lt_def;
+--
+2.51.0
+
--- /dev/null
+From a6e9d0d0446cb080590a657e6485936926af6c1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 12:07:23 -0500
+Subject: openrisc: define arch-specific version of nop()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ]
+
+When compiling a driver written for MIPS on OpenRISC that uses the nop()
+function, it fails due to the following error:
+
+ drivers/watchdog/pic32-wdt.c: Assembler messages:
+ drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop'
+
+The driver currently uses the generic version of nop() from
+include/asm-generic/barrier.h:
+
+ #ifndef nop
+ #define nop() asm volatile ("nop")
+ #endif
+
+Let's fix this on OpenRISC by defining an architecture-specific version
+of nop().
+
+This was tested by performing an allmodconfig openrisc cross compile on
+an aarch64 host.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/barrier.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+index 7538294721bed..8e592c9909023 100644
+--- a/arch/openrisc/include/asm/barrier.h
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -4,6 +4,8 @@
+
+ #define mb() asm volatile ("l.msync" ::: "memory")
+
++#define nop() asm volatile ("l.nop")
++
+ #include <asm-generic/barrier.h>
+
+ #endif /* __ASM_BARRIER_H */
+--
+2.51.0
+
--- /dev/null
+From 345f2c6acd2077d9b0149c8b2116d2194660cdb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 17:58:55 +0100
+Subject: parisc: Prevent interrupts during reboot
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/process.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index e64ab5d2a40d6..703644e5bfc4a 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -85,6 +85,9 @@ void machine_restart(char *cmd)
+ #endif
+ /* set up a new led state on systems shipped with a LED State panel */
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN);
++
++ /* prevent interrupts during reboot */
++ set_eiem(0);
+
+ /* "Normal" system reset */
+ pdc_do_reset();
+--
+2.51.0
+
--- /dev/null
+From fe48312756fd8565222a71cf5c03f5221c6d91ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:53:32 +0530
+Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
+
+From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+
+[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ]
+
+The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability,
+but they do provide ACS-like features to disable peer transactions and
+validate bus numbers in requests.
+
+Add an ACS quirk for Hamoa & Glymur.
+
+Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index c38434d973cd2..62554152caf37 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5117,6 +5117,10 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
+ /* QCOM SA8775P root port */
+ { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },
++ /* QCOM Hamoa root port */
++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs },
++ /* QCOM Glymur root port */
++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs },
+ /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */
+ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs },
+ /* Intel PCH root ports */
+--
+2.51.0
+
--- /dev/null
+From e160b0ccac93ca1799eb003140417d01c5bb5437 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 21:35:04 +0200
+Subject: PCI: Add Intel Nova Lake audio Device ID
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit b190870e0e0cfb375c0d4da02761c32083f3644d ]
+
+Add Nova Lake (NVL) audio Device ID
+
+The ID will be used by HDA legacy, SOF audio stack and the driver
+to determine which audio stack should be used (intel-dsp-config).
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260120193507.14019-2-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pci_ids.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 92ffc4373f6de..03b7c0380f71c 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -3142,6 +3142,7 @@
+ #define PCI_DEVICE_ID_INTEL_HDA_CML_S 0xa3f0
+ #define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828
+ #define PCI_DEVICE_ID_INTEL_S21152BB 0xb152
++#define PCI_DEVICE_ID_INTEL_HDA_NVL 0xd328
+ #define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7
+ #define PCI_DEVICE_ID_INTEL_HDA_PTL_H 0xe328
+ #define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428
+--
+2.51.0
+
--- /dev/null
+From 7cc6ca14a7735dd4d52dfc7732db5f55513e6074 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 10:25:51 +0100
+Subject: PCI/AER: Clear stale errors on reporting agents upon probe
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ]
+
+Correctable and Uncorrectable Error Status Registers on reporting agents
+are cleared upon PCI device enumeration in pci_aer_init() to flush past
+events. They're cleared again when an error is handled by the AER driver.
+
+If an agent reports a new error after pci_aer_init() and before the AER
+driver has probed on the corresponding Root Port or Root Complex Event
+Collector, that error is not handled by the AER driver: It clears the
+Root Error Status Register on probe, but neglects to re-clear the
+Correctable and Uncorrectable Error Status Registers on reporting agents.
+
+The error will eventually be reported when another error occurs. Which
+is irritating because to an end user it appears as if the earlier error
+has just happened.
+
+Amend the AER driver to clear stale errors on reporting agents upon probe.
+
+Skip reporting agents which have not invoked pci_aer_init() yet to avoid
+using an uninitialized pdev->aer_cap. They're recognizable by the error
+bits in the Device Control register still being clear.
+
+Reporting agents may execute pci_aer_init() after the AER driver has
+probed, particularly when devices are hotplugged or removed/rescanned via
+sysfs. For this reason, it continues to be necessary that pci_aer_init()
+clears Correctable and Uncorrectable Error Status Registers.
+
+Reported-by: Lucas Van <lucas.van@intel.com> # off-list
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Lucas Van <lucas.van@intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 23bead9415fcd..29504173425cd 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -1603,6 +1603,20 @@ static void aer_disable_irq(struct pci_dev *pdev)
+ pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_COMMAND, reg32);
+ }
+
++static int clear_status_iter(struct pci_dev *dev, void *data)
++{
++ u16 devctl;
++
++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */
++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl);
++ if (!(devctl & PCI_EXP_AER_FLAGS))
++ return 0;
++
++ pci_aer_clear_status(dev);
++ pcie_clear_device_status(dev);
++ return 0;
++}
++
+ /**
+ * aer_enable_rootport - enable Root Port's interrupts when receiving messages
+ * @rpc: pointer to a Root Port data structure
+@@ -1624,9 +1638,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc)
+ pcie_capability_clear_word(pdev, PCI_EXP_RTCTL,
+ SYSTEM_ERROR_INTR_ON_MESG_MASK);
+
+- /* Clear error status */
++ /* Clear error status of this Root Port or RCEC */
+ pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32);
++
++ /* Clear error status of agents reporting to this Root Port or RCEC */
++ if (reg32 & AER_ERR_STATUS_MASK) {
++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC)
++ pcie_walk_rcec(pdev, clear_status_iter, NULL);
++ else if (pdev->subordinate)
++ pci_walk_bus(pdev->subordinate, clear_status_iter,
++ NULL);
++ }
++
+ pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32);
+ pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32);
+--
+2.51.0
+
--- /dev/null
+From 71f997e350fd7acc0e796a410c3084d5fe60242f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 15:15:12 +0200
+Subject: PCI/bwctrl: Disable BW controller on Intel P45 using a quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 46a9f70e93ef73860d1dbbec75ef840031f8f30a ]
+
+The commit 665745f27487 ("PCI/bwctrl: Re-add BW notification portdrv as
+PCIe BW controller") was found to lead to a boot hang on a Intel P45
+system. Testing without setting Link Bandwidth Management Interrupt Enable
+(LBMIE) and Link Autonomous Bandwidth Interrupt Enable (LABIE) (PCIe r7.0,
+sec 7.5.3.7) in bwctrl allowed system to come up.
+
+P45 is a very old chipset and supports only up to gen2 PCIe, so not having
+bwctrl does not seem a huge deficiency.
+
+Add no_bw_notif in struct pci_dev and quirk Intel P45 Root Port with it.
+
+Reported-by: Adam Stylinski <kungfujesus06@gmail.com>
+Link: https://lore.kernel.org/linux-pci/aUCt1tHhm_-XIVvi@eggsbenedict/
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Adam Stylinski <kungfujesus06@gmail.com>
+Link: https://patch.msgid.link/20260116131513.2359-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/bwctrl.c | 3 +++
+ drivers/pci/quirks.c | 10 ++++++++++
+ include/linux/pci.h | 1 +
+ 3 files changed, 14 insertions(+)
+
+diff --git a/drivers/pci/pcie/bwctrl.c b/drivers/pci/pcie/bwctrl.c
+index 36f939f23d34e..4ae92c9f912a8 100644
+--- a/drivers/pci/pcie/bwctrl.c
++++ b/drivers/pci/pcie/bwctrl.c
+@@ -250,6 +250,9 @@ static int pcie_bwnotif_probe(struct pcie_device *srv)
+ struct pci_dev *port = srv->port;
+ int ret;
+
++ if (port->no_bw_notif)
++ return -ENODEV;
++
+ /* Can happen if we run out of bus numbers during enumeration. */
+ if (!port->subordinate)
+ return -ENODEV;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 3c7aebf3d238a..d32a47e81fcf3 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1359,6 +1359,16 @@ static void quirk_transparent_bridge(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82380FB, quirk_transparent_bridge);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TOSHIBA, 0x605, quirk_transparent_bridge);
+
++/*
++ * Enabling Link Bandwidth Management Interrupts (BW notifications) can cause
++ * boot hangs on P45.
++ */
++static void quirk_p45_bw_notifications(struct pci_dev *dev)
++{
++ dev->no_bw_notif = 1;
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e21, quirk_p45_bw_notifications);
++
+ /*
+ * Common misconfiguration of the MediaGX/Geode PCI master that will reduce
+ * PCI bandwidth from 70MB/s to 25MB/s. See the GXM/GXLV/GX1 datasheets
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index bf97d49c23cf5..05aeee8c8844a 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -406,6 +406,7 @@ struct pci_dev {
+ user sysfs */
+ unsigned int clear_retrain_link:1; /* Need to clear Retrain Link
+ bit manually */
++ unsigned int no_bw_notif:1; /* BW notifications may cause issues */
+ unsigned int d3hot_delay; /* D3hot->D0 transition time in ms */
+ unsigned int d3cold_delay; /* D3cold->D0 transition time in ms */
+
+--
+2.51.0
+
--- /dev/null
+From 6768f0d1aa730575ee0631b8c6dfd6372b18c6cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 18:01:01 +0800
+Subject: PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+[ Upstream commit b5d712e5b87fc56ff838684afb1bae359eb8069f ]
+
+Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR
+memories and they cause below resource allocation issue during probe.
+
+ pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port
+ pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff]
+ pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff]
+ pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref]
+ ...
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
+ pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing
+ pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
+
+Since there is no use of the Root Port BAR memories, disable both of them.
+
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+[mani: reworded the description and comment]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-dw-rockchip.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+index 3e2752c7dd096..79e55b9833e4a 100644
+--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c
++++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+@@ -74,6 +74,8 @@
+ #define PCIE_LINKUP_MASK GENMASK(17, 16)
+ #define PCIE_LTSSM_STATUS_MASK GENMASK(5, 0)
+
++#define PCIE_TYPE0_HDR_DBI2_OFFSET 0x100000
++
+ struct rockchip_pcie {
+ struct dw_pcie pci;
+ void __iomem *apb_base;
+@@ -257,6 +259,8 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
+ if (irq < 0)
+ return irq;
+
++ pci->dbi_base2 = pci->dbi_base + PCIE_TYPE0_HDR_DBI2_OFFSET;
++
+ ret = rockchip_pcie_init_irq_domain(rockchip);
+ if (ret < 0)
+ dev_err(dev, "failed to init irq domain\n");
+@@ -266,6 +270,10 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
+
+ rockchip_pcie_enable_l0s(pci);
+
++ /* Disable Root Ports BAR0 and BAR1 as they report bogus size */
++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_0, 0x0);
++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_1, 0x0);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From df344888ceea1b51bdbd346a379e24457e5d8ccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 17:34:52 +0530
+Subject: PCI: dwc: Skip PME_Turn_Off broadcast and L2/L3 transition during
+ suspend if link is not up
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+[ Upstream commit cfd2fdfd0a8da2e5bbfdc4009b9c4b8bf164c937 ]
+
+During system suspend, if the PCIe link is not up, then there is no need
+to broadcast PME_Turn_Off message and wait for L2/L3 transition. So skip
+them.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Tested-by: Vincent Guittot <vincent.guittot@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Link: https://patch.msgid.link/20251218-pci-dwc-suspend-rework-v2-1-5a7778c6094a@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware-host.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index e92513c5bda51..702885c53f467 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -1146,8 +1146,11 @@ static int dw_pcie_pme_turn_off(struct dw_pcie *pci)
+ int dw_pcie_suspend_noirq(struct dw_pcie *pci)
+ {
+ u8 offset = dw_pcie_find_capability(pci, PCI_CAP_ID_EXP);
++ int ret = 0;
+ u32 val;
+- int ret;
++
++ if (!dw_pcie_link_up(pci))
++ goto stop_link;
+
+ /*
+ * If L1SS is supported, then do not put the link into L2 as some
+@@ -1182,6 +1185,7 @@ int dw_pcie_suspend_noirq(struct dw_pcie *pci)
+ */
+ udelay(1);
+
++stop_link:
+ dw_pcie_stop_link(pci);
+ if (pci->pp.ops->deinit)
+ pci->pp.ops->deinit(&pci->pp);
+--
+2.51.0
+
--- /dev/null
+From 168779b02226a6fe12e0ed3dd9d5389364b82414 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 21:04:47 +0530
+Subject: PCI: Enable ACS after configuring IOMMU for OF platforms
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ]
+
+Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets
+'pci_acs_enable' to request that ACS be enabled for any devices enumerated
+in the future.
+
+OF platforms called pci_enable_acs() for the first device before
+of_iommu_configure() called pci_request_acs(), so ACS was never enabled for
+that device (typically a Root Port).
+
+Call pci_enable_acs() later, from pci_dma_configure(), after
+of_dma_configure() has had a chance to call pci_request_acs().
+
+Here's the call path, showing the move of pci_enable_acs() from
+pci_acs_init() to pci_dma_configure(), where it always happens after
+pci_request_acs():
+
+ pci_device_add
+ pci_init_capabilities
+ pci_acs_init
+ - pci_enable_acs
+ - if (pci_acs_enable) <-- previous test
+ - ...
+ device_add
+ bus_notify(BUS_NOTIFY_ADD_DEVICE)
+ iommu_bus_notifier
+ iommu_probe_device
+ iommu_init_device
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ of_dma_configure
+ of_iommu_configure
+ pci_request_acs
+ pci_acs_enable = 1 <-- set
+ + pci_enable_acs
+ + if (pci_acs_enable) <-- new test
+ + ...
+ bus_probe_device
+ device_initial_probe
+ ...
+ really_probe
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ ...
+ pci_enable_acs
+
+Note that we will now call pci_enable_acs() twice for every device, first
+from the iommu_probe_device() path and again from the really_probe() path.
+Presumably that's not an issue since we also call dev->bus->dma_configure()
+twice.
+
+For the ACPI platforms, pci_request_acs() is called during ACPI
+initialization time itself, independent of the IOMMU framework.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 8 ++++++++
+ drivers/pci/pci.c | 10 +---------
+ drivers/pci/pci.h | 1 +
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 327b21c48614d..b4111c92c9572 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1652,6 +1652,14 @@ static int pci_dma_configure(struct device *dev)
+ ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
+ }
+
++ /*
++ * Attempt to enable ACS regardless of capability because some Root
++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
++ * the standard ACS capability but still support ACS via those
++ * quirks.
++ */
++ pci_enable_acs(to_pci_dev(dev));
++
+ pci_put_host_bridge_device(bridge);
+
+ /* @drv may not be valid when we're called from the IOMMU layer */
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 31d443f819a7c..d147e412668bf 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1015,7 +1015,7 @@ static void pci_std_enable_acs(struct pci_dev *dev, struct pci_acs *caps)
+ * pci_enable_acs - enable ACS if hardware support it
+ * @dev: the PCI device
+ */
+-static void pci_enable_acs(struct pci_dev *dev)
++void pci_enable_acs(struct pci_dev *dev)
+ {
+ struct pci_acs caps;
+ bool enable_acs = false;
+@@ -3677,14 +3677,6 @@ bool pci_acs_path_enabled(struct pci_dev *start,
+ void pci_acs_init(struct pci_dev *dev)
+ {
+ dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
+-
+- /*
+- * Attempt to enable ACS regardless of capability because some Root
+- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+- * the standard ACS capability but still support ACS via those
+- * quirks.
+- */
+- pci_enable_acs(dev);
+ }
+
+ void pci_rebar_init(struct pci_dev *pdev)
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 565acfcd7cdb1..36cf1ffb2023c 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -920,6 +920,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
+ }
+
+ void pci_acs_init(struct pci_dev *dev);
++void pci_enable_acs(struct pci_dev *dev);
+ #ifdef CONFIG_PCI_QUIRKS
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);
+--
+2.51.0
+
--- /dev/null
+From bad4a8736f01046f80d3ceba06f377492bc9c329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 08:59:51 -0800
+Subject: PCI: Fix pci_slot_lock () device locking
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ]
+
+Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to
+prevent warnings like:
+
+ pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0
+
+Take and release the lock for the bridge providing the slot for the
+lock/trylock and unlock routines.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 82e323b5aaa25..31d443f819a7c 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5438,10 +5438,9 @@ static int pci_bus_trylock(struct pci_bus *bus)
+ /* Do any devices on or below this slot prevent a bus reset? */
+ static bool pci_slot_resettable(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+- if (slot->bus->self &&
+- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
+ return false;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+@@ -5458,7 +5457,10 @@ static bool pci_slot_resettable(struct pci_slot *slot)
+ /* Lock devices from the top of the tree down */
+ static void pci_slot_lock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge)
++ pci_dev_lock(bridge);
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5473,7 +5475,7 @@ static void pci_slot_lock(struct pci_slot *slot)
+ /* Unlock devices from the bottom of the tree up */
+ static void pci_slot_unlock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5483,12 +5485,18 @@ static void pci_slot_unlock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ }
+
+ /* Return 1 on successful lock, 0 on contention */
+ static int pci_slot_trylock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge && !pci_dev_trylock(bridge))
++ return 0;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5513,6 +5521,9 @@ static int pci_slot_trylock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 14d09bf7157aa14f701ba02516d01698b42b4605 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 11:04:27 +0800
+Subject: PCI: imx6: Add CLKREQ# override to enable REFCLK for i.MX95 PCIe
+
+From: Richard Zhu <hongxing.zhu@nxp.com>
+
+[ Upstream commit 27a064aba2da6bc58fc36a6b8e889187ae3bf89d ]
+
+The CLKREQ# is an open drain, active low signal that is driven low by
+the card to request reference clock. It's an optional signal added in
+PCIe CEM r4.0, sec 2. Thus, this signal wouldn't be driven low if it's
+not exposed on the slot.
+
+On the i.MX95 EVK board, REFCLK to the host and endpoint is gated by this
+CLKREQ# signal. So if the CLKREQ# signal is not driven by the endpoint, it
+will gate the REFCLK to host too, leading to operational failure.
+
+Hence, enable the REFCLK on this SoC by enabling the CLKREQ# override using
+imx95_pcie_clkreq_override() helper during probe. This override should only
+be cleared when the CLKREQ# signal is exposed on the slot.
+
+Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
+[mani: reworded description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20251015030428.2980427-11-hongxing.zhu@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index 4668fc9648bff..34f8f69ddfae9 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -52,6 +52,8 @@
+ #define IMX95_PCIE_REF_CLKEN BIT(23)
+ #define IMX95_PCIE_PHY_CR_PARA_SEL BIT(9)
+ #define IMX95_PCIE_SS_RW_REG_1 0xf4
++#define IMX95_PCIE_CLKREQ_OVERRIDE_EN BIT(8)
++#define IMX95_PCIE_CLKREQ_OVERRIDE_VAL BIT(9)
+ #define IMX95_PCIE_SYS_AUX_PWR_DET BIT(31)
+
+ #define IMX95_PE0_GEN_CTRL_1 0x1050
+@@ -706,6 +708,22 @@ static int imx7d_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable)
+ return 0;
+ }
+
++static void imx95_pcie_clkreq_override(struct imx_pcie *imx_pcie, bool enable)
++{
++ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1,
++ IMX95_PCIE_CLKREQ_OVERRIDE_EN,
++ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_EN : 0);
++ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1,
++ IMX95_PCIE_CLKREQ_OVERRIDE_VAL,
++ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_VAL : 0);
++}
++
++static int imx95_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable)
++{
++ imx95_pcie_clkreq_override(imx_pcie, enable);
++ return 0;
++}
++
+ static int imx_pcie_clk_enable(struct imx_pcie *imx_pcie)
+ {
+ struct dw_pcie *pci = imx_pcie->pci;
+@@ -1913,6 +1931,7 @@ static const struct imx_pcie_drvdata drvdata[] = {
+ .core_reset = imx95_pcie_core_reset,
+ .init_phy = imx95_pcie_init_phy,
+ .wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock,
++ .enable_ref_clk = imx95_pcie_enable_ref_clk,
+ },
+ [IMX8MQ_EP] = {
+ .variant = IMX8MQ_EP,
+@@ -1969,6 +1988,7 @@ static const struct imx_pcie_drvdata drvdata[] = {
+ .core_reset = imx95_pcie_core_reset,
+ .wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock,
+ .epc_features = &imx95_pcie_epc_features,
++ .enable_ref_clk = imx95_pcie_enable_ref_clk,
+ .mode = DW_PCIE_EP_TYPE,
+ },
+ };
+--
+2.51.0
+
--- /dev/null
+From 69424ceac51c035b516b4ac94c5e77dead1b1c7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 17:02:08 -0700
+Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset
+
+From: Alex Williamson <alex.williamson@nvidia.com>
+
+[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ]
+
+User forums report issues when assigning ASM1164 SATA controllers to VMs,
+especially in configurations with multiple controllers. Logs show the
+device fails to retrain after bus reset. Reports suggest this is an issue
+across multiple platforms. The device indicates support for PM reset,
+therefore the device still has a viable function level reset mechanism.
+The reporting user confirms the device is well behaved in this use case
+with bus reset disabled.
+
+Reported-by: Patrick Bianchi <patrick.w.bianchi@gmail.com>
+Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
+Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 9e073321b2dd2..c38434d973cd2 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3791,6 +3791,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset);
+ */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
+
++/*
++ * Reports from users making use of PCI device assignment with ASM1164
++ * controllers indicate an issue with bus reset where the device fails to
++ * retrain. The issue appears more common in configurations with multiple
++ * controllers. The device does indicate PM reset support (NoSoftRst-),
++ * therefore this still leaves a viable reset method.
++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset);
++
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
+ /*
+--
+2.51.0
+
--- /dev/null
+From 4cac60684f664f0df27ca4995ff8b502497b3942 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 16:44:06 +0800
+Subject: PCI: Mark Nvidia GB10 to avoid bus reset
+
+From: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+
+[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ]
+
+After asserting Secondary Bus Reset to downstream devices via a GB10 Root
+Port, the link may not retrain correctly, e.g., the link may retrain with a
+lower lane count or config accesses to downstream devices may fail.
+
+Prevent use of Secondary Bus Reset for devices below GB10.
+
+Signed-off-by: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+[bhelgaas: drop pci_ids.h update (only used once), update commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 62554152caf37..3c7aebf3d238a 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3748,6 +3748,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+ }
+
++/*
++ * After asserting Secondary Bus Reset to downstream devices via a GB10
++ * Root Port, the link may not retrain correctly.
++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset);
++
+ /*
+ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
+ * prevented for those affected devices.
+--
+2.51.0
+
--- /dev/null
+From e6f3aa511b7a9219078a5cc5fb7b678c0d508de6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 22:44:52 +0800
+Subject: PCI/MSI: Unmap MSI-X region on error
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ]
+
+msix_capability_init() fails to unmap the MSI-X region if
+msix_setup_interrupts() fails.
+
+Add the missing iounmap() for that error path.
+
+[ tglx: Massaged change log ]
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi/msi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
+index 34d664139f48f..e010ecd9f90dd 100644
+--- a/drivers/pci/msi/msi.c
++++ b/drivers/pci/msi/msi.c
+@@ -737,7 +737,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+
+ ret = msix_setup_interrupts(dev, entries, nvec, affd);
+ if (ret)
+- goto out_disable;
++ goto out_unmap;
+
+ /* Disable INTX */
+ pci_intx_for_msi(dev, 0);
+@@ -758,6 +758,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ pcibios_free_irq(dev);
+ return 0;
+
++out_unmap:
++ iounmap(dev->msix_base);
+ out_disable:
+ dev->msix_enabled = 0;
+ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
+--
+2.51.0
+
--- /dev/null
+From 6b71f83b8d1042519e54745cf8d61ec015d460e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:35:06 -0800
+Subject: perf annotate: Fix args leak of map_symbol
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 00419892bac28bf148450d762bbff990a6bd5494 ]
+
+map_symbol__exit() needs calling on an annotate_args.ms, however, rather
+than introduce proper reference count handling to symbol__annotate()
+just switch to passing the map_symbol pointer parameter around, making
+the puts the caller's responsibility.
+
+Fix a number of cases to ensure the map in a map_symbol has a
+reference count increment and add the then necessary map_symbol_exits.
+
+Fixes: 56e144fe98260a0f ("perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Dr. David Alan Gilbert <linux@treblig.org>
+Cc: Guo Ren <guoren@kernel.org>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Julia Lawall <Julia.Lawall@inria.fr>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-csky@vger.kernel.org
+Cc: linux-riscv@lists.infradead.org
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Paul Walmsley <pjw@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sergei Trofimovich <slyich@gmail.com>
+Cc: Shimin Guo <shimin.guo@skydio.com>
+Cc: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Tianyou Li <tianyou.li@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Zecheng Li <zecheng@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arch/loongarch/annotate/instructions.c | 14 ++++----
+ tools/perf/arch/s390/annotate/instructions.c | 11 +++---
+ tools/perf/util/annotate.c | 2 +-
+ tools/perf/util/capstone.c | 14 ++++----
+ tools/perf/util/disasm.c | 36 ++++++++++---------
+ tools/perf/util/disasm.h | 2 +-
+ tools/perf/util/llvm.c | 6 ++--
+ 7 files changed, 47 insertions(+), 38 deletions(-)
+
+diff --git a/tools/perf/arch/loongarch/annotate/instructions.c b/tools/perf/arch/loongarch/annotate/instructions.c
+index 70262d5f14442..1c3abb43c8d72 100644
+--- a/tools/perf/arch/loongarch/annotate/instructions.c
++++ b/tools/perf/arch/loongarch/annotate/instructions.c
+@@ -10,9 +10,7 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st
+ {
+ char *c, *endptr, *tok, *name;
+ struct map *map = ms->map;
+- struct addr_map_symbol target = {
+- .ms = { .map = map, },
+- };
++ struct addr_map_symbol target;
+
+ c = strchr(ops->raw, '#');
+ if (c++ == NULL)
+@@ -38,12 +36,16 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st
+ if (ops->target.name == NULL)
+ return -1;
+
+- target.addr = map__objdump_2mem(map, ops->target.addr);
++ target = (struct addr_map_symbol) {
++ .ms = { .map = map__get(map), },
++ .addr = map__objdump_2mem(map, ops->target.addr),
++ };
+
+ if (maps__find_ams(ms->maps, &target) == 0 &&
+ map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
+ ops->target.sym = target.ms.sym;
+
++ addr_map_symbol__exit(&target);
+ return 0;
+ }
+
+@@ -58,7 +60,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st
+ struct map *map = ms->map;
+ struct symbol *sym = ms->sym;
+ struct addr_map_symbol target = {
+- .ms = { .map = map, },
++ .ms = { .map = map__get(map), },
+ };
+ const char *c = strchr(ops->raw, '#');
+ u64 start, end;
+@@ -90,7 +92,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st
+ } else {
+ ops->target.offset_avail = false;
+ }
+-
++ addr_map_symbol__exit(&target);
+ return 0;
+ }
+
+diff --git a/tools/perf/arch/s390/annotate/instructions.c b/tools/perf/arch/s390/annotate/instructions.c
+index c61193f1e0964..626e6d2cbc81a 100644
+--- a/tools/perf/arch/s390/annotate/instructions.c
++++ b/tools/perf/arch/s390/annotate/instructions.c
+@@ -6,9 +6,7 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops,
+ {
+ char *endptr, *tok, *name;
+ struct map *map = ms->map;
+- struct addr_map_symbol target = {
+- .ms = { .map = map, },
+- };
++ struct addr_map_symbol target;
+
+ tok = strchr(ops->raw, ',');
+ if (!tok)
+@@ -36,12 +34,17 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops,
+
+ if (ops->target.name == NULL)
+ return -1;
+- target.addr = map__objdump_2mem(map, ops->target.addr);
++
++ target = (struct addr_map_symbol) {
++ .ms = { .map = map__get(map), },
++ .addr = map__objdump_2mem(map, ops->target.addr),
++ };
+
+ if (maps__find_ams(ms->maps, &target) == 0 &&
+ map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
+ ops->target.sym = target.ms.sym;
+
++ addr_map_symbol__exit(&target);
+ return 0;
+ }
+
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index 1d6900033b3a0..dc80d922f450d 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -1031,7 +1031,7 @@ int symbol__annotate(struct map_symbol *ms, struct evsel *evsel,
+ return 0;
+
+ args.arch = arch;
+- args.ms = *ms;
++ args.ms = ms;
+
+ if (notes->src == NULL) {
+ notes->src = annotated_source__new();
+diff --git a/tools/perf/util/capstone.c b/tools/perf/util/capstone.c
+index be5fd44b1f9dc..2c7feab61b7bf 100644
+--- a/tools/perf/util/capstone.c
++++ b/tools/perf/util/capstone.c
+@@ -143,7 +143,7 @@ static void print_capstone_detail(cs_insn *insn, char *buf, size_t len,
+ struct annotate_args *args, u64 addr)
+ {
+ int i;
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct symbol *sym;
+
+ /* TODO: support more architectures */
+@@ -222,7 +222,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused,
+ {
+ #ifdef HAVE_LIBCAPSTONE_SUPPORT
+ struct annotation *notes = symbol__annotation(sym);
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ u64 start = map__rip_2objdump(map, sym->start);
+ u64 offset;
+@@ -256,7 +256,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused,
+ args->line = disasm_buf;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ if (dl == NULL)
+@@ -268,7 +268,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused,
+ !strcmp(args->options->disassembler_style, "att"))
+ disassembler_style = true;
+
+- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0)
++ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0)
+ goto err;
+
+ needs_cs_close = true;
+@@ -345,7 +345,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused,
+ {
+ #ifdef HAVE_LIBCAPSTONE_SUPPORT
+ struct annotation *notes = symbol__annotation(sym);
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ struct nscookie nsc;
+ u64 start = map__rip_2objdump(map, sym->start);
+@@ -382,7 +382,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused,
+ !strcmp(args->options->disassembler_style, "att"))
+ disassembler_style = true;
+
+- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0)
++ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0)
+ goto err;
+
+ needs_cs_close = true;
+@@ -408,7 +408,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused,
+ args->line = disasm_buf;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ if (dl == NULL)
+diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
+index 50b9433f3f8e6..924429142631a 100644
+--- a/tools/perf/util/disasm.c
++++ b/tools/perf/util/disasm.c
+@@ -269,9 +269,7 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ {
+ char *endptr, *tok, *name;
+ struct map *map = ms->map;
+- struct addr_map_symbol target = {
+- .ms = { .map = map, },
+- };
++ struct addr_map_symbol target;
+
+ ops->target.addr = strtoull(ops->raw, &endptr, 16);
+
+@@ -296,12 +294,16 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ if (ops->target.name == NULL)
+ return -1;
+ find_target:
+- target.addr = map__objdump_2mem(map, ops->target.addr);
++ target = (struct addr_map_symbol) {
++ .ms = { .map = map__get(map), },
++ .addr = map__objdump_2mem(map, ops->target.addr),
++ };
+
+ if (maps__find_ams(ms->maps, &target) == 0 &&
+ map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
+ ops->target.sym = target.ms.sym;
+
++ addr_map_symbol__exit(&target);
+ return 0;
+
+ indirect_call:
+@@ -366,7 +368,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ struct map *map = ms->map;
+ struct symbol *sym = ms->sym;
+ struct addr_map_symbol target = {
+- .ms = { .map = map, },
++ .ms = { .map = map__get(map), },
+ };
+ const char *c = strchr(ops->raw, ',');
+ u64 start, end;
+@@ -440,7 +442,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ } else {
+ ops->target.offset_avail = false;
+ }
+-
++ addr_map_symbol__exit(&target);
+ return 0;
+ }
+
+@@ -1046,7 +1048,7 @@ static size_t disasm_line_size(int nr)
+ struct disasm_line *disasm_line__new(struct annotate_args *args)
+ {
+ struct disasm_line *dl = NULL;
+- struct annotation *notes = symbol__annotation(args->ms.sym);
++ struct annotation *notes = symbol__annotation(args->ms->sym);
+ int nr = notes->src->nr_events;
+
+ dl = zalloc(disasm_line_size(nr));
+@@ -1064,7 +1066,7 @@ struct disasm_line *disasm_line__new(struct annotate_args *args)
+ } else if (disasm_line__parse(dl->al.line, &dl->ins.name, &dl->ops.raw) < 0)
+ goto out_free_line;
+
+- disasm_line__init_ins(dl, args->arch, &args->ms);
++ disasm_line__init_ins(dl, args->arch, args->ms);
+ }
+
+ return dl;
+@@ -1119,7 +1121,7 @@ static int symbol__parse_objdump_line(struct symbol *sym,
+ struct annotate_args *args,
+ char *parsed_line, int *line_nr, char **fileloc)
+ {
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct annotation *notes = symbol__annotation(sym);
+ struct disasm_line *dl;
+ char *tmp;
+@@ -1151,7 +1153,7 @@ static int symbol__parse_objdump_line(struct symbol *sym,
+ args->line = parsed_line;
+ args->line_nr = *line_nr;
+ args->fileloc = *fileloc;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ (*line_nr)++;
+@@ -1169,12 +1171,14 @@ static int symbol__parse_objdump_line(struct symbol *sym,
+ if (dl->ins.ops && ins__is_call(&dl->ins) && !dl->ops.target.sym) {
+ struct addr_map_symbol target = {
+ .addr = dl->ops.target.addr,
+- .ms = { .map = map, },
++ .ms = { .map = map__get(map), },
+ };
+
+- if (!maps__find_ams(args->ms.maps, &target) &&
++ if (!maps__find_ams(args->ms->maps, &target) &&
+ target.ms.sym->start == target.al_addr)
+ dl->ops.target.sym = target.ms.sym;
++
++ addr_map_symbol__exit(&target);
+ }
+
+ annotation_line__add(&dl->al, ¬es->src->source);
+@@ -1338,7 +1342,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym,
+ struct annotate_args *args)
+ {
+ struct annotation *notes = symbol__annotation(sym);
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ u64 start = map__rip_2objdump(map, sym->start);
+ u64 end = map__rip_2objdump(map, sym->end);
+@@ -1375,7 +1379,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym,
+ args->line = disasm_buf;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ if (dl == NULL)
+@@ -1501,7 +1505,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym,
+ struct annotate_args *args)
+ {
+ struct annotation_options *opts = &annotate_opts;
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ char *command;
+ FILE *file;
+@@ -1644,7 +1648,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym,
+ int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
+ {
+ struct annotation_options *options = args->options;
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ char symfs_filename[PATH_MAX];
+ bool delete_extract = false;
+diff --git a/tools/perf/util/disasm.h b/tools/perf/util/disasm.h
+index d2cb555e4a3be..a3ea9d6762816 100644
+--- a/tools/perf/util/disasm.h
++++ b/tools/perf/util/disasm.h
+@@ -97,7 +97,7 @@ struct ins_ops {
+
+ struct annotate_args {
+ struct arch *arch;
+- struct map_symbol ms;
++ struct map_symbol *ms;
+ struct annotation_options *options;
+ s64 offset;
+ char *line;
+diff --git a/tools/perf/util/llvm.c b/tools/perf/util/llvm.c
+index 2ebf1f5f65bf7..4ada9a10bd93f 100644
+--- a/tools/perf/util/llvm.c
++++ b/tools/perf/util/llvm.c
+@@ -118,7 +118,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym,
+ {
+ #ifdef HAVE_LIBLLVM_SUPPORT
+ struct annotation *notes = symbol__annotation(sym);
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ u64 start = map__rip_2objdump(map, sym->start);
+ /* Malloc-ed buffer containing instructions read from disk. */
+@@ -184,7 +184,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym,
+ args->line = disasm_buf;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ if (dl == NULL)
+@@ -242,7 +242,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym,
+ &line_storage_len);
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ llvm_addr2line(filename, pc, &args->fileloc,
+ (unsigned int *)&args->line_nr, false, NULL);
+--
+2.51.0
+
--- /dev/null
+From 5df64ba21db4327d378bda9e3940d8e06648e313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 17:25:00 -0300
+Subject: perf annotate: Fix BUILD_NONDISTRO=1 missing args->ms conversions to
+ pointer
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit dda5f926a1006c735b00ed5c27291fce64236656 ]
+
+Fix a few missing conversions to pointer in the usage of 'struct
+annotate_args' 'ms' member in symbol__disassemble_bpf_libbfd().
+
+Fixes: 00419892bac28bf1 ("perf annotate: Fix args leak of map_symbol")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/libbfd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/libbfd.c b/tools/perf/util/libbfd.c
+index 6434c2dccd4a4..2324f6846d510 100644
+--- a/tools/perf/util/libbfd.c
++++ b/tools/perf/util/libbfd.c
+@@ -494,7 +494,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused,
+ struct bpf_prog_info_node *info_node;
+ int len = sym->end - sym->start;
+ disassembler_ftype disassemble;
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct perf_bpil *info_linear;
+ struct disassemble_info info;
+ struct dso *dso = map__dso(map);
+@@ -605,7 +605,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused,
+ args->line = strdup(srcline);
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+ dl = disasm_line__new(args);
+ if (dl) {
+ annotation_line__add(&dl->al,
+@@ -617,7 +617,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused,
+ args->line = buf + prev_buf_size;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+ dl = disasm_line__new(args);
+ if (dl)
+ annotation_line__add(&dl->al, ¬es->src->source);
+--
+2.51.0
+
--- /dev/null
+From c8c21d45f0b212dfad61bb02c6625c95a7a98bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 22:47:04 +0530
+Subject: perf annotate: Fix memcpy size in arch__grow_instructions()
+
+From: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+
+[ Upstream commit f0d98c78f8bf73ce2a9b7793f66cda240fa9ab10 ]
+
+The memcpy() in arch__grow_instructions() is copying the wrong number of
+bytes when growing from a non-allocated table.
+
+It should copy arch->nr_instructions * sizeof(struct ins) bytes, not
+just arch->nr_instructions bytes.
+
+This bug causes data corruption as only a partial copy of the
+instruction table is made, leading to garbage data in most entries and
+potential crashes
+
+Fixes: 2a1ff812c40be982 ("perf annotate: Introduce alternative method of keeping instructions table")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/disasm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
+index 924429142631a..88706b98b9064 100644
+--- a/tools/perf/util/disasm.c
++++ b/tools/perf/util/disasm.c
+@@ -81,7 +81,7 @@ static int arch__grow_instructions(struct arch *arch)
+ if (new_instructions == NULL)
+ return -1;
+
+- memcpy(new_instructions, arch->instructions, arch->nr_instructions);
++ memcpy(new_instructions, arch->instructions, arch->nr_instructions * sizeof(struct ins));
+ goto out_update_instructions;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2302bb493157bfe841791471c760cad47633eebf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 16:39:54 +0000
+Subject: perf/arm-cmn: Support CMN-600AE
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ]
+
+The functional safety features of CMN-600AE have little to no impact on
+the PMU relative to the base CMN-600 design, so for simplicity we can
+reasonably just treat it as the same thing. The only obvious difference
+is that the revision numbers aren't aligned, so we may hide some aliases
+for events which do actually exist, but those can still be specified via
+the underlying "type,eventid" format so it's not too big a deal.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Tested-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 23245352a3fc0..651edd73bfcb1 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -210,6 +210,7 @@ enum cmn_model {
+ enum cmn_part {
+ PART_CMN600 = 0x434,
+ PART_CMN650 = 0x436,
++ PART_CMN600AE = 0x438,
+ PART_CMN700 = 0x43c,
+ PART_CI700 = 0x43a,
+ PART_CMN_S3 = 0x43e,
+@@ -2266,6 +2267,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01);
+ part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg);
+ part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8;
++ /* 600AE is close enough that it's not really worth more complexity */
++ if (part == PART_CMN600AE)
++ part = PART_CMN600;
+ if (cmn->part && cmn->part != part)
+ dev_warn(cmn->dev,
+ "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n",
+--
+2.51.0
+
--- /dev/null
+From 711bde4f1ec93e941728ceff9ff6b1981e8c167b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:29:10 +0100
+Subject: perf build: Raise minimum shellcheck version to 0.7.2
+
+From: Nicolas Schier <n.schier@avm.de>
+
+[ Upstream commit 383f8e26e2c483e25453f8c3d0839877708ac701 ]
+
+Raise the minimum shellcheck version for perf builds to 0.7.2, so that
+systems with shellcheck versions below 0.7.2 will automatically skip the
+shell script checking, even if NO_SHELLCHECK is unset.
+
+Since commit 241f21be7d0fdf3c ("perf test perftool_testsuite: Use
+absolute paths"), shellcheck versions before 0.7.2 break the perf build
+with several SC1090 [2] warnings due to its too strict dynamic source
+handling [1], e.g.:
+
+ In tests/shell/base_probe/test_line_semantics.sh line 20:
+ . "$DIR_PATH/../common/init.sh"
+ ^---------------------------^ SC1090: Can't follow non-constant source. Use a directive to specify location.
+
+Fixes: 241f21be7d0fdf3c ("perf test perftool_testsuite: Use absolute paths")
+Signed-off-by: Nicolas Schier <n.schier@avm.de>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jakub Brnak <jbrnak@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Nicolas Schier <nsc@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Philipp Hahn <p.hahn@avm.de>
+Cc: Veronika Molnarova <vmolnaro@redhat.com>
+Link: https://github.com/koalaman/shellcheck/issues/1998 # [1]
+Link: https://www.shellcheck.net/wiki/SC1090
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Makefile.perf | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
+index 47c906b807ef2..da7434b385d18 100644
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -253,11 +253,12 @@ else
+ endif
+
+ # shellcheck is using in tools/perf/tests/Build with option -a/--check-sourced (
+-# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0). So make the
+-# minimal shellcheck version as v0.6.0.
++# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0) as well as
++# dynamic source inclusions (properly handled since v0.7.2).
++# So make the minimal shellcheck version as v0.7.2.
+ ifneq ($(SHELLCHECK),)
+ ifeq ($(shell expr $(shell $(SHELLCHECK) --version | grep version: | \
+- sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 060), 1)
++ sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 072), 1)
+ SHELLCHECK :=
+ else
+ SHELLCHECK := $(SHELLCHECK) -s bash -a -S warning
+--
+2.51.0
+
--- /dev/null
+From cac0a7dad82057a176bbc787d4ef172018fa8326 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 15:35:39 -0800
+Subject: perf build: Remove NO_LIBCAP that controls nothing
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 169343cc8ff2bd59758760d867bd26adae866a2b ]
+
+Using libcap was removed in commit e25ebda78e230283 ("perf cap: Tidy up
+and improve capability testing") and improve capability testing"),
+however, some build documentation and a use of the NO_LIBCAP=1 were
+lingering.
+
+Remove these left over bits.
+
+Fixes: e25ebda78e230283 ("perf cap: Tidy up and improve capability testing")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Makefile.perf | 2 --
+ tools/perf/tests/make | 2 +-
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
+index da7434b385d18..562b9d356d2a2 100644
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -88,8 +88,6 @@ include ../scripts/utilities.mak
+ #
+ # Define NO_LIBBPF if you do not want BPF support
+ #
+-# Define NO_LIBCAP if you do not want process capabilities considered by perf
+-#
+ # Define NO_SDT if you do not want to define SDT event in perf tools,
+ # note that it doesn't disable SDT scanning support.
+ #
+diff --git a/tools/perf/tests/make b/tools/perf/tests/make
+index b650ce8864ed5..fa4500c65949a 100644
+--- a/tools/perf/tests/make
++++ b/tools/perf/tests/make
+@@ -123,7 +123,7 @@ make_minimal += NO_DEMANGLE=1 NO_LIBELF=1 NO_BACKTRACE=1
+ make_minimal += NO_LIBNUMA=1 NO_LIBBIONIC=1 NO_LIBDW=1
+ make_minimal += NO_LIBDW_DWARF_UNWIND=1 NO_AUXTRACE=1 NO_LIBBPF=1
+ make_minimal += NO_SDT=1 NO_JVMTI=1 NO_LIBZSTD=1
+-make_minimal += NO_LIBCAP=1 NO_CAPSTONE=1
++make_minimal += NO_CAPSTONE=1
+
+ # $(run) contains all available tests
+ run := make_pure
+--
+2.51.0
+
--- /dev/null
+From 245dfe0e7592ea33d19d45f67f287374c3a1c35b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:36 -0800
+Subject: perf callchain: Fix srcline printing with inlines
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ]
+
+sample__fprintf_callchain() was using map__fprintf_srcline() which won't
+report inline line numbers.
+
+Fix by using the srcline from the callchain and falling back to the map
+variant.
+
+Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel_fprintf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
+index 103984b29b1e1..cbf2dd2dfc6f4 100644
+--- a/tools/perf/util/evsel_fprintf.c
++++ b/tools/perf/util/evsel_fprintf.c
+@@ -182,8 +182,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
+ if (print_dso && (!sym || !sym->inlined))
+ printed += map__fprintf_dsoname_dsoff(map, print_dsoff, addr, fp);
+
+- if (print_srcline)
+- printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ if (print_srcline) {
++ if (node->srcline)
++ printed += fprintf(fp, "\n %s", node->srcline);
++ else
++ printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ }
+
+ if (sym && sym->inlined)
+ printed += fprintf(fp, " (inlined)");
+--
+2.51.0
+
--- /dev/null
+From 300debf4170537a501afd167e8440c304e609fdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 08:51:57 -0800
+Subject: perf/core: Fix slow perf_event_task_exit() with LBR callstacks
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 4960626f956d63dce57f099016c2ecbe637a8229 ]
+
+I got a report that a task is stuck in perf_event_exit_task() waiting
+for global_ctx_data_rwsem. On large systems with lots threads, it'd
+have performance issues when it grabs the lock to iterate all threads
+in the system to allocate the context data.
+
+And it'd block task exit path which is problematic especially under
+memory pressure.
+
+ perf_event_open
+ perf_event_alloc
+ attach_perf_ctx_data
+ attach_global_ctx_data
+ percpu_down_write (global_ctx_data_rwsem)
+ for_each_process_thread
+ alloc_task_ctx_data
+ do_exit
+ perf_event_exit_task
+ percpu_down_read (global_ctx_data_rwsem)
+
+It should not hold the global_ctx_data_rwsem on the exit path. Let's
+skip allocation for exiting tasks and free the data carefully.
+
+Reported-by: Rosalie Fang <rosaliefang@google.com>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://patch.msgid.link/20260112165157.1919624-1-namhyung@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 1d8ca8e34f5c4..c34b927e5ece3 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5279,9 +5279,20 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache,
+ return -ENOMEM;
+
+ for (;;) {
+- if (try_cmpxchg((struct perf_ctx_data **)&task->perf_ctx_data, &old, cd)) {
++ if (try_cmpxchg(&task->perf_ctx_data, &old, cd)) {
+ if (old)
+ perf_free_ctx_data_rcu(old);
++ /*
++ * Above try_cmpxchg() pairs with try_cmpxchg() from
++ * detach_task_ctx_data() such that
++ * if we race with perf_event_exit_task(), we must
++ * observe PF_EXITING.
++ */
++ if (task->flags & PF_EXITING) {
++ /* detach_task_ctx_data() may free it already */
++ if (try_cmpxchg(&task->perf_ctx_data, &cd, NULL))
++ perf_free_ctx_data_rcu(cd);
++ }
+ return 0;
+ }
+
+@@ -5327,6 +5338,8 @@ attach_global_ctx_data(struct kmem_cache *ctx_cache)
+ /* Allocate everything */
+ scoped_guard (rcu) {
+ for_each_process_thread(g, p) {
++ if (p->flags & PF_EXITING)
++ continue;
+ cd = rcu_dereference(p->perf_ctx_data);
+ if (cd && !cd->global) {
+ cd->global = 1;
+@@ -14223,8 +14236,11 @@ void perf_event_exit_task(struct task_struct *task)
+
+ /*
+ * Detach the perf_ctx_data for the system-wide event.
++ *
++ * Done without holding global_ctx_data_rwsem; typically
++ * attach_global_ctx_data() will skip over this task, but otherwise
++ * attach_task_ctx_data() will observe PF_EXITING.
+ */
+- guard(percpu_read)(&global_ctx_data_rwsem);
+ detach_task_ctx_data(task);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From fcec1bd20013e323244e60cf504657c5afc33987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 10:18:35 +0000
+Subject: perf cs-etm: Fix decoding for sparse CPU maps
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit a70493e2bb0878885aa7a8178162550270693eb1 ]
+
+The ETM decoder incorrectly assumed that auxtrace queue indices were
+equivalent to CPU number. This assumption is used for inserting records
+into the queue, and for fetching queues when given a CPU number. This
+assumption held when Perf always opened a dummy event on every CPU, even
+if the user provided a subset of CPUs on the commandline, resulting in
+the indices aligning.
+
+For example:
+
+ # event : name = cs_etm//u, , id = { 2451, 2452 }, type = 11 (cs_etm), size = 136, config = 0x4010, { sample_period, samp>
+ # event : name = dummy:u, , id = { 2453, 2454, 2455, 2456 }, type = 1 (PERF_TYPE_SOFTWARE), size = 136, config = 0x9 (PER>
+
+ 0 0 0x200 [0xd0]: PERF_RECORD_ID_INDEX nr: 6
+ ... id: 2451 idx: 2 cpu: 2 tid: -1
+ ... id: 2452 idx: 3 cpu: 3 tid: -1
+ ... id: 2453 idx: 0 cpu: 0 tid: -1
+ ... id: 2454 idx: 1 cpu: 1 tid: -1
+ ... id: 2455 idx: 2 cpu: 2 tid: -1
+ ... id: 2456 idx: 3 cpu: 3 tid: -1
+
+Since commit 811082e4b668 ("perf parse-events: Support user CPUs mixed
+with threads/processes") the dummy event no longer behaves in this way,
+making the ETM event indices start from 0 on the first CPU recorded
+regardless of its ID:
+
+ # event : name = cs_etm//u, , id = { 771, 772 }, type = 11 (cs_etm), size = 144, config = 0x4010, { sample_period, sample>
+ # event : name = dummy:u, , id = { 773, 774 }, type = 1 (PERF_TYPE_SOFTWARE), size = 144, config = 0x9 (PERF_COUNT_SW_DUM>
+
+ 0 0 0x200 [0x90]: PERF_RECORD_ID_INDEX nr: 4
+ ... id: 771 idx: 0 cpu: 2 tid: -1
+ ... id: 772 idx: 1 cpu: 3 tid: -1
+ ... id: 773 idx: 0 cpu: 2 tid: -1
+ ... id: 774 idx: 1 cpu: 3 tid: -1
+
+This causes the following segfault when decoding:
+
+ $ perf record -e cs_etm//u -C 2,3 -- true
+ $ perf report
+
+ perf: Segmentation fault
+ -------- backtrace --------
+ #0 0xaaaabf9fd020 in ui__signal_backtrace setup.c:110
+ #1 0xffffab5c7930 in __kernel_rt_sigreturn [vdso][930]
+ #2 0xaaaabfb68d30 in cs_etm_decoder__reset cs-etm-decoder.c:85
+ #3 0xaaaabfb65930 in cs_etm__get_data_block cs-etm.c:2032
+ #4 0xaaaabfb666fc in cs_etm__run_per_cpu_timeless_decoder cs-etm.c:2551
+ #5 0xaaaabfb6692c in (cs_etm__process_timeless_queues cs-etm.c:2612
+ #6 0xaaaabfb63390 in cs_etm__flush_events cs-etm.c:921
+ #7 0xaaaabfb324c0 in auxtrace__flush_events auxtrace.c:2915
+ #8 0xaaaabfaac378 in __perf_session__process_events session.c:2285
+ #9 0xaaaabfaacc9c in perf_session__process_events session.c:2442
+ #10 0xaaaabf8d3d90 in __cmd_report builtin-report.c:1085
+ #11 0xaaaabf8d6944 in cmd_report builtin-report.c:1866
+ #12 0xaaaabf95ebfc in run_builtin perf.c:351
+ #13 0xaaaabf95eeb0 in handle_internal_command perf.c:404
+ #14 0xaaaabf95f068 in run_argv perf.c:451
+ #15 0xaaaabf95f390 in main perf.c:558
+ #16 0xffffaab97400 in __libc_start_call_main libc_start_call_main.h:74
+ #17 0xffffaab974d8 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
+ #18 0xaaaabf8aa8f0 in _start perf[7a8f0]
+
+Fix it by inserting into the queues based on CPU number, rather than
+using the index.
+
+Fixes: 811082e4b668db96 ("perf parse-events: Support user CPUs mixed with threads/processes")
+Signed-off-by: James Clark <james.clark@linaro.org>
+Tested-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: coresight@lists.linaro.org
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/cs-etm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index 30f4bb3e7fa30..06eb1a56430cb 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -3089,7 +3089,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o
+
+ if (aux_offset >= auxtrace_event->offset &&
+ aux_offset + aux_size <= auxtrace_event->offset + auxtrace_event->size) {
+- struct cs_etm_queue *etmq = etm->queues.queue_array[auxtrace_event->idx].priv;
++ struct cs_etm_queue *etmq = cs_etm__get_queue(etm, auxtrace_event->cpu);
+
+ /*
+ * If this AUX event was inside this buffer somewhere, create a new auxtrace event
+@@ -3098,6 +3098,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o
+ auxtrace_fragment.auxtrace = *auxtrace_event;
+ auxtrace_fragment.auxtrace.size = aux_size;
+ auxtrace_fragment.auxtrace.offset = aux_offset;
++ auxtrace_fragment.auxtrace.idx = etmq->queue_nr;
+ file_offset += aux_offset - auxtrace_event->offset + auxtrace_event->header.size;
+
+ pr_debug3("CS ETM: Queue buffer size: %#"PRI_lx64" offset: %#"PRI_lx64
+--
+2.51.0
+
--- /dev/null
+From 6f97ff086fa06bf6830edffcaa7375696fb591ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:34 +0100
+Subject: perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+
+The intention here was probably not allowing forced-threading.
+
+Replace IRQF_ONESHOT with IRQF_NO_THREAD.
+
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/cxl_pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c
+index d094030220bf2..68a54d97d2a8a 100644
+--- a/drivers/perf/cxl_pmu.c
++++ b/drivers/perf/cxl_pmu.c
+@@ -877,7 +877,7 @@ static int cxl_pmu_probe(struct device *dev)
+ if (!irq_name)
+ return -ENOMEM;
+
+- rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_ONESHOT,
++ rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD,
+ irq_name, info);
+ if (rc)
+ return rc;
+--
+2.51.0
+
--- /dev/null
+From d536710983e2380b60e7e9ee5f0b9886e09400e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:35:07 -0800
+Subject: perf maps: Fix reference count leak in maps__find_ams()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 6fdd2676db55b503c52dd3f1359b5c57f774ab75 ]
+
+ams and so ams->ms.map is an in argument, however, it is also
+overwritten. As a map is reference counted, ensure a map__put() is done
+before overwriting it.
+
+Fixes: 42fd623b58dbcc48 ("perf maps: Get map before returning in maps__find")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Dr. David Alan Gilbert <linux@treblig.org>
+Cc: Guo Ren <guoren@kernel.org>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Julia Lawall <Julia.Lawall@inria.fr>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Paul Walmsley <pjw@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sergei Trofimovich <slyich@gmail.com>
+Cc: Shimin Guo <shimin.guo@skydio.com>
+Cc: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Tianyou Li <tianyou.li@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Zecheng Li <zecheng@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/maps.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c
+index 779f6230130af..c51ec159ac769 100644
+--- a/tools/perf/util/maps.c
++++ b/tools/perf/util/maps.c
+@@ -676,6 +676,7 @@ int maps__find_ams(struct maps *maps, struct addr_map_symbol *ams)
+ if (ams->addr < map__start(ams->ms.map) || ams->addr >= map__end(ams->ms.map)) {
+ if (maps == NULL)
+ return -1;
++ map__put(ams->ms.map);
+ ams->ms.map = maps__find(maps, ams->addr);
+ if (ams->ms.map == NULL)
+ return -1;
+--
+2.51.0
+
--- /dev/null
+From ff0e86b9e2077f316288a12a21e361589a62c519 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 21:28:27 -0800
+Subject: perf symbol-elf: Fix leak of ELF files with GNU debugdata
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 92d65d9c31621befe0a5f7c0bd43bd217613c6b6 ]
+
+The processing of DSO_BINARY_TYPE__GNU_DEBUGDATA in symsrc__init happens
+with an open ELF file but the error path only closes the associate fd.
+
+Fix the goto so that the ELF file is also ended and memory released.
+
+Fixes: b10f74308e130527 ("perf symbol: Support .gnu_debugdata for symbols")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Dmitriy Vyukov <dvyukov@google.com>
+Cc: Dr. David Alan Gilbert <linux@treblig.org>
+Cc: Guo Ren <guoren@kernel.org>
+Cc: Haibo Xu <haibo1.xu@intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: Mark Wielaard <mark@klomp.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Paul Walmsley <pjw@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sergei Trofimovich <slyich@gmail.com>
+Cc: Shimin Guo <shimin.guo@skydio.com>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol-elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 9e820599bab38..9d62386464680 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1170,7 +1170,7 @@ int symsrc__init(struct symsrc *ss, struct dso *dso, const char *name,
+ Elf *embedded = read_gnu_debugdata(dso, elf, name, &new_fd);
+
+ if (!embedded)
+- goto out_close;
++ goto out_elf_end;
+
+ elf_end(elf);
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From 988397d2ce9b22c76af55432b755a04370063e35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 16:32:56 +0100
+Subject: perf test: Fix test case perftool-testsuite_report for s390
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 3d012b8614ee020666f3dd15af9f65dc487e3f5f ]
+
+Test case perftool-testsuite_report fails on s390 for some time
+now.
+
+Root cause is a time out which is too tight for large s390 machines.
+The time out value addr2line_timeout_ms is per default set to 1 second.
+
+This is the maximum time the function read_addr2line_record() waits for
+a reply from the forked off tool addr2line, which is started as a child
+in interactive mode.
+
+It reads stdin (an address in hexadecimal) and replies on stdout with
+function name, file name and line number. This might take more than one
+second.
+
+However one second is not always enough and the reply from addr2line
+tool is not received. Function read_addr2line_record() fails and emits
+a warning, which is not expected by the test case. It fails.
+
+Output before:
+
+ # perf test -F 133
+ -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file
+ ==================
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.087 MB \
+ /tmp/perftool-testsuite_report.FHz/perf_report/perf.data.1 \
+ (207 samples) ]
+ ==================
+ -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file
+ ## [ PASS ] ## perf_report :: setup SUMMARY
+ -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped
+ Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/
+ 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/
+ vmlinux: could not read first record"
+ Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/
+ 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/
+ vmlinux: could not read first record"
+ -- [ FAIL ] -- perf_report :: test_basic :: basic execution
+ (output regexp parsing)
+ ....
+ 133: perftool-testsuite_report : FAILED!
+
+Output after:
+
+ # ./perf test -F 133
+ -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file
+ ==================
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.087 MB \
+ /tmp/perftool-testsuite_report.Mlp/perf_report/perf.data.1
+ (188 samples) ]
+ ==================
+ -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file
+ ## [ PASS ] ## perf_report :: setup SUMMARY
+ -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped
+ -- [ PASS ] -- perf_report :: test_basic :: basic execution
+ -- [ PASS ] -- perf_report :: test_basic :: number of samples
+ -- [ PASS ] -- perf_report :: test_basic :: header
+ -- [ PASS ] -- perf_report :: test_basic :: header timestamp
+ -- [ PASS ] -- perf_report :: test_basic :: show CPU utilization
+ -- [ PASS ] -- perf_report :: test_basic :: pid
+ -- [ PASS ] -- perf_report :: test_basic :: non-existing symbol
+ -- [ PASS ] -- perf_report :: test_basic :: symbol filter
+ -- [ PASS ] -- perf_report :: test_basic :: latency header
+ -- [ PASS ] -- perf_report :: test_basic :: default report for latency profile
+ -- [ PASS ] -- perf_report :: test_basic :: latency report for latency profile
+ -- [ PASS ] -- perf_report :: test_basic :: parallelism histogram
+ ## [ PASS ] ## perf_report :: test_basic SUMMARY
+ 133: perftool-testsuite_report : Ok
+ #
+
+Fixes: 257046a36750a6db ("perf srcline: Fallback between addr2line implementations")
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: linux-s390@vger.kernel.org
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/addr2line.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/addr2line.c b/tools/perf/util/addr2line.c
+index f2d94a3272d71..a8b39f4f202b6 100644
+--- a/tools/perf/util/addr2line.c
++++ b/tools/perf/util/addr2line.c
+@@ -18,8 +18,8 @@
+
+ #define MAX_INLINE_NEST 1024
+
+-/* If addr2line doesn't return data for 1 second then timeout. */
+-int addr2line_timeout_ms = 1 * 1000;
++/* If addr2line doesn't return data for 5 seconds then timeout. */
++int addr2line_timeout_ms = 5 * 1000;
+
+ static int filename_split(char *filename, unsigned int *line_nr)
+ {
+--
+2.51.0
+
--- /dev/null
+From 79f854f2d2b61869b3dd632ae4aebad3286fc97d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 14:32:16 +0100
+Subject: perf test stat tests: Fix for virtualized machines
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit e272628902c1c96731e2d9f62a7fc77767686eb0 ]
+
+On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for
+z/VM systems. The root cause is this statement:
+
+ $(perf stat -a -- sleep 0.1 2>&1 |\
+ grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* -c)
+
+The 'perf stat' output on a s390 z/VM system is
+
+ # perf stat -a -- sleep 0.1 2>&1
+ Performance counter stats for 'system wide':
+
+ 56 context-switches # 46.3 cs/sec cs_per_second
+ 1,210.41 msec cpu-clock # 11.9 CPUs CPUs_utilized
+ 12 cpu-migrations # 9.9 migrations/sec ...
+ 81 page-faults # 66.9 faults/sec ...
+
+ 0.100891009 seconds time elapsed
+
+The grep command does not match any single line and exits with error
+code 1.
+
+As the bash script is executed with 'set -e', it aborts with the first
+error code being non-zero.
+
+Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'.
+
+Output before:
+
+ # perf test 102
+ 102: perf stat tests : FAILED!
+ #
+
+Output after:
+
+ # perf test 102
+ 102: perf stat tests : Ok
+ #
+
+Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: linux-s390@vger.kernel.org
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index 985adc02749e2..d72d16d0b8c46 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -196,7 +196,7 @@ test_hybrid() {
+ fi
+
+ # Run default Perf stat
+- cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c)
++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " | wc -l)
+
+ # The expectation is that default output will have a cycles events on each
+ # hybrid PMU. In situations with no cycles PMU events, like virtualized, this
+--
+2.51.0
+
--- /dev/null
+From 063dff0cdd35a0dbc29d02ee2e0692a8c732333f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 13:22:04 -0800
+Subject: perf test stat: Update test expectations and events
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit a48cd551d7436be3b1bd65c63a6d00163f7e7706 ]
+
+test_stat_record_report and test_stat_record_script used default
+output which triggers a bug when sending metrics. As this isn't
+relevant to the test switch to using named software events.
+
+Update the match in test_hybrid as the cycles event is now cpu-cycles
+to workaround potential ARM issues.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: e272628902c1 ("perf test stat tests: Fix for virtualized machines")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index 8a100a7f2dc17..985adc02749e2 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -18,7 +18,7 @@ test_default_stat() {
+
+ test_stat_record_report() {
+ echo "stat record and report test"
+- if ! perf stat record -o - true | perf stat report -i - 2>&1 | \
++ if ! perf stat record -e task-clock -o - true | perf stat report -i - 2>&1 | \
+ grep -E -q "Performance counter stats for 'pipe':"
+ then
+ echo "stat record and report test [Failed]"
+@@ -30,7 +30,7 @@ test_stat_record_report() {
+
+ test_stat_record_script() {
+ echo "stat record and script test"
+- if ! perf stat record -o - true | perf script -i - 2>&1 | \
++ if ! perf stat record -e task-clock -o - true | perf script -i - 2>&1 | \
+ grep -E -q "CPU[[:space:]]+THREAD[[:space:]]+VAL[[:space:]]+ENA[[:space:]]+RUN[[:space:]]+TIME[[:space:]]+EVENT"
+ then
+ echo "stat record and script test [Failed]"
+@@ -196,7 +196,7 @@ test_hybrid() {
+ fi
+
+ # Run default Perf stat
+- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c)
++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c)
+
+ # The expectation is that default output will have a cycles events on each
+ # hybrid PMU. In situations with no cycles PMU events, like virtualized, this
+--
+2.51.0
+
--- /dev/null
+From bf49db9a53cf1822f3a36e38a2233d2da41f90e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 09:53:37 -0800
+Subject: perf tests sched: Avoid error in cleanup on loaded machines
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit c5e47e4d00fbc15f2390bb6ed8d9c21836363291 ]
+
+The stop_noploops function will kill the noploop processes that are
+running for 10 seconds.
+
+On a loaded machine they may have already terminated meaning the kill
+will return an error of no such process.
+
+This doesn't matter and so ignore the error to avoid the test
+terminating in the cleanup.
+
+Fixes: 0e22c5ca44e68798 ("perf test: Add sched latency and script shell tests")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/sched.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/shell/sched.sh b/tools/perf/tests/shell/sched.sh
+index b9b81eaf856e6..b9637069adb1f 100755
+--- a/tools/perf/tests/shell/sched.sh
++++ b/tools/perf/tests/shell/sched.sh
+@@ -53,7 +53,7 @@ start_noploops() {
+ }
+
+ cleanup_noploops() {
+- kill "$PID1" "$PID2"
++ kill "$PID1" "$PID2" || true
+ }
+
+ test_sched_record() {
+--
+2.51.0
+
--- /dev/null
+From 3505675aadbccac736b32c617a9c98334e8dc26f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 15:37:57 -0800
+Subject: perf tools: Get debug info of DSO properly
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 069e603d8248dac98b1ef2909e2f1c4169b9da11 ]
+
+The dso__debuginfo() just used the path name to open the file but it may
+be outdated. It should check build-ID and use the file in the build-ID
+cache if available rather than just using the path name.
+
+Let's factor out dso__get_filename() to avoid code duplicate.
+
+Fixes: 53a61a6ca279165d ("perf annotate: Add dso__debuginfo() helper")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dso.c | 63 ++++++++++++++++++++++++++++++++-----------
+ tools/perf/util/dso.h | 11 ++------
+ 2 files changed, 50 insertions(+), 24 deletions(-)
+
+diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
+index 344e689567ee1..dc202d4943721 100644
+--- a/tools/perf/util/dso.c
++++ b/tools/perf/util/dso.c
+@@ -111,7 +111,7 @@ bool dso__is_object_file(const struct dso *dso)
+
+ int dso__read_binary_type_filename(const struct dso *dso,
+ enum dso_binary_type type,
+- char *root_dir, char *filename, size_t size)
++ const char *root_dir, char *filename, size_t size)
+ {
+ char build_id_hex[SBUILD_ID_SIZE];
+ int ret = 0;
+@@ -563,20 +563,15 @@ char *dso__filename_with_chroot(const struct dso *dso, const char *filename)
+ return filename_with_chroot(nsinfo__pid(dso__nsinfo_const(dso)), filename);
+ }
+
+-static int __open_dso(struct dso *dso, struct machine *machine)
+- EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock)
++static char *dso__get_filename(struct dso *dso, const char *root_dir,
++ bool *decomp)
+ {
+- int fd = -EINVAL;
+- char *root_dir = (char *)"";
+ char *name = malloc(PATH_MAX);
+- bool decomp = false;
+
+- if (!name)
+- return -ENOMEM;
++ *decomp = false;
+
+- mutex_lock(dso__lock(dso));
+- if (machine)
+- root_dir = machine->root_dir;
++ if (name == NULL)
++ return NULL;
+
+ if (dso__read_binary_type_filename(dso, dso__binary_type(dso),
+ root_dir, name, PATH_MAX))
+@@ -601,20 +596,38 @@ static int __open_dso(struct dso *dso, struct machine *machine)
+ size_t len = sizeof(newpath);
+
+ if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) {
+- fd = -(*dso__load_errno(dso));
++ errno = *dso__load_errno(dso);
+ goto out;
+ }
+
+- decomp = true;
++ *decomp = true;
+ strcpy(name, newpath);
+ }
++ return name;
++
++out:
++ free(name);
++ return NULL;
++}
+
+- fd = do_open(name);
++static int __open_dso(struct dso *dso, struct machine *machine)
++ EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock)
++{
++ int fd = -EINVAL;
++ char *name;
++ bool decomp = false;
++
++ mutex_lock(dso__lock(dso));
++
++ name = dso__get_filename(dso, machine ? machine->root_dir : "", &decomp);
++ if (name)
++ fd = do_open(name);
++ else
++ fd = -errno;
+
+ if (decomp)
+ unlink(name);
+
+-out:
+ mutex_unlock(dso__lock(dso));
+ free(name);
+ return fd;
+@@ -1910,3 +1923,23 @@ const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename,
+ return __dso__read_symbol(dso, symfs_filename, start, len,
+ out_buf, out_buf_len, is_64bit);
+ }
++
++struct debuginfo *dso__debuginfo(struct dso *dso)
++{
++ char *name;
++ bool decomp = false;
++ struct debuginfo *dinfo = NULL;
++
++ mutex_lock(dso__lock(dso));
++
++ name = dso__get_filename(dso, "", &decomp);
++ if (name)
++ dinfo = debuginfo__new(name);
++
++ if (decomp)
++ unlink(name);
++
++ mutex_unlock(dso__lock(dso));
++ free(name);
++ return dinfo;
++}
+diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
+index f8ccb9816b89c..54e470dd07305 100644
+--- a/tools/perf/util/dso.h
++++ b/tools/perf/util/dso.h
+@@ -766,7 +766,7 @@ int dso__kernel_module_get_build_id(struct dso *dso, const char *root_dir);
+
+ char dso__symtab_origin(const struct dso *dso);
+ int dso__read_binary_type_filename(const struct dso *dso, enum dso_binary_type type,
+- char *root_dir, char *filename, size_t size);
++ const char *root_dir, char *filename, size_t size);
+ bool is_kernel_module(const char *pathname, int cpumode);
+ bool dso__needs_decompress(struct dso *dso);
+ int dso__decompress_kmodule_fd(struct dso *dso, const char *name);
+@@ -915,14 +915,7 @@ u64 dso__findnew_global_type(struct dso *dso, u64 addr, u64 offset);
+ bool perf_pid_map_tid(const char *dso_name, int *tid);
+ bool is_perf_pid_map_name(const char *dso_name);
+
+-/*
+- * In the future, we may get debuginfo using build-ID (w/o path).
+- * Add this helper is for the smooth conversion.
+- */
+-static inline struct debuginfo *dso__debuginfo(struct dso *dso)
+-{
+- return debuginfo__new(dso__long_name(dso));
+-}
++struct debuginfo *dso__debuginfo(struct dso *dso);
+
+ const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename,
+ const struct map *map, const struct symbol *sym,
+--
+2.51.0
+
--- /dev/null
+From afdcd12bdc167725a47ddb2ed78676e46cc43a9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:32 -0800
+Subject: perf unwind-libdw: Fix invalid reference counts
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f815fc0c66e777c727689666cfb46b8d461c2f99 ]
+
+The addition of addr_location__exit() causes use-after put on the maps
+and map references in the unwind info. Add the gets and then add the
+map_symbol__exit() calls.
+
+Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/unwind-libdw.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index ae70fb56a0572..3ff427a49e4c5 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -136,8 +136,8 @@ static int entry(u64 ip, struct unwind_info *ui)
+ }
+
+ e->ip = ip;
+- e->ms.maps = al.maps;
+- e->ms.map = al.map;
++ e->ms.maps = maps__get(al.maps);
++ e->ms.map = map__get(al.map);
+ e->ms.sym = al.sym;
+
+ pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n",
+@@ -325,6 +325,9 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
+ if (err)
+ pr_debug("unwind: failed with '%s'\n", dwfl_errmsg(-1));
+
++ for (i = 0; i < ui->idx; i++)
++ map_symbol__exit(&ui->entries[i].ms);
++
+ dwfl_end(ui->dwfl);
+ free(ui);
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 66ba288d4932e6190311231d11046814cb2fb750 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:39:46 +0530
+Subject: perf vendor events amd: Fix Zen 5 MAB allocation events
+
+From: Sandipan Das <sandipan.das@amd.com>
+
+[ Upstream commit 76b2cf07a6d2a836108f9c2486d76599f7adf6e8 ]
+
+The unit masks for PMCx041 vary across different generations of Zen
+processors.
+
+Fix the Zen 5 events based on PMCx041 as they incorrectly use the same
+unit masks as that of Zen 4.
+
+Fixes: 45c072f2537ab07b ("perf vendor events amd: Add Zen 5 core events")
+Reported-by: Suyash Mahar <smahar@meta.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ananth Narayan <ananth.narayan@amd.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/arch/x86/amdzen5/load-store.json | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
+index ff6627a778057..06bbaea159259 100644
+--- a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
++++ b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
+@@ -70,19 +70,19 @@
+ "EventName": "ls_mab_alloc.load_store_allocations",
+ "EventCode": "0x41",
+ "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for load-store allocations.",
+- "UMask": "0x3f"
++ "UMask": "0x07"
+ },
+ {
+ "EventName": "ls_mab_alloc.hardware_prefetcher_allocations",
+ "EventCode": "0x41",
+ "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for hardware prefetcher allocations.",
+- "UMask": "0x40"
++ "UMask": "0x08"
+ },
+ {
+ "EventName": "ls_mab_alloc.all_allocations",
+ "EventCode": "0x41",
+ "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for all types of allocations.",
+- "UMask": "0x7f"
++ "UMask": "0x0f"
+ },
+ {
+ "EventName": "ls_dmnd_fills_from_sys.local_l2",
+--
+2.51.0
+
--- /dev/null
+From 7f414f03ad393cde736ea413ecada6d427b9a6d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 08:48:46 +0100
+Subject: perf/x86/cstate: Add Airmont NP
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 3006911f284d769b0f66c12b39da130325ef1440 ]
+
+From the perspective of Intel cstate residency counters, the Airmont NP
+(aka Lightning Mountain) is identical to the Airmont.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Link: https://patch.msgid.link/20251124074846.9653-4-ms@dev.tdt.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/cstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 6f5286a99e0c3..15db12647b2f8 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -598,6 +598,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
+ X86_MATCH_VFM(INTEL_ATOM_SILVERMONT, &slm_cstates),
+ X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_D, &slm_cstates),
+ X86_MATCH_VFM(INTEL_ATOM_AIRMONT, &slm_cstates),
++ X86_MATCH_VFM(INTEL_ATOM_AIRMONT_NP, &slm_cstates),
+
+ X86_MATCH_VFM(INTEL_BROADWELL, &snb_cstates),
+ X86_MATCH_VFM(INTEL_BROADWELL_D, &snb_cstates),
+--
+2.51.0
+
--- /dev/null
+From ed2d85c90a06e892517f3e6211f9c59d79342f37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 08:48:45 +0100
+Subject: perf/x86/intel: Add Airmont NP
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit a08340fd291671c54d379d285b2325490ce90ddd ]
+
+The Intel / MaxLinear Airmont NP (aka Lightning Mountain) supports the
+same architectual and non-architecural events as Airmont.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Link: https://patch.msgid.link/20251124074846.9653-3-ms@dev.tdt.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 32d551f2646a7..55d8df7b0fdaa 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -7029,6 +7029,7 @@ __init int intel_pmu_init(void)
+ case INTEL_ATOM_SILVERMONT_D:
+ case INTEL_ATOM_SILVERMONT_MID:
+ case INTEL_ATOM_AIRMONT:
++ case INTEL_ATOM_AIRMONT_NP:
+ case INTEL_ATOM_SILVERMONT_MID2:
+ memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+--
+2.51.0
+
--- /dev/null
+From 9fe197f78e19003b1889045ccf10846329f6640f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 08:48:44 +0100
+Subject: perf/x86/msr: Add Airmont NP
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 63dbadcafc1f4d1da796a8e2c0aea1e561f79ece ]
+
+Like Airmont, the Airmont NP (aka Intel / MaxLinear Lightning Mountain)
+supports SMI_COUNT MSR.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Link: https://patch.msgid.link/20251124074846.9653-2-ms@dev.tdt.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/msr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c
+index 7f5007a4752a1..8052596b85036 100644
+--- a/arch/x86/events/msr.c
++++ b/arch/x86/events/msr.c
+@@ -78,6 +78,7 @@ static bool test_intel(int idx, void *data)
+ case INTEL_ATOM_SILVERMONT:
+ case INTEL_ATOM_SILVERMONT_D:
+ case INTEL_ATOM_AIRMONT:
++ case INTEL_ATOM_AIRMONT_NP:
+
+ case INTEL_ATOM_GOLDMONT:
+ case INTEL_ATOM_GOLDMONT_D:
+--
+2.51.0
+
--- /dev/null
+From 8ed5a77c35e1a6beea54225a868f9623f8777c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 15:24:25 +0100
+Subject: phy: cadence-torrent: restore parent clock for refclk during resume
+
+From: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+
+[ Upstream commit 434e1a0ee145d0389b192252be4c993f86cf1134 ]
+
+While suspend and resume, parent clock config for refclk was getting lost.
+So save and restore it in suspend and resume operations.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+Link: https://patch.msgid.link/20251216-phy-cadence-torrent-resume-restore-refclk-parent-v3-1-8a7ed84b47e3@bootlin.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/phy-cadence-torrent.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c
+index 37fa4bad6bd72..877f22177c699 100644
+--- a/drivers/phy/cadence/phy-cadence-torrent.c
++++ b/drivers/phy/cadence/phy-cadence-torrent.c
+@@ -397,6 +397,7 @@ struct cdns_torrent_refclk_driver {
+ struct clk_hw hw;
+ struct regmap_field *cmn_fields[REFCLK_OUT_NUM_CMN_CONFIG];
+ struct clk_init_data clk_data;
++ u8 parent_index;
+ };
+
+ #define to_cdns_torrent_refclk_driver(_hw) \
+@@ -3326,11 +3327,29 @@ static const struct cdns_torrent_vals sgmii_qsgmii_xcvr_diag_ln_vals = {
+ .num_regs = ARRAY_SIZE(sgmii_qsgmii_xcvr_diag_ln_regs),
+ };
+
++static void cdns_torrent_refclk_driver_suspend(struct cdns_torrent_phy *cdns_phy)
++{
++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER];
++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw);
++
++ refclk_driver->parent_index = cdns_torrent_refclk_driver_get_parent(hw);
++}
++
++static int cdns_torrent_refclk_driver_resume(struct cdns_torrent_phy *cdns_phy)
++{
++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER];
++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw);
++
++ return cdns_torrent_refclk_driver_set_parent(hw, refclk_driver->parent_index);
++}
++
+ static int cdns_torrent_phy_suspend_noirq(struct device *dev)
+ {
+ struct cdns_torrent_phy *cdns_phy = dev_get_drvdata(dev);
+ int i;
+
++ cdns_torrent_refclk_driver_suspend(cdns_phy);
++
+ reset_control_assert(cdns_phy->phy_rst);
+ reset_control_assert(cdns_phy->apb_rst);
+ for (i = 0; i < cdns_phy->nsubnodes; i++)
+@@ -3352,6 +3371,10 @@ static int cdns_torrent_phy_resume_noirq(struct device *dev)
+ int node = cdns_phy->nsubnodes;
+ int ret, i;
+
++ ret = cdns_torrent_refclk_driver_resume(cdns_phy);
++ if (ret)
++ return ret;
++
+ ret = cdns_torrent_clk(cdns_phy);
+ if (ret)
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 22a0dce32d97fd8e1fc146c15eae57c468f24d1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 19:17:12 +0800
+Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ]
+
+Disabling PHYs in runtime usually causes the client with external abort
+exception or similar issue due to lack of API to notify clients about PHY
+removal. This patch removes the possibility to unbind i.MX PHY drivers in
+runtime.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+index f6cac4c049c43..bd37b6cb69cdc 100644
+--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+@@ -711,6 +711,7 @@ static struct platform_driver imx8mq_usb_phy_driver = {
+ .driver = {
+ .name = "imx8mq-usb-phy",
+ .of_match_table = imx8mq_usb_phy_of_match,
++ .suppress_bind_attrs = true,
+ }
+ };
+ module_platform_driver(imx8mq_usb_phy_driver);
+--
+2.51.0
+
--- /dev/null
+From d5d60e55a5dfaf68947f69664ab445c28b97ea96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 15:06:43 +0000
+Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts
+
+From: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+
+[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ]
+
+The problem with the current implementation is that it does not consider
+that the USB controller can have multiple PHY handles with different
+arguments count, as for example we have in our cn9131 based platform:
+"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;".
+
+In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells)
+leads to not proper phy detection, taking the "marvell,cp110-utmi-phy"
+dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0
+(#phy-cells = <0>) and safely look for that phy.
+
+Signed-off-by: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+index 59903f86b13f5..dd3e515a8e865 100644
+--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+@@ -338,7 +338,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
+- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1);
++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0);
+ if ((port->dr_mode != USB_DR_MODE_HOST) &&
+ (port->dr_mode != USB_DR_MODE_PERIPHERAL)) {
+ dev_err(&pdev->dev,
+--
+2.51.0
+
--- /dev/null
+From af6b90edf83d93a1423632e9383fe54fc91925fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 15:26:20 +0100
+Subject: phy: ti: phy-j721e-wiz: restore mux selection during resume
+
+From: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+
+[ Upstream commit 53f6240e88c9e8715e09fc19942f13450db4cb33 ]
+
+While suspend and resume mux selection was getting lost. So save and
+restore these values in suspend and resume operations.
+
+Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+Link: https://patch.msgid.link/20251216-phy-ti-phy-j721e-wiz-resume-restore-mux-sel-v1-1-771d564db966@bootlin.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-j721e-wiz.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c
+index a8b440c6c46bb..ba31b0a1f7f79 100644
+--- a/drivers/phy/ti/phy-j721e-wiz.c
++++ b/drivers/phy/ti/phy-j721e-wiz.c
+@@ -393,6 +393,7 @@ struct wiz {
+ struct clk *output_clks[WIZ_MAX_OUTPUT_CLOCKS];
+ struct clk_onecell_data clk_data;
+ const struct wiz_data *data;
++ int mux_sel_status[WIZ_MUX_NUM_CLOCKS];
+ };
+
+ static int wiz_reset(struct wiz *wiz)
+@@ -1654,11 +1655,25 @@ static void wiz_remove(struct platform_device *pdev)
+ pm_runtime_disable(dev);
+ }
+
++static int wiz_suspend_noirq(struct device *dev)
++{
++ struct wiz *wiz = dev_get_drvdata(dev);
++ int i;
++
++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++)
++ regmap_field_read(wiz->mux_sel_field[i], &wiz->mux_sel_status[i]);
++
++ return 0;
++}
++
+ static int wiz_resume_noirq(struct device *dev)
+ {
+ struct device_node *node = dev->of_node;
+ struct wiz *wiz = dev_get_drvdata(dev);
+- int ret;
++ int ret, i;
++
++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++)
++ regmap_field_write(wiz->mux_sel_field[i], wiz->mux_sel_status[i]);
+
+ /* Enable supplemental Control override if available */
+ if (wiz->sup_legacy_clk_override)
+@@ -1680,7 +1695,7 @@ static int wiz_resume_noirq(struct device *dev)
+ return ret;
+ }
+
+-static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, NULL, wiz_resume_noirq);
++static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, wiz_suspend_noirq, wiz_resume_noirq);
+
+ static struct platform_driver wiz_driver = {
+ .probe = wiz_probe,
+--
+2.51.0
+
--- /dev/null
+From 71c6fb5b143641e087d568dc69d14ac23b3e1c44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 18:02:17 +0800
+Subject: pinctrl: mediatek: make devm allocations safer and clearer in
+ mtk_eint_do_init()
+
+From: Liang Jie <liangjie@lixiang.com>
+
+[ Upstream commit 255b721c96046d4c57fa2268e4c72607868ce91f ]
+
+mtk_eint_do_init() allocates several pointer arrays which are then
+populated in a per-instance loop and freed on error. The arrays are
+currently allocated with devm_kmalloc(), so their entries are left
+uninitialised until the per-instance allocations succeed.
+
+On a failure in the middle of the loop, the error path iterates over
+the full nbase range and calls devm_kfree() on each element. For
+indices which were never initialised, the corresponding array entries
+contain stack garbage. If any of those happen to be non-zero,
+devm_kfree() will pass them to devres_destroy(), which will WARN
+because there is no matching devm_kmalloc() resource for such bogus
+pointers.
+
+Improve the robustness and readability by:
+
+ - Using devm_kcalloc() for the pointer arrays so that all entries
+ start as NULL, ensuring that only genuinely initialised elements
+ may be freed and preventing spurious WARN_ON()s in the error path.
+ - Switching the allocations to sizeof(*ptr) / sizeof(**ptr) forms,
+ avoiding hard-coded element types and making the code more resilient
+ to future type changes.
+ - Dropping the redundant NULL checks before devm_kfree(), as
+ devm_kfree() safely handles NULL pointers.
+
+The functional behaviour in the successful initialisation path remains
+unchanged, while the error handling becomes simpler and less
+error-prone.
+
+Reviewed-by: fanggeng <fanggeng@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Signed-off-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/mtk-eint.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
+index 9f175c73613f8..2ea0902b4f660 100644
+--- a/drivers/pinctrl/mediatek/mtk-eint.c
++++ b/drivers/pinctrl/mediatek/mtk-eint.c
+@@ -539,24 +539,32 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin)
+ }
+ }
+
+- eint->pin_list = devm_kmalloc(eint->dev, eint->nbase * sizeof(u16 *), GFP_KERNEL);
++ eint->pin_list = devm_kcalloc(eint->dev, eint->nbase,
++ sizeof(*eint->pin_list), GFP_KERNEL);
+ if (!eint->pin_list)
+ goto err_pin_list;
+
+- eint->wake_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL);
++ eint->wake_mask = devm_kcalloc(eint->dev, eint->nbase,
++ sizeof(*eint->wake_mask), GFP_KERNEL);
+ if (!eint->wake_mask)
+ goto err_wake_mask;
+
+- eint->cur_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL);
++ eint->cur_mask = devm_kcalloc(eint->dev, eint->nbase,
++ sizeof(*eint->cur_mask), GFP_KERNEL);
+ if (!eint->cur_mask)
+ goto err_cur_mask;
+
+ for (i = 0; i < eint->nbase; i++) {
+- eint->pin_list[i] = devm_kzalloc(eint->dev, eint->base_pin_num[i] * sizeof(u16),
++ eint->pin_list[i] = devm_kzalloc(eint->dev,
++ eint->base_pin_num[i] * sizeof(**eint->pin_list),
+ GFP_KERNEL);
+ port = DIV_ROUND_UP(eint->base_pin_num[i], 32);
+- eint->wake_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL);
+- eint->cur_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL);
++ eint->wake_mask[i] = devm_kzalloc(eint->dev,
++ port * sizeof(**eint->wake_mask),
++ GFP_KERNEL);
++ eint->cur_mask[i] = devm_kzalloc(eint->dev,
++ port * sizeof(**eint->cur_mask),
++ GFP_KERNEL);
+ if (!eint->pin_list[i] || !eint->wake_mask[i] || !eint->cur_mask[i])
+ goto err_eint;
+ }
+@@ -592,12 +600,9 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin)
+
+ err_eint:
+ for (i = 0; i < eint->nbase; i++) {
+- if (eint->cur_mask[i])
+- devm_kfree(eint->dev, eint->cur_mask[i]);
+- if (eint->wake_mask[i])
+- devm_kfree(eint->dev, eint->wake_mask[i]);
+- if (eint->pin_list[i])
+- devm_kfree(eint->dev, eint->pin_list[i]);
++ devm_kfree(eint->dev, eint->cur_mask[i]);
++ devm_kfree(eint->dev, eint->wake_mask[i]);
++ devm_kfree(eint->dev, eint->pin_list[i]);
+ }
+ devm_kfree(eint->dev, eint->cur_mask);
+ err_cur_mask:
+--
+2.51.0
+
--- /dev/null
+From 083d3f24beb47be9f598d9603f6d1296ae006179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 17:02:28 +0200
+Subject: pinctrl: renesas: rzt2h: Allow .get_direction() for IRQ function
+ GPIOs
+
+From: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
+
+[ Upstream commit 49b039a61a314c18074c15a7047705399e1240e6 ]
+
+Setting up an IRQ would normally be done in the .activate() and
+.deactivate() ops of the IRQ domain, but for hierarchical IRQ domains
+the .activate() and .deactivate() ops are overridden in the
+gpiochip_hierarchy_setup_domain_ops() function.
+
+As such, activating and deactivating need to be done in the .translate()
+and .free() ops of the IRQ domain.
+
+For RZ/T2H and RZ/N2H, interrupts go through the pin controller, into
+the ICU, which level-translates them and forwards them to the GIC.
+
+To use a GPIO as an interrupt it needs to be put into peripheral
+function mode 0, which will connect it to the IRQ lines of the ICU.
+
+The IRQ chip .child_to_parent_hwirq() callback is called as part of the
+IRQ fwspec parsing logic (as part of irq_create_of_mapping()) which
+happens before the IRQ is requested (as part of gpiochip_lock_as_irq()).
+
+gpiochip_lock_as_irq() calls gpiod_get_direction() if the
+.get_direction() callback is provided to ensure that the GPIO line is
+set up as input.
+
+In our case, IRQ function is separate from GPIO, and both cannot be true
+at the same time.
+
+Return GPIO_LINE_DIRECTION_IN even if pin is in IRQ function to allow
+this setup to work.
+
+Hold the spinlock to ensure atomicity between reading the PMC register
+(which determines whether the pin is in GPIO mode or not) and reading
+the function of the pin when it is not in GPIO mode.
+
+Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20251205150234.2958140-3-cosmin-gabriel.tanislav.xa@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzt2h.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzt2h.c b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
+index 3872638f5ebb3..3161b2469c362 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzt2h.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
+@@ -51,6 +51,7 @@
+
+ #define PFC_MASK GENMASK_ULL(5, 0)
+ #define PFC_PIN_MASK(pin) (PFC_MASK << ((pin) * 8))
++#define PFC_FUNC_INTERRUPT 0
+
+ /*
+ * Use 16 lower bits [15:0] for pin identifier
+@@ -486,6 +487,7 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+ struct rzt2h_pinctrl *pctrl = gpiochip_get_data(chip);
+ u8 port = RZT2H_PIN_ID_TO_PORT(offset);
+ u8 bit = RZT2H_PIN_ID_TO_PIN(offset);
++ u64 reg64;
+ u16 reg;
+ int ret;
+
+@@ -493,8 +495,25 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+ if (ret)
+ return ret;
+
+- if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit))
++ guard(spinlock_irqsave)(&pctrl->lock);
++
++ if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit)) {
++ /*
++ * When a GPIO is being requested as an IRQ, the pinctrl
++ * framework expects to be able to read the GPIO's direction.
++ * IRQ function is separate from GPIO, and enabling it takes the
++ * pin out of GPIO mode.
++ * At this point, .child_to_parent_hwirq() has already been
++ * called to enable the IRQ function.
++ * Default to input direction for IRQ function.
++ */
++ reg64 = rzt2h_pinctrl_readq(pctrl, port, PFC(port));
++ reg64 = (reg64 >> (bit * 8)) & PFC_MASK;
++ if (reg64 == PFC_FUNC_INTERRUPT)
++ return GPIO_LINE_DIRECTION_IN;
++
+ return -EINVAL;
++ }
+
+ reg = rzt2h_pinctrl_readw(pctrl, port, PM(port));
+ reg = (reg >> (bit * 2)) & PM_MASK;
+--
+2.51.0
+
--- /dev/null
+From e956c5a60cc5499f1849b6b5caacdcc91010e938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 18:26:51 +0000
+Subject: power: sequencing: fix missing state_lock in pwrseq_power_on() error
+ path
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e1dccb485c2876ac1318f36ccc0155416c633a48 ]
+
+pwrseq_power_on() calls pwrseq_unit_disable() when the
+post_enable callback fails. However, this call is outside the
+scoped_guard(mutex, &pwrseq->state_lock) block that ends.
+
+pwrseq_unit_disable() has lockdep_assert_held(&pwrseq->state_lock),
+which will fail when called from this error path.
+
+Add the scoped_guard block to cover the post_enable callback and its
+error handling to ensure the lock is held when pwrseq_unit_disable() is
+called.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Link: https://patch.msgid.link/20260130182651.1576579-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/sequencing/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/sequencing/core.c b/drivers/power/sequencing/core.c
+index 190564e559885..1fcf0af7cc0bb 100644
+--- a/drivers/power/sequencing/core.c
++++ b/drivers/power/sequencing/core.c
+@@ -914,8 +914,10 @@ int pwrseq_power_on(struct pwrseq_desc *desc)
+ if (target->post_enable) {
+ ret = target->post_enable(pwrseq);
+ if (ret) {
+- pwrseq_unit_disable(pwrseq, unit);
+- desc->powered_on = false;
++ scoped_guard(mutex, &pwrseq->state_lock) {
++ pwrseq_unit_disable(pwrseq, unit);
++ desc->powered_on = false;
++ }
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 98a91002567656bd31ea7d534ff55882e7e9a38e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 21:01:52 -0500
+Subject: powercap: intel_rapl: Add PL4 support for Ice Lake
+
+From: Daniel Tang <danielzgtg.opensource@gmail.com>
+
+[ Upstream commit 54b3cd55a515c7c0fcfa0c1f0b10d62c11d64bcc ]
+
+Microsoft Surface Pro 7 firmware throttles the processor upon
+boot/resume. Userspace needs to be able to restore the correct value.
+
+Link: https://github.com/linux-surface/linux-surface/issues/706
+Signed-off-by: Daniel Tang <danielzgtg.opensource@gmail.com>
+Link: https://patch.msgid.link/6088605.ChMirdbgyp@daniel-desktop3
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/powercap/intel_rapl_msr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c
+index c6b9a7debc354..e827247683dbf 100644
+--- a/drivers/powercap/intel_rapl_msr.c
++++ b/drivers/powercap/intel_rapl_msr.c
+@@ -140,6 +140,7 @@ static int rapl_msr_write_raw(int cpu, struct reg_action *ra)
+
+ /* List of verified CPUs. */
+ static const struct x86_cpu_id pl4_support_ids[] = {
++ X86_MATCH_VFM(INTEL_ICELAKE_L, NULL),
+ X86_MATCH_VFM(INTEL_TIGERLAKE_L, NULL),
+ X86_MATCH_VFM(INTEL_ALDERLAKE, NULL),
+ X86_MATCH_VFM(INTEL_ALDERLAKE_L, NULL),
+--
+2.51.0
+
--- /dev/null
+From fd30fee50c2ba95b4495e64c61e98509b255d84d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 10:03:58 +0800
+Subject: pstore: ram_core: fix incorrect success return when vmap() fails
+
+From: Ruipeng Qi <ruipengqi3@gmail.com>
+
+[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ]
+
+In persistent_ram_vmap(), vmap() may return NULL on failure.
+
+If offset is non-zero, adding offset_in_page(start) causes the function
+to return a non-NULL pointer even though the mapping failed.
+persistent_ram_buffer_map() therefore incorrectly returns success.
+
+Subsequent access to prz->buffer may dereference an invalid address
+and cause crashes.
+
+Add proper NULL checking for vmap() failures.
+
+Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
+Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index c9eaacdec37e4..7b6d6378a3b87 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot);
+ kfree(pages);
+
++ /*
++ * vmap() may fail and return NULL. Do not add the offset in this
++ * case, otherwise a NULL mapping would appear successful.
++ */
++ if (!vaddr)
++ return NULL;
++
+ /*
+ * Since vmap() uses page granularity, we must add the offset
+ * into the page here, to get the byte granularity address
+--
+2.51.0
+
--- /dev/null
+From ea7e2955aff20a2ca3fe0b93bee485cc25b99e5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 17:36:04 +0000
+Subject: ptp: ptp_vmclock: add 'VMCLOCK' to ACPI device match
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+[ Upstream commit ed4d23ed469ca14d47670c0384f6ae6c4ff060a5 ]
+
+As we finalised the spec, we spotted that vmgenid actually says that the
+_HID is supposed to be hypervisor-specific. Although in the 13 years
+since the original vmgenid doc was published, nobody seems to have cared
+about using _HID to distinguish between implementations on different
+hypervisors, and we only ever use the _CID.
+
+For consistency, match the _CID of "VMCLOCK" too.
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Babis Chalios <bchalios@amazon.es>
+Tested-by: Takahiro Itazuri <itazur@amazon.com>
+Link: https://patch.msgid.link/20260130173704.12575-6-itazur@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_vmclock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ptp/ptp_vmclock.c b/drivers/ptp/ptp_vmclock.c
+index b3a83b03d9c14..cbbfc494680c7 100644
+--- a/drivers/ptp/ptp_vmclock.c
++++ b/drivers/ptp/ptp_vmclock.c
+@@ -591,6 +591,7 @@ static int vmclock_probe(struct platform_device *pdev)
+
+ static const struct acpi_device_id vmclock_acpi_ids[] = {
+ { "AMZNC10C", 0 },
++ { "VMCLOCK", 0 },
+ {}
+ };
+ MODULE_DEVICE_TABLE(acpi, vmclock_acpi_ids);
+--
+2.51.0
+
--- /dev/null
+From d075c099925bcaa00328cfdcb1e7526a8e13d5a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:15:16 +0100
+Subject: RDMA/rtrs-clt: For conn rejection use actual err number
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ]
+
+When the connection establishment request is rejected from the server
+side, then the actual error number sent back should be used.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com
+Reviewed-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 2b397a544cb93..8fa1d72bd20a4 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1923,7 +1923,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ struct rtrs_path *s = con->c.path;
+ const struct rtrs_msg_conn_rsp *msg;
+ const char *rej_msg;
+- int status, errno;
++ int status, errno = -ECONNRESET;
+ u8 data_len;
+
+ status = ev->status;
+@@ -1945,7 +1945,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ status, rej_msg);
+ }
+
+- return -ECONNRESET;
++ return errno;
+ }
+
+ void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait)
+--
+2.51.0
+
--- /dev/null
+From 9613e99b2aa28da0e654919ef758c38b5d58bced Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 21:37:14 -0600
+Subject: regulator: core: Remove regulator supply_name length limit
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit e243cdd87b911ce9968b62e4ab2b680dfadc4341 ]
+
+When creating the regulator object, associated with a consumer device,
+the supply_name is string formatted into a statically sized buffer on
+the stack, then strdup()'ed onto the heap.
+
+Not only is the dance on the stack unnecessary, but when the device's
+name is long we might not fit the constructed supply_name in the fixed
+64 byte buffer on the stack.
+
+One such case can be seen on the Qualcomm Rb3Gen2 board, where we find a
+PCIe controller, with a PCIe switch, with a USB controller, with a USB
+hub, consuming a regulator. In this example the dev->kobj.name itself is
+62 characters long.
+
+Drop the temporary buffer on the stack and kasprintf() the string
+directly on the heap, both to simplify the code, and to remove the
+length limitation.
+
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260211-regulator-supply-name-length-v1-1-3875541c1576@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 17c60d9547dc5..765bd1b5deb3a 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1838,8 +1838,6 @@ static const struct file_operations constraint_flags_fops = {
+ #endif
+ };
+
+-#define REG_STR_SIZE 64
+-
+ static void link_and_create_debugfs(struct regulator *regulator, struct regulator_dev *rdev,
+ struct device *dev)
+ {
+@@ -1887,15 +1885,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ lockdep_assert_held_once(&rdev->mutex.base);
+
+ if (dev) {
+- char buf[REG_STR_SIZE];
+- int size;
+-
+- size = snprintf(buf, REG_STR_SIZE, "%s-%s",
+- dev->kobj.name, supply_name);
+- if (size >= REG_STR_SIZE)
+- return NULL;
+-
+- supply_name = kstrdup(buf, GFP_KERNEL);
++ supply_name = kasprintf(GFP_KERNEL, "%s-%s", dev->kobj.name, supply_name);
+ if (supply_name == NULL)
+ return NULL;
+ } else {
+--
+2.51.0
+
--- /dev/null
+From 7d6b665227d1440cc8c7d7910bebe8dfba844e87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 14:28:23 +0200
+Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox
+ TX channel is uninitialized
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ]
+
+Firmwares that do not use mailbox communication (e.g., the hello_world
+sample) leave priv->tx_ch as NULL. The current suspend logic
+unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without
+an initialized TX channel.
+
+Detect the no_mailboxes case early and skip sending the suspend
+message. Instead, proceed directly to the runtime PM suspend path,
+which is the correct behavior for firmwares that cannot respond to
+mailbox requests.
+
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c
+index e61a08df113e4..c0c2bda4964a7 100644
+--- a/drivers/remoteproc/imx_dsp_rproc.c
++++ b/drivers/remoteproc/imx_dsp_rproc.c
+@@ -1303,6 +1303,15 @@ static int imx_dsp_suspend(struct device *dev)
+ if (rproc->state != RPROC_RUNNING)
+ goto out;
+
++ /*
++ * No channel available for sending messages;
++ * indicates no mailboxes present, so trigger PM runtime suspend
++ */
++ if (!priv->tx_ch) {
++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n");
++ goto out;
++ }
++
+ reinit_completion(&priv->pm_comp);
+
+ /* Tell DSP that suspend is happening */
+--
+2.51.0
+
--- /dev/null
+From 0cca95457534251805422bc1321af2d1f4019bcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 11:07:55 +0000
+Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock`
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ]
+
+A potential circular locking dependency (ABBA deadlock) exists between
+`ec_dev->lock` and the clock framework's `prepare_lock`.
+
+The first order (A -> B) occurs when scp_ipi_send() is called while
+`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()):
+1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send().
+2. scp_ipi_send() calls clk_prepare_enable(), which acquires
+ `prepare_lock`.
+See #0 in the following example calling trace.
+(Lock Order: `ec_dev->lock` -> `prepare_lock`)
+
+The reverse order (B -> A) is more complex and has been observed
+(learned) by lockdep. It involves the clock prepare operation
+triggering power domain changes, which then propagates through sysfs
+and power supply uevents, eventually calling back into the ChromeOS EC
+driver and attempting to acquire `ec_dev->lock`:
+1. Something calls clk_prepare(), which acquires `prepare_lock`. It
+ then triggers genpd operations like genpd_runtime_resume(), which
+ takes `&genpd->mlock`.
+2. Power domain changes can trigger regulator changes; regulator
+ changes can then trigger device link changes; device link changes
+ can then trigger sysfs changes. Eventually, power_supply_uevent()
+ is called.
+3. This leads to calls like cros_usbpd_charger_get_prop(), which calls
+ cros_ec_cmd_xfer_status(), which then attempts to acquire
+ `ec_dev->lock`.
+See #1 ~ #6 in the following example calling trace.
+(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`)
+
+Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the
+remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock`
+is only acquired in prepare()/unprepare() callbacks. Since
+`ec_dev->lock` is not involved in the callbacks, the dependency loop is
+broken.
+
+This means the clock is always "prepared" when the SCP is running. The
+prolonged "prepared time" for the clock should be acceptable as SCP is
+designed to be a very power efficient processor. The power consumption
+impact can be negligible.
+
+A simplified calling trace reported by lockdep:
+> -> #6 (&ec_dev->lock)
+> cros_ec_cmd_xfer
+> cros_ec_cmd_xfer_status
+> cros_usbpd_charger_get_port_status
+> cros_usbpd_charger_get_prop
+> power_supply_get_property
+> power_supply_show_property
+> power_supply_uevent
+> dev_uevent
+> uevent_show
+> dev_attr_show
+> sysfs_kf_seq_show
+> kernfs_seq_show
+> -> #5 (kn->active#2)
+> kernfs_drain
+> __kernfs_remove
+> kernfs_remove_by_name_ns
+> sysfs_remove_file_ns
+> device_del
+> __device_link_del
+> device_links_driver_bound
+> -> #4 (device_links_lock)
+> device_link_remove
+> _regulator_put
+> regulator_put
+> -> #3 (regulator_list_mutex)
+> regulator_lock_dependent
+> regulator_disable
+> scpsys_power_off
+> _genpd_power_off
+> genpd_power_off
+> -> #2 (&genpd->mlock/1)
+> genpd_add_subdomain
+> pm_genpd_add_subdomain
+> scpsys_add_subdomain
+> scpsys_probe
+> -> #1 (&genpd->mlock)
+> genpd_runtime_resume
+> __rpm_callback
+> rpm_callback
+> rpm_resume
+> __pm_runtime_resume
+> clk_core_prepare
+> clk_prepare
+> -> #0 (prepare_lock)
+> clk_prepare
+> scp_ipi_send
+> scp_send_ipi
+> mtk_rpmsg_send
+> rpmsg_send
+> cros_ec_pkt_xfer_rpmsg
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++---------
+ drivers/remoteproc/mtk_scp_ipi.c | 4 ++--
+ 2 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
+index 8206a17664818..2aeb0ded165cf 100644
+--- a/drivers/remoteproc/mtk_scp.c
++++ b/drivers/remoteproc/mtk_scp.c
+@@ -282,7 +282,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+ struct mtk_scp *scp = priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return IRQ_NONE;
+@@ -290,7 +290,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+
+ scp->data->scp_irq_handler(scp);
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return IRQ_HANDLED;
+ }
+@@ -664,7 +664,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -679,7 +679,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+
+ ret = scp_elf_load_segments(rproc, fw);
+ leave:
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+@@ -690,14 +690,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+ }
+
+ ret = scp_ipi_init(scp, fw);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -708,7 +708,7 @@ static int scp_start(struct rproc *rproc)
+ struct scp_run *run = &scp->run;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -733,14 +733,14 @@ static int scp_start(struct rproc *rproc)
+ goto stop;
+ }
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver);
+
+ return 0;
+
+ stop:
+ scp->data->scp_reset_assert(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -908,7 +908,7 @@ static int scp_stop(struct rproc *rproc)
+ struct mtk_scp *scp = rproc->priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return ret;
+@@ -916,12 +916,29 @@ static int scp_stop(struct rproc *rproc)
+
+ scp->data->scp_reset_assert(scp);
+ scp->data->scp_stop(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return 0;
+ }
+
++static int scp_prepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ return clk_prepare(scp->clk);
++}
++
++static int scp_unprepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ clk_unprepare(scp->clk);
++ return 0;
++}
++
+ static const struct rproc_ops scp_ops = {
++ .prepare = scp_prepare,
++ .unprepare = scp_unprepare,
+ .start = scp_start,
+ .stop = scp_stop,
+ .load = scp_load,
+diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c
+index c068227e251e7..7a37e273b3af8 100644
+--- a/drivers/remoteproc/mtk_scp_ipi.c
++++ b/drivers/remoteproc/mtk_scp_ipi.c
+@@ -171,7 +171,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+ WARN_ON(len > scp_sizes->ipi_share_buffer_size) || WARN_ON(!buf))
+ return -EINVAL;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clock\n");
+ return ret;
+@@ -211,7 +211,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+
+ unlock_mutex:
+ mutex_unlock(&scp->send_lock);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 9c91289901084af66cf93a35be0653882d381e56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 09:53:54 +0200
+Subject: Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
+
+From: Tomas Melin <tomas.melin@vaisala.com>
+
+[ Upstream commit c197179990124f991fca220d97fac56779a02c6d ]
+
+This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.
+
+OP-TEE logic in U-Boot automatically injects a reserved-memory
+node along with optee firmware node to kernel device tree.
+The injection logic is dependent on that there is no manually
+defined optee node. Having the node in zynqmp.dtsi effectively
+breaks OP-TEE's insertion of the reserved-memory node, causing
+memory access violations during runtime.
+
+Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/20251125-revert-zynqmp-optee-v1-1-d2ce4c0fcaf6@vaisala.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index 938b014ca9231..b55c6b2e8e0e1 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -192,11 +192,6 @@ psci {
+ };
+
+ firmware {
+- optee: optee {
+- compatible = "linaro,optee-tz";
+- method = "smc";
+- };
+-
+ zynqmp_firmware: zynqmp-firmware {
+ compatible = "xlnx,zynqmp-firmware";
+ #power-domain-cells = <1>;
+--
+2.51.0
+
--- /dev/null
+From 17a38bf2d50334a6a435ffa836bd06d240e4b329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 17:16:51 +0100
+Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask"
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ]
+
+This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed.
+
+Almost every register in this chip can be customized via OTP
+memory. Somehow the value for R19, which decide if the flag is set
+on read or write operation, seems to have been overwritten for the chip
+the original patch were written for.
+
+Revert the change to follow the default behavior.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9052-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c
+index 80fc5c0cac2fb..be5f2b34e18ae 100644
+--- a/drivers/mfd/da9052-spi.c
++++ b/drivers/mfd/da9052-spi.c
+@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)
+ spi_set_drvdata(spi, da9052);
+
+ config = da9052_regmap_config;
+- config.write_flag_mask = 1;
++ config.read_flag_mask = 1;
+ config.reg_bits = 7;
+ config.pad_bits = 1;
+ config.val_bits = 8;
+--
+2.51.0
+
--- /dev/null
+From 8aa552c6ef8c540246499404f6b04b84637e127b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 21:09:56 -0700
+Subject: riscv: vector: init vector context with proper vlenb
+
+From: Sergey Matyukevich <geomatsi@gmail.com>
+
+[ Upstream commit ef3ff40346db8476a9ef7269fc9d1837e7243c40 ]
+
+The vstate in thread_struct is zeroed when the vector context is
+initialized. That includes read-only register vlenb, which holds
+the vector register length in bytes. Zeroed state persists until
+mstatus.VS becomes 'dirty' and a context switch saves the actual
+hardware values.
+
+This can expose the zero vlenb value to the user-space in early
+debug scenarios, e.g. when ptrace attaches to a traced process
+early, before any vector instruction except the first one was
+executed.
+
+Fix this by specifying proper vlenb on vector context init.
+
+Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
+Reviewed-by: Andy Chiu <andybnac@gmail.com>
+Tested-by: Andy Chiu <andybnac@gmail.com>
+Link: https://patch.msgid.link/20251214163537.1054292-3-geomatsi@gmail.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/vector.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/vector.c b/arch/riscv/kernel/vector.c
+index 901e67adf5760..34048c4c26dcd 100644
+--- a/arch/riscv/kernel/vector.c
++++ b/arch/riscv/kernel/vector.c
+@@ -109,8 +109,8 @@ bool insn_is_vector(u32 insn_buf)
+ return false;
+ }
+
+-static int riscv_v_thread_zalloc(struct kmem_cache *cache,
+- struct __riscv_v_ext_state *ctx)
++static int riscv_v_thread_ctx_alloc(struct kmem_cache *cache,
++ struct __riscv_v_ext_state *ctx)
+ {
+ void *datap;
+
+@@ -120,13 +120,15 @@ static int riscv_v_thread_zalloc(struct kmem_cache *cache,
+
+ ctx->datap = datap;
+ memset(ctx, 0, offsetof(struct __riscv_v_ext_state, datap));
++ ctx->vlenb = riscv_v_vsize / 32;
++
+ return 0;
+ }
+
+ void riscv_v_thread_alloc(struct task_struct *tsk)
+ {
+ #ifdef CONFIG_RISCV_ISA_V_PREEMPTIVE
+- riscv_v_thread_zalloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate);
++ riscv_v_thread_ctx_alloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate);
+ #endif
+ }
+
+@@ -212,12 +214,14 @@ bool riscv_v_first_use_handler(struct pt_regs *regs)
+ * context where VS has been off. So, try to allocate the user's V
+ * context and resume execution.
+ */
+- if (riscv_v_thread_zalloc(riscv_v_user_cachep, ¤t->thread.vstate)) {
++ if (riscv_v_thread_ctx_alloc(riscv_v_user_cachep, ¤t->thread.vstate)) {
+ force_sig(SIGBUS);
+ return true;
+ }
++
+ riscv_v_vstate_on(regs);
+ riscv_v_vstate_set_restore(current, regs);
++
+ return true;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6ba9eccd028532d7f1139124077192558d9fdb8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 13:47:33 +0100
+Subject: rnbd-srv: Zero the rsp buffer before using it
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ]
+
+Before using the data buffer to send back the response message, zero it
+completely. This prevents any stray bytes to be picked up by the client
+side when there the message is exchanged between different protocol
+versions.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-srv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
+index 9b3fdc202e152..7eeb321d61402 100644
+--- a/drivers/block/rnbd/rnbd-srv.c
++++ b/drivers/block/rnbd/rnbd-srv.c
+@@ -551,6 +551,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp,
+ {
+ struct block_device *bdev = file_bdev(sess_dev->bdev_file);
+
++ memset(rsp, 0, sizeof(*rsp));
++
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP);
+ rsp->device_id = cpu_to_le32(sess_dev->device_id);
+ rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev));
+@@ -657,6 +659,7 @@ static void process_msg_sess_info(struct rnbd_srv_session *srv_sess,
+
+ trace_process_msg_sess_info(srv_sess, sess_info_msg);
+
++ memset(rsp, 0, sizeof(*rsp));
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP);
+ rsp->ver = srv_sess->ver;
+ }
+--
+2.51.0
+
--- /dev/null
+From e0a172b1561a64818635de3b5314a50b82dbf270 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 17:35:19 +0000
+Subject: rtc: interface: Alarm race handling should not discard preceding
+ error
+
+From: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+
+[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ]
+
+Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting
+alarm") should not discard any errors from the preceding validations.
+
+Prior to that commit, if the alarm feature was disabled, or the
+set_alarm failed, a meaningful error code would be returned to the
+caller for further action.
+
+After, more often than not, the __rtc_read_time will cause a success
+return code instead, misleading the caller.
+
+An example of this is when timer_enqueue is called for a rtc-abx080x
+device. Since that driver does not clear the alarm feature bit, but
+instead relies on the set_alarm operation to return invalid, the discard
+of the return code causes very different behaviour; i.e.
+ hwclock: select() to /dev/rtc0 to wait for clock tick timed out
+
+Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm")
+Signed-off-by: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+Reviewed-by: Esben Haabendal <esben@geanix.com>
+Tested-by: Nick Bowler <nbowler@draconx.ca>
+Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index b8b298efd9a9c..1906f4884a834 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ * are in, we can return -ETIME to signal that the timer has already
+ * expired, which is true in both cases.
+ */
+- if ((scheduled - now) <= 1) {
++ if (!err && (scheduled - now) <= 1) {
+ err = __rtc_read_time(rtc, &tm);
+ if (err)
+ return err;
+--
+2.51.0
+
--- /dev/null
+From 6e6e3a2a4aff748bef17fda2271962f920070b64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 20:54:32 -0800
+Subject: rtc: max31335: use correct CONFIG symbol in IS_REACHABLE()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d5aca9a17f6de884febc56018f92d743b8ea1298 ]
+
+IS_REACHABLE() is meant to be used with full symbol names from a kernel
+.config file, not the shortened symbols used in Kconfig files, so
+change HWMON to CONFIG_HWMON in 3 places.
+
+Fixes: dedaf03b99d6 ("rtc: max31335: add driver support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20260108045432.2705691-1-rdunlap@infradead.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-max31335.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/rtc/rtc-max31335.c b/drivers/rtc/rtc-max31335.c
+index 23b7bf16b4cd5..952b455071d68 100644
+--- a/drivers/rtc/rtc-max31335.c
++++ b/drivers/rtc/rtc-max31335.c
+@@ -591,7 +591,7 @@ static struct nvmem_config max31335_nvmem_cfg = {
+ .size = MAX31335_RAM_SIZE,
+ };
+
+-#if IS_REACHABLE(HWMON)
++#if IS_REACHABLE(CONFIG_HWMON)
+ static int max31335_read_temp(struct device *dev, enum hwmon_sensor_types type,
+ u32 attr, int channel, long *val)
+ {
+@@ -672,7 +672,7 @@ static int max31335_clkout_register(struct device *dev)
+ static int max31335_probe(struct i2c_client *client)
+ {
+ struct max31335_data *max31335;
+-#if IS_REACHABLE(HWMON)
++#if IS_REACHABLE(CONFIG_HWMON)
+ struct device *hwmon;
+ #endif
+ const struct chip_desc *match;
+@@ -727,7 +727,7 @@ static int max31335_probe(struct i2c_client *client)
+ return dev_err_probe(&client->dev, ret,
+ "cannot register rtc nvmem\n");
+
+-#if IS_REACHABLE(HWMON)
++#if IS_REACHABLE(CONFIG_HWMON)
+ if (max31335->chip->temp_reg) {
+ hwmon = devm_hwmon_device_register_with_info(&client->dev, client->name, max31335,
+ &max31335_chip_info, NULL);
+--
+2.51.0
+
--- /dev/null
+From 390df839f28b1272a2e20acebc53c9c376474c15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:53:45 +0000
+Subject: rtc: zynqmp: correct frequency value
+
+From: Tomas Melin <tomas.melin@vaisala.com>
+
+[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ]
+
+Fix calibration value in case a clock reference is provided.
+The actual calibration value written into register is
+frequency - 1.
+
+Reviewed-by: Harini T <harini.t@amd.com>
+Tested-by: Harini T <harini.t@amd.com>
+Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-zynqmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c
+index 3baa2b481d9f2..856bc1678e7d3 100644
+--- a/drivers/rtc/rtc-zynqmp.c
++++ b/drivers/rtc/rtc-zynqmp.c
+@@ -345,7 +345,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev)
+ &xrtcdev->freq);
+ if (ret)
+ xrtcdev->freq = RTC_CALIB_DEF;
++ } else {
++ xrtcdev->freq--;
+ }
++
+ ret = readl(xrtcdev->reg_base + RTC_CALIB_RD);
+ if (!ret)
+ writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR));
+--
+2.51.0
+
--- /dev/null
+From b8a7d1641bd5d012cc3ba19234a04d8e35dfb707 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 08:49:48 -0300
+Subject: rtla: Fix NULL pointer dereference in actions_parse
+
+From: Wander Lairson Costa <wander@redhat.com>
+
+[ Upstream commit a0890f9dbd24b302d327fe7dad9b9c5be0e278aa ]
+
+The actions_parse() function uses strtok() to tokenize the trigger
+string, but does not check if the returned token is NULL before
+passing it to strcmp(). If the trigger parameter is an empty string
+or contains only delimiter characters, strtok() returns NULL, causing
+strcmp() to dereference a NULL pointer and crash the program.
+
+This issue can be triggered by malformed user input or edge cases in
+trigger string parsing. Add a NULL check immediately after the strtok()
+call to validate that a token was successfully extracted before using
+it. If no token is found, the function now returns -1 to indicate a
+parsing error.
+
+Signed-off-by: Wander Lairson Costa <wander@redhat.com>
+Link: https://lore.kernel.org/r/20260106133655.249887-13-wander@redhat.com
+Signed-off-by: Tomas Glozar <tglozar@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/actions.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/tracing/rtla/src/actions.c b/tools/tracing/rtla/src/actions.c
+index 8945aee58d511..15986505b4376 100644
+--- a/tools/tracing/rtla/src/actions.c
++++ b/tools/tracing/rtla/src/actions.c
+@@ -141,6 +141,8 @@ actions_parse(struct actions *self, const char *trigger, const char *tracefn)
+
+ strcpy(trigger_c, trigger);
+ token = strtok(trigger_c, ",");
++ if (!token)
++ return -1;
+
+ if (strcmp(token, "trace") == 0)
+ type = ACTION_TRACE_OUTPUT;
+--
+2.51.0
+
--- /dev/null
+From 9730cfad6578f9a4c207763afc3551109d9a5b99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 11:11:39 +0900
+Subject: rust: cpufreq: always inline functions using build_assert with
+ arguments
+
+From: Alexandre Courbot <acourbot@nvidia.com>
+
+[ Upstream commit 8c8b12a55614ea05953e8d695e700e6e1322a05d ]
+
+`build_assert` relies on the compiler to optimize out its error path.
+Functions using it with its arguments must thus always be inlined,
+otherwise the error path of `build_assert` might not be optimized out,
+triggering a build error.
+
+Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/cpufreq.rs | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/rust/kernel/cpufreq.rs b/rust/kernel/cpufreq.rs
+index 1a555fcb120a9..df5d9f6f43f3b 100644
+--- a/rust/kernel/cpufreq.rs
++++ b/rust/kernel/cpufreq.rs
+@@ -1015,6 +1015,8 @@ impl<T: Driver> Registration<T> {
+ ..pin_init::zeroed()
+ };
+
++ // Always inline to optimize out error path of `build_assert`.
++ #[inline(always)]
+ const fn copy_name(name: &'static CStr) -> [c_char; CPUFREQ_NAME_LEN] {
+ let src = name.to_bytes_with_nul();
+ let mut dst = [0; CPUFREQ_NAME_LEN];
+--
+2.51.0
+
--- /dev/null
+From 4c679955d456099e6346a4c60c692407b02bebb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 16:43:58 +0100
+Subject: s390/boot: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit 5ba35a6c13fff0929c34aba6b7602dacbe68686c ]
+
+Add -Wno-default-const-init-unsafe to boot KBUILD_CFLAGS, similar to
+scripts/Makefile.extrawarn, since clang generates warnings for the dummy
+variable in typecheck():
+
+ CC arch/s390/boot/version.o
+ arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
+ 221 | return psw_bits(regs->psw).pstate;
+ | ^
+ arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
+ 98 | typecheck(psw_t, __psw); \
+ | ^
+ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
+ 11 | typeof(x) __dummy2; \
+ | ^
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile
+index 02f2cf0827487..1768424a1824f 100644
+--- a/arch/s390/boot/Makefile
++++ b/arch/s390/boot/Makefile
+@@ -21,6 +21,7 @@ KBUILD_AFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_AFLAGS_DECOMPRESSOR))
+ KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_CFLAGS_DECOMPRESSOR))
+ KBUILD_AFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS
+ KBUILD_CFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS
++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
+
+ CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char
+
+--
+2.51.0
+
--- /dev/null
+From befb761c6df6ccac638b8a5ee55c0253d1a24942 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 10:14:12 +0100
+Subject: s390/perf: Disable register readout on sampling events
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ]
+
+Running commands
+ # ./perf record -IR0,R1 -a sleep 1
+extracts and displays register value of general purpose register r1 and r0.
+However the value displayed of any register is random and does not
+reflect the register value recorded at the time of the sample interrupt.
+
+The sampling device driver on s390 creates a very large buffer
+for the hardware to store the samples. Only when that large buffer
+gets full an interrupt is generated and many hundreds of sample
+entries are processed and copied to the kernel ring buffer and
+eventually get copied to the perf tool. It is during the copy
+to the kernel ring buffer that each sample is processed (on s390)
+and at that time the register values are extracted.
+This is not the original goal, the register values should be read
+when the samples are created not when the samples are copied to the
+kernel ring buffer.
+
+Prevent this event from being installed in the first place and
+return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index f432869f89213..9af7228d2d792 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -842,7 +842,7 @@ static bool is_callchain_event(struct perf_event *event)
+ u64 sample_type = event->attr.sample_type;
+
+ return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER |
+- PERF_SAMPLE_STACK_USER);
++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER);
+ }
+
+ static int cpumsf_pmu_event_init(struct perf_event *event)
+--
+2.51.0
+
--- /dev/null
+From 7cf31582f5334f49499b2e0ea06f03a7d8105246 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 16:47:07 +0100
+Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ]
+
+Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
+to scripts/Makefile.extrawarn, since clang generates warnings for the
+dummy variable in typecheck():
+
+ CC arch/s390/purgatory/purgatory.o
+ arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
+ 221 | return psw_bits(regs->psw).pstate;
+ | ^
+ arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
+ 98 | typecheck(psw_t, __psw); \
+ | ^
+ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
+ 11 | typeof(x) __dummy2; \
+ | ^
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/purgatory/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
+index bd39b36e7bd68..cfb73bbcdfe85 100644
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -22,6 +22,7 @@ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+ KBUILD_CFLAGS += -D__DISABLE_EXPORTS
+ KBUILD_CFLAGS += $(CLANG_FLAGS)
+ KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
+ KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS))
+ KBUILD_AFLAGS += -D__DISABLE_EXPORTS
+
+--
+2.51.0
+
--- /dev/null
+From a3eea662daf816cfc9398b4ae8fced8685261be9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 10:59:00 +0100
+Subject: sched/debug: Fix updating of ppos on server write ops
+
+From: Joel Fernandes <joelagnelf@nvidia.com>
+
+[ Upstream commit 6080fb211672aec6ce8f2f5a2e0b4eae736f2027 ]
+
+Updating "ppos" on error conditions does not make much sense. The pattern
+is to return the error code directly without modifying the position, or
+modify the position on success and return the number of bytes written.
+
+Since on success, the return value of apply is 0, there is no point in
+modifying ppos either. Fix it by removing all this and just returning
+error code or number of bytes written on success.
+
+Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Juri Lelli <juri.lelli@redhat.com>
+Reviewed-by: Andrea Righi <arighi@nvidia.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Tested-by: Christian Loehle <christian.loehle@arm.com>
+Link: https://patch.msgid.link/20260126100050.3854740-3-arighi@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 41caa22e0680a..93f009e1076d8 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -345,8 +345,8 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
+ long cpu = (long) ((struct seq_file *) filp->private_data)->private;
+ struct rq *rq = cpu_rq(cpu);
+ u64 runtime, period;
++ int retval = 0;
+ size_t err;
+- int retval;
+ u64 value;
+
+ err = kstrtoull_from_user(ubuf, cnt, 10, &value);
+@@ -380,8 +380,6 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
+ dl_server_stop(&rq->fair_server);
+
+ retval = dl_server_apply_params(&rq->fair_server, runtime, period, 0);
+- if (retval)
+- cnt = retval;
+
+ if (!runtime)
+ printk_deferred("Fair server disabled in CPU %d, system may crash due to starvation.\n",
+@@ -389,6 +387,9 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
+
+ if (rq->cfs.h_nr_queued)
+ dl_server_start(&rq->fair_server);
++
++ if (retval < 0)
++ return retval;
+ }
+
+ *ppos += cnt;
+--
+2.51.0
+
--- /dev/null
+From c70d84cbc061990336093d57d3f0e83121b42b4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:33:15 +0100
+Subject: scsi: buslogic: Reduce stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ]
+
+Some randconfig builds run into excessive stack usage with gcc-14 or
+higher, which use __attribute__((cold)) where earlier versions did not do
+that:
+
+drivers/scsi/BusLogic.c: In function 'blogic_init':
+drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
+
+The problem is that a lot of code gets inlined into blogic_init() here. Two
+functions stick out, but they are a bit different:
+
+ - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel
+ stack, which is a problem in combination with other functions that also
+ do. Marking this one as noinline means that the stack slots get get
+ reused between function calls
+
+ - blogic_reportconfig() has a few large variables, but whenever it is not
+ inlined into its caller, the compiler is actually smart enough to reuse
+ stack slots for these automatically, so marking it as noinline saves
+ most of the stack space by itself.
+
+The combination of both of these should avoid the problem entirely.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/BusLogic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index a86d780d1ba40..026c3e617cb1c 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -920,7 +920,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter)
+ a particular probe order.
+ */
+
+-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter)
++static noinline_for_stack void __init
++blogic_init_probeinfo_list(struct blogic_adapter *adapter)
+ {
+ /*
+ If a PCI BIOS is present, interrogate it for MultiMaster and
+@@ -1690,7 +1691,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter)
+ blogic_reportconfig reports the configuration of Host Adapter.
+ */
+
+-static bool __init blogic_reportconfig(struct blogic_adapter *adapter)
++static noinline_for_stack bool __init
++blogic_reportconfig(struct blogic_adapter *adapter)
+ {
+ unsigned short alltgt_mask = (1 << adapter->maxdev) - 1;
+ unsigned short sync_ok, fast_ok;
+--
+2.51.0
+
--- /dev/null
+From 9c70b928ce560ea5fa6891e2ff76d2f9b00463ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 11:45:26 +0900
+Subject: scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace
+ event
+
+From: Keita Morisaki <keita.morisaki@tier4.jp>
+
+[ Upstream commit 9672ed3de7d772ceddd713c769c05e832fc69bae ]
+
+The ufs_mtk_clk_scale() trace event currently stores the address of the
+name string directly via __field(const char *, name). This pointer may
+become invalid after the module is unloaded, causing page faults when the
+trace buffer is subsequently accessed.
+
+This can occur because the MediaTek UFS driver can be configured as a
+loadable module (tristate in Kconfig), meaning the name string passed to
+the trace event may reside in module memory that becomes invalid after
+module unload.
+
+Fix this by using __string() and __assign_str() to copy the string contents
+into the ring buffer instead of storing the pointer. This ensures the trace
+data remains valid regardless of module state.
+
+This change increases the memory usage for each ftrace entry by a few bytes
+(clock names are typically 7-15 characters like "ufs_sel" or
+"ufs_sel_max_src") compared to storing an 8-byte pointer.
+
+Note that this change does not affect anything unless all of the following
+conditions are met:
+
+ - CONFIG_SCSI_UFS_MEDIATEK is enabled
+
+ - ftrace tracing is enabled
+
+ - The ufs_mtk_clk_scale event is enabled in ftrace
+
+Signed-off-by: Keita Morisaki <keita.morisaki@tier4.jp>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://patch.msgid.link/20260202024526.122515-1-keita.morisaki@tier4.jp
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek-trace.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek-trace.h b/drivers/ufs/host/ufs-mediatek-trace.h
+index b5f2ec3140748..0df8ac843379a 100644
+--- a/drivers/ufs/host/ufs-mediatek-trace.h
++++ b/drivers/ufs/host/ufs-mediatek-trace.h
+@@ -33,19 +33,19 @@ TRACE_EVENT(ufs_mtk_clk_scale,
+ TP_ARGS(name, scale_up, clk_rate),
+
+ TP_STRUCT__entry(
+- __field(const char*, name)
++ __string(name, name)
+ __field(bool, scale_up)
+ __field(unsigned long, clk_rate)
+ ),
+
+ TP_fast_assign(
+- __entry->name = name;
++ __assign_str(name);
+ __entry->scale_up = scale_up;
+ __entry->clk_rate = clk_rate;
+ ),
+
+ TP_printk("ufs: clk (%s) scaled %s @ %lu",
+- __entry->name,
++ __get_str(name),
+ __entry->scale_up ? "up" : "down",
+ __entry->clk_rate)
+ );
+--
+2.51.0
+
--- /dev/null
+From 2226f129fab128267af55a6ff8c3dcf3647e1762 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:28 +0530
+Subject: serial: 8250: 8250_omap.c: Add support for handling UART error
+ conditions
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit 623b07b370e9963122d167e04fdc1dc713ebfbaf ]
+
+The DMA IRQ handler does not accounts for the overrun(OE) or any other
+errors being reported by the IP before triggering a DMA transaction which
+leads to the interrupts not being handled resulting into an IRQ storm.
+
+The way to handle OE is to:
+1. Reset the RX FIFO.
+2. Read the UART_RESUME register, which clears the internal flag
+
+Earlier, the driver issued DMA transations even in case of OE which shouldn't
+be done according to the OE handling mechanism mentioned above, as we are
+resetting the FIFO's, refer section: "12.1.6.4.8.1.3.6 Overrun During
+Receive" [0].
+
+[0] https://www.ti.com/lit/pdf/spruiu1
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-2-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 9e49ef48b851b..e26bae0a6488f 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -100,6 +100,9 @@
+ #define OMAP_UART_REV_52 0x0502
+ #define OMAP_UART_REV_63 0x0603
+
++/* Resume register */
++#define UART_OMAP_RESUME 0x0B
++
+ /* Interrupt Enable Register 2 */
+ #define UART_OMAP_IER2 0x1B
+ #define UART_OMAP_IER2_RHR_IT_DIS BIT(2)
+@@ -119,7 +122,6 @@
+ /* Timeout low and High */
+ #define UART_OMAP_TO_L 0x26
+ #define UART_OMAP_TO_H 0x27
+-
+ struct omap8250_priv {
+ void __iomem *membase;
+ int line;
+@@ -1256,6 +1258,20 @@ static u16 omap_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, u16 status
+ return status;
+ }
+
++static void am654_8250_handle_uart_errors(struct uart_8250_port *up, u8 iir, u16 status)
++{
++ if (status & UART_LSR_OE) {
++ serial8250_clear_and_reinit_fifos(up);
++ serial_in(up, UART_LSR);
++ serial_in(up, UART_OMAP_RESUME);
++ } else {
++ if (status & (UART_LSR_FE | UART_LSR_PE | UART_LSR_BI))
++ serial_in(up, UART_RX);
++ if (iir & UART_IIR_XOFF)
++ serial_in(up, UART_IIR);
++ }
++}
++
+ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
+ u16 status)
+ {
+@@ -1266,7 +1282,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
+ * Queue a new transfer if FIFO has data.
+ */
+ if ((status & (UART_LSR_DR | UART_LSR_BI)) &&
+- (up->ier & UART_IER_RDI)) {
++ (up->ier & UART_IER_RDI) && !(status & UART_LSR_OE)) {
++ am654_8250_handle_uart_errors(up, iir, status);
+ omap_8250_rx_dma(up);
+ serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE);
+ } else if ((iir & 0x3f) == UART_IIR_RX_TIMEOUT) {
+@@ -1282,6 +1299,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
+ serial_out(up, UART_OMAP_EFR2, 0x0);
+ up->ier |= UART_IER_RLSI | UART_IER_RDI;
+ serial_out(up, UART_IER, up->ier);
++ } else {
++ am654_8250_handle_uart_errors(up, iir, status);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From fc4b4afba6c53bfb521355f2d75d553e5e35b68d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:29 +0530
+Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
+ termination is done
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ]
+
+Clear rx_running flag only after DMA teardown polling completes. In the
+previous implementation the flag was being cleared while hardware teardown
+was still in progress, creating a mismatch between software state
+(flag = 0, "ready") and hardware state (still terminating).
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index e26bae0a6488f..272bc07c9a6b5 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -931,7 +931,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+
+ cookie = dma->rx_cookie;
+- dma->rx_running = 0;
+
+ /* Re-enable RX FIFO interrupt now that transfer is complete */
+ if (priv->habit & UART_HAS_RHR_IT_DIS) {
+@@ -965,6 +964,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+ ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+
++ dma->rx_running = 0;
+ p->port.icount.rx += ret;
+ p->port.icount.buf_overrun += count - ret;
+ out:
+--
+2.51.0
+
--- /dev/null
+From c0ce1baa50bcfd75e20a7723ce96ad49b38b4364 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 17:54:25 +0300
+Subject: serial: 8250_dw: handle clock enable errors in runtime_resume
+
+From: Artem Shimko <a.shimko.dev@gmail.com>
+
+[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ]
+
+Add error checking for clk_prepare_enable() calls in
+dw8250_runtime_resume(). Currently if either clock fails to enable,
+the function returns success while leaving clocks in inconsistent state.
+
+This change implements comprehensive error handling by checking the return
+values of both clk_prepare_enable() calls. If the second clock enable
+operation fails after the first clock has already been successfully
+enabled, the code now properly cleans up by disabling and unpreparing
+the first clock before returning. The error code is then propagated to
+the caller, ensuring that clock enable failures are properly reported
+rather than being silently ignored.
+
+Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
+Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index 710ae4d40aec4..0ff500965c103 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -741,11 +741,18 @@ static int dw8250_runtime_suspend(struct device *dev)
+
+ static int dw8250_runtime_resume(struct device *dev)
+ {
++ int ret;
+ struct dw8250_data *data = dev_get_drvdata(dev);
+
+- clk_prepare_enable(data->pclk);
++ ret = clk_prepare_enable(data->pclk);
++ if (ret)
++ return ret;
+
+- clk_prepare_enable(data->clk);
++ ret = clk_prepare_enable(data->clk);
++ if (ret) {
++ clk_disable_unprepare(data->pclk);
++ return ret;
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
+perf-test-stat-update-test-expectations-and-events.patch
+perf-test-stat-tests-fix-for-virtualized-machines.patch
+perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch
+perf-unwind-libdw-fix-invalid-reference-counts.patch
+perf-callchain-fix-srcline-printing-with-inlines.patch
+libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch
+rtc-max31335-use-correct-config-symbol-in-is_reachab.patch
+perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch
+perf-tools-get-debug-info-of-dso-properly.patch
+perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch
+perf-annotate-fix-args-leak-of-map_symbol.patch
+perf-maps-fix-reference-count-leak-in-maps__find_ams.patch
+perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch
+perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch
+tools-headers-go-back-to-include-asm-generic-unistd..patch
+perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch
+perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch
+perf-build-remove-no_libcap-that-controls-nothing.patch
+libperf-build-always-place-libperf-includes-first.patch
+perf-test-fix-test-case-perftool-testsuite_report-fo.patch
+rtc-interface-alarm-race-handling-should-not-discard.patch
+statmount-permission-check-should-return-eperm.patch
+hfsplus-fix-volume-corruption-issue-for-generic-480.patch
+audit-add-fchmodat2-to-change-attributes-class.patch
+hfsplus-fix-volume-corruption-issue-for-generic-498.patch
+fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch
+kselftest-kublk-include-message-in-_static_assert-fo.patch
+audit-add-missing-syscalls-to-read-class.patch
+hfsplus-pretend-special-inodes-as-regular-files.patch
+i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch
+i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch
+i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch
+dlm-fix-recovery-pending-middle-conversion.patch
+minix-add-required-sanity-checking-to-minix_check_su.patch
+dlm-validate-length-in-dlm_search_rsb_tree.patch
+btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch
+btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch
+netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch
+smb-client-add-proper-locking-around-ses-iface_last_.patch
+gfs2-fiemap-page-fault-fix.patch
+smb-client-prevent-races-in-query_interfaces.patch
+tools-cpupower-fix-inverted-aperf-capability-check.patch
+s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch
+tools-power-cpupower-reset-errno-before-strtoull.patch
+s390-purgatory-add-wno-default-const-init-unsafe-to-.patch
+perf-arm-cmn-support-cmn-600ae.patch
+arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch
+rnbd-srv-zero-the-rsp-buffer-before-using-it.patch
+x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch
+ntfs-d_compare-must-not-block.patch
+efi-cper-don-t-dump-the-entire-memory-region.patch
+apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch
+apei-ghes-arm-processor-error-don-t-go-past-allocate.patch
+efi-cper-don-t-go-past-the-arm-processor-cper-record.patch
+acpi-processor-fix-null-pointer-dereference-in-acpi_.patch
+acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch
+acpica-abort-aml-bytecode-execution-when-executing-a.patch
+powercap-intel_rapl-add-pl4-support-for-ice-lake.patch
+io_uring-timeout-annotate-data-race-in-io_flush_time.patch
+alpha-fix-user-space-corruption-during-memory-compac.patch
+md-cluster-fix-null-pointer-dereference-in-process_m.patch
+md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch
+rust-cpufreq-always-inline-functions-using-build_ass.patch
+cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch
+s390-perf-disable-register-readout-on-sampling-event.patch
+perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch
+acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch
+acpi-battery-fix-incorrect-charging-status-when-curr.patch
+xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch
+blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch
+blk-mq-sched-unify-elevators-checking-for-async-requ.patch
+block-decouple-secure-erase-size-limit-from-discard-.patch
+sparc-synchronize-user-stack-on-fork-and-clone.patch
+sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch
+bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch
+irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch
+perf-x86-msr-add-airmont-np.patch
+perf-x86-cstate-add-airmont-np.patch
+perf-x86-intel-add-airmont-np.patch
+gendwarfksyms-fix-build-on-32-bit-hosts.patch
+bpf-crypto-use-the-correct-destructor-kfunc-type.patch
+bpf-net_sched-use-the-correct-destructor-kfunc-type.patch
+bpf-recognize-special-arithmetic-shift-in-the-verifi.patch
+genirq-cpuhotplug-notify-about-affinity-changes-brea.patch
+bpf-properly-mark-live-registers-for-indirect-jumps.patch
+perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch
+arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch
+clocksource-drivers-sh_tmu-always-leave-device-runni.patch
+clocksource-drivers-timer-integrator-ap-add-missing-.patch
+pci-msi-unmap-msi-x-region-on-error.patch
+bpftool-fix-dependencies-for-static-build.patch
+crypto-hisilicon-qm-move-the-barrier-before-writing-.patch
+mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch
+char-tpm-cr50-remove-irqf_oneshot.patch
+sched-debug-fix-updating-of-ppos-on-server-write-ops.patch
+pstore-ram_core-fix-incorrect-success-return-when-vm.patch
+firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch
+revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch
+edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch
+edac-igen6-add-two-intel-amston-lake-socs-support.patch
+arm64-tegra-smaug-add-usb-role-switch-support.patch
+soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch
+x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch
+parisc-prevent-interrupts-during-reboot.patch
+drm-xe-ggtt-use-scope-based-runtime-pm.patch
+drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch
+drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch
+drm-display-dp_mst-add-protection-against-0-vcpi.patch
+drm-panthor-always-wait-after-sending-a-command-to-a.patch
+drm-xe-xe3_lpg-apply-wa_16028005424.patch
+gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch
+accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch
+drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch
+drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch
+drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch
+drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch
+drm-amd-display-guard-fams2-configuration-updates.patch
+drm-panel-edp-add-auo-b140qax01.h-panel.patch
+drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch
+spi-geni-qcom-initialize-mode-related-registers-to-0.patch
+spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch
+spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch
+drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch
+drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch
+asoc-sof-ipc4-support-for-sending-payload-along-with.patch
+media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch
+gpio-pca953x-add-support-for-tcal6408-tcal6416.patch
+spi-stm32-fix-overrun-issue-at-8bpw.patch
+drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch
+media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch
+media-omap3isp-isppreview-always-clamp-in-preview_tr.patch
+media-omap3isp-set-initial-format.patch
+media-chips-media-wave5-fix-conditional-in-start_str.patch
+media-chips-media-wave5-process-ready-frames-when-cm.patch
+drm-panel-edp-add-boe-nv140wum-t08-panel.patch
+media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch
+drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch
+drm-amd-display-fix-dsc-edp-issue.patch
+drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch
+drm-amd-display-add-signal-type-check-for-dcn401-get.patch
+drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch
+hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch
+hid-pidff-do-not-set-out-of-range-trigger-button.patch
+hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch
+drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch
+drm-amd-display-only-power-down-dig-on-phy-endpoints.patch
+drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch
+asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch
+asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch
+spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch
+cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch
+media-amphion-clear-last_buffer_dequeued-flag-for-de.patch
+drm-panel-fix-a-possible-null-pointer-dereference-in.patch
+media-adv7180-fix-frame-interval-in-progressive-mode.patch
+media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch
+media-solo6x10-check-for-out-of-bounds-chip_id.patch
+media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch
+media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch
+media-v4l2-async-fix-error-handling-on-steps-after-f.patch
+media-mt9m114-avoid-a-reset-low-spike-during-probe.patch
+media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch
+media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch
+media-ipu6-close-firmware-streams-on-streaming-enabl.patch
+media-ipu6-always-close-firmware-stream.patch
+alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch
+alsa-usb-audio-presonus-s18xx-uses-little-endian.patch
+drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch
+drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch
+drm-account-property-blob-allocations-to-memcg.patch
+drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch
+hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch
+virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch
+asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch
+pci-add-intel-nova-lake-audio-device-id.patch
+drm-amd-display-disable-fec-when-powering-down-encod.patch
+drm-amd-display-ensure-link-output-is-disabled-in-ba.patch
+drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch
+drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch
+drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch
+media-rkisp1-fix-filter-mode-register-configuration.patch
+drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch
+hid-multitouch-add-egalaxtouch-exc3188-support.patch
+media-uvcvideo-create-an-id-namespace-for-streaming-.patch
+hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch
+alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch
+alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch
+gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch
+asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch
+spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch
+drm-amd-display-fix-gfx12-family-constant-checks.patch
+drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch
+drm-amdgpu-validate-user-queue-size-constraints.patch
+spi-cadence-qspi-try-hard-to-disable-the-clocks.patch
+asoc-codecs-max98390-check-return-value-of-devm_gpio.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch
+hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch
+hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch
+hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch
+hwmon-f71882fg-add-f81968-support.patch
+hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch
+hid-logitech-hidpp-add-support-for-logitech-k980.patch
+asoc-es8328-add-error-unwind-in-resume.patch
+modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch
+power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch
+asoc-sof-intel-hda-fix-null-pointer-dereference.patch
+spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch
+asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch
+alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch
+alsa-mixer-oss-add-card-disconnect-checkpoints.patch
+alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch
+jfs-add-missing-set_freezable-for-freezable-kthread.patch
+jfs-nlink-overflow-in-jfs_rename.patch
+pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch
+wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch
+wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch
+wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch
+wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch
+wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch
+wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch
+wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch
+wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch
+wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch
+wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch
+dm-replace-eexist-with-ebusy.patch
+dm-remove-fake-timeout-to-avoid-leak-request.patch
+iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch
+net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch
+wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch
+rtla-fix-null-pointer-dereference-in-actions_parse.patch
+wifi-libertas-fix-warning-in-usb_tx_block.patch
+iommu-amd-move-wait_on_sem-out-of-spinlock.patch
+wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch
+wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch
+wifi-rtw89-mac-correct-page-number-for-csi-response.patch
+wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch
+pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch
+wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch
+wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch
+wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch
+wifi-ath12k-fix-preferred-hardware-mode-calculation.patch
+wifi-ath12k-fix-mac-phy-capability-parsing.patch
+wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch
+ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch
+ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch
+ipv6-annotate-data-races-in-net-ipv6-route.c.patch
+ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch
+ext4-mark-group-add-fast-commit-ineligible.patch
+ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch
+ext4-mark-group-extend-fast-commit-ineligible.patch
+ext4-use-reserved-metadata-blocks-when-splitting-ext.patch
+netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch
+netfilter-xt_tcpmss-check-remaining-length-before-re.patch
+openrisc-define-arch-specific-version-of-nop.patch
+net-usb-r8152-fix-transmit-queue-timeout.patch
+pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch
+wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch
+wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch
+wifi-iwlwifi-fix-22000-series-smem-parsing.patch
+wifi-iwlwifi-mld-fix-chandef-start-calculation.patch
+wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch
+driver-core-faux-stop-using-static-struct-device.patch
+wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch
+wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch
+net-rds-no-shortcut-out-of-rds_conn_error.patch
+ext4-propagate-flags-to-convert_initialized_extent.patch
+gro-change-the-bug_on-in-gro_pull_from_frag0.patch
+ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch
+net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch
+wifi-rtw89-pci-validate-release-report-content-befor.patch
+ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch
+bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch
+bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch
+bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch
+bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch
+bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch
+bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch
+bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch
+octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch
+net-sfp-add-quirk-for-lantech-8330-265d.patch
+wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch
+wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch
+bnxt_en-allow-ntuple-filters-for-drops.patch
+ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch
+net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch
+vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch
+net-rds-clear-reconnect-pending-bit.patch
+pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch
+pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch
+pci-fix-pci_slot_lock-device-locking.patch
+pci-enable-acs-after-configuring-iommu-for-of-platfo.patch
+pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch
+pci-mark-nvidia-gb10-to-avoid-bus-reset.patch
+pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch
+myri10ge-avoid-uninitialized-variable-use.patch
+nfc-nxp-nci-remove-interrupt-trigger-type.patch
+hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch
+rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch
+hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch
+um-preserve-errno-within-signal-handler.patch
+ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch
+hisi_acc_vfio_pci-update-status-after-ras-error.patch
+scsi-buslogic-reduce-stack-usage.patch
+vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch
+scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch
+riscv-vector-init-vector-context-with-proper-vlenb.patch
+tracing-fix-false-sharing-in-hwlat-get_sample.patch
+remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch
+mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch
+mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch
+mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch
+mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch
+mailbox-sprd-mask-interrupts-that-are-not-handled.patch
+remoteproc-mediatek-break-lock-dependency-to-prepare.patch
+mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch
+clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch
+clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch
+clk-microchip-core-correct-return-value-on-_get_pare.patch
+hid-i2c-hid-add-focaltech-ft8112.patch
+m68k-nommu-fix-memmove-with-differently-aligned-src-.patch
+9p-xen-protect-xen_9pfs_front_free-against-concurren.patch
+dmaengine-stm32-dma3-use-module_platform_driver.patch
+soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch
+soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch
+staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch
+serial-8250_dw-handle-clock-enable-errors-in-runtime.patch
+usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch
+fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch
+most-core-fix-resource-leak-in-most_register_interfa.patch
+dmaengine-sun6i-choose-appropriate-burst-length-unde.patch
+dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch
+phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch
+phy-cadence-torrent-restore-parent-clock-for-refclk-.patch
+misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch
+pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch
+misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch
+misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch
+pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch
+iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch
+usb-gadget-f_fs-fix-dma-buf-out-queues.patch
+usb-gadget-f_fs-fix-ioctl-error-handling.patch
+usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch
+staging-rtl8723bs-fix-memory-leak-on-failure-path.patch
+serial-8250-8250_omap.c-add-support-for-handling-uar.patch
+serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch
+fix-it87_wdt-early-reboot-by-reporting-running-timer.patch
+binder-don-t-use-pk-through-printk.patch
+watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch
+watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch
+phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch
+phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch
+revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch
+mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch
+iio-use-irqf_no_thread.patch
+iio-magnetometer-remove-irqf_oneshot.patch
+mips-loongson-make-cpumask_of_node-robust-against-nu.patch
+fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch
+fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch
+fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch
+fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch
+ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch
+fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch
+ceph-supply-snapshot-context-in-ceph_uninline_data.patch
+libceph-define-and-enforce-ceph_max_key_len.patch
+thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch
+acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch
+include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch
+arm-9467-1-mm-don-t-use-pk-through-printk.patch
+drm-amd-display-fix-writeback-on-dcn-3.2.patch
+drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch
+mshv-clear-eventfd-counter-on-irqfd-shutdown.patch
+asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch
+regulator-core-remove-regulator-supply_name-length-l.patch
+alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch
+drm-amd-display-fix-system-resume-lag-issue.patch
+drm-amd-display-avoid-updating-surface-with-the-same.patch
+drm-amdgpu-return-when-ras-table-checksum-is-error.patch
+drm-amdgpu-adjust-usleep_range-in-fence-wait.patch
+alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch
+alsa-usb-audio-update-the-number-of-packets-properly.patch
+drm-amdgpu-add-hainan-clock-adjustment.patch
+drm-amd-display-bypass-post-csc-for-additional-color.patch
+spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch
+drm-radeon-add-hainan-clock-adjustment.patch
+alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch
+btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch
+asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch
+alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch
+arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch
+drm-amd-display-remove-conditional-for-shaper-3dlut-.patch
+drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch
+rtc-zynqmp-correct-frequency-value.patch
+ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch
+ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch
+iommu-amd-serialize-sequence-allocation-under-concur.patch
--- /dev/null
+From a2b6ac1098e18efbdbea89259322f19fb4e3aa50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 14:54:45 -0300
+Subject: smb: client: add proper locking around ses->iface_last_update
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ]
+
+There is a missing ses->iface_lock in cifs_setup_session,
+around ses->iface_last_update.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/connect.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
+index 2f94d93b95e91..d96d23a8f4903 100644
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -4267,7 +4267,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
+ ses->ses_status = SES_IN_SETUP;
+
+ /* force iface_list refresh */
++ spin_lock(&ses->iface_lock);
+ ses->iface_last_update = 0;
++ spin_unlock(&ses->iface_lock);
+ }
+ spin_unlock(&ses->ses_lock);
+
+--
+2.51.0
+
--- /dev/null
+From e3b3e39e4e69cd5c81da5e6be790ad50805dcab9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 14:54:44 -0300
+Subject: smb: client: prevent races in ->query_interfaces()
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ]
+
+It was possible for two query interface works to be concurrently trying
+to update the interfaces.
+
+Prevent this by checking and updating iface_last_update under
+iface_lock.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index 1e39f2165e427..c3c5fddb2caab 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -637,13 +637,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ p = buf;
+
+ spin_lock(&ses->iface_lock);
+- /* do not query too frequently, this time with lock held */
+- if (ses->iface_last_update &&
+- time_before(jiffies, ses->iface_last_update +
+- (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
+- spin_unlock(&ses->iface_lock);
+- return 0;
+- }
+
+ /*
+ * Go through iface_list and mark them as inactive
+@@ -666,7 +659,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ "Empty network interface list returned by server %s\n",
+ ses->server->hostname);
+ rc = -EOPNOTSUPP;
+- ses->iface_last_update = jiffies;
+ goto out;
+ }
+
+@@ -795,8 +787,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ + sizeof(p->Next) && p->Next))
+ cifs_dbg(VFS, "%s: incomplete interface info\n", __func__);
+
+- ses->iface_last_update = jiffies;
+-
+ out:
+ /*
+ * Go through the list again and put the inactive entries
+@@ -825,10 +815,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_
+ struct TCP_Server_Info *pserver;
+
+ /* do not query too frequently */
++ spin_lock(&ses->iface_lock);
+ if (ses->iface_last_update &&
+ time_before(jiffies, ses->iface_last_update +
+- (SMB_INTERFACE_POLL_INTERVAL * HZ)))
++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
++ spin_unlock(&ses->iface_lock);
+ return 0;
++ }
++
++ ses->iface_last_update = jiffies;
++
++ spin_unlock(&ses->iface_lock);
+
+ rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
+ FSCTL_QUERY_NETWORK_INTERFACE_INFO,
+--
+2.51.0
+
--- /dev/null
+From 31bad2dfb812952024c3612d706ec4c0f05a152f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 06:12:41 +0800
+Subject: soc: imx8m: Fix error handling for clk_prepare_enable()
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit f6ef3d9ff81240e9bcc030f2da132eb0f8a761d7 ]
+
+imx8m_soc_prepare() directly returns the result of clk_prepare_enable(),
+which skips proper cleanup if the clock enable fails. Check the return
+value of clk_prepare_enable() and release resources if failure.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/r/202601111406.ZVV3YaiU-lkp@intel.com/
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/soc-imx8m.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c
+index 04a1b60f2f2b5..8e2322999f099 100644
+--- a/drivers/soc/imx/soc-imx8m.c
++++ b/drivers/soc/imx/soc-imx8m.c
+@@ -148,7 +148,11 @@ static int imx8m_soc_prepare(struct platform_device *pdev, const char *ocotp_com
+ goto err_clk;
+ }
+
+- return clk_prepare_enable(drvdata->clk);
++ ret = clk_prepare_enable(drvdata->clk);
++ if (ret)
++ goto err_clk;
++
++ return 0;
+
+ err_clk:
+ iounmap(drvdata->ocotp_base);
+--
+2.51.0
+
--- /dev/null
+From c8967ff305aab7163d519c4622873d72cc895e00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:09:47 +0200
+Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of
+ NUC15)
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ]
+
+Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and
+LAPBC710.
+
+Link: https://github.com/thesofproject/linux/issues/5529
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/dmi-quirks.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
+index 91ab97a456fa9..5854218e1a274 100644
+--- a/drivers/soundwire/dmi-quirks.c
++++ b/drivers/soundwire/dmi-quirks.c
+@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
+ },
+ .driver_data = (void *)intel_tgl_bios,
+ },
++ {
++ /*
++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County'
++ * LAPBC510 and LAPBC710)
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"),
++ },
++ .driver_data = (void *)intel_tgl_bios,
++ },
+ {
+ /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From a683a612c141a3841aceddd27b4f1a4cbf0ca888 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:17:29 +0000
+Subject: soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
+
+From: Maciej Strozek <mstrozek@opensource.cirrus.com>
+
+[ Upstream commit f87e5575a6bd1925cd55f500b61b661724372e5f ]
+
+Add cs42l45 to the wake_capable_list because it can generate jack events
+whilst the bus is stopped.
+
+Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20251215151729.3911077-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/intel_auxdevice.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soundwire/intel_auxdevice.c b/drivers/soundwire/intel_auxdevice.c
+index 6df2601fff909..8752b0e3ce74c 100644
+--- a/drivers/soundwire/intel_auxdevice.c
++++ b/drivers/soundwire/intel_auxdevice.c
+@@ -52,6 +52,7 @@ struct wake_capable_part {
+
+ static struct wake_capable_part wake_capable_list[] = {
+ {0x01fa, 0x4243},
++ {0x01fa, 0x4245},
+ {0x025d, 0x5682},
+ {0x025d, 0x700},
+ {0x025d, 0x711},
+--
+2.51.0
+
--- /dev/null
+From 31b8bf8b75045361c6c16cfbcc7ff575af5b66a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 13:40:29 +0000
+Subject: sparc: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ]
+
+Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros").
+
+glibc-2.42 drops the legacy termio struct, but the ioctls.h header still
+defines some TC* constants in terms of termio (via sizeof). Hardcode the
+values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h
+index 7fd2f5873c9e7..a8bbdf9877a41 100644
+--- a/arch/sparc/include/uapi/asm/ioctls.h
++++ b/arch/sparc/include/uapi/asm/ioctls.h
+@@ -5,10 +5,10 @@
+ #include <asm/ioctl.h>
+
+ /* Big T */
+-#define TCGETA _IOR('T', 1, struct termio)
+-#define TCSETA _IOW('T', 2, struct termio)
+-#define TCSETAW _IOW('T', 3, struct termio)
+-#define TCSETAF _IOW('T', 4, struct termio)
++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */
++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */
++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */
++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */
+ #define TCSBRK _IO('T', 5)
+ #define TCXONC _IO('T', 6)
+ #define TCFLSH _IO('T', 7)
+--
+2.51.0
+
--- /dev/null
+From 5b3f97f429326b2743b126f126f83f3b85e8c214 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:47:52 +0100
+Subject: sparc: Synchronize user stack on fork and clone
+
+From: Andreas Larsson <andreas@gaisler.com>
+
+[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ]
+
+Flush all uncommitted user windows before calling the generic syscall
+handlers for clone, fork, and vfork.
+
+Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the
+arch-specific syscall wrappers for these syscalls will attempt to flush
+all windows (including user windows).
+
+In the window overflow trap handlers on both SPARC{32|64},
+if the window can't be stored (i.e due to MMU related faults) the routine
+backups the user window and increments a thread counter (wsaved).
+
+By adding a synchronization point after the flush attempt, when fault
+handling is enabled, any uncommitted user windows will be flushed.
+
+Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394
+Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++--------------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
+index 0442ab00518d3..7d69877511fac 100644
+--- a/arch/sparc/kernel/process.c
++++ b/arch/sparc/kernel/process.c
+@@ -17,14 +17,18 @@
+
+ asmlinkage long sparc_fork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+ struct kernel_clone_args args = {
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs)
+
+ asmlinkage long sparc_vfork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+-
+ struct kernel_clone_args args = {
+ .flags = CLONE_VFORK | CLONE_VM,
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs)
+
+ asmlinkage long sparc_clone(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
+- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ unsigned long orig_i1;
++ unsigned int flags;
+ long ret;
++ struct kernel_clone_args args = {0};
+
+- struct kernel_clone_args args = {
+- .flags = (flags & ~CSIGNAL),
+- .exit_signal = (flags & CSIGNAL),
+- .tls = regs->u_regs[UREG_I3],
+- };
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ args.flags = (flags & ~CSIGNAL);
++ args.exit_signal = (flags & CSIGNAL);
++ args.tls = regs->u_regs[UREG_I3];
+
+ #ifdef CONFIG_COMPAT
+ if (test_thread_flag(TIF_32BIT)) {
+--
+2.51.0
+
--- /dev/null
+From d86779d67393537c04c58c29e068c0c7aaa749fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 16:13:34 +0100
+Subject: spi: cadence-qspi: Try hard to disable the clocks
+
+From: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>
+
+[ Upstream commit 612227b392eed94a3398dc03334a84a699a82276 ]
+
+In the remove path, we should try hard to perform all steps as we simply
+cannot fail.
+
+The "no runtime PM" quirk must only alter the state of the RPM core, but
+the clocks should still be disabled if that is possible. Move the
+disable call outside of the RPM quirk.
+
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>
+Tested-by: Santhosh Kumar K <s-k6@ti.com>
+Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-9-f9c21419a3e6@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index 3689e38ebe56f..b3e4dd72d8b8a 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -2044,6 +2044,7 @@ static void cqspi_remove(struct platform_device *pdev)
+ const struct cqspi_driver_platdata *ddata;
+ struct cqspi_st *cqspi = platform_get_drvdata(pdev);
+ struct device *dev = &pdev->dev;
++ int ret = 0;
+
+ ddata = of_device_get_match_data(dev);
+
+@@ -2059,8 +2060,10 @@ static void cqspi_remove(struct platform_device *pdev)
+ dma_release_channel(cqspi->rx_chan);
+
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
+- if (pm_runtime_get_sync(&pdev->dev) >= 0)
+- clk_disable(cqspi->clk);
++ ret = pm_runtime_get_sync(&pdev->dev);
++
++ if (ret >= 0)
++ clk_disable(cqspi->clk);
+
+ if (cqspi->is_jh7110)
+ cqspi_jh7110_disable_clk(pdev, cqspi);
+--
+2.51.0
+
--- /dev/null
+From b3fbdd4af0a916894cc7b3e3d938f6a4a0a0b455 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 19:13:35 +0000
+Subject: spi: cadence-quadspi: Parse DT for flashes with the rest of the DT
+ parsing
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 9f0736a4e136a6eb61e0cf530ddc18ab6d816ba3 ]
+
+The recent refactoring of where runtime PM is enabled done in commit
+f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to
+avoid imbalance") made the fact that when we do a pm_runtime_disable()
+in the error paths of probe() we can trigger a runtime disable which in
+turn results in duplicate clock disables. This is particularly likely
+to happen when there is missing or broken DT description for the flashes
+attached to the controller.
+
+Early on in the probe function we do a pm_runtime_get_noresume() since
+the probe function leaves the device in a powered up state but in the
+error path we can't assume that PM is enabled so we also manually
+disable everything, including clocks. This means that when runtime PM is
+active both it and the probe function release the same reference to the
+main clock for the IP, triggering warnings from the clock subsystem:
+
+[ 8.693719] clk:75:7 already disabled
+[ 8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb
+...
+[ 8.694261] clk_core_disable+0xa0/0xb4 (P)
+[ 8.694272] clk_disable+0x38/0x60
+[ 8.694283] cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi]
+[ 8.694309] platform_probe+0x5c/0xa4
+
+Dealing with this issue properly is complicated by the fact that we
+don't know if runtime PM is active so can't tell if it will disable the
+clocks or not. We can, however, sidestep the issue for the flash
+descriptions by moving their parsing to when we parse the controller
+properties which also save us doing a bunch of setup which can never be
+used so let's do that.
+
+Reported-by: Francesco Dolcini <francesco@dolcini.it>
+Closes: https://lore.kernel.org/r/20251201072844.GA6785@francesco-nb
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://patch.msgid.link/20251204-spi-cadence-qspi-runtime-pm-imbalance-v2-1-10af9115d531@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index 1cca9d87fbde4..3689e38ebe56f 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -1853,6 +1853,12 @@ static int cqspi_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
++ ret = cqspi_setup_flash(cqspi);
++ if (ret) {
++ dev_err(dev, "failed to setup flash parameters %d\n", ret);
++ return ret;
++ }
++
+ /* Obtain QSPI clock. */
+ cqspi->clk = devm_clk_get(dev, NULL);
+ if (IS_ERR(cqspi->clk)) {
+@@ -1996,12 +2002,6 @@ static int cqspi_probe(struct platform_device *pdev)
+ pm_runtime_get_noresume(dev);
+ }
+
+- ret = cqspi_setup_flash(cqspi);
+- if (ret) {
+- dev_err(dev, "failed to setup flash parameters %d\n", ret);
+- goto probe_setup_failed;
+- }
+-
+ host->num_chipselect = cqspi->num_chipselect;
+
+ if (ddata && (ddata->quirks & CQSPI_SUPPORT_DEVICE_RESET))
+--
+2.51.0
+
--- /dev/null
+From 068247050efc95315866f9660dd8f97d48e8eb40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 21:58:52 +0530
+Subject: spi: geni-qcom: Fix abort sequence execution for serial engine errors
+
+From: Praveen Talari <praveen.talari@oss.qualcomm.com>
+
+[ Upstream commit 96e041647bb0f9d92f95df1d69cb7442d7408b79 ]
+
+The driver currently skips the abort sequence for target mode when serial
+engine errors occur. This leads to improper error recovery as the serial
+engine may remain in an undefined state without proper cleanup, potentially
+causing subsequent operations to fail or behave unpredictably.
+
+Fix this by ensuring the abort sequence and DMA reset always execute during
+error recovery, as both are required for proper serial engine error
+handling.
+
+Co-developed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260204162854.1206323-3-praveen.talari@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 24 ++++++++++--------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 5ab20d7955121..acfcf870efd84 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -160,24 +160,20 @@ static void handle_se_timeout(struct spi_controller *spi,
+ xfer = mas->cur_xfer;
+ mas->cur_xfer = NULL;
+
+- if (spi->target) {
+- /*
+- * skip CMD Cancel sequnece since spi target
+- * doesn`t support CMD Cancel sequnece
+- */
++ /* The controller doesn't support the Cancel commnand in target mode */
++ if (!spi->target) {
++ reinit_completion(&mas->cancel_done);
++ geni_se_cancel_m_cmd(se);
++
+ spin_unlock_irq(&mas->lock);
+- goto reset_if_dma;
+- }
+
+- reinit_completion(&mas->cancel_done);
+- geni_se_cancel_m_cmd(se);
+- spin_unlock_irq(&mas->lock);
++ time_left = wait_for_completion_timeout(&mas->cancel_done, HZ);
++ if (time_left)
++ goto reset_if_dma;
+
+- time_left = wait_for_completion_timeout(&mas->cancel_done, HZ);
+- if (time_left)
+- goto reset_if_dma;
++ spin_lock_irq(&mas->lock);
++ }
+
+- spin_lock_irq(&mas->lock);
+ reinit_completion(&mas->abort_done);
+ geni_se_abort_m_cmd(se);
+ spin_unlock_irq(&mas->lock);
+--
+2.51.0
+
--- /dev/null
+From 0fc47aedc10403cb4eded29ff528f813cc5192c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:01 -0500
+Subject: spi-geni-qcom: initialize mode related registers to 0
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ]
+
+setup_fifo_params assumes these will be zero, it won't write these
+registers if the initial mode is zero.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index a0d8d3425c6c6..9e9953469b3a0 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -724,6 +724,12 @@ static int spi_geni_init(struct spi_geni_master *mas)
+ case 0:
+ mas->cur_xfer_mode = GENI_SE_FIFO;
+ geni_se_select_mode(se, GENI_SE_FIFO);
++ /* setup_fifo_params assumes that these registers start with a zero value */
++ writel(0, se->base + SE_SPI_LOOPBACK);
++ writel(0, se->base + SE_SPI_DEMUX_SEL);
++ writel(0, se->base + SE_SPI_CPHA);
++ writel(0, se->base + SE_SPI_CPOL);
++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV);
+ ret = 0;
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 97a58bbf521a906dc5773534c7051379db9da79a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:00 -0500
+Subject: spi-geni-qcom: use xfer->bits_per_word for can_dma()
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit fb2bbe3838728f572485706677590e4fc41eec5c ]
+
+mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word
+when can_dma() is called. Use the right value instead.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 9e9953469b3a0..5ab20d7955121 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -548,10 +548,10 @@ static u32 get_xfer_len_in_words(struct spi_transfer *xfer,
+ {
+ u32 len;
+
+- if (!(mas->cur_bits_per_word % MIN_WORD_LEN))
+- len = xfer->len * BITS_PER_BYTE / mas->cur_bits_per_word;
++ if (!(xfer->bits_per_word % MIN_WORD_LEN))
++ len = xfer->len * BITS_PER_BYTE / xfer->bits_per_word;
+ else
+- len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1);
++ len = xfer->len / (xfer->bits_per_word / BITS_PER_BYTE + 1);
+ len &= TRANS_LEN_MSK;
+
+ return len;
+@@ -571,7 +571,7 @@ static bool geni_can_dma(struct spi_controller *ctlr,
+ return true;
+
+ len = get_xfer_len_in_words(xfer, mas);
+- fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / mas->cur_bits_per_word;
++ fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / xfer->bits_per_word;
+
+ if (len > fifo_size)
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 1db8c46879196949cc693cc0a07fb518552d8917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 18:18:01 +0100
+Subject: spi: spi-mem: Limit octal DTR constraints to octal DTR situations
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9 ]
+
+In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is
+considered requiring a duplicated command opcode. This is wrong as this
+constraint only applies to octal DTR operations (8D-8D-8D).
+
+Narrow the application of this constraint to the concerned bus
+interface.
+
+Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2,
+4} would benefit from this check either as there is only in octal DTR
+mode that a single clock edge would be enough to transmit the full
+opcode.
+
+Make sure the constraint of expecting two bytes for the command is
+applied to the relevant bus interface.
+
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 064b99204d9ac..71e3eaf59df97 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -175,8 +175,19 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,
+ if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16))
+ return false;
+
+- if (op->cmd.nbytes != 2)
+- return false;
++ /* Extra 8D-8D-8D limitations */
++ if (op->cmd.dtr && op->cmd.buswidth == 8) {
++ if (op->cmd.nbytes != 2)
++ return false;
++
++ if ((op->addr.nbytes % 2) ||
++ (op->dummy.nbytes % 2) ||
++ (op->data.nbytes % 2)) {
++ dev_err(&ctlr->dev,
++ "Even byte numbers not allowed in octal DTR operations\n");
++ return false;
++ }
++ }
+ } else {
+ if (op->cmd.nbytes != 1)
+ return false;
+--
+2.51.0
+
--- /dev/null
+From 63b6c71dbbd5ebe12a7466b71666a4ec57a5ad8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 20:30:04 +0800
+Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
+
+From: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+
+[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ]
+
+spi_mem_dirmap_create() may reconfigure controller-wide settings,
+which can interfere with concurrent transfers to other devices
+sharing the same SPI controller but using different chip selects.
+
+Wrap the ->dirmap_create() callback with spi_mem_access_start() and
+spi_mem_access_end() to serialize access and prevent cross-CS
+interference during dirmap creation.
+
+This patch has been verified on a setup where a SPI TPM is connected
+to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1
+of the same controller. Without this patch, spi_mem_dirmap_create()
+for the SPI NOR flash interferes with ongoing SPI TPM data transfers,
+resulting in failure to create the TPM device. This was tested on an
+ASPEED AST2700 EVB.
+
+Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 71e3eaf59df97..db9467535416d 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -714,9 +714,18 @@ spi_mem_dirmap_create(struct spi_mem *mem,
+
+ desc->mem = mem;
+ desc->info = *info;
+- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create)
++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) {
++ ret = spi_mem_access_start(mem);
++ if (ret) {
++ kfree(desc);
++ return ERR_PTR(ret);
++ }
++
+ ret = ctlr->mem_ops->dirmap_create(desc);
+
++ spi_mem_access_end(mem);
++ }
++
+ if (ret) {
+ desc->nodirmap = true;
+ if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
+--
+2.51.0
+
--- /dev/null
+From f4e0491391cce1544534ed39e15cf52e4703efec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 08:26:16 +0100
+Subject: spi: spidev: fix lock inversion between spi_lock and buf_lock
+
+From: Fabian Godehardt <fg@emlix.com>
+
+[ Upstream commit 40534d19ed2afb880ecf202dab26a8e7a5808d16 ]
+
+The spidev driver previously used two mutexes, spi_lock and buf_lock,
+but acquired them in different orders depending on the code path:
+
+ write()/read(): buf_lock -> spi_lock
+ ioctl(): spi_lock -> buf_lock
+
+This AB-BA locking pattern triggers lockdep warnings and can
+cause real deadlocks:
+
+ WARNING: possible circular locking dependency detected
+ spidev_ioctl() -> mutex_lock(&spidev->buf_lock)
+ spidev_sync_write() -> mutex_lock(&spidev->spi_lock)
+ *** DEADLOCK ***
+
+The issue is reproducible with a simple userspace program that
+performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from
+separate threads on the same spidev file descriptor.
+
+Fix this by simplifying the locking model and removing the lock
+inversion entirely. spidev_sync() no longer performs any locking,
+and all callers serialize access using spi_lock.
+
+buf_lock is removed since its functionality is fully covered by
+spi_lock, eliminating the possibility of lock ordering issues.
+
+This removes the lock inversion and prevents deadlocks without
+changing userspace ABI or behaviour.
+
+Signed-off-by: Fabian Godehardt <fg@emlix.com>
+Link: https://patch.msgid.link/20260211072616.489522-1-fg@emlix.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spidev.c | 63 ++++++++++++++++----------------------------
+ 1 file changed, 22 insertions(+), 41 deletions(-)
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 5300c942a2a44..4d53c394101a4 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -74,7 +74,6 @@ struct spidev_data {
+ struct list_head device_entry;
+
+ /* TX/RX buffers are NULL unless this device is open (users > 0) */
+- struct mutex buf_lock;
+ unsigned users;
+ u8 *tx_buffer;
+ u8 *rx_buffer;
+@@ -102,24 +101,6 @@ spidev_sync_unlocked(struct spi_device *spi, struct spi_message *message)
+ return status;
+ }
+
+-static ssize_t
+-spidev_sync(struct spidev_data *spidev, struct spi_message *message)
+-{
+- ssize_t status;
+- struct spi_device *spi;
+-
+- mutex_lock(&spidev->spi_lock);
+- spi = spidev->spi;
+-
+- if (spi == NULL)
+- status = -ESHUTDOWN;
+- else
+- status = spidev_sync_unlocked(spi, message);
+-
+- mutex_unlock(&spidev->spi_lock);
+- return status;
+-}
+-
+ static inline ssize_t
+ spidev_sync_write(struct spidev_data *spidev, size_t len)
+ {
+@@ -132,7 +113,8 @@ spidev_sync_write(struct spidev_data *spidev, size_t len)
+
+ spi_message_init(&m);
+ spi_message_add_tail(&t, &m);
+- return spidev_sync(spidev, &m);
++
++ return spidev_sync_unlocked(spidev->spi, &m);
+ }
+
+ static inline ssize_t
+@@ -147,7 +129,8 @@ spidev_sync_read(struct spidev_data *spidev, size_t len)
+
+ spi_message_init(&m);
+ spi_message_add_tail(&t, &m);
+- return spidev_sync(spidev, &m);
++
++ return spidev_sync_unlocked(spidev->spi, &m);
+ }
+
+ /*-------------------------------------------------------------------------*/
+@@ -157,7 +140,7 @@ static ssize_t
+ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
+ {
+ struct spidev_data *spidev;
+- ssize_t status;
++ ssize_t status = -ESHUTDOWN;
+
+ /* chipselect only toggles at start or end of operation */
+ if (count > bufsiz)
+@@ -165,7 +148,11 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
+
+ spidev = filp->private_data;
+
+- mutex_lock(&spidev->buf_lock);
++ mutex_lock(&spidev->spi_lock);
++
++ if (spidev->spi == NULL)
++ goto err_spi_removed;
++
+ status = spidev_sync_read(spidev, count);
+ if (status > 0) {
+ unsigned long missing;
+@@ -176,7 +163,9 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
+ else
+ status = status - missing;
+ }
+- mutex_unlock(&spidev->buf_lock);
++
++err_spi_removed:
++ mutex_unlock(&spidev->spi_lock);
+
+ return status;
+ }
+@@ -187,7 +176,7 @@ spidev_write(struct file *filp, const char __user *buf,
+ size_t count, loff_t *f_pos)
+ {
+ struct spidev_data *spidev;
+- ssize_t status;
++ ssize_t status = -ESHUTDOWN;
+ unsigned long missing;
+
+ /* chipselect only toggles at start or end of operation */
+@@ -196,13 +185,19 @@ spidev_write(struct file *filp, const char __user *buf,
+
+ spidev = filp->private_data;
+
+- mutex_lock(&spidev->buf_lock);
++ mutex_lock(&spidev->spi_lock);
++
++ if (spidev->spi == NULL)
++ goto err_spi_removed;
++
+ missing = copy_from_user(spidev->tx_buffer, buf, count);
+ if (missing == 0)
+ status = spidev_sync_write(spidev, count);
+ else
+ status = -EFAULT;
+- mutex_unlock(&spidev->buf_lock);
++
++err_spi_removed:
++ mutex_unlock(&spidev->spi_lock);
+
+ return status;
+ }
+@@ -379,14 +374,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+
+ ctlr = spi->controller;
+
+- /* use the buffer lock here for triple duty:
+- * - prevent I/O (from us) so calling spi_setup() is safe;
+- * - prevent concurrent SPI_IOC_WR_* from morphing
+- * data fields while SPI_IOC_RD_* reads them;
+- * - SPI_IOC_MESSAGE needs the buffer locked "normally".
+- */
+- mutex_lock(&spidev->buf_lock);
+-
+ switch (cmd) {
+ /* read requests */
+ case SPI_IOC_RD_MODE:
+@@ -510,7 +497,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ break;
+ }
+
+- mutex_unlock(&spidev->buf_lock);
+ spi_dev_put(spi);
+ mutex_unlock(&spidev->spi_lock);
+ return retval;
+@@ -541,9 +527,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
+ return -ESHUTDOWN;
+ }
+
+- /* SPI_IOC_MESSAGE needs the buffer locked "normally" */
+- mutex_lock(&spidev->buf_lock);
+-
+ /* Check message and copy into scratch area */
+ ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc);
+ if (IS_ERR(ioc)) {
+@@ -564,7 +547,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
+ kfree(ioc);
+
+ done:
+- mutex_unlock(&spidev->buf_lock);
+ spi_dev_put(spi);
+ mutex_unlock(&spidev->spi_lock);
+ return retval;
+@@ -800,7 +782,6 @@ static int spidev_probe(struct spi_device *spi)
+ /* Initialize the driver data */
+ spidev->spi = spi;
+ mutex_init(&spidev->spi_lock);
+- mutex_init(&spidev->buf_lock);
+
+ INIT_LIST_HEAD(&spidev->device_entry);
+
+--
+2.51.0
+
--- /dev/null
+From e6c94b7036006a00021e588b4da84b1a877674cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 11:48:28 +0100
+Subject: spi: stm32: fix Overrun issue at < 8bpw
+
+From: Deepak Kumar <deepak.kumar01@st.com>
+
+[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ]
+
+When SPI communication is suspended by hardware automatically, it could
+happen that few bits of next frame are already clocked out due to
+internal synchronization delay.
+
+To achieve a safe suspension, we need to ensure that each word must be
+at least 8 SPI clock cycles long. That's why, if bpw is less than 8
+bits, we need to use midi to reach 8 SPI clock cycles at least.
+
+This will ensure that each word achieve safe suspension and prevent
+overrun condition.
+
+Signed-off-by: Deepak Kumar <deepak.kumar01@st.com>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 2c804c1aef989..80986bd251d29 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1906,11 +1906,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, struct spi_transfer
+ cfg2_clrb |= STM32H7_SPI_CFG2_MIDI;
+ if ((len > 1) && (spi->cur_midi > 0)) {
+ u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed);
+- u32 midi = min_t(u32,
+- DIV_ROUND_UP(spi->cur_midi, sck_period_ns),
+- FIELD_GET(STM32H7_SPI_CFG2_MIDI,
+- STM32H7_SPI_CFG2_MIDI));
++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns);
+
++ if ((spi->cur_bpw + midi) < 8)
++ midi = 8 - spi->cur_bpw;
++
++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI));
+
+ dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n",
+ sck_period_ns, midi, midi * sck_period_ns);
+--
+2.51.0
+
--- /dev/null
+From f34aaeb860eace943d1e00e20d6ae0058acd93ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:47:12 +0530
+Subject: staging: rtl8723bs: fix memory leak on failure path
+
+From: Diksha Kumari <dikshakdevgan@gmail.com>
+
+[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ]
+
+cfg80211_inform_bss_frame() may return NULL on failure. In that case,
+the allocated buffer 'buf' is not freed and the function returns early,
+leading to potential memory leak.
+Fix this by ensuring that 'buf' is freed on both success and failure paths.
+
+Signed-off-by: Diksha Kumari <dikshakdevgan@gmail.com>
+Reviewed-by: Mukesh Kumar Chaurasiya <mkchauras@linux.ibm.com>
+Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+index 315bab3737294..5d28dbf8b50ef 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -315,9 +315,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl
+ len, notify_signal, GFP_ATOMIC);
+
+ if (unlikely(!bss))
+- goto exit;
++ goto free_buf;
+
+ cfg80211_put_bss(wiphy, bss);
++free_buf:
+ kfree(buf);
+
+ exit:
+--
+2.51.0
+
--- /dev/null
+From cbfef9c5aaf29fa220413b69d0afc058fa613cd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:27:28 +0800
+Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq()
+ failure
+
+From: Liang Jie <liangjie@lixiang.com>
+
+[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ]
+
+The return value of sdio_alloc_irq() was not stored in status.
+If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds,
+status remains _SUCCESS and the error path skips resource cleanup,
+while rtw_drv_init() still returns success.
+
+Store the return value of sdio_alloc_irq() in status and reuse the
+existing error handling which relies on status.
+
+Reviewed-by: fanggeng <fanggeng@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+index f3caaa857c864..139ace51486d2 100644
+--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+@@ -377,7 +377,8 @@ static int rtw_drv_init(
+ if (status != _SUCCESS)
+ goto free_if1;
+
+- if (sdio_alloc_irq(dvobj) != _SUCCESS)
++ status = sdio_alloc_irq(dvobj);
++ if (status != _SUCCESS)
+ goto free_if1;
+
+ status = _SUCCESS;
+--
+2.51.0
+
--- /dev/null
+From f1223b4b657a26e6ffc4a8a7036660f77206e154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Nov 2025 14:41:20 +0530
+Subject: statmount: permission check should return EPERM
+
+From: Bhavik Sachdev <b.sachdev1904@gmail.com>
+
+[ Upstream commit fccbe38a5d06dbe44bcd89196fe1d2c2272a1f4a ]
+
+Currently, statmount() returns ENOENT when caller is not CAP_SYS_ADMIN
+in the user namespace owner of target mount namespace. This should be
+EPERM instead.
+
+Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
+Signed-off-by: Bhavik Sachdev <b.sachdev1904@gmail.com>
+Link: https://patch.msgid.link/20251129091455.757724-2-b.sachdev1904@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 4272349650b14..5b31682db450e 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -5796,7 +5796,7 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,
+
+ if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) &&
+ !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
+- return -ENOENT;
++ return -EPERM;
+
+ ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT);
+ if (!ks)
+--
+2.51.0
+
--- /dev/null
+From 331737a72b916b91fc29eb2ee960882e573c94f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 08:23:15 +0000
+Subject: thermal: int340x: Fix sysfs group leak on DLVR registration failure
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ]
+
+When DLVR sysfs group creation fails in proc_thermal_rfim_add(),
+the function returns immediately without cleaning up the FIVR group
+that may have been created earlier.
+
+Add proper error unwinding to remove the FIVR group before returning
+failure.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../thermal/intel/int340x_thermal/processor_thermal_rfim.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+index 1f3d22b659dbe..635bc8fded1e9 100644
+--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+@@ -451,8 +451,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc
+ break;
+ }
+ ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group);
+- if (ret)
++ if (ret) {
++ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR)
++ sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group);
+ return ret;
++ }
+ }
+
+ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) {
+--
+2.51.0
+
--- /dev/null
+From 2840037173c66d116ebb3cc2365697bb10c0a064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Nov 2025 14:46:13 +0530
+Subject: tools/cpupower: Fix inverted APERF capability check
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 24858a84163c8d04827166b3bcaed80612bb62fc ]
+
+The capability check was inverted, causing the function to return
+error when APERF support is available and proceed when it is not.
+
+Negate the condition to return error only when APERF capability
+is absent.
+
+Link: https://lore.kernel.org/r/20251126091613.567480-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/utils/cpufreq-info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c
+index 7d3732f5f2f6f..5fe01e516817e 100644
+--- a/tools/power/cpupower/utils/cpufreq-info.c
++++ b/tools/power/cpupower/utils/cpufreq-info.c
+@@ -270,7 +270,7 @@ static int get_freq_hardware(unsigned int cpu, unsigned int human)
+ {
+ unsigned long freq;
+
+- if (cpupower_cpu_info.caps & CPUPOWER_CAP_APERF)
++ if (!(cpupower_cpu_info.caps & CPUPOWER_CAP_APERF))
+ return -EINVAL;
+
+ freq = cpufreq_get_freq_hardware(cpu);
+--
+2.51.0
+
--- /dev/null
+From 94d0768803c6b199d15b1d86d902b362f4fdf2dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 09:43:24 +0000
+Subject: tools headers: Go back to include asm-generic/unistd.h for arm64
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 096b86ce08332fbcb0ec6ff6714c44899ec03970 ]
+
+The header unistd.h is included under Arm64's uAPI folder (see
+tools/arch/arm64/include/uapi/asm/), but it does not include its
+dependent header unistd_64.h.
+
+The intention is for unistd_64.h to be generated dynamically using
+scripts/Makefile.asm-headers.
+
+However, this dynamic approach causes problems because the header is not
+available early enough, even though it is widely included throughout
+tools.
+
+Using the perf build as an example:
+
+ 1) Feature detection: Perf first runs feature tests.
+
+ The BPF feature program test-bpf.c includes unistd.h. Since
+ unistd_64.h has not been generated yet, the program fails to build,
+ and the BPF feature ends up being disabled.
+
+ 2) libperf build:
+
+ The libperf Makefile later generates unistd_64.h on the fly, so
+ libperf itself builds successfully.
+
+ 3) Final perf build:
+
+ Although the perf binary can build successfully using the generated
+ header, we never get a chance to build BPF skeleton programs,
+ because BPF support was already disabled earlier.
+
+Restore to include asm-generic/unistd.h for fixing the issue. This
+aligns with most architectures (x86 is a special case that keeps
+unistd_32.h/unistd_64.h for its particular syscall numbers) and ensures
+the header is available from the start.
+
+Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/arch/arm64/include/uapi/asm/unistd.h | 24 +++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/tools/arch/arm64/include/uapi/asm/unistd.h b/tools/arch/arm64/include/uapi/asm/unistd.h
+index df36f23876e86..9306726337fe0 100644
+--- a/tools/arch/arm64/include/uapi/asm/unistd.h
++++ b/tools/arch/arm64/include/uapi/asm/unistd.h
+@@ -1,2 +1,24 @@
+ /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+-#include <asm/unistd_64.h>
++/*
++ * Copyright (C) 2012 ARM Ltd.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program. If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#define __ARCH_WANT_RENAMEAT
++#define __ARCH_WANT_NEW_STAT
++#define __ARCH_WANT_SET_GET_RLIMIT
++#define __ARCH_WANT_TIME32_SYSCALLS
++#define __ARCH_WANT_MEMFD_SECRET
++
++#include <asm-generic/unistd.h>
+--
+2.51.0
+
--- /dev/null
+From 86acd9473ecffa58c556d3a4231960f5686c79a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:47:45 +0530
+Subject: tools/power cpupower: Reset errno before strtoull()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ]
+
+cpuidle_state_get_one_value() never cleared errno before calling
+strtoull(), so a prior ERANGE caused every cpuidle counter read to
+return zero. Reset errno to 0 before the conversion so each sysfs read
+is evaluated independently.
+
+Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index f2c1139adf716..bd857ee7541a7 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -150,6 +150,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu,
+ if (len == 0)
+ return 0;
+
++ errno = 0;
+ value = strtoull(linebuf, &endp, 0);
+
+ if (endp == linebuf || errno == ERANGE)
+--
+2.51.0
+
--- /dev/null
+From 6291b2a682c39727aadd6781fd361c4bc68cd089 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 23:48:10 -0800
+Subject: tracing: Fix false sharing in hwlat get_sample()
+
+From: Colin Lord <clord@mykolab.com>
+
+[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ]
+
+The get_sample() function in the hwlat tracer assumes the caller holds
+hwlat_data.lock, but this is not actually happening. The result is
+unprotected data access to hwlat_data, and in per-cpu mode can result in
+false sharing which may show up as false positive latency events.
+
+The specific case of false sharing observed was primarily between
+hwlat_data.sample_width and hwlat_data.count. These are separated by
+just 8B and are therefore likely to share a cache line. When one thread
+modifies count, the cache line is in a modified state so when other
+threads read sample_width in the main latency detection loop, they fetch
+the modified cache line. On some systems, the fetch itself may be slow
+enough to count as a latency event, which could set up a self
+reinforcing cycle of latency events as each event increments count which
+then causes more latency events, continuing the cycle.
+
+The other result of the unprotected data access is that hwlat_data.count
+can end up with duplicate or missed values, which was observed on some
+systems in testing.
+
+Convert hwlat_data.count to atomic64_t so it can be safely modified
+without locking, and prevent false sharing by pulling sample_width into
+a local variable.
+
+One system this was tested on was a dual socket server with 32 CPUs on
+each numa node. With settings of 1us threshold, 1000us width, and
+2000us window, this change reduced the number of latency events from
+500 per second down to approximately 1 event per minute. Some machines
+tested did not exhibit measurable latency from the false sharing.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com
+Signed-off-by: Colin Lord <clord@mykolab.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_hwlat.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
+index 2f7b94e98317c..3fe274b84f1c2 100644
+--- a/kernel/trace/trace_hwlat.c
++++ b/kernel/trace/trace_hwlat.c
+@@ -102,9 +102,9 @@ struct hwlat_sample {
+ /* keep the global state somewhere. */
+ static struct hwlat_data {
+
+- struct mutex lock; /* protect changes */
++ struct mutex lock; /* protect changes */
+
+- u64 count; /* total since reset */
++ atomic64_t count; /* total since reset */
+
+ u64 sample_window; /* total sampling window (on+off) */
+ u64 sample_width; /* active sampling portion of window */
+@@ -193,8 +193,7 @@ void trace_hwlat_callback(bool enter)
+ * get_sample - sample the CPU TSC and look for likely hardware latencies
+ *
+ * Used to repeatedly capture the CPU TSC (or similar), looking for potential
+- * hardware-induced latency. Called with interrupts disabled and with
+- * hwlat_data.lock held.
++ * hardware-induced latency. Called with interrupts disabled.
+ */
+ static int get_sample(void)
+ {
+@@ -204,6 +203,7 @@ static int get_sample(void)
+ time_type start, t1, t2, last_t2;
+ s64 diff, outer_diff, total, last_total = 0;
+ u64 sample = 0;
++ u64 sample_width = READ_ONCE(hwlat_data.sample_width);
+ u64 thresh = tracing_thresh;
+ u64 outer_sample = 0;
+ int ret = -1;
+@@ -267,7 +267,7 @@ static int get_sample(void)
+ if (diff > sample)
+ sample = diff; /* only want highest value */
+
+- } while (total <= hwlat_data.sample_width);
++ } while (total <= sample_width);
+
+ barrier(); /* finish the above in the view for NMIs */
+ trace_hwlat_callback_enabled = false;
+@@ -285,8 +285,7 @@ static int get_sample(void)
+ if (kdata->nmi_total_ts)
+ do_div(kdata->nmi_total_ts, NSEC_PER_USEC);
+
+- hwlat_data.count++;
+- s.seqnum = hwlat_data.count;
++ s.seqnum = atomic64_inc_return(&hwlat_data.count);
+ s.duration = sample;
+ s.outer_duration = outer_sample;
+ s.nmi_total_ts = kdata->nmi_total_ts;
+@@ -832,7 +831,7 @@ static int hwlat_tracer_init(struct trace_array *tr)
+
+ hwlat_trace = tr;
+
+- hwlat_data.count = 0;
++ atomic64_set(&hwlat_data.count, 0);
+ tr->max_latency = 0;
+ save_tracing_thresh = tracing_thresh;
+
+--
+2.51.0
+
--- /dev/null
+From 3f66255bebd110fd1dd26e8f54b982e117d45a56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 08:12:27 +0800
+Subject: um: Preserve errno within signal handler
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit f68b2d5a907b53eed99cf2efcaaae116df73c298 ]
+
+We rely on errno to determine whether a syscall has failed, so we
+need to ensure that accessing errno is async-signal-safe. Currently,
+we preserve the errno in sig_handler_common(), but it doesn't cover
+every possible case. Let's do it in hard_handler() instead, which
+is the signal handler we actually register.
+
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Link: https://patch.msgid.link/20260106001228.1531146-2-tiwei.btw@antgroup.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/signal.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
+index 11f07f4982700..bebeb6b4bee8b 100644
+--- a/arch/um/os-Linux/signal.c
++++ b/arch/um/os-Linux/signal.c
+@@ -35,7 +35,6 @@ void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *, void *mc) =
+ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc)
+ {
+ struct uml_pt_regs r;
+- int save_errno = errno;
+
+ r.is_user = 0;
+ if (sig == SIGSEGV) {
+@@ -49,8 +48,6 @@ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc)
+ unblock_signals_trace();
+
+ (*sig_info[sig])(sig, si, &r, mc);
+-
+- errno = save_errno;
+ }
+
+ /*
+@@ -201,8 +198,11 @@ static void hard_handler(int sig, siginfo_t *si, void *p)
+ {
+ ucontext_t *uc = p;
+ mcontext_t *mc = &uc->uc_mcontext;
++ int save_errno = errno;
+
+ (*handlers[sig])(sig, (struct siginfo *)si, mc);
++
++ errno = save_errno;
+ }
+
+ void set_handler(int sig)
+--
+2.51.0
+
--- /dev/null
+From 1136876b5f18d09c1a091a081228a99fe1c1f017 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 16:59:02 +0000
+Subject: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
+
+From: Mario Peter <mario.peter@leica-geosystems.com>
+
+[ Upstream commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123 ]
+
+The ChipIdea UDC driver can encounter "not page aligned sg buffer"
+errors when a USB device is reconnected after being disconnected
+during an active transfer. This occurs because _ep_nuke() returns
+requests to the gadget layer without properly unmapping DMA buffers
+or cleaning up scatter-gather bounce buffers.
+
+Root cause:
+When a disconnect happens during a multi-segment DMA transfer, the
+request's num_mapped_sgs field and sgt.sgl pointer remain set with
+stale values. The request is returned to the gadget driver with status
+-ESHUTDOWN but still has active DMA state. If the gadget driver reuses
+this request on reconnect without reinitializing it, the stale DMA
+state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero
+num_mapped_sgs) and attempt to use freed/invalid DMA addresses,
+leading to alignment errors and potential memory corruption.
+
+The normal completion path via _hardware_dequeue() properly calls
+usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before
+returning the request. The _ep_nuke() path must do the same cleanup
+to ensure requests are returned in a clean, reusable state.
+
+Fix:
+Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror
+the cleanup sequence in _hardware_dequeue():
+- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set
+- Call sglist_do_debounce() with copy=false if bounce buffer exists
+
+This ensures that when requests are returned due to endpoint shutdown,
+they don't retain stale DMA mappings. The 'false' parameter to
+sglist_do_debounce() prevents copying data back (appropriate for
+shutdown path where transfer was aborted).
+
+Signed-off-by: Mario Peter <mario.peter@leica-geosystems.com>
+Reviewed-by: Xu Yang <xu.yang_2@nxp.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/udc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 64a421ae0f05b..c8d931d9d4330 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -931,6 +931,13 @@ __acquires(hwep->lock)
+ list_del_init(&hwreq->queue);
+ hwreq->req.status = -ESHUTDOWN;
+
++ /* Unmap DMA and clean up bounce buffers before giving back */
++ usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent,
++ &hwreq->req, hwep->dir);
++
++ if (hwreq->sgt.sgl)
++ sglist_do_debounce(hwreq, false);
++
+ if (hwreq->req.complete != NULL) {
+ spin_unlock(hwep->lock);
+ usb_gadget_giveback_request(&hwep->ep, &hwreq->req);
+--
+2.51.0
+
--- /dev/null
+From 173bc96e93b7584cfc5092e9d6a08d0c0c330be8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 08:30:21 +1000
+Subject: usb: gadget: f_fs: fix DMA-BUF OUT queues
+
+From: Sam Day <me@samcday.com>
+
+[ Upstream commit 0145e7acd29855dfba4a2f387d455b5d9a520f0e ]
+
+Currently, DMA_FROM_DEVICE is used when attaching DMABUFs to IN
+endpoints and DMA_TO_DEVICE for OUT endpoints. This is inverted from
+how it should be.
+
+The result is IOMMU read-only mappings placed on OUT queues,
+triggering arm-smmu write faults.
+
+Put differently, OUT endpoints flow data from host -> gadget, meaning
+the UDC peripheral needs to have write access to the buffer to fill it
+with the incoming data.
+
+This commit flips the directions and updates the implicit-sync helpers
+so IN endpoints act as readers and OUT endpoints as writers.
+
+Signed-off-by: Sam Day <me@samcday.com>
+Tested-by: David Heidelberg <david@ixit.cz> # OnePlus 6T on sdm845-next-20251119
+Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-2-e51633891a81@samcday.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 47cfbe41fdff8..2061c38d772ca 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1489,7 +1489,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd)
+ goto err_dmabuf_detach;
+ }
+
+- dir = epfile->in ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
++ dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
+
+ err = ffs_dma_resv_lock(dmabuf, nonblock);
+ if (err)
+@@ -1619,7 +1619,7 @@ static int ffs_dmabuf_transfer(struct file *file,
+ /* Make sure we don't have writers */
+ timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS);
+ retl = dma_resv_wait_timeout(dmabuf->resv,
+- dma_resv_usage_rw(epfile->in),
++ dma_resv_usage_rw(!epfile->in),
+ true, timeout);
+ if (retl == 0)
+ retl = -EBUSY;
+@@ -1664,7 +1664,7 @@ static int ffs_dmabuf_transfer(struct file *file,
+ dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops,
+ &priv->lock, priv->context, seqno);
+
+- resv_dir = epfile->in ? DMA_RESV_USAGE_WRITE : DMA_RESV_USAGE_READ;
++ resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE;
+
+ dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir);
+ dma_resv_unlock(dmabuf->resv);
+--
+2.51.0
+
--- /dev/null
+From b5098f8b6defb075558c38093dd7246d858531c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 08:30:20 +1000
+Subject: usb: gadget: f_fs: Fix ioctl error handling
+
+From: Sam Day <me@samcday.com>
+
+[ Upstream commit 8e4c1d06183c25022f6b0002a5cab84979ca6337 ]
+
+When ffs_epfile_ioctl handles FUNCTIONFS_DMABUF_* ioctls, it's currently
+falling through when copy_from_user fails.
+
+However, this fallthrough isn't being checked properly, so the handler
+continues executing further than it should. It then tries the secondary
+dispatch where it ultimately gives up and returns -ENOTTY.
+
+The end result is invalid ioctl invocations will yield a -ENOTTY rather
+than an -EFAULT.
+
+It's a common pattern elsewhere in the kernel code to directly return
+-EFAULT when copy_from_user fails. So we update ffs_epfile_ioctl to do
+the same and fix this issue.
+
+Signed-off-by: Sam Day <me@samcday.com>
+Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-1-e51633891a81@samcday.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 2061c38d772ca..497d20260b040 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1724,10 +1724,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ {
+ int fd;
+
+- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
+- ret = -EFAULT;
+- break;
+- }
++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
++ return -EFAULT;
+
+ return ffs_dmabuf_attach(file, fd);
+ }
+@@ -1735,10 +1733,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ {
+ int fd;
+
+- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
+- ret = -EFAULT;
+- break;
+- }
++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
++ return -EFAULT;
+
+ return ffs_dmabuf_detach(file, fd);
+ }
+@@ -1746,10 +1742,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ {
+ struct usb_ffs_dmabuf_transfer_req req;
+
+- if (copy_from_user(&req, (void __user *)value, sizeof(req))) {
+- ret = -EFAULT;
+- break;
+- }
++ if (copy_from_user(&req, (void __user *)value, sizeof(req)))
++ return -EFAULT;
+
+ return ffs_dmabuf_transfer(file, &req);
+ }
+--
+2.51.0
+
--- /dev/null
+From a8648ccfd58734f8efcbadf794b3abf1aea82981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:48:48 +0000
+Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
+
+From: Benson Leung <bleung@chromium.org>
+
+[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ]
+
+ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated
+using whichever pdo is in the last position of the src_pdos array, presuming
+it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current
+helpers are used on that last pdo.
+
+However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and
+for PPS) may exist, and are always at the end of the array if they do.
+In the event one of these more advanced chargers are attached the helpers for
+fixed return mangled values.
+
+Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger
+with PPS support:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=13400000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=5790000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS
+APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect.
+
+Instead, enumerate through the src_pdos and filter just for Fixed PDOs for
+now, and find the one with the highest voltage and current respectively.
+
+After, from the same charger:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=20000000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=4000000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Signed-off-by: Benson Leung <bleung@chromium.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c
+index 8ae900c8c1321..525c6fc2217da 100644
+--- a/drivers/usb/typec/ucsi/psy.c
++++ b/drivers/usb/typec/ucsi/psy.c
+@@ -88,15 +88,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_voltage = 0;
+
+ switch (UCSI_CONSTAT(con, PWR_OPMODE)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_fixed_voltage(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_voltage = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000;
++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage
++ : max_voltage;
+ }
++ val->intval = max_voltage;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0:
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+@@ -144,6 +149,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_current = 0;
+
+ if (!UCSI_CONSTAT(con, CONNECTED)) {
+ val->intval = 0;
+@@ -152,12 +158,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+
+ switch (UCSI_CONSTAT(con, PWR_OPMODE)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_max_current(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_current = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_current = pdo_max_current(pdo) * 1000;
++ max_current = (pdo_current > max_current) ? pdo_current
++ : max_current;
+ }
++ val->intval = max_current;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+ val->intval = UCSI_TYPEC_1_5_CURRENT * 1000;
+--
+2.51.0
+
--- /dev/null
+From 23142a88185ce3efc98fb57fd3706633368495ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 12:27:03 +0530
+Subject: vhost: fix caching attributes of MMIO regions by setting them
+ explicitly
+
+From: Kommula Shiva Shankar <kshankar@marvell.com>
+
+[ Upstream commit 5145b277309f3818e2db507f525d19ac3b910922 ]
+
+Explicitly set non-cached caching attributes for MMIO regions.
+Default write-back mode can cause CPU to cache device memory,
+causing invalid reads and unpredictable behavior.
+
+Invalid read and write issues were observed on ARM64 when mapping the
+notification area to userspace via mmap.
+
+Signed-off-by: Kommula Shiva Shankar <kshankar@marvell.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Message-Id: <20260102065703.656255-1-kshankar@marvell.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index 05a481e4c385a..b0179e8567aba 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -1527,6 +1527,7 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma)
+ if (vma->vm_end - vma->vm_start != notify.size)
+ return -ENOTSUPP;
+
++ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);
+ vma->vm_ops = &vhost_vdpa_vm_ops;
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 49a22ed5fbede28c572f2ec493b2cca199c76c83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:45 +0100
+Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ]
+
+The unpacked unions within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)'
+ and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 239 | } u;
+ | ^
+
+./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+
+With the recent changes to compile-test the UAPI headers in more cases,
+these warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warnings.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/vbox_vmmdev_types.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
+index 6073858d52a2e..11f3627c3729b 100644
+--- a/include/uapi/linux/vbox_vmmdev_types.h
++++ b/include/uapi/linux/vbox_vmmdev_types.h
+@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 {
+ /** Relative to the request header. */
+ __u32 offset;
+ } page_list;
+- } u;
++ } __packed u;
+ } __packed;
+ VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
+
+@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 {
+ union {
+ __u64 phys_addr;
+ __u64 linear_addr;
+- } u;
++ } __packed u;
+ } __packed pointer;
+ struct {
+ /** Size of the buffer described by the page list. */
+--
+2.51.0
+
--- /dev/null
+From 7d4903d2ad35c9074ac1212a8fa19795394784c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:34:00 +0100
+Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ]
+
+The gcc-16.0.1 snapshot produces a false-positive warning that turns
+into a build failure with CONFIG_WERROR:
+
+In file included from arch/x86/include/asm/string.h:6,
+ from net/vmw_vsock/vmci_transport.c:10:
+In function 'vmci_transport_packet_init',
+ inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2:
+arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull]
+ 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy'
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+
+This seems relatively harmless, and it so far the only instance of this
+warning I have found. The __vmci_transport_send_control_pkt function
+is called either with wait=NULL or with one of the type values that
+pass 'wait' into memcpy() here, but not from the same caller.
+
+Replacing the memcpy with a struct assignment is otherwise the same
+but avoids the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Bryan Tan <bryan-bt.tan@broadcom.com>
+Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 7eccd6708d664..aca3132689cf1 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt,
+
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
+- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
++ pkt->u.wait = *wait;
+ break;
+
+ case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
+--
+2.51.0
+
--- /dev/null
+From 016e34669b8cbd2133bfa578b087c587204587fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 22:24:33 +0200
+Subject: watchdog: imx7ulp_wdt: handle the nowayout option
+
+From: Oleksandr Suvorov <cryosay@gmail.com>
+
+[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ]
+
+The module parameter `nowayout` indicates whether the watchdog should ever
+be allowed to stop, but the driver currently ignores this option.
+
+Pass the `nowayout` parameter to the watchdog core by setting the
+WDOG_NO_WAY_OUT flag accordingly.
+
+Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/imx7ulp_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c
+index 0f13a30533574..03479110453ce 100644
+--- a/drivers/watchdog/imx7ulp_wdt.c
++++ b/drivers/watchdog/imx7ulp_wdt.c
+@@ -346,6 +346,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev)
+ watchdog_stop_on_reboot(wdog);
+ watchdog_stop_on_unregister(wdog);
+ watchdog_set_drvdata(wdog, imx7ulp_wdt);
++ watchdog_set_nowayout(wdog, nowayout);
+
+ imx7ulp_wdt->hw = of_device_get_match_data(dev);
+ ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate);
+--
+2.51.0
+
--- /dev/null
+From 6eae9203c5e9f52897ecb4ed9a54297808296026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Dec 2025 21:09:22 +0100
+Subject: watchdog: rzv2h_wdt: Discard pm_runtime_put() return value
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 2dea984a74265a67e3210f818416a83b87f70200 ]
+
+Failing device probe due to pm_runtime_put() returning an error is not
+particularly useful.
+
+Returning an error code from pm_runtime_put() merely means that it has
+not queued up a work item to check whether or not the device can be
+suspended and there are many perfectly valid situations in which that
+can happen, like after writing "on" to the devices' runtime PM "control"
+attribute in sysfs for one example. It also happens when the kernel is
+configured with CONFIG_PM unset.
+
+Accordingly, update rzt2h_wdt_wdtdcr_init() to simply discard the return
+value of pm_runtime_put() and return success to the caller after
+invoking that function.
+
+This will facilitate a planned change of the pm_runtime_put() return
+type to void in the future.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/rzv2h_wdt.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/watchdog/rzv2h_wdt.c b/drivers/watchdog/rzv2h_wdt.c
+index a694786837e11..f9bb4ef3d327b 100644
+--- a/drivers/watchdog/rzv2h_wdt.c
++++ b/drivers/watchdog/rzv2h_wdt.c
+@@ -270,9 +270,7 @@ static int rzt2h_wdt_wdtdcr_init(struct platform_device *pdev,
+
+ rzt2h_wdt_wdtdcr_count_stop(priv);
+
+- ret = pm_runtime_put(&pdev->dev);
+- if (ret < 0)
+- return ret;
++ pm_runtime_put(&pdev->dev);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 210d78cfa5be22f410deddabfab81866df8b609a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:56:11 +0000
+Subject: wifi: ath10k: fix lock protection in
+ ath10k_wmi_event_peer_sta_ps_state_chg()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ]
+
+ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to
+assert that ar->data_lock should be held by the caller, but neither
+ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock
+before calling this function.
+
+The field arsta->peer_ps_state is documented as protected by
+ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable,
+ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock.
+
+Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update,
+and remove the lockdep_assert_held() to be aligned with new locking,
+following the pattern used by other WMI event handlers in the driver.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu
+[removed excess blank line]
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index b4aad6604d6d9..ce22141e5efd9 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5289,8 +5289,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ struct ath10k_sta *arsta;
+ u8 peer_addr[ETH_ALEN];
+
+- lockdep_assert_held(&ar->data_lock);
+-
+ ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data;
+ ether_addr_copy(peer_addr, ev->peer_macaddr.addr);
+
+@@ -5305,7 +5303,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ }
+
+ arsta = (struct ath10k_sta *)sta->drv_priv;
++ spin_lock_bh(&ar->data_lock);
+ arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state);
++ spin_unlock_bh(&ar->data_lock);
+
+ exit:
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From 2dc006b05b51b9e3b4a6ad5db71179e7a2998793 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 17:00:34 -0800
+Subject: wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
+
+From: Ross Vandegrift <ross@kallisti.us>
+
+[ Upstream commit 4015b1972763d7d513172276e51439f37e622a92 ]
+
+Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added
+to the appropriate quirk list. I've tested this patch on top of 6.18.2,
+it fixes the issue for me on 21D4
+
+Mark Pearson provided the other product IDs covering the second Z16 Gen1
+and both Z13 Gen1 identifiers. They share the same firmware, and folks
+in the bugzilla report do indeed see the problem on Z13.
+
+[1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196
+
+Signed-off-by: Ross Vandegrift <ross@kallisti.us>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Tested-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
+index 06b4df2370e95..78a1b0edd8b45 100644
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -994,6 +994,34 @@ static const struct dmi_system_id ath11k_pm_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "21F9"),
+ },
+ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z13 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D2"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z13 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D3"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z16 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D4"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z16 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D5"),
++ },
++ },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From fe21f332e5e55c161d195d6caf5e1c39cb5f9759 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 11:46:07 +0800
+Subject: wifi: ath11k: Fix failure to connect to a 6 GHz AP
+
+From: Qian Zhang <qian.zhang@oss.qualcomm.com>
+
+[ Upstream commit 0bc8c48de6f06c0cac52dde024ffda4433de6234 ]
+
+STA fails to connect to a 6 GHz AP with the following errors:
+ ath11k_pci 0000:01:00.0: failed to handle chan list with power type 1
+ wlp1s0: deauthenticating from c8:a3:e8:dd:41:e3 by local choice (Reason: 3=DEAUTH_LEAVING)
+
+ath11k_reg_handle_chan_list() treats the update as redundant and
+returns -EINVAL. That causes the connection attempt to fail.
+
+Avoid unnecessary validation during association. Apply the regulatory
+redundant check only when the power type is IEEE80211_REG_UNSET_AP,
+which only occurs during core initialization.
+
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
+
+Signed-off-by: Qian Zhang <qian.zhang@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260108034607.812885-1-qian.zhang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
+index d62a2014315a0..49b79648752cf 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+ * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+ #include <linux/rtnetlink.h>
+
+@@ -926,8 +926,11 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
+ */
+ if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] &&
+ !memcmp((char *)ab->default_regd[pdev_idx]->alpha2,
+- (char *)reg_info->alpha2, 2))
+- goto retfail;
++ (char *)reg_info->alpha2, 2) &&
++ power_type == IEEE80211_REG_UNSET_AP) {
++ ath11k_reg_reset_info(reg_info);
++ return 0;
++ }
+
+ /* Intersect new rules with default regd if a new country setting was
+ * requested, i.e a default regd was already set during initialization
+--
+2.51.0
+
--- /dev/null
+From 618439d9cb7ae8c8c67c75010a5bfbcd1ef30400 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 15:36:26 +0800
+Subject: wifi: ath12k: fix mac phy capability parsing
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit b5151c9b6e3a347416a4b4b55fc00195526d8771 ]
+
+Currently ath12k_pull_mac_phy_cap_svc_ready_ext() assumes only one band
+supported in each phy, hence it skips 5 GHz band if 2 GHz band support
+is detected. This does not work for device which gets only one phy but
+has both bands supported, such as QCC2072.
+
+Change to check each band individually to fix this issue.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
+
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-6-fc8ce1e43969@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/wmi.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
+index 6dd95bcaf2436..f3474a13e32aa 100644
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
++++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -493,6 +493,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ struct ath12k_band_cap *cap_band;
+ struct ath12k_pdev_cap *pdev_cap = &pdev->cap;
+ struct ath12k_fw_pdev *fw_pdev;
++ u32 supported_bands;
+ u32 phy_map;
+ u32 hw_idx, phy_idx = 0;
+ int i;
+@@ -516,14 +517,19 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ return -EINVAL;
+
+ mac_caps = wmi_mac_phy_caps + phy_idx;
++ supported_bands = le32_to_cpu(mac_caps->supported_bands);
++
++ if (!(supported_bands & WMI_HOST_WLAN_2GHZ_CAP) &&
++ !(supported_bands & WMI_HOST_WLAN_5GHZ_CAP))
++ return -EINVAL;
+
+ pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps);
+ pdev->hw_link_id = ath12k_wmi_mac_phy_get_hw_link_id(mac_caps);
+- pdev_cap->supported_bands |= le32_to_cpu(mac_caps->supported_bands);
++ pdev_cap->supported_bands |= supported_bands;
+ pdev_cap->ampdu_density = le32_to_cpu(mac_caps->ampdu_density);
+
+ fw_pdev = &ab->fw_pdev[ab->fw_pdev_count];
+- fw_pdev->supported_bands = le32_to_cpu(mac_caps->supported_bands);
++ fw_pdev->supported_bands = supported_bands;
+ fw_pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps);
+ fw_pdev->phy_id = le32_to_cpu(mac_caps->phy_id);
+ ab->fw_pdev_count++;
+@@ -532,10 +538,12 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ * band to band for a single radio, need to see how this should be
+ * handled.
+ */
+- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) {
++ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) {
+ pdev_cap->tx_chain_mask = le32_to_cpu(mac_caps->tx_chain_mask_2g);
+ pdev_cap->rx_chain_mask = le32_to_cpu(mac_caps->rx_chain_mask_2g);
+- } else if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) {
++ }
++
++ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) {
+ pdev_cap->vht_cap = le32_to_cpu(mac_caps->vht_cap_info_5g);
+ pdev_cap->vht_mcs = le32_to_cpu(mac_caps->vht_supp_mcs_5g);
+ pdev_cap->he_mcs = le32_to_cpu(mac_caps->he_supp_mcs_5g);
+@@ -545,8 +553,6 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ WMI_NSS_RATIO_EN_DIS_GET(mac_caps->nss_ratio);
+ pdev_cap->nss_ratio_info =
+ WMI_NSS_RATIO_INFO_GET(mac_caps->nss_ratio);
+- } else {
+- return -EINVAL;
+ }
+
+ /* tx/rx chainmask reported from fw depends on the actual hw chains used,
+@@ -562,7 +568,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ pdev_cap->rx_chain_mask_shift =
+ find_first_bit((unsigned long *)&pdev_cap->rx_chain_mask, 32);
+
+- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) {
++ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) {
+ cap_band = &pdev_cap->band[NL80211_BAND_2GHZ];
+ cap_band->phy_id = le32_to_cpu(mac_caps->phy_id);
+ cap_band->max_bw_supported = le32_to_cpu(mac_caps->max_bw_supported_2g);
+@@ -582,7 +588,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ le32_to_cpu(mac_caps->he_ppet2g.ppet16_ppet8_ru3_ru0[i]);
+ }
+
+- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) {
++ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) {
+ cap_band = &pdev_cap->band[NL80211_BAND_5GHZ];
+ cap_band->phy_id = le32_to_cpu(mac_caps->phy_id);
+ cap_band->max_bw_supported =
+--
+2.51.0
+
--- /dev/null
+From 835019963c09542903d9a941525e182eff4720a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 15:36:24 +0800
+Subject: wifi: ath12k: fix preferred hardware mode calculation
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 7f852de0003219c431a6f2ffd951fd82a4673660 ]
+
+For single pdev device like WCN7850/QCC2072, preferred_hw_mode is
+initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends
+supported modes to host, each mode is compared with the initial one
+and if the priority of the new mode is higher, update the parameter
+and store mode capability.
+
+For WCN7850, this does not result in issue, as one of the supported
+mode indeed has a higher priority. However the only available mode of
+QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the
+comparison, hence mode capability is not stored. Subsequently driver
+initialization fails.
+
+Fix it by accepting a mode with the same priority.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
+
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
+index 44e99b47e445d..6dd95bcaf2436 100644
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
++++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -4490,7 +4490,7 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc,
+
+ pref = soc->wmi_ab.preferred_hw_mode;
+
+- if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) {
++ if (ath12k_hw_mode_pri_map[mode] <= ath12k_hw_mode_pri_map[pref]) {
+ svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps;
+ soc->wmi_ab.preferred_hw_mode = mode;
+ }
+--
+2.51.0
+
--- /dev/null
+From f92b669c4d60cf2fe8e2620e29bb0e610c740466 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 13:51:57 +0200
+Subject: wifi: cfg80211: allow only one NAN interface, also in multi radio
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit e69fda4d07701373354e52b0321bd40311d743d0 ]
+
+According to Wi-Fi Aware (TM) 4.0 specification 2.8, A NAN device can
+have one NAN management interface. This applies also to multi radio
+devices.
+The current code allows a driver to support more than one NAN interface,
+if those are not in the same radio.
+
+Fix it.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20260107135129.fdaecec0fe8a.I246b5ba6e9da3ec1481ff197e47f6ce0793d7118@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/core.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index 87f083d9247a4..2ce6e39926d05 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -658,12 +658,8 @@ int wiphy_verify_iface_combinations(struct wiphy *wiphy,
+ c->limits[j].max > 1))
+ return -EINVAL;
+
+- /* Only a single NAN can be allowed, avoid this
+- * check for multi-radio global combination, since it
+- * hold the capabilities of all radio combinations.
+- */
+- if (!combined_radio &&
+- WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
++ /* Only a single NAN can be allowed */
++ if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
+ c->limits[j].max > 1))
+ return -EINVAL;
+
+--
+2.51.0
+
--- /dev/null
+From a827544c0734e8bf875f6435c6d808ce9a415f1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:30:05 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il3945_store_measurement()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ]
+
+il3945_store_measurement() calls il3945_get_measurement() which internally
+calls il_send_cmd_sync() without holding il->mutex. However,
+il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that
+callers must hold this lock.
+
+Other sysfs store functions in the same file properly acquire the mutex:
+- il3945_store_flags() acquires mutex at 3945-mac.c:3110
+- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144
+
+Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call
+in the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 104748fcdc33e..54991f31c52c5 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3224,7 +3224,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
+
+ D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n",
+ type, params.channel, buf);
++ mutex_lock(&il->mutex);
+ il3945_get_measurement(il, ¶ms, type);
++ mutex_unlock(&il->mutex);
+
+ return count;
+ }
+--
+2.51.0
+
--- /dev/null
+From 73f56d8f18142ec5477cccc62c80007003c3e6d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:40:39 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il4965_store_tx_power()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ]
+
+il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex.
+However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating
+that callers must hold this lock.
+
+All other callers of il_set_tx_power() properly acquire the mutex:
+- il_bg_scan_completed() acquires mutex at common.c:1683
+- il_mac_config() acquires mutex at common.c:5006
+- il3945_commit_rxon() and il4965_commit_rxon() are called via work
+ queues that hold the mutex (like il4965_bg_alive_start)
+
+Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in
+the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 3588dec75ebdd..57fa866efd9f8 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4606,7 +4606,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr,
+ if (ret)
+ IL_INFO("%s is not in decimal form.\n", buf);
+ else {
++ mutex_lock(&il->mutex);
+ ret = il_set_tx_power(il, val, false);
++ mutex_unlock(&il->mutex);
+ if (ret)
+ IL_ERR("failed setting tx power (0x%08x).\n", ret);
+ else
+--
+2.51.0
+
--- /dev/null
+From a63a4ba0c8c7924d21aeb243487d1e5b13d062ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:02:19 +0200
+Subject: wifi: iwlwifi: fix 22000 series SMEM parsing
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 58192b9ce09b0f0f86e2036683bd542130b91a98 ]
+
+If the firmware were to report three LMACs (which doesn't
+exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is
+an overrun of the array. Reject such and use IWL_FW_CHECK
+instead of WARN_ON in this function.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20251110150012.16e8c2d70c26.Iadfcc1aedf43c5175b3f0757bea5aa232454f1ac@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/smem.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+index 90fd69b4860c1..344ddde85b189 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+@@ -6,6 +6,7 @@
+ */
+ #include "iwl-drv.h"
+ #include "runtime.h"
++#include "dbg.h"
+ #include "fw/api/commands.h"
+
+ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
+@@ -17,7 +18,9 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
+ u8 api_ver = iwl_fw_lookup_notif_ver(fwrt->fw, SYSTEM_GROUP,
+ SHARED_MEM_CFG_CMD, 0);
+
+- if (WARN_ON(lmac_num > ARRAY_SIZE(mem_cfg->lmac_smem)))
++ /* Note: notification has 3 entries, but we only expect 2 */
++ if (IWL_FW_CHECK(fwrt, lmac_num > ARRAY_SIZE(fwrt->smem_cfg.lmac),
++ "FW advertises %d LMACs\n", lmac_num))
+ return;
+
+ fwrt->smem_cfg.num_lmacs = lmac_num;
+@@ -26,7 +29,8 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
+ fwrt->smem_cfg.rxfifo2_size = le32_to_cpu(mem_cfg->rxfifo2_size);
+
+ if (api_ver >= 4 &&
+- !WARN_ON_ONCE(iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg))) {
++ !IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg),
++ "bad shared mem notification size\n")) {
+ fwrt->smem_cfg.rxfifo2_control_size =
+ le32_to_cpu(mem_cfg->rxfifo2_control_size);
+ }
+--
+2.51.0
+
--- /dev/null
+From e4e6b0e216f0eea3ed915c339ec47f0bb3482c18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jan 2026 19:39:12 +0200
+Subject: wifi: iwlwifi: mld: fix chandef start calculation
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit d2fcdf36554316cc51f7928b777944738d06e332 ]
+
+A link pair in which both links are in 5 GHz can be used for EMLSR only
+if they are separated enough.
+
+To check this condition we calculate the start and the end of the
+chandefs of both links in the pair and do some checks.
+
+But the calculation of the start/end of the chandef is currently done
+by subtracting/adding half the bandwidth from/to the control channel's
+center frequency, when it should really be subtracted/added from/to the
+center frequency of the entire chandef.
+
+Fix the wrong calculation.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20260111193638.2138fdb99bd5.I4d2e5957b22482a57b1d6ca444e90fcf73bf2cab@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
+index 241a6271d13d6..bf70e71aa5143 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
+@@ -851,9 +851,9 @@ iwl_mld_emlsr_pair_state(struct ieee80211_vif *vif,
+ if (c_low->chan->center_freq > c_high->chan->center_freq)
+ swap(c_low, c_high);
+
+- c_low_upper_edge = c_low->chan->center_freq +
++ c_low_upper_edge = c_low->center_freq1 +
+ cfg80211_chandef_get_width(c_low) / 2;
+- c_high_lower_edge = c_high->chan->center_freq -
++ c_high_lower_edge = c_high->center_freq1 -
+ cfg80211_chandef_get_width(c_high) / 2;
+
+ if (a->chandef->chan->band == NL80211_BAND_5GHZ &&
+--
+2.51.0
+
--- /dev/null
+From dc188d679586314968b5842ab156eaad85b29770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jan 2026 19:39:14 +0200
+Subject: wifi: iwlwifi: mld: Fix primary link selection logic
+
+From: Nidhish A N <nidhish.a.n@intel.com>
+
+[ Upstream commit 7a749db26cab2334d5b356ac31e6f1147c7682da ]
+
+When assigning emlsr.primary with emlsr.selected_primary
+we are checking if BIT(mld_vif->emlsr.selected_links) are
+a part of vif->active_links. This is incorrect as
+emlsr.selected_links is a bitmap of possibly two selected links.
+Therefore, performing the BIT() operation on it does not
+yield any meaningful result and almost always leads to
+incorrect primary link selection.
+
+Additionally, we cannot rely on vif->active_links at this
+stage of the link switch flow because it contains both the
+removed links and also the newly added links.
+For example, if we had selected links in the past (0x11)
+and we now select links because of TTLM/debugfs (0x100),
+vif->active_links will now be (0x111) and primary link
+will be 0, while 0 is not even an active link. Thus,
+we create our own bitmap of final active links.
+
+Signed-off-by: Nidhish A N <nidhish.a.n@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20260111193638.38b2e14e3a20.Ie81a88dfff0c5d2becedabab8398702808f6b1bf@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/mld/mac80211.c | 23 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+index 2a7e7417d7d84..0f2db3ed58530 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+@@ -980,7 +980,9 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
+ {
+ struct iwl_mld *mld = IWL_MAC80211_GET_MLD(hw);
+ struct iwl_mld_link *mld_link = iwl_mld_link_from_mac80211(link);
+- unsigned int n_active = iwl_mld_count_active_links(mld, vif);
++ struct iwl_mld_link *temp_mld_link;
++ struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif);
++ u16 final_active_links = 0;
+ int ret;
+
+ lockdep_assert_wiphy(mld->wiphy);
+@@ -988,10 +990,7 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
+ if (WARN_ON(!mld_link))
+ return -EINVAL;
+
+- /* if the assigned one was not counted yet, count it now */
+ if (!rcu_access_pointer(mld_link->chan_ctx)) {
+- n_active++;
+-
+ /* Track addition of non-BSS link */
+ if (ieee80211_vif_type_p2p(vif) != NL80211_IFTYPE_STATION) {
+ ret = iwl_mld_emlsr_check_non_bss_block(mld, 1);
+@@ -1012,17 +1011,25 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
+
+ rcu_assign_pointer(mld_link->chan_ctx, ctx);
+
+- if (n_active > 1) {
+- struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif);
++ /* We cannot rely on vif->active_links at this stage as it contains
++ * both the removed links and the newly added links.
++ * Therefore, we create our own bitmap of the final active links,
++ * which does not include the removed links.
++ */
++ for_each_mld_vif_valid_link(mld_vif, temp_mld_link) {
++ if (rcu_access_pointer(temp_mld_link->chan_ctx))
++ final_active_links |= BIT(link_id);
++ }
+
++ if (hweight16(final_active_links) > 1) {
+ /* Indicate to mac80211 that EML is enabled */
+ vif->driver_flags |= IEEE80211_VIF_EML_ACTIVE;
+ mld_vif->emlsr.last_entry_ts = jiffies;
+
+- if (vif->active_links & BIT(mld_vif->emlsr.selected_links))
++ if (final_active_links == mld_vif->emlsr.selected_links)
+ mld_vif->emlsr.primary = mld_vif->emlsr.selected_primary;
+ else
+- mld_vif->emlsr.primary = __ffs(vif->active_links);
++ mld_vif->emlsr.primary = __ffs(final_active_links);
+
+ iwl_dbg_tlv_time_point(&mld->fwrt, IWL_FW_INI_TIME_ESR_LINK_UP,
+ NULL);
+--
+2.51.0
+
--- /dev/null
+From 0ad128a69fff1073f7c257009c72da6af2e067cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 18:08:46 +0200
+Subject: wifi: iwlwifi: mld: Handle rate selection for NAN interface
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit dbbeebece03050cd510073ce89fee83844e06b00 ]
+
+Frames transmitted over a NAN interface might not have channel
+information assigned to them. In such cases assign the lowest
+OFDM to the frame.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20251110180612.72046f98f878.Ib784931fffd0747acd9d7bb22eabbbec5282733e@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/tx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
+index 3b4b575aadaa5..e3fb4fc4f452e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
+@@ -345,6 +345,11 @@ u8 iwl_mld_get_lowest_rate(struct iwl_mld *mld,
+
+ iwl_mld_get_basic_rates_and_band(mld, vif, info, &basic_rates, &band);
+
++ if (band >= NUM_NL80211_BANDS) {
++ WARN_ON(vif->type != NL80211_IFTYPE_NAN);
++ return IWL_FIRST_OFDM_RATE;
++ }
++
+ sband = mld->hw->wiphy->bands[band];
+ for_each_set_bit(i, &basic_rates, BITS_PER_LONG) {
+ u16 hw = sband->bitrates[i].hw_value;
+--
+2.51.0
+
--- /dev/null
+From cff641481963b268273164aef6214f66c52e41ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:02:15 +0200
+Subject: wifi: iwlwifi: mvm: check the validity of noa_len
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d ]
+
+Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using
+its value to determine the noa_len, which is later used for the NoA
+attribute.
+
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index 867807abde664..49ffc4ecee855 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -1761,6 +1761,20 @@ void iwl_mvm_probe_resp_data_notif(struct iwl_mvm *mvm,
+
+ mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
++ /*
++ * len_low should be 2 + n*13 (where n is the number of descriptors.
++ * 13 is the size of a NoA descriptor). We can have either one or two
++ * descriptors.
++ */
++ if (IWL_FW_CHECK(mvm, notif->noa_active &&
++ notif->noa_attr.len_low != 2 +
++ sizeof(struct ieee80211_p2p_noa_desc) &&
++ notif->noa_attr.len_low != 2 +
++ sizeof(struct ieee80211_p2p_noa_desc) * 2,
++ "Invalid noa_attr.len_low (%d)\n",
++ notif->noa_attr.len_low))
++ return;
++
+ new_data = kzalloc(sizeof(*new_data), GFP_KERNEL);
+ if (!new_data)
+ return;
+--
+2.51.0
+
--- /dev/null
+From 0c635579596821ea00135e20c1c6659998652552 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:58:06 +0100
+Subject: wifi: libertas: fix WARNING in usb_tx_block
+
+From: Szymon Wilczek <swilczek.lx@gmail.com>
+
+[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ]
+
+The function usb_tx_block() submits cardp->tx_urb without ensuring that
+any previous transmission on this URB has completed. If a second call
+occurs while the URB is still active (e.g. during rapid firmware loading),
+usb_submit_urb() detects the active state and triggers a warning:
+'URB submitted while active'.
+
+Fix this by enforcing serialization: call usb_kill_urb() before
+submitting the new request. This ensures the URB is idle and safe to reuse.
+
+Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
+Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
+Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index b3c4040257a67..924ab93b7b671 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb
+ goto tx_ret;
+ }
+
++ usb_kill_urb(cardp->tx_urb);
++
+ usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
+ usb_sndbulkpipe(cardp->udev,
+ cardp->ep_out),
+--
+2.51.0
+
--- /dev/null
+From 59b60d35bbc20fe7dfd86da2a100c1719dcd5b48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Nov 2025 16:50:31 +0200
+Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ]
+
+rtw8822b_set_antenna() can be called from userspace when the chip is
+powered off. In that case a WARNING is triggered in
+rtw8822b_config_trx_mode() because trying to read the RF registers
+when the chip is powered off returns an unexpected value.
+
+Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when
+the chip is powered on.
+
+------------[ cut here ]------------
+write RF mode table fail
+WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1
+Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021
+RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+Call Trace:
+ <TASK>
+ rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]
+ rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]
+ ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]
+ nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? netdev_run_todo+0x63/0x550
+ genl_family_rcv_msg_doit+0xfc/0x160
+ genl_rcv_msg+0x1aa/0x2b0
+ ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_genl_rcv_msg+0x10/0x10
+ netlink_rcv_skb+0x59/0x110
+ genl_rcv+0x28/0x40
+ netlink_unicast+0x285/0x3c0
+ ? __alloc_skb+0xdb/0x1a0
+ netlink_sendmsg+0x20d/0x430
+ ____sys_sendmsg+0x39f/0x3d0
+ ? import_iovec+0x2f/0x40
+ ___sys_sendmsg+0x99/0xe0
+ ? refill_obj_stock+0x12e/0x240
+ __sys_sendmsg+0x8a/0xf0
+ do_syscall_64+0x81/0x970
+ ? do_syscall_64+0x81/0x970
+ ? ksys_read+0x73/0xf0
+ ? do_syscall_64+0x81/0x970
+ ? count_memcg_events+0xc2/0x190
+ ? handle_mm_fault+0x1d7/0x2d0
+ ? do_user_addr_fault+0x21a/0x690
+ ? exc_page_fault+0x7e/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+---[ end trace 0000000000000000 ]---
+
+Link: https://github.com/lwfinger/rtw88/issues/366
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+index 89b6485b229a8..4d88cc2f41485 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -1005,7 +1005,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev,
+ hal->antenna_tx = antenna_tx;
+ hal->antenna_rx = antenna_rx;
+
+- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags))
++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From c0e40c607c43d76351801264bbea47cbf705a698 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 23:09:37 +0500
+Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
+
+From: Roman Peshkichev <roman.peshkichev@gmail.com>
+
+[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ]
+
+The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter,
+while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf.
+In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0.
+
+The driver unconditionally wrote (dtim_period - 1) to
+REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This
+caused delays in broadcast/multicast traffic processing and issues with
+ad-hoc operation.
+
+Convert the function parameter to u8 to match ieee80211_bss_conf and avoid
+the underflow by writing 0 when dtim_period is 0.
+
+Link: https://github.com/lwfinger/rtw88/issues/406
+Signed-off-by: Roman Peshkichev <roman.peshkichev@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 4 ++--
+ drivers/net/wireless/realtek/rtw88/main.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index d93d21656f26c..f72d12c3b2bc6 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -730,10 +730,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel)
+ }
+ EXPORT_SYMBOL(rtw_set_rx_freq_band);
+
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period)
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period)
+ {
+ rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE);
+- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1);
++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0);
+ }
+
+ void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel,
+diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h
+index 43ed6d6b42919..1ab70214ce36e 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -2226,7 +2226,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band)
+ }
+
+ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel);
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period);
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period);
+ void rtw_get_channel_params(struct cfg80211_chan_def *chandef,
+ struct rtw_channel_params *ch_param);
+ bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target);
+--
+2.51.0
+
--- /dev/null
+From d4c3d846fc16af4e4967c430876af74915f48864 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 01:26:45 +0200
+Subject: wifi: rtw88: Fix inadvertent sharing of struct
+ ieee80211_supported_band data
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit fcac0f23d4d20b11014a39f8e2527cdc12ec9c82 ]
+
+Internally wiphy writes to individual channels in this structure,
+so we must not share one static definition of channel list between
+multiple device instances, because that causes hard to debug
+breakage.
+
+For example, with two rtw88 driven devices in the system, channel
+information may get incoherent, preventing channel use.
+
+Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing
+of struct ieee80211_supported_band data").
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 34 +++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 6f35357e73246..dde2ea6a00e06 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1658,16 +1658,41 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev)
+ return len;
+ }
+
++static struct ieee80211_supported_band *
++rtw_sband_dup(struct rtw_dev *rtwdev,
++ const struct ieee80211_supported_band *sband)
++{
++ struct ieee80211_supported_band *dup;
++
++ dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL);
++ if (!dup)
++ return NULL;
++
++ dup->channels = devm_kmemdup_array(rtwdev->dev, sband->channels,
++ sband->n_channels,
++ sizeof(*sband->channels),
++ GFP_KERNEL);
++ if (!dup->channels)
++ return NULL;
++
++ dup->bitrates = devm_kmemdup_array(rtwdev->dev, sband->bitrates,
++ sband->n_bitrates,
++ sizeof(*sband->bitrates),
++ GFP_KERNEL);
++ if (!dup->bitrates)
++ return NULL;
++
++ return dup;
++}
++
+ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ const struct rtw_chip_info *chip)
+ {
+ struct ieee80211_supported_band *sband;
+ struct rtw_dev *rtwdev = hw->priv;
+- struct device *dev = rtwdev->dev;
+
+ if (chip->band & RTW_BAND_2G) {
+- sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband),
+- GFP_KERNEL);
++ sband = rtw_sband_dup(rtwdev, &rtw_band_2ghz);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+@@ -1676,8 +1701,7 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ }
+
+ if (chip->band & RTW_BAND_5G) {
+- sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband),
+- GFP_KERNEL);
++ sband = rtw_sband_dup(rtwdev, &rtw_band_5ghz);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+--
+2.51.0
+
--- /dev/null
+From 4fbcc45758270449d98d3ca7c426160fd5d05d4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:32:04 +0800
+Subject: wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
+
+From: Hsiu-Ming Chang <cges30901@gmail.com>
+
+[ Upstream commit 77653c327e11c71c5363b18a53fbf2b92ed21da4 ]
+
+Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB
+Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105.
+
+Signed-off-by: Hsiu-Ming Chang <cges30901@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+index 7a0fffc359e25..8cd09d66655db 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+@@ -37,6 +37,8 @@ static const struct usb_device_id rtw_8821cu_id_table[] = {
+ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0105, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Mercusys */
+ {},
+ };
+ MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table);
+--
+2.51.0
+
--- /dev/null
+From eea78be92295d927021bda7de831f9e2415559b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 01:25:32 +0200
+Subject: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d ]
+
+Simplify the code by using device managed memory allocations.
+
+This also fixes a memory leak in rtw_register_hw(). The supported bands
+were not freed in the error path.
+
+Copied from commit 145df52a8671 ("wifi: rtw89: Convert
+rtw89_core_set_supported_band to use devm_*").
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index f72d12c3b2bc6..6f35357e73246 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1661,11 +1661,13 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev)
+ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ const struct rtw_chip_info *chip)
+ {
+- struct rtw_dev *rtwdev = hw->priv;
+ struct ieee80211_supported_band *sband;
++ struct rtw_dev *rtwdev = hw->priv;
++ struct device *dev = rtwdev->dev;
+
+ if (chip->band & RTW_BAND_2G) {
+- sband = kmemdup(&rtw_band_2ghz, sizeof(*sband), GFP_KERNEL);
++ sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband),
++ GFP_KERNEL);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+@@ -1674,7 +1676,8 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ }
+
+ if (chip->band & RTW_BAND_5G) {
+- sband = kmemdup(&rtw_band_5ghz, sizeof(*sband), GFP_KERNEL);
++ sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband),
++ GFP_KERNEL);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+@@ -1690,13 +1693,6 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ rtw_err(rtwdev, "failed to set supported band\n");
+ }
+
+-static void rtw_unset_supported_band(struct ieee80211_hw *hw,
+- const struct rtw_chip_info *chip)
+-{
+- kfree(hw->wiphy->bands[NL80211_BAND_2GHZ]);
+- kfree(hw->wiphy->bands[NL80211_BAND_5GHZ]);
+-}
+-
+ static void rtw_vif_smps_iter(void *data, u8 *mac,
+ struct ieee80211_vif *vif)
+ {
+@@ -2320,10 +2316,7 @@ EXPORT_SYMBOL(rtw_register_hw);
+
+ void rtw_unregister_hw(struct rtw_dev *rtwdev, struct ieee80211_hw *hw)
+ {
+- const struct rtw_chip_info *chip = rtwdev->chip;
+-
+ ieee80211_unregister_hw(hw);
+- rtw_unset_supported_band(hw, chip);
+ rtw_debugfs_deinit(rtwdev);
+ rtw_led_deinit(rtwdev);
+ }
+--
+2.51.0
+
--- /dev/null
+From fc99d8a3e1dece8a489361d5428d916d3c79f247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 12:41:57 +0800
+Subject: wifi: rtw89: 8922a: add digital compensation for 2GHz
+
+From: Po-Hao Huang <phhuang@realtek.com>
+
+[ Upstream commit 8da7e88682d58a7c2e2c2101e49d3c9c9ac481b0 ]
+
+This fixes transmit power too low under 2GHz connection. Previously
+we missed the settings of 2GHz, add the according calibrated tables.
+
+Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260117044157.2392958-10-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8922a.c | 57 +++++++++++++++----
+ 1 file changed, 47 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+index 757dedd1a11d5..730e5d0d65750 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+@@ -1770,6 +1770,32 @@ static int rtw8922a_ctrl_rx_path_tmac(struct rtw89_dev *rtwdev,
+ }
+
+ #define DIGITAL_PWR_COMP_REG_NUM 22
++static const u32 rtw8922a_digital_pwr_comp_2g_s0_val[][DIGITAL_PWR_COMP_REG_NUM] = {
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010000, 0x00000101,
++ 0x01010101, 0x02020201, 0x02010000, 0x03030202, 0x00000303,
++ 0x03020101, 0x06060504, 0x01010000, 0x06050403, 0x01000606,
++ 0x05040202, 0x07070706},
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101,
++ 0x01000000, 0x01010101, 0x01010000, 0x02020202, 0x00000404,
++ 0x03020101, 0x04040303, 0x02010000, 0x03030303, 0x00000505,
++ 0x03030201, 0x05050303},
++};
++
++static const u32 rtw8922a_digital_pwr_comp_2g_s1_val[][DIGITAL_PWR_COMP_REG_NUM] = {
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x01010000, 0x01010101, 0x00000101,
++ 0x01010100, 0x01010101, 0x01010000, 0x02020202, 0x01000202,
++ 0x02020101, 0x03030202, 0x02010000, 0x05040403, 0x01000606,
++ 0x05040302, 0x07070605},
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101,
++ 0x01010000, 0x02020201, 0x02010100, 0x03030202, 0x01000404,
++ 0x04030201, 0x05050404, 0x01010100, 0x04030303, 0x01000505,
++ 0x03030101, 0x05050404},
++};
++
+ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = {
+ {0x012C0096, 0x044C02BC, 0x00322710, 0x015E0096, 0x03C8028A,
+ 0x0BB80708, 0x17701194, 0x02020100, 0x03030303, 0x01000303,
+@@ -1784,7 +1810,7 @@ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = {
+ };
+
+ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev,
+- bool enable, u8 nss,
++ u8 band, u8 nss,
+ enum rtw89_rf_path path)
+ {
+ static const u32 ltpc_t0[2] = {R_BE_LTPC_T0_PATH0, R_BE_LTPC_T0_PATH1};
+@@ -1792,14 +1818,25 @@ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev,
+ u32 addr, val;
+ u32 i;
+
+- if (nss == 1)
+- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0];
+- else
+- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1];
++ if (nss == 1) {
++ if (band == RTW89_BAND_2G)
++ digital_pwr_comp = path == RF_PATH_A ?
++ rtw8922a_digital_pwr_comp_2g_s0_val[0] :
++ rtw8922a_digital_pwr_comp_2g_s1_val[0];
++ else
++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0];
++ } else {
++ if (band == RTW89_BAND_2G)
++ digital_pwr_comp = path == RF_PATH_A ?
++ rtw8922a_digital_pwr_comp_2g_s0_val[1] :
++ rtw8922a_digital_pwr_comp_2g_s1_val[1];
++ else
++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1];
++ }
+
+ addr = ltpc_t0[path];
+ for (i = 0; i < DIGITAL_PWR_COMP_REG_NUM; i++, addr += 4) {
+- val = enable ? digital_pwr_comp[i] : 0;
++ val = digital_pwr_comp[i];
+ rtw89_phy_write32(rtwdev, addr, val);
+ }
+ }
+@@ -1808,7 +1845,7 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev,
+ enum rtw89_phy_idx phy_idx)
+ {
+ const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_CHANCTX_0);
+- bool enable = chan->band_type != RTW89_BAND_2G;
++ u8 band = chan->band_type;
+ u8 path;
+
+ if (rtwdev->mlo_dbcc_mode == MLO_1_PLUS_1_1RF) {
+@@ -1816,10 +1853,10 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev,
+ path = RF_PATH_A;
+ else
+ path = RF_PATH_B;
+- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 1, path);
++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 1, path);
+ } else {
+- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_A);
+- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_B);
++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_A);
++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_B);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4e366c650fdc273f80e5630272706b069aadbbba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Nov 2025 10:18:56 +0100
+Subject: wifi: rtw89: 8922a: set random mac if efuse contains zeroes
+
+From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+
+[ Upstream commit 41be33d3efc120f6a2c02d12742655f2aa09e1b6 ]
+
+I have some rtl8922ae devices with no permanent mac stored in efuse.
+
+It could be properly saved and/or configured from user tools like
+NetworkManager, but it would be desirable to be able to initialize it
+somehow to get the device working by default.
+
+So, in the same way as with other devices, if the mac address read from
+efuse contains zeros, a random mac address is assigned to at least allow
+operation, and the user is warned about this in case any action needs to
+be considered.
+
+Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251126091905.217951-1-jtornosm@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8922a.c | 22 +++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+index 6aa19ad259aca..757dedd1a11d5 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+@@ -636,16 +636,30 @@ static int rtw8922a_read_efuse_rf(struct rtw89_dev *rtwdev, u8 *log_map)
+ static int rtw8922a_read_efuse(struct rtw89_dev *rtwdev, u8 *log_map,
+ enum rtw89_efuse_block block)
+ {
++ struct rtw89_efuse *efuse = &rtwdev->efuse;
++ int ret;
++
+ switch (block) {
+ case RTW89_EFUSE_BLOCK_HCI_DIG_PCIE_SDIO:
+- return rtw8922a_read_efuse_pci_sdio(rtwdev, log_map);
++ ret = rtw8922a_read_efuse_pci_sdio(rtwdev, log_map);
++ break;
+ case RTW89_EFUSE_BLOCK_HCI_DIG_USB:
+- return rtw8922a_read_efuse_usb(rtwdev, log_map);
++ ret = rtw8922a_read_efuse_usb(rtwdev, log_map);
++ break;
+ case RTW89_EFUSE_BLOCK_RF:
+- return rtw8922a_read_efuse_rf(rtwdev, log_map);
++ ret = rtw8922a_read_efuse_rf(rtwdev, log_map);
++ break;
+ default:
+- return 0;
++ ret = 0;
++ break;
++ }
++
++ if (!ret && is_zero_ether_addr(efuse->addr)) {
++ rtw89_info(rtwdev, "efuse mac address is zero, using random mac\n");
++ eth_random_addr(efuse->addr);
+ }
++
++ return ret;
+ }
+
+ #define THM_TRIM_POSITIVE_MASK BIT(6)
+--
+2.51.0
+
--- /dev/null
+From 6b840c7f2260353137c90ce3e0e3c282e9f89512 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 08:43:58 +0800
+Subject: wifi: rtw89: Add support for MSI AX1800 Nano (GUAX18N)
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+[ Upstream commit 3116f287b81fe777a00b93ab07ec3c270093b185 ]
+
+Add the ID 0db0:f0c8 to the table to support an additional RTL8832BU
+adapter: MSI AX1800 Nano (GUAX18N).
+
+Compile tested only.
+
+Link: https://github.com/morrownr/rtl8852bu-20250826/pull/2
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260112004358.5516-1-zenmchen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
+index 0694272f7ffae..add5987110b33 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
+@@ -30,6 +30,8 @@ static const struct usb_device_id rtw_8852bu_id_table[] = {
+ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0x6931, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0xf0c8, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3327, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x3574, 0x6121, 0xff, 0xff, 0xff),
+--
+2.51.0
+
--- /dev/null
+From 668b054ac597631151113c0ee911eeb61763f6bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:15 +0800
+Subject: wifi: rtw89: disable EHT protocol by chip capabilities
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 7fd36ffedeedc97c44a10249a3f12d471bb2dc26 ]
+
+For certain chip models, EHT protocol is disabled, and driver must follow
+the capabilities. Otherwise, chips become unusable.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-5-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 2 +-
+ drivers/net/wireless/realtek/rtw89/core.h | 1 +
+ drivers/net/wireless/realtek/rtw89/fw.h | 4 ++++
+ drivers/net/wireless/realtek/rtw89/mac.c | 5 +++++
+ 4 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index ed6018f54f20a..018857d3569a8 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -5111,7 +5111,7 @@ static void rtw89_init_eht_cap(struct rtw89_dev *rtwdev,
+ u8 val, val_mcs13;
+ int sts = 8;
+
+- if (chip->chip_gen == RTW89_CHIP_AX)
++ if (chip->chip_gen == RTW89_CHIP_AX || hal->no_eht)
+ return;
+
+ if (hal->no_mcs_12_13)
+diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
+index 928c8c84c9644..c3839d49f4420 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.h
++++ b/drivers/net/wireless/realtek/rtw89/core.h
+@@ -4996,6 +4996,7 @@ struct rtw89_hal {
+ bool support_cckpd;
+ bool support_igi;
+ bool no_mcs_12_13;
++ bool no_eht;
+
+ atomic_t roc_chanctx_idx;
+ u8 roc_link_index;
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
+index ddebf79720687..47e5cbec306d2 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.h
++++ b/drivers/net/wireless/realtek/rtw89/fw.h
+@@ -42,6 +42,10 @@ struct rtw89_c2hreg_phycap {
+ #define RTW89_C2HREG_PHYCAP_W0_BW GENMASK(31, 24)
+ #define RTW89_C2HREG_PHYCAP_W1_TX_NSS GENMASK(7, 0)
+ #define RTW89_C2HREG_PHYCAP_W1_PROT GENMASK(15, 8)
++#define RTW89_C2HREG_PHYCAP_W1_PROT_11N 1
++#define RTW89_C2HREG_PHYCAP_W1_PROT_11AC 2
++#define RTW89_C2HREG_PHYCAP_W1_PROT_11AX 3
++#define RTW89_C2HREG_PHYCAP_W1_PROT_11BE 4
+ #define RTW89_C2HREG_PHYCAP_W1_NIC GENMASK(23, 16)
+ #define RTW89_C2HREG_PHYCAP_W1_WL_FUNC GENMASK(31, 24)
+ #define RTW89_C2HREG_PHYCAP_W2_HW_TYPE GENMASK(7, 0)
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index df429bdef7956..71194ea68bcee 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -2999,6 +2999,7 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev)
+ struct rtw89_efuse *efuse = &rtwdev->efuse;
+ struct rtw89_mac_c2h_info c2h_info = {};
+ struct rtw89_hal *hal = &rtwdev->hal;
++ u8 protocol;
+ u8 tx_nss;
+ u8 rx_nss;
+ u8 tx_ant;
+@@ -3046,6 +3047,10 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev)
+ rtw89_debug(rtwdev, RTW89_DBG_FW, "TX path diversity=%d\n", hal->tx_path_diversity);
+ rtw89_debug(rtwdev, RTW89_DBG_FW, "Antenna diversity=%d\n", hal->ant_diversity);
+
++ protocol = u32_get_bits(phycap->w1, RTW89_C2HREG_PHYCAP_W1_PROT);
++ if (protocol < RTW89_C2HREG_PHYCAP_W1_PROT_11BE)
++ hal->no_eht = true;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6f9bd77dd6fe77b1aa8a78471ce6fb63562a97ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 17:06:46 +0800
+Subject: wifi: rtw89: fix potential zero beacon interval in beacon tracking
+
+From: Kuan-Chung Chen <damon.chen@realtek.com>
+
+[ Upstream commit eb57be32f438c57c88d6ce756101c1dfbcc03bba ]
+
+During fuzz testing, it was discovered that bss_conf->beacon_int
+might be zero, which could result in a division by zero error in
+subsequent calculations. Set a default value of 100 TU if the
+interval is zero to ensure stability.
+
+Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251231090647.56407-11-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 917b2adede61d..ed6018f54f20a 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -2655,7 +2655,7 @@ static void rtw89_core_bcn_track_assoc(struct rtw89_dev *rtwdev,
+
+ rcu_read_lock();
+ bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
+- beacon_int = bss_conf->beacon_int;
++ beacon_int = bss_conf->beacon_int ?: 100;
+ dtim = bss_conf->dtim_period;
+ rcu_read_unlock();
+
+@@ -2685,9 +2685,7 @@ static void rtw89_core_bcn_track_reset(struct rtw89_dev *rtwdev)
+ memset(&rtwdev->bcn_track, 0, sizeof(rtwdev->bcn_track));
+ }
+
+-static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
+- struct ieee80211_bss_conf *bss_conf,
+- struct sk_buff *skb)
++static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, struct sk_buff *skb)
+ {
+ #define RTW89_APPEND_TSF_2GHZ 384
+ #define RTW89_APPEND_TSF_5GHZ 52
+@@ -2696,7 +2694,7 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
+ struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
+ struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
+ struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
+- u32 bcn_intvl_us = ieee80211_tu_to_usec(bss_conf->beacon_int);
++ u32 bcn_intvl_us = ieee80211_tu_to_usec(bcn_track->beacon_int);
+ u64 tsf = le64_to_cpu(mgmt->u.beacon.timestamp);
+ u8 wp, num = bcn_stat->num;
+ u16 append;
+@@ -2704,6 +2702,10 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
+ if (!RTW89_CHK_FW_FEATURE(BEACON_TRACKING, &rtwdev->fw))
+ return;
+
++ /* Skip if not yet associated */
++ if (!bcn_intvl_us)
++ return;
++
+ switch (rx_status->band) {
+ default:
+ case NL80211_BAND_2GHZ:
+@@ -2791,7 +2793,7 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,
+ pkt_stat->beacon_rate = desc_info->data_rate;
+ pkt_stat->beacon_len = skb->len;
+
+- rtw89_vif_rx_bcn_stat(rtwdev, bss_conf, skb);
++ rtw89_vif_rx_bcn_stat(rtwdev, skb);
+ }
+
+ if (!ether_addr_equal(bss_conf->addr, hdr->addr1))
+--
+2.51.0
+
--- /dev/null
+From 09903bfa27fd3dce9fd64a520457382a325c1263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 09:39:50 +0800
+Subject: wifi: rtw89: fix unable to receive probe responses under MLO
+ connection
+
+From: Po-Hao Huang <phhuang@realtek.com>
+
+[ Upstream commit 6f6d7a325fbde4f025ee1b1277f6f44727e21223 ]
+
+During MLO connections, A1 of the probe responses we received are
+in link address, these frames will then be dropped by mac80211 due to
+not matching the MLD address in ieee80211_scan_accept_presp().
+Fix this by using MLD address to scan when not using random MAC address.
+
+Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260114013950.19704-13-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/fw.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index 080c4f8a655a8..c9851aafe649e 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -8042,6 +8042,7 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
+ struct cfg80211_scan_request *req = &scan_req->req;
+ const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
+ rtwvif_link->chanctx_idx);
++ struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
+ struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
+ struct rtw89_chanctx_pause_parm pause_parm = {
+ .rsn = RTW89_CHANCTX_PAUSE_REASON_HW_SCAN,
+@@ -8071,6 +8072,8 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
+ if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
+ get_random_mask_addr(mac_addr, req->mac_addr,
+ req->mac_addr_mask);
++ else if (ieee80211_vif_is_mld(vif))
++ ether_addr_copy(mac_addr, vif->addr);
+ else
+ ether_addr_copy(mac_addr, rtwvif_link->mac_addr);
+
+--
+2.51.0
+
--- /dev/null
+From 60b2cd9f63d73220f2a07cc316014732261472d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:17 +0800
+Subject: wifi: rtw89: mac: correct page number for CSI response
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit aa2a44d0d22d45d659b9f01638809b1735e46cff ]
+
+For beamforming procedure, hardware reserve memory page for CSI response.
+The unit of register is (value - 1), so add one accordingly as expected.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-7-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac_be.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
+index e33297220f8b5..e5a61c628b731 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
+@@ -1168,7 +1168,7 @@ static int resp_pktctl_init_be(struct rtw89_dev *rtwdev, u8 mac_idx)
+
+ reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_RESP_CSI_RESERVED_PAGE, mac_idx);
+ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_START_PAGE_MASK, qt_cfg.pktid);
+- rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num);
++ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num + 1);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From f213827d4a763e54a28724c8bfbf7f9981b91630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 11:06:51 +0800
+Subject: wifi: rtw89: mcc: reset probe counter when receiving beacon
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit 1b40c1c7571fcf926095ed92f25bd87900bdc8ed ]
+
+For BE chips, needs to transmit QoS null data periodically to ensure
+the connection with AP in GC+STA mode. However, in environments
+with interference, the Qos null data might fail to transmit
+successfully. Therefore, when receive the beacon from AP will
+reset the QoS null data failure counter to avoid unnecessary
+disconnection.
+
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251223030651.480633-13-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/chan.c | 5 ++++-
+ drivers/net/wireless/realtek/rtw89/mac80211.c | 1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c
+index 86f1b39a967fe..8fe6a7ef738f7 100644
+--- a/drivers/net/wireless/realtek/rtw89/chan.c
++++ b/drivers/net/wireless/realtek/rtw89/chan.c
+@@ -2608,17 +2608,20 @@ bool rtw89_mcc_detect_go_bcn(struct rtw89_dev *rtwdev,
+ static void rtw89_mcc_detect_connection(struct rtw89_dev *rtwdev,
+ struct rtw89_mcc_role *role)
+ {
++ struct rtw89_vif_link *rtwvif_link = role->rtwvif_link;
+ struct ieee80211_vif *vif;
+ bool start_detect;
+ int ret;
+
+ ret = rtw89_core_send_nullfunc(rtwdev, role->rtwvif_link, true, false,
+ RTW89_MCC_PROBE_TIMEOUT);
+- if (ret)
++ if (ret &&
++ READ_ONCE(rtwvif_link->sync_bcn_tsf) == rtwvif_link->last_sync_bcn_tsf)
+ role->probe_count++;
+ else
+ role->probe_count = 0;
+
++ rtwvif_link->last_sync_bcn_tsf = READ_ONCE(rtwvif_link->sync_bcn_tsf);
+ if (role->probe_count < RTW89_MCC_PROBE_MAX_TRIES)
+ return;
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
+index 7b04183a3a5dd..474be7a5e49c7 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
+@@ -127,6 +127,7 @@ static int __rtw89_ops_add_iface_link(struct rtw89_dev *rtwdev,
+ rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT;
+ rtwvif_link->rand_tsf_done = false;
+ rtwvif_link->detect_bcn_count = 0;
++ rtwvif_link->last_sync_bcn_tsf = 0;
+
+ rcu_read_lock();
+
+--
+2.51.0
+
--- /dev/null
+From 3da7bd4b6ffb997ae31246c0948b184019ff9b6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 16:50:35 +0800
+Subject: wifi: rtw89: pci: restore LDO setting after device resume
+
+From: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+
+[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ]
+
+The LDO (Low Dropout Regulator) setting is missing after suspend/resume
+in some platforms, and it will cause card loss. Therefore, reconfigure
+this setting to avoid it.
+
+Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index f7be5e7e0a37c..6be1849b0c4d2 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -4591,6 +4591,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev)
+ rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1,
+ B_AX_SEL_REQ_ENTR_L1);
+ }
++ rtw89_pci_hci_ldo(rtwdev);
+ rtw89_pci_l2_hci_ldo(rtwdev);
+
+ rtw89_pci_basic_cfg(rtwdev, true);
+--
+2.51.0
+
--- /dev/null
+From b7da31ee9d10a8b8b3b91da8e91c6f9ac47e5c1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 09:39:56 +0800
+Subject: wifi: rtw89: pci: validate release report content before using for
+ RTL8922DE
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 5f93d611b33a05bd03d6843c8efe8cb6a1992620 ]
+
+The commit 957eda596c76
+("wifi: rtw89: pci: validate sequence number of TX release report")
+does validation on existing chips, which somehow a release report of SKB
+becomes malformed. As no clear cause found, add rules ahead for RTL8922DE
+to avoid crash if it happens.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260123013957.16418-11-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index 6395c53b3e170..f7be5e7e0a37c 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -604,8 +604,10 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp)
+
+ info->parse_rpp(rtwdev, rpp, &rpp_info);
+
+- if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) {
+- rtw89_warn(rtwdev, "should no fwcmd release report\n");
++ if (unlikely(rpp_info.txch >= RTW89_TXCH_NUM ||
++ info->tx_dma_ch_mask & BIT(rpp_info.txch))) {
++ rtw89_warn(rtwdev, "should no release report on txch %d\n",
++ rpp_info.txch);
+ return;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8965436f644d7a5b258391db76e0ed88a65251cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:12 +0800
+Subject: wifi: rtw89: pci: validate sequence number of TX release report
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 957eda596c7665f2966970fd1dcc35fe299b38e8 ]
+
+Hardware rarely reports abnormal sequence number in TX release report,
+which will access out-of-bounds of wd_ring->pages array, causing NULL
+pointer dereference.
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] PREEMPT SMP NOPTI
+ CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U
+ 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)
+ Call Trace:
+ <IRQ>
+ rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]
+ rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]
+ net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759
+ handle_softirqs+0xbe/0x290 kernel/softirq.c:601
+ ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]
+ __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423
+ </IRQ>
+ <TASK>
+ rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]
+ ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0
+ irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314
+ ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202
+ ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220
+ kthread+0xea/0x110 kernel/kthread.c:376
+ ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287
+ ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
+ </TASK>
+
+To prevent crash, validate rpp_info.seq before using.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-2-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index 0ee5f85794476..6395c53b3e170 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -604,11 +604,16 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp)
+
+ info->parse_rpp(rtwdev, rpp, &rpp_info);
+
+- if (rpp_info.txch == RTW89_TXCH_CH12) {
++ if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) {
+ rtw89_warn(rtwdev, "should no fwcmd release report\n");
+ return;
+ }
+
++ if (unlikely(rpp_info.seq >= RTW89_PCI_TXWD_NUM_MAX)) {
++ rtw89_warn(rtwdev, "invalid seq %d\n", rpp_info.seq);
++ return;
++ }
++
+ tx_ring = &rtwpci->tx.rings[rpp_info.txch];
+ wd_ring = &tx_ring->wd_ring;
+ txwd = &wd_ring->pages[rpp_info.seq];
+--
+2.51.0
+
--- /dev/null
+From eadc04ee05d7148d4353715622c35a9b67ee8119 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Dec 2025 11:09:25 +0800
+Subject: wifi: rtw89: regd: 6 GHz power type marks default when inactive
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit 8c96752d99c0b094af68317a8c701b09bd0862d9 ]
+
+When inactive, 6 GHz power type has been assigned to the default one,
+but missed to mark the local control variable, dflt, true. Then, this
+might let some 6 GHz power info of disconnected APs keep being taken
+into account under certain cases.
+
+So, mark default when inactive.
+
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251229030926.27004-12-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/regd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/regd.c b/drivers/net/wireless/realtek/rtw89/regd.c
+index 58582f8d2b74c..8211d1277699c 100644
+--- a/drivers/net/wireless/realtek/rtw89/regd.c
++++ b/drivers/net/wireless/realtek/rtw89/regd.c
+@@ -1142,6 +1142,7 @@ static int rtw89_reg_6ghz_power_recalc(struct rtw89_dev *rtwdev,
+ }
+ } else {
+ rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT;
++ dflt = true;
+ }
+
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From ddac1aedc601f6a68d4ff3fe3c7255eacdf572b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 11:06:44 +0800
+Subject: wifi: rtw89: ser: enable error IMR after recovering from L1
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit f4de946bdb379f543e3a599f8f048d741ad4a58e ]
+
+After recovering from L1, explicitly enable error IMR to ensure next
+L1 SER (system error recovery) can work normally.
+
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251223030651.480633-6-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac.c | 1 +
+ drivers/net/wireless/realtek/rtw89/mac.h | 1 +
+ drivers/net/wireless/realtek/rtw89/mac_be.c | 1 +
+ drivers/net/wireless/realtek/rtw89/ser.c | 10 ++++++++++
+ 4 files changed, 13 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index fd11b8fb3c899..2de75d22c97f2 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -7016,6 +7016,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_ax = {
+ .check_mac_en = rtw89_mac_check_mac_en_ax,
+ .sys_init = sys_init_ax,
+ .trx_init = trx_init_ax,
++ .err_imr_ctrl = err_imr_ctrl_ax,
+ .hci_func_en = rtw89_mac_hci_func_en_ax,
+ .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_ax,
+ .dle_func_en = dle_func_en_ax,
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h
+index 25fe5e5c8a979..51e37c183a35e 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.h
++++ b/drivers/net/wireless/realtek/rtw89/mac.h
+@@ -999,6 +999,7 @@ struct rtw89_mac_gen_def {
+ enum rtw89_mac_hwmod_sel sel);
+ int (*sys_init)(struct rtw89_dev *rtwdev);
+ int (*trx_init)(struct rtw89_dev *rtwdev);
++ void (*err_imr_ctrl)(struct rtw89_dev *rtwdev, bool en);
+ void (*hci_func_en)(struct rtw89_dev *rtwdev);
+ void (*dmac_func_pre_en)(struct rtw89_dev *rtwdev);
+ void (*dle_func_en)(struct rtw89_dev *rtwdev, bool enable);
+diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
+index ef69672b6862e..e33297220f8b5 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
+@@ -2594,6 +2594,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_be = {
+ .check_mac_en = rtw89_mac_check_mac_en_be,
+ .sys_init = sys_init_be,
+ .trx_init = trx_init_be,
++ .err_imr_ctrl = err_imr_ctrl_be,
+ .hci_func_en = rtw89_mac_hci_func_en_be,
+ .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_be,
+ .dle_func_en = dle_func_en_be,
+diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
+index f99e179f7ff9f..7fdc69578da31 100644
+--- a/drivers/net/wireless/realtek/rtw89/ser.c
++++ b/drivers/net/wireless/realtek/rtw89/ser.c
+@@ -431,6 +431,14 @@ static void hal_send_m4_event(struct rtw89_ser *ser)
+ rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RCVY_EN);
+ }
+
++static void hal_enable_err_imr(struct rtw89_ser *ser)
++{
++ struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
++
++ mac->err_imr_ctrl(rtwdev, true);
++}
++
+ /* state handler */
+ static void ser_idle_st_hdl(struct rtw89_ser *ser, u8 evt)
+ {
+@@ -552,6 +560,8 @@ static void ser_do_hci_st_hdl(struct rtw89_ser *ser, u8 evt)
+ break;
+
+ case SER_EV_MAC_RESET_DONE:
++ hal_enable_err_imr(ser);
++
+ ser_state_goto(ser, SER_IDLE_ST);
+ break;
+
+--
+2.51.0
+
--- /dev/null
+From 8252eb0a1d7a5bf78e3d75d196a336d5677786aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 11:06:50 +0800
+Subject: wifi: rtw89: setting TBTT AGG number when mac port initialization
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit 5e5f83fba48381098b26a8b2513a6d5fc5c66ccb ]
+
+When initializing mac port, needs to set TBTT AGG number to trigger TBTT
+related interrupts. Otherwise, after sending join info H2C command with
+disconnection mode, firmware will clear TBTT AGG number. Without the
+setting from mac port initialization after that, this port will not be
+able to transmit beacons.
+
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251223030651.480633-12-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index 2de75d22c97f2..df429bdef7956 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -4262,6 +4262,7 @@ static void rtw89_mac_bcn_drop(struct rtw89_dev *rtwdev,
+ #define BCN_HOLD_DEF 200
+ #define BCN_MASK_DEF 0
+ #define TBTT_ERLY_DEF 5
++#define TBTT_AGG_DEF 1
+ #define BCN_SET_UNIT 32
+ #define BCN_ERLY_SET_DLY (10 * 2)
+
+@@ -4565,6 +4566,16 @@ static void rtw89_mac_port_cfg_tbtt_early(struct rtw89_dev *rtwdev,
+ B_AX_TBTTERLY_MASK, TBTT_ERLY_DEF);
+ }
+
++static void rtw89_mac_port_cfg_tbtt_agg(struct rtw89_dev *rtwdev,
++ struct rtw89_vif_link *rtwvif_link)
++{
++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
++ const struct rtw89_port_reg *p = mac->port_base;
++
++ rtw89_write16_port_mask(rtwdev, rtwvif_link, p->tbtt_agg,
++ B_AX_TBTT_AGG_NUM_MASK, TBTT_AGG_DEF);
++}
++
+ static void rtw89_mac_port_cfg_bss_color(struct rtw89_dev *rtwdev,
+ struct rtw89_vif_link *rtwvif_link)
+ {
+@@ -4825,6 +4836,7 @@ int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvi
+ rtw89_mac_port_cfg_bcn_hold_time(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_bcn_mask_area(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_tbtt_early(rtwdev, rtwvif_link);
++ rtw89_mac_port_cfg_tbtt_agg(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_bss_color(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_mbssid(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_func_en(rtwdev, rtwvif_link, true);
+--
+2.51.0
+
--- /dev/null
+From ab4987f7ae13fa2d1818b23c500ef547f6adb93d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:13 +0800
+Subject: wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
+
+From: Chin-Yen Lee <timlee@realtek.com>
+
+[ Upstream commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b ]
+
+Some APs disconnect clients by sending a Disassociation frame
+rather than a Deauthentication frame. Since these frames use
+different reason codes in WoWLAN mode, this commit adds support
+for handling Disassociation to prevent missed disconnection events.
+
+Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/wow.c | 4 ++++
+ drivers/net/wireless/realtek/rtw89/wow.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
+index 5faa51ad896a2..f34cd863d1009 100644
+--- a/drivers/net/wireless/realtek/rtw89/wow.c
++++ b/drivers/net/wireless/realtek/rtw89/wow.c
+@@ -809,6 +809,10 @@ static void rtw89_wow_show_wakeup_reason(struct rtw89_dev *rtwdev)
+
+ reason = rtw89_read8(rtwdev, wow_reason_reg);
+ switch (reason) {
++ case RTW89_WOW_RSN_RX_DISASSOC:
++ wakeup.disconnect = true;
++ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx disassoc\n");
++ break;
+ case RTW89_WOW_RSN_RX_DEAUTH:
+ wakeup.disconnect = true;
+ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx deauth\n");
+diff --git a/drivers/net/wireless/realtek/rtw89/wow.h b/drivers/net/wireless/realtek/rtw89/wow.h
+index d2ba6cebc2a6b..71e07f482174f 100644
+--- a/drivers/net/wireless/realtek/rtw89/wow.h
++++ b/drivers/net/wireless/realtek/rtw89/wow.h
+@@ -33,6 +33,7 @@
+ enum rtw89_wake_reason {
+ RTW89_WOW_RSN_RX_PTK_REKEY = 0x1,
+ RTW89_WOW_RSN_RX_GTK_REKEY = 0x2,
++ RTW89_WOW_RSN_RX_DISASSOC = 0x4,
+ RTW89_WOW_RSN_RX_DEAUTH = 0x8,
+ RTW89_WOW_RSN_DISCONNECT = 0x10,
+ RTW89_WOW_RSN_RX_MAGIC_PKT = 0x21,
+--
+2.51.0
+
--- /dev/null
+From 35b7ce25cb5946cdae7a657abf5d8c5bc71fe3a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 12:37:49 +0100
+Subject: x86/sev: Use kfree_sensitive() when freeing a SNP message descriptor
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+[ Upstream commit af05e558988ed004a20fc4de7d0f80cfbba663f0 ]
+
+Use the proper helper instead of an open-coded variant.
+
+Closes: https://lore.kernel.org/r/202512202235.WHPQkLZu-lkp@intel.com
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Julia Lawall <julia.lawall@inria.fr>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Link: https://patch.msgid.link/20260112114147.GBaWTd-8HSy_Xp4S3X@fat_crate.local
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/sev/core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c
+index 9ae3b11754e65..c8ddb9febe3d9 100644
+--- a/arch/x86/coco/sev/core.c
++++ b/arch/x86/coco/sev/core.c
+@@ -2008,8 +2008,7 @@ void snp_msg_free(struct snp_msg_desc *mdesc)
+ free_shared_pages(mdesc->request, sizeof(struct snp_guest_msg));
+ iounmap((__force void __iomem *)mdesc->secrets);
+
+- memset(mdesc, 0, sizeof(*mdesc));
+- kfree(mdesc);
++ kfree_sensitive(mdesc);
+ }
+ EXPORT_SYMBOL_GPL(snp_msg_free);
+
+--
+2.51.0
+
--- /dev/null
+From fe178be6b913bbb8e43707f8fd7ff021cc6c2f3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 12:00:08 +0800
+Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when
+ CONFIG_X86_PAE is set
+
+From: Hou Wenlong <houwenlong.hwl@antgroup.com>
+
+[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ]
+
+The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests
+do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds
+different pagetables depending on whether CONFIG_X86_PAE is set.
+Therefore, enabling PAE mode for 32-bit KVM guests without
+CONFIG_X86_PAE being set would result in a boot failure during CR3
+loading.
+
+Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <d09ce9a134eb9cbc16928a5b316969f8ba606b81.1768017442.git.houwenlong.hwl@antgroup.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/pvh/head.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
+index 344030c1a81d4..53ee2d53fcf8e 100644
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -91,10 +91,12 @@ SYM_CODE_START(pvh_start_xen)
+
+ leal rva(early_stack_end)(%ebp), %esp
+
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ /* Enable PAE mode. */
+ mov %cr4, %eax
+ orl $X86_CR4_PAE, %eax
+ mov %eax, %cr4
++#endif
+
+ #ifdef CONFIG_X86_64
+ /* Enable Long mode. */
+--
+2.51.0
+
--- /dev/null
+From 97c86784261b33879baac8e61d9f486eaf1cdf89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 17:47:29 -0500
+Subject: xenbus: Use .freeze/.thaw to handle xenbus devices
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ]
+
+The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming
+from s3 or s2idle disconnects its PV devices during resume. The
+backends are not expecting this and do not reconnect.
+
+b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/
+resume/chkpt") changed xen_suspend()/do_suspend() from
+PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the
+suspend/resume callbacks remained.
+
+.freeze/restore are used with hiberation where Linux restarts in a new
+place in the future. .suspend/resume are useful for runtime power
+management for the duration of a boot.
+
+The current behavior of the callbacks works for an xl save/restore or
+live migration where the domain is restored/migrated to a new location
+and connecting to a not-already-connected backend.
+
+Change xenbus_pm_ops to use .freeze/thaw/restore and drop the
+.suspend/resume hook. This matches the use in drivers/xen/manage.c for
+save/restore and live migration. With .suspend/resume empty, PV devices
+are left connected during s2idle and s3, so PV devices are not changed
+and work after resume.
+
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Acked-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index 6d1819269cbe5..199917b6f77ca 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev)
+ }
+
+ static const struct dev_pm_ops xenbus_pm_ops = {
+- .suspend = xenbus_dev_suspend,
+- .resume = xenbus_frontend_dev_resume,
+ .freeze = xenbus_dev_suspend,
+ .thaw = xenbus_dev_cancel,
+- .restore = xenbus_dev_resume,
++ .restore = xenbus_frontend_dev_resume,
+ };
+
+ static struct xen_bus_type xenbus_frontend = {
+--
+2.51.0
+
--- /dev/null
+From 2cd6f8d04f75e71b1acdd15fab8ee1f0a1dd27d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 15:03:48 -0800
+Subject: 9p/xen: protect xen_9pfs_front_free against concurrent calls
+
+From: Stefano Stabellini <stefano.stabellini@amd.com>
+
+[ Upstream commit ce8ded2e61f47747e31eeefb44dc24a2160a7e32 ]
+
+The xenwatch thread can race with other back-end change notifications
+and call xen_9pfs_front_free() twice, hitting the observed general
+protection fault due to a double-free. Guard the teardown path so only
+one caller can release the front-end state at a time, preventing the
+crash.
+
+This is a fix for the following double-free:
+
+[ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
+[ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none)
+[ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150
+[ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42
+[ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246
+[ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000
+[ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000
+[ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000
+[ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68
+[ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040
+[ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000
+[ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660
+[ 27.052418] Call Trace:
+[ 27.052420] <TASK>
+[ 27.052422] xen_9pfs_front_changed+0x5d5/0x720
+[ 27.052426] ? xenbus_otherend_changed+0x72/0x140
+[ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10
+[ 27.052434] xenwatch_thread+0x94/0x1c0
+[ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10
+[ 27.052442] kthread+0xf8/0x240
+[ 27.052445] ? __pfx_kthread+0x10/0x10
+[ 27.052449] ? __pfx_kthread+0x10/0x10
+[ 27.052452] ret_from_fork+0x16b/0x1a0
+[ 27.052456] ? __pfx_kthread+0x10/0x10
+[ 27.052459] ret_from_fork_asm+0x1a/0x30
+[ 27.052463] </TASK>
+[ 27.052465] Modules linked in:
+[ 27.052471] ---[ end trace 0000000000000000 ]---
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
+Message-ID: <20260129230348.2390470-1-stefano.stabellini@amd.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/9p/trans_xen.c | 85 ++++++++++++++++++++++++----------------------
+ 1 file changed, 44 insertions(+), 41 deletions(-)
+
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 12f752a923324..9bbfc20744f69 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -277,45 +277,52 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
+ {
+ int i, j;
+
+- write_lock(&xen_9pfs_lock);
+- list_del(&priv->list);
+- write_unlock(&xen_9pfs_lock);
+-
+- for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
+- struct xen_9pfs_dataring *ring = &priv->rings[i];
+-
+- cancel_work_sync(&ring->work);
+-
+- if (!priv->rings[i].intf)
+- break;
+- if (priv->rings[i].irq > 0)
+- unbind_from_irqhandler(priv->rings[i].irq, ring);
+- if (priv->rings[i].data.in) {
+- for (j = 0;
+- j < (1 << priv->rings[i].intf->ring_order);
+- j++) {
+- grant_ref_t ref;
+-
+- ref = priv->rings[i].intf->ref[j];
+- gnttab_end_foreign_access(ref, NULL);
+- }
+- free_pages_exact(priv->rings[i].data.in,
++ if (priv->rings) {
++ for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
++ struct xen_9pfs_dataring *ring = &priv->rings[i];
++
++ cancel_work_sync(&ring->work);
++
++ if (!priv->rings[i].intf)
++ break;
++ if (priv->rings[i].irq > 0)
++ unbind_from_irqhandler(priv->rings[i].irq, ring);
++ if (priv->rings[i].data.in) {
++ for (j = 0;
++ j < (1 << priv->rings[i].intf->ring_order);
++ j++) {
++ grant_ref_t ref;
++
++ ref = priv->rings[i].intf->ref[j];
++ gnttab_end_foreign_access(ref, NULL);
++ }
++ free_pages_exact(priv->rings[i].data.in,
+ 1UL << (priv->rings[i].intf->ring_order +
+ XEN_PAGE_SHIFT));
++ }
++ gnttab_end_foreign_access(priv->rings[i].ref, NULL);
++ free_page((unsigned long)priv->rings[i].intf);
+ }
+- gnttab_end_foreign_access(priv->rings[i].ref, NULL);
+- free_page((unsigned long)priv->rings[i].intf);
++ kfree(priv->rings);
+ }
+- kfree(priv->rings);
+ kfree(priv->tag);
+ kfree(priv);
+ }
+
+ static void xen_9pfs_front_remove(struct xenbus_device *dev)
+ {
+- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
++ struct xen_9pfs_front_priv *priv;
+
++ write_lock(&xen_9pfs_lock);
++ priv = dev_get_drvdata(&dev->dev);
++ if (priv == NULL) {
++ write_unlock(&xen_9pfs_lock);
++ return;
++ }
+ dev_set_drvdata(&dev->dev, NULL);
++ list_del(&priv->list);
++ write_unlock(&xen_9pfs_lock);
++
+ xen_9pfs_front_free(priv);
+ }
+
+@@ -382,7 +389,7 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ {
+ int ret, i;
+ struct xenbus_transaction xbt;
+- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
++ struct xen_9pfs_front_priv *priv;
+ char *versions, *v;
+ unsigned int max_rings, max_ring_order, len = 0;
+
+@@ -410,6 +417,10 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ if (p9_xen_trans.maxsize > XEN_FLEX_RING_SIZE(max_ring_order))
+ p9_xen_trans.maxsize = XEN_FLEX_RING_SIZE(max_ring_order) / 2;
+
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv)
++ return -ENOMEM;
++ priv->dev = dev;
+ priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings),
+ GFP_KERNEL);
+ if (!priv->rings) {
+@@ -468,6 +479,11 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ goto error;
+ }
+
++ write_lock(&xen_9pfs_lock);
++ dev_set_drvdata(&dev->dev, priv);
++ list_add_tail(&priv->list, &xen_9pfs_devs);
++ write_unlock(&xen_9pfs_lock);
++
+ xenbus_switch_state(dev, XenbusStateInitialised);
+ return 0;
+
+@@ -482,19 +498,6 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
+ static int xen_9pfs_front_probe(struct xenbus_device *dev,
+ const struct xenbus_device_id *id)
+ {
+- struct xen_9pfs_front_priv *priv = NULL;
+-
+- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv)
+- return -ENOMEM;
+-
+- priv->dev = dev;
+- dev_set_drvdata(&dev->dev, priv);
+-
+- write_lock(&xen_9pfs_lock);
+- list_add_tail(&priv->list, &xen_9pfs_devs);
+- write_unlock(&xen_9pfs_lock);
+-
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2f1669002b279500dd8fc65c9e3fb9d066e01c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 10:16:03 -0800
+Subject: accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg()
+
+From: Lizhi Hou <lizhi.hou@amd.com>
+
+[ Upstream commit cd77d5a4aaf8c5c1d819f47cf814bf7d4920b0a2 ]
+
+In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll for a
+non-zero tail pointer. This assumed that a zero value indicates an error.
+However, certain corner cases legitimately produce a zero tail pointer.
+To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail
+pointer will be treated as a valid rewind event.
+
+Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
+Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
+Link: https://patch.msgid.link/20251204181603.793824-1-lizhi.hou@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------
+ 1 file changed, 1 insertion(+), 18 deletions(-)
+
+diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
+index 8b72cf6bd6e4d..469242ed82246 100644
+--- a/drivers/accel/amdxdna/amdxdna_mailbox.c
++++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
+@@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct mailbox_channel *mb_chann, u32 mbox_reg)
+ return readl(ringbuf_addr);
+ }
+
+-static int mailbox_reg_read_non_zero(struct mailbox_channel *mb_chann, u32 mbox_reg, u32 *val)
+-{
+- struct xdna_mailbox_res *mb_res = &mb_chann->mb->res;
+- void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg;
+- int ret, value;
+-
+- /* Poll till value is not zero */
+- ret = readx_poll_timeout(readl, ringbuf_addr, value,
+- value, 1 /* us */, 100);
+- if (ret < 0)
+- return ret;
+-
+- *val = value;
+- return 0;
+-}
+-
+ static inline void
+ mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val)
+ {
+@@ -291,8 +275,7 @@ static int mailbox_get_msg(struct mailbox_channel *mb_chann)
+ u32 start_addr;
+ int ret;
+
+- if (mailbox_reg_read_non_zero(mb_chann, mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail))
+- return -EINVAL;
++ tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X);
+ head = mb_chann->i2x_head;
+ ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X);
+ start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr;
+--
+2.51.0
+
--- /dev/null
+From c9c7c440a376c08e7c341abca84c5c8cdd12fb56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jan 2026 17:48:56 +0300
+Subject: ACPI: battery: fix incorrect charging status when current is zero
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ata İlhan Köktürk <atailhan2006@gmail.com>
+
+[ Upstream commit bb1256e0ddc7e9e406164319769b9f8d8389f056 ]
+
+On some laptops, such as the Huawei Matebook series, the embedded
+controller continues to report "Charging" status even when the
+charge threshold is reached and no current is being drawn.
+
+This incorrect reporting prevents the system from switching to battery
+power profiles, leading to significantly higher power (e.g., 18W instead
+of 7W during browsing) and missed remaining battery time estimation.
+
+Validate the "Charging" state by checking if rate_now is zero. If the
+hardware reports charging but the current is zero, report "Not Charging"
+to user space.
+
+Signed-off-by: Ata İlhan Köktürk <atailhan2006@gmail.com>
+[ rjw: Whitespace fix, braces added to an inner if (), new comment rewrite ]
+[ rjw: Changelog edits ]
+Link: https://patch.msgid.link/20260129144856.43058-1-atailhan2006@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/battery.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 34181fa52e937..4b28ef79e6ac8 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -211,7 +211,14 @@ static int acpi_battery_get_property(struct power_supply *psy,
+ if (battery->state & ACPI_BATTERY_STATE_DISCHARGING)
+ val->intval = acpi_battery_handle_discharging(battery);
+ else if (battery->state & ACPI_BATTERY_STATE_CHARGING)
+- val->intval = POWER_SUPPLY_STATUS_CHARGING;
++ /* Validate the status by checking the current. */
++ if (battery->rate_now != ACPI_BATTERY_VALUE_UNKNOWN &&
++ battery->rate_now == 0) {
++ /* On charge but no current (0W/0mA). */
++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
++ } else {
++ val->intval = POWER_SUPPLY_STATUS_CHARGING;
++ }
+ else if (battery->state & ACPI_BATTERY_STATE_CHARGE_LIMITING)
+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
+ else if (acpi_battery_is_charged(battery))
+--
+2.51.0
+
--- /dev/null
+From 3c6d96536800ce77f300eacbe93341766dbc76a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 00:32:14 +0800
+Subject: ACPI: processor: Fix NULL-pointer dereference in
+ acpi_processor_errata_piix4()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ]
+
+In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
+device and then reassigned an ISA device:
+
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
+
+If the first lookup succeeds but the second fails, dev becomes NULL. This
+leads to a potential null-pointer dereference when dev_dbg() is called:
+
+ if (errata.piix4.bmisx)
+ dev_dbg(&dev->dev, ...);
+
+To prevent this, use two temporary pointers and retrieve each device
+independently, avoiding overwriting dev with a possible NULL value.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+[ rjw: Subject adjustment, added an empty code line ]
+Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_processor.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index 7ec1dc04fd11b..85096ce7b658b 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ {
+ u8 value1 = 0;
+ u8 value2 = 0;
++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL;
+
+
+ if (!dev)
+@@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * each IDE controller's DMA status to make sure we catch all
+ * DMA activity.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- errata.piix4.bmisx = pci_resource_start(dev, 4);
+- pci_dev_put(dev);
++ if (ide_dev) {
++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
++ pci_dev_put(ide_dev);
+ }
+
+ /*
+@@ -124,24 +125,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * disable C3 support if this is enabled, as some legacy
+ * devices won't operate well if fast DMA is disabled.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB_0,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- pci_read_config_byte(dev, 0x76, &value1);
+- pci_read_config_byte(dev, 0x77, &value2);
++ if (isa_dev) {
++ pci_read_config_byte(isa_dev, 0x76, &value1);
++ pci_read_config_byte(isa_dev, 0x77, &value2);
+ if ((value1 & 0x80) || (value2 & 0x80))
+ errata.piix4.fdma = 1;
+- pci_dev_put(dev);
++ pci_dev_put(isa_dev);
+ }
+
+ break;
+ }
+
+- if (errata.piix4.bmisx)
+- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
+- if (errata.piix4.fdma)
+- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
++ if (ide_dev)
++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
++
++ if (isa_dev)
++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 9fd925309bda23a11ba7b2d0220f7a81a03d700a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 15:27:19 +0800
+Subject: ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
+
+From: Ai Chao <aichao@kylinos.cn>
+
+[ Upstream commit ba6ded26dffe511b862a98a25955955e7154bfa8 ]
+
+Like the JWIPC JVC9100 has its serial IRQ (10 and 11) described
+as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which
+breaks the serial.
+
+irq 10, level, active-low, shared, skip-override
+irq 11, level, active-low, shared, skip-override
+
+Add the JVC9100 to the irq1_level_low_skip_override[] quirk table to fix
+this.
+
+Signed-off-by: Ai Chao <aichao@kylinos.cn>
+Link: https://patch.msgid.link/20260113072719.4154485-1-aichao@kylinos.cn
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index d16906f46484d..bc8050d8a6f51 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -532,6 +532,12 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "16T90SP"),
+ },
+ },
++ {
++ /* JWIPC JVC9100 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "JVC9100"),
++ },
++ },
+ { }
+ };
+
+@@ -706,6 +712,8 @@ struct irq_override_cmp {
+
+ static const struct irq_override_cmp override_table[] = {
+ { irq1_level_low_skip_override, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false },
++ { irq1_level_low_skip_override, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false },
++ { irq1_level_low_skip_override, 11, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false },
+ { irq1_edge_low_force_override, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 8f527a55c5f40e15a553074a8f0aad24a5e0bc15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 21:28:47 +0800
+Subject: ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
+
+From: Yicong Yang <yang.yicong@picoheart.com>
+
+[ Upstream commit 7cf28b3797a81b616bb7eb3e90cf131afc452919 ]
+
+The device object rescan in acpi_scan_clear_dep_fn() is scheduled on a
+system workqueue which is not guaranteed to be finished before entering
+userspace. This may cause some key devices to be missing when userspace
+init task tries to find them. Two issues observed on RISCV platforms:
+
+ - Kernel panic due to userspace init cannot have an opened
+ console.
+
+ The console device scanning is queued by acpi_scan_clear_dep_queue()
+ and not finished by the time userspace init process running, thus by
+ the time userspace init runs, no console is present.
+
+ - Entering rescue shell due to the lack of root devices (PCIe nvme in
+ our case).
+
+ Same reason as above, the PCIe host bridge scanning is queued on
+ a system workqueue and finished after init process runs.
+
+The reason is because both devices (console, PCIe host bridge) depend on
+riscv-aplic irqchip to serve their interrupts (console's wired interrupt
+and PCI's INTx interrupts). In order to keep the dependency, these
+devices are scanned and created after initializing riscv-aplic. The
+riscv-aplic is initialized in device_initcall() and a device scan work
+is queued via acpi_scan_clear_dep_queue(), which is close to the time
+userspace init process is run. Since system_dfl_wq is used in
+acpi_scan_clear_dep_queue() with no synchronization, the issues will
+happen if userspace init runs before these devices are ready.
+
+The solution is to wait for the queued work to complete before entering
+userspace init. One possible way would be to use a dedicated workqueue
+instead of system_dfl_wq, and explicitly flush it somewhere in the
+initcall stage before entering userspace. Another way is to use
+async_schedule_dev_nocall() for scanning these devices. It's designed
+for asynchronous initialization and will work in the same way as before
+because it's using a dedicated unbound workqueue as well, but the kernel
+init code calls async_synchronize_full() right before entering userspace
+init which will wait for the work to complete.
+
+Compared to a dedicated workqueue, the second approach is simpler
+because the async schedule framework takes care of all of the details.
+The ACPI code only needs to focus on its job. A dedicated workqueue for
+this could also be redundant because some platforms don't need
+acpi_scan_clear_dep_queue() for their device scanning.
+
+Signed-off-by: Yicong Yang <yang.yicong@picoheart.com>
+[ rjw: Subject adjustment, changelog edits ]
+Link: https://patch.msgid.link/20260128132848.93638-1-yang.yicong@picoheart.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 41 +++++++++++++++--------------------------
+ 1 file changed, 15 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 416d87f9bd107..b78f6be2f9468 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -5,6 +5,7 @@
+
+ #define pr_fmt(fmt) "ACPI: " fmt
+
++#include <linux/async.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+ #include <linux/slab.h>
+@@ -2360,46 +2361,34 @@ static int acpi_dev_get_next_consumer_dev_cb(struct acpi_dep_data *dep, void *da
+ return 0;
+ }
+
+-struct acpi_scan_clear_dep_work {
+- struct work_struct work;
+- struct acpi_device *adev;
+-};
+-
+-static void acpi_scan_clear_dep_fn(struct work_struct *work)
++static void acpi_scan_clear_dep_fn(void *dev, async_cookie_t cookie)
+ {
+- struct acpi_scan_clear_dep_work *cdw;
+-
+- cdw = container_of(work, struct acpi_scan_clear_dep_work, work);
++ struct acpi_device *adev = to_acpi_device(dev);
+
+ acpi_scan_lock_acquire();
+- acpi_bus_attach(cdw->adev, (void *)true);
++ acpi_bus_attach(adev, (void *)true);
+ acpi_scan_lock_release();
+
+- acpi_dev_put(cdw->adev);
+- kfree(cdw);
++ acpi_dev_put(adev);
+ }
+
+ static bool acpi_scan_clear_dep_queue(struct acpi_device *adev)
+ {
+- struct acpi_scan_clear_dep_work *cdw;
+-
+ if (adev->dep_unmet)
+ return false;
+
+- cdw = kmalloc(sizeof(*cdw), GFP_KERNEL);
+- if (!cdw)
+- return false;
+-
+- cdw->adev = adev;
+- INIT_WORK(&cdw->work, acpi_scan_clear_dep_fn);
+ /*
+- * Since the work function may block on the lock until the entire
+- * initial enumeration of devices is complete, put it into the unbound
+- * workqueue.
++ * Async schedule the deferred acpi_scan_clear_dep_fn() since:
++ * - acpi_bus_attach() needs to hold acpi_scan_lock which cannot
++ * be acquired under acpi_dep_list_lock (held here)
++ * - the deferred work at boot stage is ensured to be finished
++ * before userspace init task by the async_synchronize_full()
++ * barrier
++ *
++ * Use _nocall variant since it'll return on failure instead of
++ * run the function synchronously.
+ */
+- queue_work(system_dfl_wq, &cdw->work);
+-
+- return true;
++ return async_schedule_dev_nocall(acpi_scan_clear_dep_fn, &adev->dev);
+ }
+
+ static void acpi_scan_delete_dep_data(struct acpi_dep_data *dep)
+--
+2.51.0
+
--- /dev/null
+From 1c1d35754384cd45c39272e3369f301ea52437c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Feb 2026 00:22:42 +0200
+Subject: ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
+
+From: Yauhen Kharuzhy <jekhor@gmail.com>
+
+[ Upstream commit a8c975302868c716afef0f50467bebbd069a35b8 ]
+
+The PWM2 on YB1-X90 tablets is used for keyboard backlight control but
+it is disabled in the ACPI DSDT table. Add it to the override_status_ids
+list to allow keyboard function control driver
+(drivers/platform/x86/lenovo/yogabook.c) to use it.
+
+Signed-off-by: Yauhen Kharuzhy <jekhor@gmail.com>
+Link: https://patch.msgid.link/20260211222242.4101162-1-jekhor@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index 4ee30c2897a2b..418951639f511 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -81,6 +81,18 @@ static const struct override_status_id override_status_ids[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"),
+ }),
+
++ /*
++ * Lenovo Yoga Book uses PWM2 for touch keyboard backlight control.
++ * It needs to be enabled only for the Android device version (YB1-X90*
++ * aka YETI-11); the Windows version (YB1-X91*) uses ACPI control
++ * methods.
++ */
++ PRESENT_ENTRY_HID("80862289", "2", INTEL_ATOM_AIRMONT, {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"),
++ }),
++
+ /*
+ * The INT0002 device is necessary to clear wakeup interrupt sources
+ * on Cherry Trail devices, without it we get nobody cared IRQ msgs.
+--
+2.51.0
+
--- /dev/null
+From 8d0e0a1802339d27675fdda6a4039bd4481a595e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 21:01:21 +0100
+Subject: ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
+
+From: Jakob Riemenschneider <riemenschneiderjakob@gmail.com>
+
+[ Upstream commit 229ecbaac6b31f89c554b77eb407377a5eade7d4 ]
+
+Windows 11, version 22H2 introduced a new function index (Function 9) to
+the Microsoft LPS0 _DSM, titled "Turn On Display Notification".
+
+According to Microsoft documentation, this function signals to the system
+firmware that the OS intends to turn on the display when exiting Modern
+Standby. This allows the firmware to release Power Limits (PLx) earlier.
+
+Crucially, this patch fixes a functional issue observed on the Lenovo Yoga
+Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to
+resume after suspend. Investigation linked shows the EC on this device
+turns off these components during sleep but requires the Function 9
+notification to wake them up again.
+
+This patch defines the new function index (ACPI_MS_TURN_ON_DISPLAY) and
+invokes it in acpi_s2idle_restore_early_lps0(). The execution order is
+updated to match the logic of an "intent" signal:
+
+ 1. LPS0 Exit (Function 6)
+ 2. Turn On Display Intent (Function 9)
+ 3. Modern Standby Exit (Function 8)
+ 4. Screen On (Function 4)
+
+Invoking Function 9 before the Modern Standby Exit ensures the firmware
+has time to restore power rails and functionality (like fans) before the
+software fully exits the sleep state.
+
+Link: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications#turn-on-display-notification-function-9
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220505
+Suggested-by: Antheas Kapenekakis <antheas@antheas.dev>
+Signed-off-by: Jakob Riemenschneider <riemenschneiderjakob@gmail.com>
+Link: https://patch.msgid.link/20260127200121.1292216-1-riemenschneiderjakob@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/s2idle.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c
+index cc3c83e4cc23b..2189330ffc6d3 100644
+--- a/drivers/acpi/x86/s2idle.c
++++ b/drivers/acpi/x86/s2idle.c
+@@ -49,6 +49,7 @@ static const struct acpi_device_id lps0_device_ids[] = {
+ #define ACPI_LPS0_EXIT 6
+ #define ACPI_LPS0_MS_ENTRY 7
+ #define ACPI_LPS0_MS_EXIT 8
++#define ACPI_MS_TURN_ON_DISPLAY 9
+
+ /* AMD */
+ #define ACPI_LPS0_DSM_UUID_AMD "e3f32452-febc-43ce-9039-932122d37721"
+@@ -356,6 +357,8 @@ static const char *acpi_sleep_dsm_state_to_str(unsigned int state)
+ return "lps0 ms entry";
+ case ACPI_LPS0_MS_EXIT:
+ return "lps0 ms exit";
++ case ACPI_MS_TURN_ON_DISPLAY:
++ return "lps0 ms turn on display";
+ }
+ } else {
+ switch (state) {
+@@ -617,6 +620,9 @@ static void acpi_s2idle_restore_early_lps0(void)
+ if (lps0_dsm_func_mask_microsoft > 0) {
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT,
+ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
++ /* Intent to turn on display */
++ acpi_sleep_run_lps0_dsm(ACPI_MS_TURN_ON_DISPLAY,
++ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
+ /* Modern Standby exit */
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_EXIT,
+ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
+--
+2.51.0
+
--- /dev/null
+From ebf77dc3e2303dec3ffb368d9a678e24f26780f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 13:25:33 +0100
+Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ]
+
+The ACPI specification states that when executing AML_FATAL_OP,
+the OS should log the fatal error event and shutdown in a timely
+fashion.
+
+Windows complies with this requirement by immediatly entering a
+Bso_d, effectively aborting the execution of the AML bytecode in
+question.
+
+ACPICA however might continue with the AML bytecode execution
+should acpi_os_signal() simply return AE_OK. This will cause issues
+because ACPI BIOS implementations might assume that the Fatal()
+operator does not return.
+
+Fix this by aborting the AML bytecode execution in such a case
+by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a
+local variable because of its small size (12 bytes) and to ensure
+that acpi_os_signal() always receives valid information about the
+fatal ACPI BIOS error.
+
+Link: https://github.com/acpica/acpica/commit/d516c7758ba6
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++---------------------
+ 1 file changed, 18 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
+index bf08110ed6d25..c8c8c4e49563e 100644
+--- a/drivers/acpi/acpica/exoparg3.c
++++ b/drivers/acpi/acpica/exoparg3.c
+@@ -10,6 +10,7 @@
+ #include <acpi/acpi.h>
+ #include "accommon.h"
+ #include "acinterp.h"
++#include <acpi/acoutput.h>
+ #include "acparser.h"
+ #include "amlcode.h"
+
+@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3")
+ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ {
+ union acpi_operand_object **operand = &walk_state->operands[0];
+- struct acpi_signal_fatal_info *fatal;
+- acpi_status status = AE_OK;
++ struct acpi_signal_fatal_info fatal;
+
+ ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R,
+ acpi_ps_get_opcode_name(walk_state->opcode));
+@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ switch (walk_state->opcode) {
+ case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */
+
+- ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+- "FatalOp: Type %X Code %X Arg %X "
+- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
+- (u32)operand[0]->integer.value,
+- (u32)operand[1]->integer.value,
+- (u32)operand[2]->integer.value));
+-
+- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info));
+- if (fatal) {
+- fatal->type = (u32) operand[0]->integer.value;
+- fatal->code = (u32) operand[1]->integer.value;
+- fatal->argument = (u32) operand[2]->integer.value;
+- }
++ fatal.type = (u32)operand[0]->integer.value;
++ fatal.code = (u32)operand[1]->integer.value;
++ fatal.argument = (u32)operand[2]->integer.value;
+
+- /* Always signal the OS! */
++ ACPI_BIOS_ERROR((AE_INFO,
++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n",
++ fatal.type, fatal.code, fatal.argument));
+
+- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal);
++ /* Always signal the OS! */
+
+- /* Might return while OS is shutting down, just continue */
++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal);
+
+- ACPI_FREE(fatal);
+- goto cleanup;
++ /*
++ * Might return while OS is shutting down, so abort the AML execution
++ * by returning an error.
++ */
++ return_ACPI_STATUS(AE_ERROR);
+
+ case AML_EXTERNAL_OP:
+ /*
+@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ * wrong if an external opcode ever gets here.
+ */
+ ACPI_ERROR((AE_INFO, "Executed External Op"));
+- status = AE_OK;
+- goto cleanup;
++
++ return_ACPI_STATUS(AE_OK);
+
+ default:
+
+ ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X",
+ walk_state->opcode));
+
+- status = AE_AML_BAD_OPCODE;
+- goto cleanup;
++ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
+ }
+-
+-cleanup:
+-
+- return_ACPI_STATUS(status);
+ }
+
+ /*******************************************************************************
+--
+2.51.0
+
--- /dev/null
+From aaaa4d470040b3376aff5f3b093bc70d1c76a152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 18:30:43 +0100
+Subject: alpha: fix user-space corruption during memory compaction
+
+From: Magnus Lindholm <linmag7@gmail.com>
+
+[ Upstream commit dd5712f3379cfe760267cdd28ff957d9ab4e51c7 ]
+
+Alpha systems can suffer sporadic user-space crashes and heap
+corruption when memory compaction is enabled.
+
+Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned
+tcache chunk"), and compiler internal errors. The failures disappear
+when compaction is disabled or when using global TLB invalidation.
+
+The root cause is insufficient TLB shootdown during page migration.
+Alpha relies on ASN-based MM context rollover for instruction cache
+coherency, but this alone is not sufficient to prevent stale data or
+instruction translations from surviving migration.
+
+Fix this by introducing a migration-specific helper that combines:
+ - MM context invalidation (ASN rollover),
+ - immediate per-CPU TLB invalidation (TBI),
+ - synchronous cross-CPU shootdown when required.
+
+The helper is used only by migration/compaction paths to avoid changing
+global TLB semantics.
+
+Additionally, update flush_tlb_other(), pte_clear(), to use
+READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering.
+
+This fixes observed crashes on both UP and SMP Alpha systems.
+
+Reviewed-by: Ivan Kokshaysky <ink@unseen.parts>
+Tested-by: Matoro Mahri <matoro_mailinglist_kernel@matoro.tk>
+Tested-by: Michael Cree <mcree@orcon.net.nz>
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/20260102173603.18247-2-linmag7@gmail.com
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/asm/pgtable.h | 33 ++++++++-
+ arch/alpha/include/asm/tlbflush.h | 4 +-
+ arch/alpha/mm/Makefile | 2 +-
+ arch/alpha/mm/tlbflush.c | 112 ++++++++++++++++++++++++++++++
+ 4 files changed, 148 insertions(+), 3 deletions(-)
+ create mode 100644 arch/alpha/mm/tlbflush.c
+
+diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
+index 90e7a95391022..c9508ec37efc4 100644
+--- a/arch/alpha/include/asm/pgtable.h
++++ b/arch/alpha/include/asm/pgtable.h
+@@ -17,6 +17,7 @@
+ #include <asm/processor.h> /* For TASK_SIZE */
+ #include <asm/machvec.h>
+ #include <asm/setup.h>
++#include <linux/page_table_check.h>
+
+ struct mm_struct;
+ struct vm_area_struct;
+@@ -183,6 +184,9 @@ extern inline void pud_set(pud_t * pudp, pmd_t * pmdp)
+ { pud_val(*pudp) = _PAGE_TABLE | ((((unsigned long) pmdp) - PAGE_OFFSET) << (32-PAGE_SHIFT)); }
+
+
++extern void migrate_flush_tlb_page(struct vm_area_struct *vma,
++ unsigned long addr);
++
+ extern inline unsigned long
+ pmd_page_vaddr(pmd_t pmd)
+ {
+@@ -202,7 +206,7 @@ extern inline int pte_none(pte_t pte) { return !pte_val(pte); }
+ extern inline int pte_present(pte_t pte) { return pte_val(pte) & _PAGE_VALID; }
+ extern inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+- pte_val(*ptep) = 0;
++ WRITE_ONCE(pte_val(*ptep), 0);
+ }
+
+ extern inline int pmd_none(pmd_t pmd) { return !pmd_val(pmd); }
+@@ -264,6 +268,33 @@ extern inline pte_t * pte_offset_kernel(pmd_t * dir, unsigned long address)
+
+ extern pgd_t swapper_pg_dir[1024];
+
++#ifdef CONFIG_COMPACTION
++#define __HAVE_ARCH_PTEP_GET_AND_CLEAR
++
++static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
++ unsigned long address,
++ pte_t *ptep)
++{
++ pte_t pte = READ_ONCE(*ptep);
++
++ pte_clear(mm, address, ptep);
++ return pte;
++}
++
++#define __HAVE_ARCH_PTEP_CLEAR_FLUSH
++
++static inline pte_t ptep_clear_flush(struct vm_area_struct *vma,
++ unsigned long addr, pte_t *ptep)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ pte_t pte = ptep_get_and_clear(mm, addr, ptep);
++
++ page_table_check_pte_clear(mm, pte);
++ migrate_flush_tlb_page(vma, addr);
++ return pte;
++}
++
++#endif
+ /*
+ * The Alpha doesn't have any external MMU info: the kernel page
+ * tables contain all the necessary information.
+diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h
+index ba4b359d6c395..0c8529997f54e 100644
+--- a/arch/alpha/include/asm/tlbflush.h
++++ b/arch/alpha/include/asm/tlbflush.h
+@@ -58,7 +58,9 @@ flush_tlb_other(struct mm_struct *mm)
+ unsigned long *mmc = &mm->context[smp_processor_id()];
+ /* Check it's not zero first to avoid cacheline ping pong
+ when possible. */
+- if (*mmc) *mmc = 0;
++
++ if (READ_ONCE(*mmc))
++ WRITE_ONCE(*mmc, 0);
+ }
+
+ #ifndef CONFIG_SMP
+diff --git a/arch/alpha/mm/Makefile b/arch/alpha/mm/Makefile
+index 101dbd06b4ceb..2d05664058f64 100644
+--- a/arch/alpha/mm/Makefile
++++ b/arch/alpha/mm/Makefile
+@@ -3,4 +3,4 @@
+ # Makefile for the linux alpha-specific parts of the memory manager.
+ #
+
+-obj-y := init.o fault.o
++obj-y := init.o fault.o tlbflush.o
+diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
+new file mode 100644
+index 0000000000000..ccbc317b9a348
+--- /dev/null
++++ b/arch/alpha/mm/tlbflush.c
+@@ -0,0 +1,112 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Alpha TLB shootdown helpers
++ *
++ * Copyright (C) 2025 Magnus Lindholm <linmag7@gmail.com>
++ *
++ * Alpha-specific TLB flush helpers that cannot be expressed purely
++ * as inline functions.
++ *
++ * These helpers provide combined MM context handling (ASN rollover)
++ * and immediate TLB invalidation for page migration and memory
++ * compaction paths, where lazy shootdowns are insufficient.
++ */
++
++#include <linux/mm.h>
++#include <linux/smp.h>
++#include <linux/sched.h>
++#include <asm/tlbflush.h>
++#include <asm/pal.h>
++#include <asm/mmu_context.h>
++
++#define asn_locked() (cpu_data[smp_processor_id()].asn_lock)
++
++/*
++ * Migration/compaction helper: combine mm context (ASN) handling with an
++ * immediate per-page TLB invalidate and (for exec) an instruction barrier.
++ *
++ * This mirrors the SMP combined IPI handler semantics, but runs locally on UP.
++ */
++#ifndef CONFIG_SMP
++void migrate_flush_tlb_page(struct vm_area_struct *vma,
++ unsigned long addr)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ int tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2;
++
++ /*
++ * First do the mm-context side:
++ * If we're currently running this mm, reload a fresh context ASN.
++ * Otherwise, mark context invalid.
++ *
++ * On UP, this is mostly about matching the SMP semantics and ensuring
++ * exec/i-cache tagging assumptions hold when compaction migrates pages.
++ */
++ if (mm == current->active_mm)
++ flush_tlb_current(mm);
++ else
++ flush_tlb_other(mm);
++
++ /*
++ * Then do the immediate translation kill for this VA.
++ * For exec mappings, order instruction fetch after invalidation.
++ */
++ tbi(tbi_type, addr);
++}
++
++#else
++struct tlb_mm_and_addr {
++ struct mm_struct *mm;
++ unsigned long addr;
++ int tbi_type; /* 2 = DTB, 3 = ITB+DTB */
++};
++
++static void ipi_flush_mm_and_page(void *x)
++{
++ struct tlb_mm_and_addr *d = x;
++
++ /* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */
++ if (d->mm == current->active_mm && !asn_locked())
++ __load_new_mm_context(d->mm);
++ else
++ flush_tlb_other(d->mm);
++
++ /* Part 2: immediate per-VA invalidation on this CPU. */
++ tbi(d->tbi_type, d->addr);
++}
++
++void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ struct tlb_mm_and_addr d = {
++ .mm = mm,
++ .addr = addr,
++ .tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2,
++ };
++
++ /*
++ * One synchronous rendezvous: every CPU runs ipi_flush_mm_and_page().
++ * This is the "combined" version of flush_tlb_mm + per-page invalidate.
++ */
++ preempt_disable();
++ on_each_cpu(ipi_flush_mm_and_page, &d, 1);
++
++ /*
++ * mimic flush_tlb_mm()'s mm_users<=1 optimization.
++ */
++ if (atomic_read(&mm->mm_users) <= 1) {
++
++ int cpu, this_cpu;
++ this_cpu = smp_processor_id();
++
++ for (cpu = 0; cpu < NR_CPUS; cpu++) {
++ if (!cpu_online(cpu) || cpu == this_cpu)
++ continue;
++ if (READ_ONCE(mm->context[cpu]))
++ WRITE_ONCE(mm->context[cpu], 0);
++ }
++ }
++ preempt_enable();
++}
++
++#endif
+--
+2.51.0
+
--- /dev/null
+From c117476615358374c0e46a1041e4d622dc49ef8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Feb 2026 22:30:01 +0900
+Subject: ALSA: ctxfi: Add quirk for SE-300PCIE variant (160b:0102)
+
+From: Harin Lee <me@harin.net>
+
+[ Upstream commit 3a92733e052753d87fdd56bd6f621f969be28447 ]
+
+Add quirk for the Onkyo SE-300PCIE variant with PCI subsystem ID
+(160b:0102). This variant (OK0011) was found in the official Windows
+driver packages.
+
+Also, reorder entries and fix the indentation to maintain
+consistency.
+
+Signed-off-by: Harin Lee <me@harin.net>
+Link: https://patch.msgid.link/20260208133001.680550-1-me@harin.net
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/ctxfi/ctatc.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c
+index 227d8c8490e1f..a25a599fc5bec 100644
+--- a/sound/pci/ctxfi/ctatc.c
++++ b/sound/pci/ctxfi/ctatc.c
+@@ -52,18 +52,19 @@ static const struct snd_pci_quirk subsys_20k1_list[] = {
+ static const struct snd_pci_quirk subsys_20k2_list[] = {
+ SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB0760,
+ "SB0760", CTSB0760),
+- SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB1270,
+- "SB1270", CTSB1270),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB08801,
+ "SB0880", CTSB0880),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB08802,
+ "SB0880", CTSB0880),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB08803,
+ "SB0880", CTSB0880),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB1270,
++ "SB1270", CTSB1270),
++ SND_PCI_QUIRK(0x160b, 0x0101, "OK0010", CTOK0010),
++ SND_PCI_QUIRK(0x160b, 0x0102, "OK0010", CTOK0010),
+ SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_CREATIVE, 0xf000,
+ PCI_SUBDEVICE_ID_CREATIVE_HENDRIX, "HENDRIX",
+ CTHENDRIX),
+- SND_PCI_QUIRK(0x160b, 0x0101, "OK0010", CTOK0010),
+ { } /* terminator */
+ };
+
+@@ -78,8 +79,8 @@ static const char *ct_subsys_name[NUM_CTCARDS] = {
+ [CTSB0760] = "SB076x",
+ [CTHENDRIX] = "Hendrix",
+ [CTSB0880] = "SB0880",
+- [CTSB1270] = "SB1270",
+- [CTOK0010] = "OK0010",
++ [CTSB1270] = "SB1270",
++ [CTOK0010] = "OK0010",
+ [CT20K2_UNKNOWN] = "Unknown",
+ };
+
+--
+2.51.0
+
--- /dev/null
+From a3e5f6ef243574469a67e881a2e2ab622449545e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 23:55:01 +0800
+Subject: ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
+
+From: gongqi <550230171hxy@gmail.com>
+
+[ Upstream commit f2581ea2d9f30844c437e348a462027ea25c12e9 ]
+
+The headset microphone on the MECHREVO Wujie 15X Pro requires the
+CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID
+(0x1d05:0x3012) to the quirk table.
+
+Signed-off-by: gongqi <550230171hxy@gmail.com>
+Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
+index 0c517378a6d28..f71123a475464 100644
+--- a/sound/hda/codecs/conexant.c
++++ b/sound/hda/codecs/conexant.c
+@@ -1134,6 +1134,7 @@ static const struct hda_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad/Ideapad", CXT_FIXUP_LENOVO_XPAD_ACPI),
+ SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
+ SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
++ SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC),
+ HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER),
+ HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER),
+ {}
+--
+2.51.0
+
--- /dev/null
+From 357393640c454c961609fe2d4defac0cd49f1d86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 21:35:07 +0200
+Subject: ALSA: hda: controllers: intel: add support for Nova Lake
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 7f428282fde34f06f3ab898b8a9081bf93a41f22 ]
+
+Add NVL to the PCI-ID list.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260120193507.14019-5-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/controllers/intel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/hda/controllers/intel.c b/sound/hda/controllers/intel.c
+index 1e8e3d61291a1..1b365e0772970 100644
+--- a/sound/hda/controllers/intel.c
++++ b/sound/hda/controllers/intel.c
+@@ -2551,6 +2551,7 @@ static const struct pci_device_id azx_ids[] = {
+ /* Wildcat Lake */
+ { PCI_DEVICE_DATA(INTEL, HDA_WCL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) },
+ /* Nova Lake */
++ { PCI_DEVICE_DATA(INTEL, HDA_NVL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) },
+ { PCI_DEVICE_DATA(INTEL, HDA_NVL_S, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) },
+ /* Apollolake (Broxton-P) */
+ { PCI_DEVICE_DATA(INTEL, HDA_APL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON) },
+--
+2.51.0
+
--- /dev/null
+From b642debceb0b279dc0e976f0799b1ee0120968df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Feb 2026 22:32:10 +0100
+Subject: ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
+
+From: Aaron Erhardt <aer@tuxedocomputers.com>
+
+[ Upstream commit d649c58bcad8fb9b749e3837136a201632fa109d ]
+
+Depending on the timing during boot, the BIOS might report wrong pin
+capabilities, which can lead to HDMI audio being disabled. Therefore,
+force HDMI audio connection on TUXEDO InfinityBook S 14 Gen6.
+
+Signed-off-by: Aaron Erhardt <aer@tuxedocomputers.com>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260218213234.429686-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/hdmi/hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c
+index 111c9b5335afc..c2e3adc7b3c00 100644
+--- a/sound/hda/codecs/hdmi/hdmi.c
++++ b/sound/hda/codecs/hdmi/hdmi.c
+@@ -1557,6 +1557,7 @@ static const struct snd_pci_quirk force_connect_list[] = {
+ SND_PCI_QUIRK(0x1043, 0x86ae, "ASUS", 1), /* Z170 PRO */
+ SND_PCI_QUIRK(0x1043, 0x86c7, "ASUS", 1), /* Z170M PLUS */
+ SND_PCI_QUIRK(0x1462, 0xec94, "MS-7C94", 1),
++ SND_PCI_QUIRK(0x1558, 0x14a1, "TUXEDO InfinityBook S 14 Gen6", 1),
+ SND_PCI_QUIRK(0x8086, 0x2060, "Intel NUC5CPYB", 1),
+ SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1),
+ {}
+--
+2.51.0
+
--- /dev/null
+From 74e7a062009c9fa3a0b352ddd4a989a3eb44e632 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 00:12:40 +0530
+Subject: ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
+
+From: Bharat Dev Burman <bharat.singh7924@gmail.com>
+
+[ Upstream commit 72919c57a055f6d7b79d66731dc398e9b433f47c ]
+
+HP Victus 16-e0xxx with ALC245 codec does not handle the toggling of
+the mute LED.
+This patch adds a quirk entry for subsystem ID 0x88eb using a new
+ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT fixup, enabling correct mute LED
+behavior.
+
+Signed-off-by: Bharat Dev Burman <bharat.singh7924@gmail.com>
+Link: https://patch.msgid.link/20260112184253.33376-1-bharat.singh7924@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 1964494321006..c9f59e62ee022 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -1551,6 +1551,22 @@ static void alc245_fixup_hp_mute_led_v1_coefbit(struct hda_codec *codec,
+ }
+ }
+
++static void alc245_fixup_hp_mute_led_v2_coefbit(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->mute_led_polarity = 0;
++ spec->mute_led_coef.idx = 0x0b;
++ spec->mute_led_coef.mask = 1 << 3;
++ spec->mute_led_coef.on = 1 << 3;
++ spec->mute_led_coef.off = 0;
++ snd_hda_gen_add_mute_led_cdev(codec, coef_mute_led_set);
++ }
++}
++
+ /* turn on/off mic-mute LED per capture hook by coef bit */
+ static int coef_micmute_led_set(struct led_classdev *led_cdev,
+ enum led_brightness brightness)
+@@ -3828,6 +3844,7 @@ enum {
+ ALC287_FIXUP_YOGA7_14ARB7_I2C,
+ ALC245_FIXUP_HP_MUTE_LED_COEFBIT,
+ ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT,
++ ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT,
+ ALC245_FIXUP_HP_X360_MUTE_LEDS,
+ ALC287_FIXUP_THINKPAD_I2S_SPK,
+ ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD,
+@@ -6165,6 +6182,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc245_fixup_hp_mute_led_v1_coefbit,
+ },
++ [ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc245_fixup_hp_mute_led_v2_coefbit,
++ },
+ [ALC245_FIXUP_HP_X360_MUTE_LEDS] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc245_fixup_hp_mute_led_coefbit,
+@@ -6654,6 +6675,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
++ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT),
+ SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+ SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),
+--
+2.51.0
+
--- /dev/null
+From c03ec08e2781d0522eb2c970fba3f73762be10c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 20:01:33 -0500
+Subject: ALSA: hda/realtek: Add quirk for Minisforum V3 SE
+
+From: Samuel Dionne-Riel <samuel@dionne-riel.com>
+
+[ Upstream commit e3474301824926ecce1d45f2ede7ecdda9a35840 ]
+
+First, adding a generic quirk for Bass speaker DAC avoidance.
+
+This pattern (re-routing the bass speakers off of a DAC without volume
+control) seems common enough that having a "model" to match against and
+quickly use to verify may be worthwhile.
+
+The alc285_fixup_thinkpad_x1_gen7 routing was selected, amongst the
+different options, as it should allow tuning the ratio between both
+speaker set.
+
+The routing was verified using `hda-verb`, and picking either 0x00 or
+0x01. Either routing made the volume of the bass speakers controllable.
+
+ hda-verb /dev/snd/hwC1D0 0x17 SET_CONNECT_SEL 0x01
+
+This likely will apply for the Minisforum V3, though there isn't a lot
+of information to confirm whether or not the identifiers are the same.
+
+This was verified on the Minisforum V3 SE, and the root cause (the bass
+speakers routing) was found out by using pink noise, and playing with
+the mixers.
+
+Signed-off-by: Samuel Dionne-Riel <samuel@dionne-riel.com>
+Link: https://patch.msgid.link/20260203010132.1981419-2-samuel@dionne-riel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index b6fae275919c6..82219f03b212c 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -4046,6 +4046,7 @@ enum {
+ ALC288_FIXUP_SURFACE_SWAP_DACS,
+ ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO,
+ ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY,
++ ALC245_FIXUP_BASS_HP_DAC,
+ };
+
+ /* A special fixup for Lenovo C940 and Yoga Duet 7;
+@@ -6548,6 +6549,11 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc233_fixup_lenovo_gpio2_mic_hotkey,
+ },
++ [ALC245_FIXUP_BASS_HP_DAC] = {
++ .type = HDA_FIXUP_FUNC,
++ /* Borrow the DAC routing selected for those Thinkpads */
++ .v.func = alc285_fixup_thinkpad_x1_gen7,
++ },
+ };
+
+ static const struct hda_quirk alc269_fixup_tbl[] = {
+@@ -7609,6 +7615,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1e39, 0xca14, "MEDION NM14LNL", ALC233_FIXUP_MEDION_MTL_SPK),
+ SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1f4c, 0xe001, "Minisforum V3 (SE)", ALC245_FIXUP_BASS_HP_DAC),
+ SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK),
+@@ -7824,6 +7831,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC285_FIXUP_HP_GPIO_AMP_INIT, .name = "alc285-hp-amp-init"},
+ {.id = ALC236_FIXUP_LENOVO_INV_DMIC, .name = "alc236-fixup-lenovo-inv-mic"},
+ {.id = ALC2XX_FIXUP_HEADSET_MIC, .name = "alc2xx-fixup-headset-mic"},
++ {.id = ALC245_FIXUP_BASS_HP_DAC, .name = "alc245-fixup-bass-hp-dac"},
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
+--
+2.51.0
+
--- /dev/null
+From 9d430e9a8d0c7f427f6e99250ce16360160380ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Dec 2025 17:20:06 +0800
+Subject: ALSA: hda/realtek - Enable Mute LED for Lenovo platform
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit 5de5db35350d9c4def1de2ae273e224a4eee5ed1 ]
+
+Enable SPK Mute Led and Mic Mute Led for Lenovo platform.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Link: https://patch.msgid.link/8a99edffee044e13b6e348d1b69c2b57@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 57 +++++++++++++++++++++++++++++++
+ 1 file changed, 57 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 15203c5855eb5..1964494321006 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -1616,6 +1616,20 @@ static void alc295_fixup_hp_mute_led_coefbit11(struct hda_codec *codec,
+ }
+ }
+
++static void alc233_fixup_lenovo_coef_micmute_led(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->mic_led_coef.idx = 0x10;
++ spec->mic_led_coef.mask = 1 << 13;
++ spec->mic_led_coef.on = 0;
++ spec->mic_led_coef.off = 1 << 13;
++ snd_hda_gen_add_micmute_led_cdev(codec, coef_micmute_led_set);
++ }
++}
++
+ static void alc285_fixup_hp_mute_led(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -1918,6 +1932,39 @@ static void alc280_fixup_hp_gpio2_mic_hotkey(struct hda_codec *codec,
+ }
+ }
+
++/* GPIO2 = mic mute hotkey
++ * GPIO3 = mic mute LED
++ */
++static void alc233_fixup_lenovo_gpio2_mic_hotkey(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ alc233_fixup_lenovo_coef_micmute_led(codec, fix, action);
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ alc_update_coef_idx(codec, 0x10, 1<<2, 1<<2);
++ if (alc_register_micmute_input_device(codec) != 0)
++ return;
++
++ spec->gpio_mask |= 0x04;
++ spec->gpio_dir |= 0x0;
++ snd_hda_codec_write_cache(codec, codec->core.afg, 0,
++ AC_VERB_SET_GPIO_UNSOLICITED_RSP_MASK, 0x04);
++ snd_hda_jack_detect_enable_callback(codec, codec->core.afg,
++ gpio2_mic_hotkey_event);
++ return;
++ }
++
++ if (!spec->kb_dev)
++ return;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_FREE:
++ input_unregister_device(spec->kb_dev);
++ spec->kb_dev = NULL;
++ }
++}
++
+ /* Line2 = mic mute hotkey
+ * GPIO2 = mic mute LED
+ */
+@@ -3816,6 +3863,7 @@ enum {
+ ALC245_FIXUP_HP_TAS2781_I2C_MUTE_LED,
+ ALC288_FIXUP_SURFACE_SWAP_DACS,
+ ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO,
++ ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY,
+ };
+
+ /* A special fixup for Lenovo C940 and Yoga Duet 7;
+@@ -6306,6 +6354,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc288_fixup_surface_swap_dacs,
+ },
++ [ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc233_fixup_lenovo_gpio2_mic_hotkey,
++ },
+ };
+
+ static const struct hda_quirk alc269_fixup_tbl[] = {
+@@ -7213,7 +7265,12 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x31af, "ThinkCentre Station", ALC623_FIXUP_LENOVO_THINKSTATION_P340),
++ SND_PCI_QUIRK(0x17aa, 0x3341, "Lenovo ThinkCentre M90 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
++ SND_PCI_QUIRK(0x17aa, 0x3342, "Lenovo ThinkCentre M90 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
++ SND_PCI_QUIRK(0x17aa, 0x3343, "Lenovo ThinkCentre M70 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
++ SND_PCI_QUIRK(0x17aa, 0x3344, "Lenovo ThinkCentre M70 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x334b, "Lenovo ThinkCentre M70 Gen5", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x17aa, 0x334f, "Lenovo ThinkCentre M90a Gen5", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3384, "ThinkCentre M90a PRO", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED),
+ SND_PCI_QUIRK(0x17aa, 0x3386, "ThinkCentre M90a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED),
+ SND_PCI_QUIRK(0x17aa, 0x3387, "ThinkCentre M70a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED),
+--
+2.51.0
+
--- /dev/null
+From 521394d0404f33c32755263efef2d1ee7f2b6154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Feb 2026 23:19:37 +0100
+Subject: ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
+
+From: Illia Barbashyn <04baril@gmail.com>
+
+[ Upstream commit ac1ff574bbc09a6c90f4fe8f9e6b8d66c983064c ]
+
+The mute and mic-mute LEDs on HP ENVY x360 Convertible 15-es0xxx
+(PCI SSID 103c:88b3) do not work with the current driver.
+
+This model requires a combination of COEFBIT and GPIO fixups to
+correctly control the LEDs. Introduce a new fixup function
+alc245_fixup_hp_envy_x360_mute_led and add a quirk to apply it.
+
+Signed-off-by: Illia Barbashyn <04baril@gmail.com>
+Link: https://patch.msgid.link/20260207221955.24132-1-04baril@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 82219f03b212c..c11312aa5ca76 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -1660,6 +1660,13 @@ static void alc285_fixup_hp_spectre_x360_mute_led(struct hda_codec *codec,
+ alc285_fixup_hp_gpio_micmute_led(codec, fix, action);
+ }
+
++static void alc245_fixup_hp_envy_x360_mute_led(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ alc245_fixup_hp_mute_led_v1_coefbit(codec, fix, action);
++ alc245_fixup_hp_gpio_led(codec, fix, action);
++}
++
+ static void alc236_fixup_hp_mute_led(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -3919,6 +3926,7 @@ enum {
+ ALC285_FIXUP_HP_GPIO_LED,
+ ALC285_FIXUP_HP_MUTE_LED,
+ ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED,
++ ALC245_FIXUP_HP_ENVY_X360_MUTE_LED,
+ ALC285_FIXUP_HP_BEEP_MICMUTE_LED,
+ ALC236_FIXUP_HP_MUTE_LED_COEFBIT2,
+ ALC236_FIXUP_HP_GPIO_LED,
+@@ -5575,6 +5583,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_spectre_x360_mute_led,
+ },
++ [ALC245_FIXUP_HP_ENVY_X360_MUTE_LED] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc245_fixup_hp_envy_x360_mute_led,
++ },
+ [ALC285_FIXUP_HP_BEEP_MICMUTE_LED] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_beep,
+@@ -6848,6 +6860,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8895, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x103c, 0x88b3, "HP ENVY x360 Convertible 15-es0xxx", ALC245_FIXUP_HP_ENVY_X360_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT),
+--
+2.51.0
+
--- /dev/null
+From 1be81f24be6bd78deb743a4f0a7cf4c801bec999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Feb 2026 17:21:12 +0700
+Subject: ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA
+
+From: Erik Sanjaya <sirreidlos@gmail.com>
+
+[ Upstream commit 91062e119b4eafde553c894ca072cd615a6dae2e ]
+
+The ASUS Zenbook 14 UX3405MA uses an ALC294 codec with CS35L41
+amplifiers over SPI. The existing quirk for this model only configured
+the amplifiers, leaving the headset microphone on the combo jack
+non-functional.
+
+Introduce a new fixup that configures pin 0x19 as headset mic input
+and chains to ALC245_FIXUP_CS35L41_SPI_2 to preserve speaker
+functionality.
+
+Similar to the fix done for the UM3406HA in commit 018f659753fd
+("ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14").
+
+Signed-off-by: Erik Sanjaya <sirreidlos@gmail.com>
+Link: https://patch.msgid.link/20260217102112.20651-1-sirreidlos@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index c11312aa5ca76..36053042ca772 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -3886,6 +3886,7 @@ enum {
+ ALC294_FIXUP_ASUS_MIC,
+ ALC294_FIXUP_ASUS_HEADSET_MIC,
+ ALC294_FIXUP_ASUS_I2C_HEADSET_MIC,
++ ALC294_FIXUP_ASUS_SPI_HEADSET_MIC,
+ ALC294_FIXUP_ASUS_SPK,
+ ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+ ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
+@@ -5236,6 +5237,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC287_FIXUP_CS35L41_I2C_2
+ },
++ [ALC294_FIXUP_ASUS_SPI_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x04a11020 }, /* use as headset mic */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC245_FIXUP_CS35L41_SPI_2
++ },
+ [ALC294_FIXUP_ASUS_SPK] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -7189,7 +7199,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
+ SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+- SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC294_FIXUP_ASUS_SPI_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x1a8e, "ASUS G712LWS", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2),
+--
+2.51.0
+
--- /dev/null
+From 1dff336a75d2086049ea913b37f0d64452446063 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 18:14:52 +0100
+Subject: ALSA: hda/realtek: fix LG Gram Style 14 speakers
+
+From: Damien Dagorn <damien.dagorn29@gmail.com>
+
+[ Upstream commit cc051fbd7f40226cc407558bc97c5099513e8657 ]
+
+The LG Gram Style 14 (14Z90RS-G.AD77F, SSID 1854:0490) with Realtek ALC298
+shows normal routing and volume changes, but internal speakers stay silent
+unless a userland HDA-verb workaround is applied.
+
+Add a dedicated quirk for the LG Gram Style 14 that programs the codec
+coefficient sequence used by the known workaround and enables the speaker
+amps only during playback.
+
+Tested-by: Damien Dagorn <damien.dagorn29@gmail.com>
+Signed-off-by: Damien Dagorn <damien.dagorn29@gmail.com>
+Link: https://lore.kernel.org/CAN59QMUhd4kHrkRoJA6VzEr2VKezN2yjHnANaQoZn2-Bnwe3bQ@mail.gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 170 ++++++++++++++++++++++++++++++
+ 1 file changed, 170 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index c9f59e62ee022..b6fae275919c6 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -1854,6 +1854,163 @@ static void alc298_samsung_v2_init_amps(struct hda_codec *codec,
+ spec->gen.pcm_playback_hook = alc298_samsung_v2_playback_hook;
+ }
+
++/* LG Gram Style 14: program vendor coef sequence used by HDA-verb workaround */
++struct alc298_lg_gram_style_seq {
++ unsigned short verb;
++ unsigned short idx;
++ unsigned short val;
++};
++
++static void alc298_lg_gram_style_coef_write(struct hda_codec *codec,
++ unsigned int verb,
++ unsigned int idx,
++ unsigned int val)
++{
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_COEF_INDEX, 0x23);
++ snd_hda_codec_write(codec, 0x20, 0, verb, idx);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0x00);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, val);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0xb011);
++}
++
++static void alc298_lg_gram_style_run_seq(struct hda_codec *codec,
++ const struct alc298_lg_gram_style_seq *seq,
++ int seq_size)
++{
++ int i;
++
++ for (i = 0; i < seq_size; i++)
++ alc298_lg_gram_style_coef_write(codec, seq[i].verb,
++ seq[i].idx, seq[i].val);
++}
++
++/* Coef sequences derived from the HDA-verb workaround for this model. */
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_preinit_seq[] = {
++ { 0x420, 0x00, 0x01 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_disable_seq[] = {
++ { 0x423, 0xff, 0x00 },
++ { 0x420, 0x3a, 0x80 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_enable_seq[] = {
++ { 0x420, 0x3a, 0x81 },
++ { 0x423, 0xff, 0x01 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_38[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe },
++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 },
++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_39[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd },
++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 },
++ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3c[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe },
++ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d },
++};
++
++static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3d[] = {
++ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
++ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd },
++ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
++ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
++ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d },
++};
++
++struct alc298_lg_gram_style_amp_desc {
++ unsigned char nid;
++ const struct alc298_lg_gram_style_seq *init_seq;
++ int init_seq_size;
++};
++
++static const struct alc298_lg_gram_style_amp_desc alc298_lg_gram_style_amps[] = {
++ { 0x38, alc298_lg_gram_style_init_seq_38,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_38) },
++ { 0x39, alc298_lg_gram_style_init_seq_39,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_39) },
++ { 0x3c, alc298_lg_gram_style_init_seq_3c,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3c) },
++ { 0x3d, alc298_lg_gram_style_init_seq_3d,
++ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3d) },
++};
++
++static void alc298_lg_gram_style_enable_amps(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ int i;
++
++ for (i = 0; i < spec->num_speaker_amps; i++) {
++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_enable_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_enable_seq));
++ }
++}
++
++static void alc298_lg_gram_style_disable_amps(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ int i;
++
++ for (i = 0; i < spec->num_speaker_amps; i++) {
++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_disable_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq));
++ }
++}
++
++static void alc298_lg_gram_style_playback_hook(struct hda_pcm_stream *hinfo,
++ struct hda_codec *codec,
++ struct snd_pcm_substream *substream,
++ int action)
++{
++ if (action == HDA_GEN_PCM_ACT_OPEN)
++ alc298_lg_gram_style_enable_amps(codec);
++ if (action == HDA_GEN_PCM_ACT_CLOSE)
++ alc298_lg_gram_style_disable_amps(codec);
++}
++
++static void alc298_lg_gram_style_init_amps(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ int i;
++
++ spec->num_speaker_amps = ARRAY_SIZE(alc298_lg_gram_style_amps);
++
++ for (i = 0; i < spec->num_speaker_amps; i++) {
++ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_preinit_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_preinit_seq));
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_disable_seq,
++ ARRAY_SIZE(alc298_lg_gram_style_disable_seq));
++ alc298_lg_gram_style_run_seq(codec,
++ alc298_lg_gram_style_amps[i].init_seq,
++ alc298_lg_gram_style_amps[i].init_seq_size);
++ alc_write_coef_idx(codec, 0x89, 0x0);
++ }
++
++ spec->gen.pcm_playback_hook = alc298_lg_gram_style_playback_hook;
++}
++
+ static void alc298_fixup_samsung_amp_v2_2_amps(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -1868,6 +2025,13 @@ static void alc298_fixup_samsung_amp_v2_4_amps(struct hda_codec *codec,
+ alc298_samsung_v2_init_amps(codec, 4);
+ }
+
++static void alc298_fixup_lg_gram_style_14(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PROBE)
++ alc298_lg_gram_style_init_amps(codec);
++}
++
+ static void gpio2_mic_hotkey_event(struct hda_codec *codec,
+ struct hda_jack_callback *event)
+ {
+@@ -3764,6 +3928,7 @@ enum {
+ ALC298_FIXUP_SAMSUNG_AMP,
+ ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS,
+ ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS,
++ ALC298_FIXUP_LG_GRAM_STYLE_14,
+ ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ ALC295_FIXUP_ASUS_MIC_NO_PRESENCE,
+@@ -5459,6 +5624,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc298_fixup_samsung_amp_v2_4_amps
+ },
++ [ALC298_FIXUP_LG_GRAM_STYLE_14] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc298_fixup_lg_gram_style_14
++ },
+ [ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -7406,6 +7575,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1854, 0x0488, "LG gram 16 (16Z90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
+ SND_PCI_QUIRK(0x1854, 0x0489, "LG gram 16 (16Z90R-A)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
+ SND_PCI_QUIRK(0x1854, 0x048a, "LG gram 17 (17ZD90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
++ SND_PCI_QUIRK(0x1854, 0x0490, "LG Gram Style 14 (14Z90RS)", ALC298_FIXUP_LG_GRAM_STYLE_14),
+ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
+ SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x19e5, 0x3212, "Huawei KLV-WX9 ", ALC256_FIXUP_ACER_HEADSET_MIC),
+--
+2.51.0
+
--- /dev/null
+From 94314611f6f5e01908868021a83a5a820c1d8717 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 11:09:46 +0800
+Subject: ALSA: hda/tas2781: Ignore reset check for SPI device
+
+From: Baojun Xu <baojun.xu@ti.com>
+
+[ Upstream commit 908ef80e31e4d3bd953a0088fe57640cd9ae7b3e ]
+
+In the SPI driver probe, the device should be in the default state, so the
+device status check is not necessary. It should be forced to do the
+firmware download as I2C device.
+
+Signed-off-by: Baojun Xu <baojun.xu@ti.com>
+Link: https://patch.msgid.link/20260211030946.2330-1-baojun.xu@ti.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hda/codecs/side-codecs/tas2781_hda_spi.c | 20 +++++++------------
+ 1 file changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
+index b9a55672bf15d..488e35dac9524 100644
+--- a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
++++ b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
+@@ -634,7 +634,7 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context)
+ struct tasdevice_priv *tas_priv = context;
+ struct tas2781_hda *tas_hda = dev_get_drvdata(tas_priv->dev);
+ struct hda_codec *codec = tas_priv->codec;
+- int ret, val;
++ int ret;
+
+ pm_runtime_get_sync(tas_priv->dev);
+ guard(mutex)(&tas_priv->codec_lock);
+@@ -673,20 +673,14 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context)
+ tas_priv->rcabin.profile_cfg_id = 0;
+
+ tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
+- ret = tasdevice_spi_dev_read(tas_priv, tas_priv->index,
+- TAS2781_REG_CLK_CONFIG, &val);
+- if (ret < 0)
+- goto out;
+
+- if (val == TAS2781_REG_CLK_CONFIG_RESET) {
+- ret = tasdevice_prmg_load(tas_priv, 0);
+- if (ret < 0) {
+- dev_err(tas_priv->dev, "FW download failed = %d\n",
+- ret);
+- goto out;
+- }
+- tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
++ ret = tasdevice_prmg_load(tas_priv, 0);
++ if (ret < 0) {
++ dev_err(tas_priv->dev, "FW download failed = %d\n", ret);
++ goto out;
+ }
++ tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
++
+ if (tas_priv->fmw->nr_programs > 0)
+ tas_priv->tasdevice[tas_priv->index].cur_prog = 0;
+ if (tas_priv->fmw->nr_configurations > 0)
+--
+2.51.0
+
--- /dev/null
+From 26bc0cd08cfdb7e84f36dba94093ef11714e3e36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 13:12:11 +0100
+Subject: ALSA: mixer: oss: Add card disconnect checkpoints
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 084d5d44418148662365eced3e126ad1a81ee3e2 ]
+
+ALSA OSS mixer layer calls the kcontrol ops rather individually, and
+pending calls might be not always caught at disconnecting the device.
+
+For avoiding the potential UAF scenarios, add sanity checks of the
+card disconnection at each entry point of OSS mixer accesses. The
+rwsem is taken just before that check, hence the rest context should
+be covered by that properly.
+
+Link: https://patch.msgid.link/20260209121212.171430-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/oss/mixer_oss.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
+index 8d2d46d03301b..f4ad0bfb4dac6 100644
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -523,6 +523,8 @@ static void snd_mixer_oss_get_volume1_vol(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -557,6 +559,8 @@ static void snd_mixer_oss_get_volume1_sw(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -618,6 +622,8 @@ static void snd_mixer_oss_put_volume1_vol(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -656,6 +662,8 @@ static void snd_mixer_oss_put_volume1_sw(struct snd_mixer_oss_file *fmixer,
+ if (numid == ID_UNKNOWN)
+ return;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return;
+ kctl = snd_ctl_find_numid(card, numid);
+ if (!kctl)
+ return;
+@@ -796,6 +804,8 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
+ if (uinfo == NULL || uctl == NULL)
+ return -ENOMEM;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return -ENODEV;
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+ if (!kctl)
+ return -ENOENT;
+@@ -839,6 +849,8 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
+ if (uinfo == NULL || uctl == NULL)
+ return -ENOMEM;
+ guard(rwsem_read)(&card->controls_rwsem);
++ if (card->shutdown)
++ return -ENODEV;
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+ if (!kctl)
+ return -ENOENT;
+@@ -885,6 +897,8 @@ static int snd_mixer_oss_build_test(struct snd_mixer_oss *mixer, struct slot *sl
+ if (!info)
+ return -ENOMEM;
+ scoped_guard(rwsem_read, &card->controls_rwsem) {
++ if (card->shutdown)
++ return -ENODEV;
+ kcontrol = snd_mixer_oss_test_id(mixer, name, index);
+ if (kcontrol == NULL)
+ return 0;
+@@ -1006,6 +1020,8 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer,
+ if (snd_mixer_oss_build_test_all(mixer, ptr, &slot))
+ return 0;
+ guard(rwsem_read)(&mixer->card->controls_rwsem);
++ if (mixer->card->shutdown)
++ return -ENODEV;
+ kctl = NULL;
+ if (!ptr->index)
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+--
+2.51.0
+
--- /dev/null
+From 17bb1dccc6549c2d9378c99f6fed12489135bb5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 18:04:18 +0800
+Subject: ALSA: usb-audio: Add DSD support for iBasso DC04U
+
+From: Qihang Guo <v-conet@outlook.com>
+
+[ Upstream commit fe7cd89f0e29f0852316857b4861309f9b891370 ]
+
+Vendor ID 0x0661 is assigned to Hamamatsu Photonics K.K.,
+but is used by iBasso for iBasso DC04U (0x0661:0x0883),
+which supports native DSD playback.
+
+This patch adds QUIRK_FLAG_DSD_RAW for iBasso DC04U, enabling
+native DSD playback (DSD_U32_BE). The change has been verified
+on Arch Linux using mpd and pw-cat.
+
+Signed-off-by: Qihang Guo <v-conet@outlook.com>
+Link: https://patch.msgid.link/TYYPR01MB14098529E0BD900921BE6F42CF465A@TYYPR01MB14098.jpnprd01.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 4f9d19bf1ccac..7fabaeb3781a2 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2235,6 +2235,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ DEVICE_FLG(0x0644, 0x806c, /* Esoteric XD */
+ QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY |
+ QUIRK_FLAG_IFACE_DELAY | QUIRK_FLAG_FORCE_IFACE_RESET),
++ DEVICE_FLG(0x0661, 0x0883, /* iBasso DC04 Ultra */
++ QUIRK_FLAG_DSD_RAW),
+ DEVICE_FLG(0x06f8, 0xb000, /* Hercules DJ Console (Windows Edition) */
+ QUIRK_FLAG_IGNORE_CTL_ERROR),
+ DEVICE_FLG(0x06f8, 0xd002, /* Hercules DJ Console (Macintosh Edition) */
+--
+2.51.0
+
--- /dev/null
+From 6c027da59799abd57b42e18be1560eb51348b32e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 08:38:29 +0000
+Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
+
+From: Lianqin Hu <hulianqin@vivo.com>
+
+[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ]
+
+Setting up the interface when suspended/resumeing fail on this card.
+Adding a reset and delay quirk will eliminate this problem.
+
+usb 1-1: New USB device found, idVendor=001f, idProduct=0b21
+usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+usb 1-1: Product: AB13X USB Audio
+usb 1-1: Manufacturer: Generic
+usb 1-1: SerialNumber: 20210926172016
+
+Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
+Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 7fabaeb3781a2..86c329632e396 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2146,6 +2146,8 @@ struct usb_audio_quirk_flags_table {
+
+ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ /* Device matches */
++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */
++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
+ DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
+ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
+ DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
+--
+2.51.0
+
--- /dev/null
+From 514985d35f01ef684c62234b308bd6906303d749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:07 +0100
+Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ]
+
+At silencing the playback URB packets in the implicit fb mode before
+the actual playback, we blindly assume that the received packets fit
+with the buffer size. But when the setup in the capture stream
+differs from the playback stream (e.g. due to the USB core limitation
+of max packet size), such an inconsistency may lead to OOB writes to
+the buffer, resulting in a crash.
+
+For addressing it, add a sanity check of the transfer buffer size at
+prepare_silent_urb(), and stop the data copy if the received data
+overflows. Also, report back the transfer error properly from there,
+too.
+
+Note that this doesn't fix the root cause of the playback error
+itself, but this merely covers the kernel Oops.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
+Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 39 ++++++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 17 deletions(-)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 27ade2aa16f5a..1eaf52d1ae9c7 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -275,8 +275,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip)
+ return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH;
+ }
+
+-static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+- struct snd_urb_ctx *ctx)
++static int prepare_silent_urb(struct snd_usb_endpoint *ep,
++ struct snd_urb_ctx *ctx)
+ {
+ struct urb *urb = ctx->urb;
+ unsigned int offs = 0;
+@@ -289,28 +289,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+ extra = sizeof(packet_length);
+
+ for (i = 0; i < ctx->packets; ++i) {
+- unsigned int offset;
+- unsigned int length;
+- int counts;
+-
+- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
+- length = counts * ep->stride; /* number of silent bytes */
+- offset = offs * ep->stride + extra * i;
+- urb->iso_frame_desc[i].offset = offset;
++ int length;
++
++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
++ if (length < 0)
++ return length;
++ length *= ep->stride; /* number of silent bytes */
++ if (offs + length + extra > ctx->buffer_size)
++ break;
++ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = length + extra;
+ if (extra) {
+ packet_length = cpu_to_le32(length);
+- memcpy(urb->transfer_buffer + offset,
++ memcpy(urb->transfer_buffer + offs,
+ &packet_length, sizeof(packet_length));
++ offs += extra;
+ }
+- memset(urb->transfer_buffer + offset + extra,
++ memset(urb->transfer_buffer + offs,
+ ep->silence_value, length);
+- offs += counts;
++ offs += length;
+ }
+
+- urb->number_of_packets = ctx->packets;
+- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra;
++ if (!offs)
++ return -EPIPE;
++
++ urb->number_of_packets = i;
++ urb->transfer_buffer_length = offs;
+ ctx->queued = 0;
++ return 0;
+ }
+
+ /*
+@@ -332,8 +338,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep,
+ if (data_subs && ep->prepare_data_urb)
+ return ep->prepare_data_urb(data_subs, urb, in_stream_lock);
+ /* no data provider, so send silence */
+- prepare_silent_urb(ep, ctx);
+- break;
++ return prepare_silent_urb(ep, ctx);
+
+ case SND_USB_ENDPOINT_TYPE_SYNC:
+ if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) {
+--
+2.51.0
+
--- /dev/null
+From 0a5e1ebfc19e55e9db199bbef8e607ab6fbc59b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jan 2026 16:36:40 -0500
+Subject: ALSA: usb-audio: presonus s18xx uses little-endian
+
+From: fenugrec <fenugrec@mail.com>
+
+[ Upstream commit 3ce03297baff0ba116769044e4594fb324d4a551 ]
+
+Use __le32 types for USB control transfers
+
+Signed-off-by: fenugrec <fenugrec@mail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260111-preso_clean1-v2-1-44b4e5129a75@mail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_s1810c.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
+index 6e09e074c0e7f..93510aa0dc5ef 100644
+--- a/sound/usb/mixer_s1810c.c
++++ b/sound/usb/mixer_s1810c.c
+@@ -82,13 +82,13 @@
+ * mixer and output but a different set for device.
+ */
+ struct s1810c_ctl_packet {
+- u32 a;
+- u32 b;
+- u32 fixed1;
+- u32 fixed2;
+- u32 c;
+- u32 d;
+- u32 e;
++ __le32 a;
++ __le32 b;
++ __le32 fixed1;
++ __le32 fixed2;
++ __le32 c;
++ __le32 d;
++ __le32 e;
+ };
+
+ #define SC1810C_CTL_LINE_SW 0
+@@ -118,7 +118,7 @@ struct s1810c_ctl_packet {
+ * being zero and different f1/f2.
+ */
+ struct s1810c_state_packet {
+- u32 fields[63];
++ __le32 fields[63];
+ };
+
+ #define SC1810C_STATE_48V_SW 58
+@@ -140,14 +140,14 @@ snd_s1810c_send_ctl_packet(struct usb_device *dev, u32 a,
+ struct s1810c_ctl_packet pkt = { 0 };
+ int ret = 0;
+
+- pkt.fixed1 = SC1810C_CMD_F1;
+- pkt.fixed2 = SC1810C_CMD_F2;
++ pkt.fixed1 = __cpu_to_le32(SC1810C_CMD_F1);
++ pkt.fixed2 = __cpu_to_le32(SC1810C_CMD_F2);
+
+- pkt.a = a;
+- pkt.b = b;
+- pkt.c = c;
+- pkt.d = d;
+- pkt.e = e;
++ pkt.a = __cpu_to_le32(a);
++ pkt.b = __cpu_to_le32(b);
++ pkt.c = __cpu_to_le32(c);
++ pkt.d = __cpu_to_le32(d);
++ pkt.e = __cpu_to_le32(e);
+
+ ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
+ SC1810C_CMD_REQ,
+@@ -176,8 +176,8 @@ snd_sc1810c_get_status_field(struct usb_device *dev,
+ struct s1810c_state_packet pkt_in = { { 0 } };
+ int ret = 0;
+
+- pkt_out.fields[SC1810C_STATE_F1_IDX] = SC1810C_SET_STATE_F1;
+- pkt_out.fields[SC1810C_STATE_F2_IDX] = SC1810C_SET_STATE_F2;
++ pkt_out.fields[SC1810C_STATE_F1_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F1);
++ pkt_out.fields[SC1810C_STATE_F2_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F2);
+ ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
+ SC1810C_SET_STATE_REQ,
+ SC1810C_SET_STATE_REQTYPE,
+@@ -197,7 +197,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev,
+ return ret;
+ }
+
+- (*field) = pkt_in.fields[field_idx];
++ (*field) = __le32_to_cpu(pkt_in.fields[field_idx]);
+ (*seqnum)++;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 2fca7c8e7fb59f83beb683088d441b11f0916a20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:05 +0100
+Subject: ALSA: usb-audio: Update the number of packets properly at receiving
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ]
+
+At receiving the packets from the implicit feedback source, we didn't
+update ctx->packets field but only the ctx->packet_size[] data.
+In exceptional cases, this might lead to unexpectedly superfluous data
+transfer (although this won't happen usually due to the nature of USB
+isochronous transfer). Fix it to update the field properly.
+
+Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 8f9313857ee9d..27ade2aa16f5a 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -481,6 +481,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+
+ /* copy over the length information */
+ if (implicit_fb) {
++ ctx->packets = packet->packets;
+ for (i = 0; i < packet->packets; i++)
+ ctx->packet_size[i] = packet->packet_size[i];
+ }
+--
+2.51.0
+
--- /dev/null
+From 325188c55418809ceb43be56412185be4731cfb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:03 +0100
+Subject: APEI/GHES: ARM processor Error: don't go past allocated memory
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 87880af2d24e62a84ed19943dbdd524f097172f2 ]
+
+If the BIOS generates a very small ARM Processor Error, or
+an incomplete one, the current logic will fail to deferrence
+
+ err->section_length
+and
+ ctx_info->size
+
+Add checks to avoid that. With such changes, such GHESv2
+records won't cause OOPSes like this:
+
+[ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP
+[ 1.495449] Modules linked in:
+[ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT
+[ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+[ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred
+[ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+[ 1.497199] pc : log_arm_hw_error+0x5c/0x200
+[ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220
+
+0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75).
+70 err_info = (struct cper_arm_err_info *)(err + 1);
+71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num);
+72 ctx_err = (u8 *)ctx_info;
+73
+74 for (n = 0; n < err->context_info_num; n++) {
+75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
+76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
+77 ctx_len += sz;
+78 }
+79
+
+and similar ones while trying to access section_length on an
+error dump with too small size.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 32 ++++++++++++++++++++++++++++----
+ drivers/ras/ras.c | 6 +++++-
+ 2 files changed, 33 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index a37c8fb574832..77ea7a5b761f1 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -556,21 +556,45 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
+ {
+ struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata);
+ int flags = sync ? MF_ACTION_REQUIRED : 0;
++ int length = gdata->error_data_length;
+ char error_type[120];
+ bool queued = false;
+ int sec_sev, i;
+ char *p;
+
+ sec_sev = ghes_severity(gdata->error_severity);
+- log_arm_hw_error(err, sec_sev);
++ if (length >= sizeof(*err)) {
++ log_arm_hw_error(err, sec_sev);
++ } else {
++ pr_warn(FW_BUG "arm error length: %d\n", length);
++ pr_warn(FW_BUG "length is too small\n");
++ pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
++ return false;
++ }
++
+ if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE)
+ return false;
+
+ p = (char *)(err + 1);
++ length -= sizeof(err);
++
+ for (i = 0; i < err->err_info_num; i++) {
+- struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p;
+- bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR;
+- bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR);
++ struct cper_arm_err_info *err_info;
++ bool is_cache, has_pa;
++
++ /* Ensure we have enough data for the error info header */
++ if (length < sizeof(*err_info))
++ break;
++
++ err_info = (struct cper_arm_err_info *)p;
++
++ /* Validate the claimed length before using it */
++ length -= err_info->length;
++ if (length < 0)
++ break;
++
++ is_cache = err_info->type & CPER_ARM_CACHE_ERROR;
++ has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR);
+
+ /*
+ * The field (err_info->error_info & BIT(26)) is fixed to set to
+diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
+index 2a5b5a9fdcb36..03df3db623346 100644
+--- a/drivers/ras/ras.c
++++ b/drivers/ras/ras.c
+@@ -72,7 +72,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
+ ctx_err = (u8 *)ctx_info;
+
+ for (n = 0; n < err->context_info_num; n++) {
+- sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
++ sz = sizeof(struct cper_arm_ctx_info);
++
++ if (sz + (long)ctx_info - (long)err >= err->section_length)
++ sz += ctx_info->size;
++
+ ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
+ ctx_len += sz;
+ }
+--
+2.51.0
+
--- /dev/null
+From 15e6687ec479226d800224e49d8566e8c7f0e72c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:05 +0100
+Subject: APEI/GHES: ensure that won't go past CPER allocated record
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ]
+
+The logic at ghes_new() prevents allocating too large records, by
+checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
+Yet, the allocation is done with the actual number of pages from the
+CPER bios table location, which can be smaller.
+
+Yet, a bad firmware could send data with a different size, which might
+be bigger than the allocated memory, causing an OOPS:
+
+ Unable to handle kernel paging request at virtual address fff00000f9b40000
+ Mem abort info:
+ ESR = 0x0000000096000007
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x07: level 3 translation fault
+ Data abort info:
+ ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+ swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
+ [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
+ Internal error: Oops: 0000000096000007 [#1] SMP
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
+ Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+ Workqueue: kacpi_notify acpi_os_execute_deferred
+ pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+ pc : hex_dump_to_buffer+0x30c/0x4a0
+ lr : hex_dump_to_buffer+0x328/0x4a0
+ sp : ffff800080e13880
+ x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
+ x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
+ x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
+ x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
+ x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
+ x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
+ x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
+ x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
+ x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
+ x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
+ Call trace:
+ hex_dump_to_buffer+0x30c/0x4a0 (P)
+ print_hex_dump+0xac/0x170
+ cper_estatus_print_section+0x90c/0x968
+ cper_estatus_print+0xf0/0x158
+ __ghes_print_estatus+0xa0/0x148
+ ghes_proc+0x1bc/0x220
+ ghes_notify_hed+0x5c/0xb8
+ notifier_call_chain+0x78/0x148
+ blocking_notifier_call_chain+0x4c/0x80
+ acpi_hed_notify+0x28/0x40
+ acpi_ev_notify_dispatch+0x50/0x80
+ acpi_os_execute_deferred+0x24/0x48
+ process_one_work+0x15c/0x3b0
+ worker_thread+0x2d0/0x400
+ kthread+0x148/0x228
+ ret_from_fork+0x10/0x20
+ Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
+ ---[ end trace 0000000000000000 ]---
+
+Prevent that by taking the actual allocated are into account when
+checking for CPER length.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 6 +++++-
+ include/acpi/ghes.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 0dc767392a6c6..a37c8fb574832 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -29,6 +29,7 @@
+ #include <linux/cper.h>
+ #include <linux/cleanup.h>
+ #include <linux/platform_device.h>
++#include <linux/minmax.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+ #include <linux/vmalloc.h>
+@@ -294,6 +295,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
+ error_block_length = GHES_ESTATUS_MAX_SIZE;
+ }
+ ghes->estatus = kmalloc(error_block_length, GFP_KERNEL);
++ ghes->estatus_length = error_block_length;
+ if (!ghes->estatus) {
+ rc = -ENOMEM;
+ goto err_unmap_status_addr;
+@@ -365,13 +367,15 @@ static int __ghes_check_estatus(struct ghes *ghes,
+ struct acpi_hest_generic_status *estatus)
+ {
+ u32 len = cper_estatus_len(estatus);
++ u32 max_len = min(ghes->generic->error_block_length,
++ ghes->estatus_length);
+
+ if (len < sizeof(*estatus)) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n");
+ return -EIO;
+ }
+
+- if (len > ghes->generic->error_block_length) {
++ if (!len || len > max_len) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n");
+ return -EIO;
+ }
+diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
+index ebd21b05fe6ed..93db60da5934e 100644
+--- a/include/acpi/ghes.h
++++ b/include/acpi/ghes.h
+@@ -21,6 +21,7 @@ struct ghes {
+ struct acpi_hest_generic_v2 *generic_v2;
+ };
+ struct acpi_hest_generic_status *estatus;
++ unsigned int estatus_length;
+ unsigned long flags;
+ union {
+ struct list_head list;
+--
+2.51.0
+
--- /dev/null
+From fa9b8834dc9f71fa7b70a8bf4be856c57130a36c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 10:56:33 +0100
+Subject: ARM: 9467/1: mm: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weissschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ]
+
+Restricted pointers ("%pK") were never meant to be used
+through printk(). They can acquire sleeping locks in atomic contexts.
+
+Switch to %px over the more secure %p as this usage is a debugging aid,
+gated behind CONFIG_DEBUG_VIRTUAL and used by WARN().
+
+Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/physaddr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c
+index 3f263c840ebc4..1a37ebfacbba9 100644
+--- a/arch/arm/mm/physaddr.c
++++ b/arch/arm/mm/physaddr.c
+@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x)
+ phys_addr_t __virt_to_phys(unsigned long x)
+ {
+ WARN(!__virt_addr_valid(x),
+- "virt_to_phys used for non-linear address: %pK (%pS)\n",
++ "virt_to_phys used for non-linear address: %px (%pS)\n",
+ (void *)x, (void *)x);
+
+ return __virt_to_phys_nodebug(x);
+--
+2.51.0
+
--- /dev/null
+From e0c73cf95ab594b3c783ad681b2566af53d48e6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 17:24:48 +0800
+Subject: arm64: Add support for TSV110 Spectre-BHB mitigation
+
+From: Jinqian Yang <yangjinqian1@huawei.com>
+
+[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ]
+
+The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
+Buffer) attack, which can be exploited to leak information through
+branch prediction side channels. This commit adds the MIDR of TSV110
+to the list for software mitigation.
+
+Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
+Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/proton-pack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
+index 80a580e019c50..b3801f532b10b 100644
+--- a/arch/arm64/kernel/proton-pack.c
++++ b/arch/arm64/kernel/proton-pack.c
+@@ -887,6 +887,7 @@ static u8 spectre_bhb_loop_affected(void)
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ {},
+ };
+ static const struct midr_range spectre_bhb_k24_list[] = {
+--
+2.51.0
+
--- /dev/null
+From 35ed926bafd216785f922097f8e839f4630ac86b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:11:56 +0100
+Subject: arm64/ftrace,bpf: Fix partial regs after bpf_prog_run
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 276f3b6daf6024ae2742afd161e7418a5584a660 ]
+
+Mahe reported issue with bpf_override_return helper not working when
+executed from kprobe.multi bpf program on arm.
+
+The problem is that on arm we use alternate storage for pt_regs object
+that is passed to bpf_prog_run and if any register is changed (which
+is the case of bpf_override_return) it's not propagated back to actual
+pt_regs object.
+
+Fixing this by introducing and calling ftrace_partial_regs_update function
+to propagate the values of changed registers (ip and stack).
+
+Reported-by: Mahe Tardy <mahe.tardy@gmail.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/bpf/20260112121157.854473-1-jolsa@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ftrace_regs.h | 25 +++++++++++++++++++++++++
+ kernel/trace/bpf_trace.c | 1 +
+ 2 files changed, 26 insertions(+)
+
+diff --git a/include/linux/ftrace_regs.h b/include/linux/ftrace_regs.h
+index 15627ceea9bcc..386fa48c4a957 100644
+--- a/include/linux/ftrace_regs.h
++++ b/include/linux/ftrace_regs.h
+@@ -33,6 +33,31 @@ struct ftrace_regs;
+ #define ftrace_regs_get_frame_pointer(fregs) \
+ frame_pointer(&arch_ftrace_regs(fregs)->regs)
+
++static __always_inline void
++ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs) { }
++
++#else
++
++/*
++ * ftrace_partial_regs_update - update the original ftrace_regs from regs
++ * @fregs: The ftrace_regs to update from @regs
++ * @regs: The partial regs from ftrace_partial_regs() that was updated
++ *
++ * Some architectures have the partial regs living in the ftrace_regs
++ * structure, whereas other architectures need to make a different copy
++ * of the @regs. If a partial @regs is retrieved by ftrace_partial_regs() and
++ * if the code using @regs updates a field (like the instruction pointer or
++ * stack pointer) it may need to propagate that change to the original @fregs
++ * it retrieved the partial @regs from. Use this function to guarantee that
++ * update happens.
++ */
++static __always_inline void
++ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs)
++{
++ ftrace_regs_set_instruction_pointer(fregs, instruction_pointer(regs));
++ ftrace_regs_set_return_value(fregs, regs_return_value(regs));
++}
++
+ #endif /* HAVE_ARCH_FTRACE_REGS */
+
+ /* This can be overridden by the architectures */
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 59c2394981c72..325579c7da260 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2564,6 +2564,7 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
+ old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
+ err = bpf_prog_run(link->link.prog, regs);
+ bpf_reset_run_ctx(old_run_ctx);
++ ftrace_partial_regs_update(fregs, bpf_kprobe_multi_pt_regs_ptr());
+ rcu_read_unlock();
+
+ out:
+--
+2.51.0
+
--- /dev/null
+From 8d0306e642a437d89b909f456f601bdfb1f6de3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 11:54:21 +0100
+Subject: arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 729a2e8e9ac47099a967567389cc9d73ef4194ca ]
+
+gcc-16 warns about an instance that older compilers did not:
+
+arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_clear':
+arch/arm64/mm/hugetlbpage.c:369:57: error: parameter 'addr' set but not used [-Werror=unused-but-set-parameter=]
+
+The issue here is that __pte_clear() does not actually use its second
+argument, but when CONFIG_ARM64_CONTPTE is enabled it still gets
+updated.
+
+Replace the macro with an inline function to let the compiler see
+the argument getting passed down.
+
+Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Dev Jain <dev.jain@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/pgtable.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 64d5f1d9cce96..5ab5fe3bef25e 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -179,8 +179,6 @@ static inline pteval_t __phys_to_pte_val(phys_addr_t phys)
+ __pte(__phys_to_pte_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))
+
+ #define pte_none(pte) (!pte_val(pte))
+-#define __pte_clear(mm, addr, ptep) \
+- __set_pte(ptep, __pte(0))
+ #define pte_page(pte) (pfn_to_page(pte_pfn(pte)))
+
+ /*
+@@ -1320,6 +1318,13 @@ static inline bool pud_user_accessible_page(pud_t pud)
+ /*
+ * Atomic pte/pmd modifications.
+ */
++
++static inline void __pte_clear(struct mm_struct *mm,
++ unsigned long addr, pte_t *ptep)
++{
++ __set_pte(ptep, __pte(0));
++}
++
+ static inline int __ptep_test_and_clear_young(struct vm_area_struct *vma,
+ unsigned long address,
+ pte_t *ptep)
+--
+2.51.0
+
--- /dev/null
+From b217685acb3d540c16a25464358de6b9c5d2252d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 15:07:18 -0800
+Subject: arm64: mte: Set TCMA1 whenever MTE is present in the kernel
+
+From: Carl Worth <carl@os.amperecomputing.com>
+
+[ Upstream commit a4e5927115f30a301f9939ed43e6a21a343e06ad ]
+
+Set the TCMA1 bit so that access to TTBR1 addresses with 0xf in their
+tag bits will be treated as tag unchecked.
+
+This is important to avoid unwanted tag checking on some
+systems. Specifically, SCTLR_EL1.TCF can be set to indicate that no
+tag check faults are desired. But the architecture doesn't guarantee
+that in this case the system won't still perform tag checks.
+
+Use TCMA1 to ensure that undesired tag checks are not performed. This
+bit was already set in the KASAN case. Adding it to the non-KASAN case
+prevents tag checking since all TTBR1 address will have a value of 0xf
+in their tag bits.
+
+This patch has been measured on an Ampere system to improve the following:
+
+* Eliminate over 98% of kernel-side tag checks during "perf bench
+ futex hash", as measured with "perf stat".
+
+* Eliminate all MTE overhead (was previously a 25% performance
+ penalty) from the Phoronix pts/memcached benchmark (1:10 Set:Get
+ ration with 96 cores).
+
+Reported-by: Taehyun Noh <taehyun@utexas.edu>
+Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Carl Worth <carl@os.amperecomputing.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/mm/proc.S | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
+index 5d907ce3b6d3f..22866b49be372 100644
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -48,14 +48,14 @@
+ #define TCR_KASAN_SW_FLAGS 0
+ #endif
+
+-#ifdef CONFIG_KASAN_HW_TAGS
+-#define TCR_MTE_FLAGS TCR_EL1_TCMA1 | TCR_EL1_TBI1 | TCR_EL1_TBID1
+-#elif defined(CONFIG_ARM64_MTE)
++#ifdef CONFIG_ARM64_MTE
+ /*
+ * The mte_zero_clear_page_tags() implementation uses DC GZVA, which relies on
+- * TBI being enabled at EL1.
++ * TBI being enabled at EL1. TCMA1 is needed to treat accesses with the
++ * match-all tag (0xF) as Tag Unchecked, irrespective of the SCTLR_EL1.TCF
++ * setting.
+ */
+-#define TCR_MTE_FLAGS TCR_EL1_TBI1 | TCR_EL1_TBID1
++#define TCR_MTE_FLAGS TCR_EL1_TCMA1 | TCR_EL1_TBI1 | TCR_EL1_TBID1
+ #else
+ #define TCR_MTE_FLAGS 0
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 5128128649de5518e16bd543641b6f691af770ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 21:27:21 +0000
+Subject: arm64: tegra: smaug: Add usb-role-switch support
+
+From: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+
+[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ]
+
+The USB2 port on Smaug is configured for OTG operation but lacked the
+required 'usb-role-switch' property, leading to a failed probe and a
+non-functioning USB port. Add the property along with setting the default
+role to host.
+
+Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+index 5aa6afd56cbc6..dfbd1c72388c1 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+@@ -1809,6 +1809,8 @@ usb2-0 {
+ status = "okay";
+ vbus-supply = <&usbc_vbus>;
+ mode = "otg";
++ usb-role-switch;
++ role-switch-default-mode = "host";
+ };
+
+ usb3-0 {
+--
+2.51.0
+
--- /dev/null
+From c8e347f94b68f826524294a6b675bcc5c429ea56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Feb 2026 16:15:34 +0530
+Subject: ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models
+
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+
+[ Upstream commit 3acf517e1ae05ef66561b7a2782690387ce46e21 ]
+
+This patch adds a quirk to include the codec amplifier function for Lenovo
+models listed in the quirk table.
+
+Note: In these models, the RT722 codec amplifier is excluded, and an
+external amplifier is used instead.
+
+Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://patch.msgid.link/20260218104734.3641481-3-Vijendar.Mukunda@amd.com
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/soc/amd/acp/acp-sdw-legacy-mach.c b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
+index fae94b9edd5a3..4f92de33a71a0 100644
+--- a/sound/soc/amd/acp/acp-sdw-legacy-mach.c
++++ b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
+@@ -95,6 +95,22 @@ static const struct dmi_system_id soc_sdw_quirk_table[] = {
+ },
+ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR),
+ },
++ {
++ .callback = soc_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YW"),
++ },
++ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR),
++ },
++ {
++ .callback = soc_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YX"),
++ },
++ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR),
++ },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From eaa08ca86c1d41cf927199187fa0e955dd76fc46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 17:19:04 +0800
+Subject: ASoC: codecs: max98390: Check return value of
+ devm_gpiod_get_optional() in max98390_i2c_probe()
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ]
+
+The devm_gpiod_get_optional() function may return an error pointer
+(ERR_PTR) in case of a genuine failure during GPIO acquisition,
+not just NULL which indicates the legitimate absence of an optional
+GPIO.
+
+Add an IS_ERR() check after the function call to catch such errors and
+propagate them to the probe function, ensuring the driver fails to load
+safely rather than proceeding with an invalid pointer.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98390.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c
+index 3dd4dd94bc371..ff58805e97d17 100644
+--- a/sound/soc/codecs/max98390.c
++++ b/sound/soc/codecs/max98390.c
+@@ -1067,6 +1067,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c)
+
+ reset_gpio = devm_gpiod_get_optional(&i2c->dev,
+ "reset", GPIOD_OUT_HIGH);
++ if (IS_ERR(reset_gpio))
++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio),
++ "Failed to get reset gpio\n");
+
+ /* Power on device */
+ if (reset_gpio) {
+--
+2.51.0
+
--- /dev/null
+From 4ee8d20ca3b679dd458174585f7b0d763546fb1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jan 2026 00:00:17 +0800
+Subject: ASoC: es8328: Add error unwind in resume
+
+From: Hsieh Hung-En <hungen3108@gmail.com>
+
+[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ]
+
+Handle failures in the resume path by unwinding previously enabled
+resources.
+
+If enabling regulators or syncing the regcache fails, disable regulators
+and unprepare the clock to avoid leaking resources and leaving the device
+in a partially resumed state.
+
+Signed-off-by: Hsieh Hung-En <hungen3108@gmail.com>
+Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index 1e11175cfbbbf..47c6b0c218b2c 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -758,17 +758,23 @@ static int es8328_resume(struct snd_soc_component *component)
+ es8328->supplies);
+ if (ret) {
+ dev_err(component->dev, "unable to enable regulators\n");
+- return ret;
++ goto err_clk;
+ }
+
+ regcache_mark_dirty(regmap);
+ ret = regcache_sync(regmap);
+ if (ret) {
+ dev_err(component->dev, "unable to sync regcache\n");
+- return ret;
++ goto err_regulators;
+ }
+
+ return 0;
++
++err_regulators:
++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies);
++err_clk:
++ clk_disable_unprepare(es8328->clk);
++ return ret;
+ }
+
+ static int es8328_component_probe(struct snd_soc_component *component)
+--
+2.51.0
+
--- /dev/null
+From fefca4bf916e7e4623c6826ef69a4fdace6e9e89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 05:24:29 +0000
+Subject: ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 84faa91585fa22a161763f2fe8f84a602a196c87 ]
+
+imx_rpmsg_probe() calls snd_soc_find_dai() without holding client_mutex.
+However, snd_soc_find_dai() has lockdep_assert_held(&client_mutex)
+indicating callers must hold this lock, as the function iterates over the
+global component list.
+
+All other callers of snd_soc_find_dai() either hold client_mutex via the
+snd_soc_bind_card() path or use the snd_soc_find_dai_with_mutex() wrapper.
+
+Use snd_soc_find_dai_with_mutex() instead to fix the missing lock
+protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260205052429.4046903-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-rpmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/fsl/imx-rpmsg.c b/sound/soc/fsl/imx-rpmsg.c
+index 53f04d1f32806..76a8e68c1b620 100644
+--- a/sound/soc/fsl/imx-rpmsg.c
++++ b/sound/soc/fsl/imx-rpmsg.c
+@@ -145,7 +145,7 @@ static int imx_rpmsg_probe(struct platform_device *pdev)
+ data->dai.ignore_pmdown_time = 1;
+
+ data->dai.cpus->dai_name = pdev->dev.platform_data;
+- cpu_dai = snd_soc_find_dai(data->dai.cpus);
++ cpu_dai = snd_soc_find_dai_with_mutex(data->dai.cpus);
+ if (!cpu_dai) {
+ ret = -EPROBE_DEFER;
+ goto fail;
+--
+2.51.0
+
--- /dev/null
+From e5d5920c79f7f1f6e71f83c3bc922a203ec0019f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 22:52:25 +0100
+Subject: ASoC: qcom: q6asm: drop DSP responses for closed data streams
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Bellegarde <cedric.bellegarde@adishatz.org>
+
+[ Upstream commit 8a066a81ee0c1b6cdbd81393536c3b2d19ccef25 ]
+
+'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses
+after closing")' attempted to ignore DSP responses arriving
+after a stream had been closed.
+
+However, those responses were still handled, causing lockups.
+
+Fix this by unconditionally dropping all DSP responses associated with
+closed data streams.
+
+Signed-off-by: Cédric Bellegarde <cedric.bellegarde@adishatz.org>
+Link: https://patch.msgid.link/20260102215225.609166-1-cedric.bellegarde@adishatz.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/qdsp6/q6asm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/qcom/qdsp6/q6asm.c b/sound/soc/qcom/qdsp6/q6asm.c
+index e7295b7b24610..3c4a24c9dba22 100644
+--- a/sound/soc/qcom/qdsp6/q6asm.c
++++ b/sound/soc/qcom/qdsp6/q6asm.c
+@@ -638,7 +638,6 @@ static int32_t q6asm_stream_callback(struct apr_device *adev,
+ client_event = ASM_CLIENT_EVENT_CMD_OUT_FLUSH_DONE;
+ break;
+ case ASM_STREAM_CMD_OPEN_WRITE_V3:
+- case ASM_DATA_CMD_WRITE_V2:
+ case ASM_STREAM_CMD_OPEN_READ_V3:
+ case ASM_STREAM_CMD_OPEN_READWRITE_V2:
+ case ASM_STREAM_CMD_SET_ENCDEC_PARAM:
+@@ -657,8 +656,9 @@ static int32_t q6asm_stream_callback(struct apr_device *adev,
+ break;
+ case ASM_DATA_CMD_EOS:
+ case ASM_DATA_CMD_READ_V2:
++ case ASM_DATA_CMD_WRITE_V2:
+ /* response as result of close stream */
+- break;
++ goto done;
+ default:
+ dev_err(ac->dev, "command[0x%x] not expecting rsp\n",
+ result->opcode);
+--
+2.51.0
+
--- /dev/null
+From 32e798062ef8fb17f8a2c25ade50f6ebe3e1fe92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 15:43:35 +0800
+Subject: ASoC: rt721-sdca: Fix issue of fail to detect OMTP jack type
+
+From: Jack Yu <jack.yu@realtek.com>
+
+[ Upstream commit 5578da7d957fbaf91f6c39ba2363c2d2e4273183 ]
+
+Add related HP-JD settings to fix issue of fail to detect
+OMTP jack type.
+
+Signed-off-by: Jack Yu <jack.yu@realtek.com>
+Link: https://patch.msgid.link/20260210074335.2337830-1-jack.yu@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt721-sdca.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/rt721-sdca.c b/sound/soc/codecs/rt721-sdca.c
+index 8233532a1752a..35960c2252249 100644
+--- a/sound/soc/codecs/rt721-sdca.c
++++ b/sound/soc/codecs/rt721-sdca.c
+@@ -245,12 +245,12 @@ static void rt721_sdca_jack_preset(struct rt721_sdca_priv *rt721)
+ regmap_write(rt721->mbq_regmap, 0x5b10007, 0x2000);
+ regmap_write(rt721->mbq_regmap, 0x5B10017, 0x1b0f);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_CBJ_CTRL,
+- RT721_CBJ_A0_GAT_CTRL1, 0x2a02);
++ RT721_CBJ_A0_GAT_CTRL1, 0x2205);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_CAP_PORT_CTRL,
+ RT721_HP_AMP_2CH_CAL4, 0xa105);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL,
+ RT721_UAJ_TOP_TCON14, 0x3b33);
+- regmap_write(rt721->mbq_regmap, 0x310400, 0x3023);
++ regmap_write(rt721->mbq_regmap, 0x310400, 0x3043);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL,
+ RT721_UAJ_TOP_TCON14, 0x3f33);
+ rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL,
+--
+2.51.0
+
--- /dev/null
+From db5bebf611e4ceaa31a473b604406eea40bac672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 14:56:58 +0800
+Subject: ASoC: sdw_utils: remove dai registered check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 8d38c275f7ffe257d21bea224d4288eef183817d ]
+
+Checking for a registered DAI for non-existing endpoints causes the
+following error. The driver will always return -EPROBE_DEFER if the
+codec driver doesn't register the DAI of the unexist endpoint.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260120065658.1806027-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sdw_utils/soc_sdw_utils.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
+
+diff --git a/sound/soc/sdw_utils/soc_sdw_utils.c b/sound/soc/sdw_utils/soc_sdw_utils.c
+index ccf149f949e8f..d03072cd13cb9 100644
+--- a/sound/soc/sdw_utils/soc_sdw_utils.c
++++ b/sound/soc/sdw_utils/soc_sdw_utils.c
+@@ -1421,29 +1421,14 @@ static int is_sdca_endpoint_present(struct device *dev,
+ const struct snd_soc_acpi_adr_device *adr_dev = &adr_link->adr_d[adr_index];
+ const struct snd_soc_acpi_endpoint *adr_end;
+ const struct asoc_sdw_dai_info *dai_info;
+- struct snd_soc_dai_link_component *dlc;
+- struct snd_soc_dai *codec_dai;
+ struct sdw_slave *slave;
+ struct device *sdw_dev;
+ const char *sdw_codec_name;
+ int ret, i;
+
+- dlc = kzalloc(sizeof(*dlc), GFP_KERNEL);
+- if (!dlc)
+- return -ENOMEM;
+-
+ adr_end = &adr_dev->endpoints[end_index];
+ dai_info = &codec_info->dais[adr_end->num];
+
+- dlc->dai_name = dai_info->dai_name;
+- codec_dai = snd_soc_find_dai_with_mutex(dlc);
+- if (!codec_dai) {
+- dev_warn(dev, "codec dai %s not registered yet\n", dlc->dai_name);
+- kfree(dlc);
+- return -EPROBE_DEFER;
+- }
+- kfree(dlc);
+-
+ sdw_codec_name = _asoc_sdw_get_codec_name(dev, adr_link, adr_index);
+ if (!sdw_codec_name)
+ return -ENOMEM;
+--
+2.51.0
+
--- /dev/null
+From 3e9c76ae43031470981cbc0861745059dca45dd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 17:17:48 +0800
+Subject: ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
+ aggregated
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 08c09899960118ffb01417242e659eb6cc067d6a ]
+
+rt722 is aggregated with rt1320 amp in arl_rt722_l0_rt1320_l2 and it is
+the only audio configuration in the ARL platform. Set .aggregated = 1 to
+represent the fact and avoid unexpected issue.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://patch.msgid.link/20260119091749.1752088-2-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../intel/common/soc-acpi-intel-arl-match.c | 23 +++++++++----------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-arl-match.c b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
+index 6bf7a6250ddc3..c952f7d2b2c0e 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-arl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
+@@ -45,23 +45,22 @@ static const struct snd_soc_acpi_endpoint spk_3_endpoint = {
+ .group_id = 1,
+ };
+
+-/*
+- * RT722 is a multi-function codec, three endpoints are created for
+- * its headset, amp and dmic functions.
+- */
+-static const struct snd_soc_acpi_endpoint rt722_endpoints[] = {
++static const struct snd_soc_acpi_endpoint jack_amp_g1_dmic_endpoints[] = {
++ /* Jack Endpoint */
+ {
+ .num = 0,
+ .aggregated = 0,
+ .group_position = 0,
+ .group_id = 0,
+ },
++ /* Amp Endpoint, work as spk_l_endpoint */
+ {
+ .num = 1,
+- .aggregated = 0,
++ .aggregated = 1,
+ .group_position = 0,
+- .group_id = 0,
++ .group_id = 1,
+ },
++ /* DMIC Endpoint */
+ {
+ .num = 2,
+ .aggregated = 0,
+@@ -229,11 +228,11 @@ static const struct snd_soc_acpi_adr_device rt711_sdca_0_adr[] = {
+ }
+ };
+
+-static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = {
++static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = {
+ {
+ .adr = 0x000030025D072201ull,
+- .num_endpoints = ARRAY_SIZE(rt722_endpoints),
+- .endpoints = rt722_endpoints,
++ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints),
++ .endpoints = jack_amp_g1_dmic_endpoints,
+ .name_prefix = "rt722"
+ }
+ };
+@@ -394,8 +393,8 @@ static const struct snd_soc_acpi_link_adr arl_rt711_l0_rt1316_l3[] = {
+ static const struct snd_soc_acpi_link_adr arl_rt722_l0_rt1320_l2[] = {
+ {
+ .mask = BIT(0),
+- .num_adr = ARRAY_SIZE(rt722_0_single_adr),
+- .adr_d = rt722_0_single_adr,
++ .num_adr = ARRAY_SIZE(rt722_0_agg_adr),
++ .adr_d = rt722_0_agg_adr,
+ },
+ {
+ .mask = BIT(2),
+--
+2.51.0
+
--- /dev/null
+From 54966a1b75d05b5f3dd9afc243f52158849fe4b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 17:17:49 +0800
+Subject: ASoC: soc-acpi-intel-ptl-match: use aggregated endpoint in
+ ptl_rt722_l0_rt1320_l23
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 4fbd3b2ec04dc6ef93090ec24733a5c5671fb71f ]
+
+The rt722 amp and rt1320 amps are aggregated in this case.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://patch.msgid.link/20260119091749.1752088-3-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
+index e297c8ecedb72..1055fb4838f61 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
+@@ -383,6 +383,15 @@ static const struct snd_soc_acpi_link_adr ptl_rt721_l3[] = {
+ {},
+ };
+
++static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = {
++ {
++ .adr = 0x000030025d072201ull,
++ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints),
++ .endpoints = jack_amp_g1_dmic_endpoints,
++ .name_prefix = "rt722"
++ }
++};
++
+ static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = {
+ {
+ .adr = 0x000030025d072201ull,
+@@ -536,8 +545,8 @@ static const struct snd_soc_acpi_link_adr ptl_rt722_l3[] = {
+ static const struct snd_soc_acpi_link_adr ptl_rt722_l0_rt1320_l23[] = {
+ {
+ .mask = BIT(0),
+- .num_adr = ARRAY_SIZE(rt722_0_single_adr),
+- .adr_d = rt722_0_single_adr,
++ .num_adr = ARRAY_SIZE(rt722_0_agg_adr),
++ .adr_d = rt722_0_agg_adr,
+ },
+ {
+ .mask = BIT(2),
+--
+2.51.0
+
--- /dev/null
+From 187dc06721943b6a9c92b3b26df7d04ab60b8c74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 10:18:32 +0200
+Subject: ASoC: SOF: Intel: hda: Fix NULL pointer dereference
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit 16c589567a956d46a7c1363af3f64de3d420af20 ]
+
+If there's a mismatch between the DAI links in the machine driver and
+the topology, it is possible that the playback/capture widget is not
+set, especially in the case of loopback capture for echo reference
+where we use the dummy DAI link. Return the error when the widget is not
+set to avoid a null pointer dereference like below when the topology is
+broken.
+
+RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]
+
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Mateusz Redzynia <mateuszx.redzynia@intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
+index 883d0d3bae9ec..3c742d5351333 100644
+--- a/sound/soc/sof/intel/hda-dai.c
++++ b/sound/soc/sof/intel/hda-dai.c
+@@ -70,12 +70,22 @@ static const struct hda_dai_widget_dma_ops *
+ hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai)
+ {
+ struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream);
+- struct snd_sof_widget *swidget = w->dobj.private;
++ struct snd_sof_widget *swidget;
+ struct snd_sof_dev *sdev;
+ struct snd_sof_dai *sdai;
+
+- sdev = widget_to_sdev(w);
++ /*
++ * this is unlikely if the topology and the machine driver DAI links match.
++ * But if there's a missing DAI link in topology, this will prevent a NULL pointer
++ * dereference later on.
++ */
++ if (!w) {
++ dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__);
++ return NULL;
++ }
+
++ sdev = widget_to_sdev(w);
++ swidget = w->dobj.private;
+ if (!swidget) {
+ dev_err(sdev->dev, "%s: swidget is NULL\n", __func__);
+ return NULL;
+--
+2.51.0
+
--- /dev/null
+From 7c8674e765960f70bc696630565047c5b33c3092 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 16:39:43 +0200
+Subject: ASoC: SOF: ipc4: Support for sending payload along with
+ LARGE_CONFIG_GET
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit d96cb0b86d6e8bbbbfa425771606f6c1aebc318e ]
+
+There are message types when we would need to send a payload along with
+the LARGE_CONFIG_GET message to provide information to the firmware on
+what data is requested.
+Such cases are the ALSA Kcontrol related messages when the high level
+param_id tells only the type of the control, but the ID/index of the exact
+control is specified in the payload area.
+
+The caller must place the payload for TX before calling the set_get_data()
+and this payload will be sent alongside with the message to the firmware.
+
+The data area will be overwritten by the received data from firmware.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://patch.msgid.link/20251217143945.2667-7-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4.c | 44 ++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 42 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4.c b/sound/soc/sof/ipc4.c
+index a4a090e6724a6..20d723f48fff0 100644
+--- a/sound/soc/sof/ipc4.c
++++ b/sound/soc/sof/ipc4.c
+@@ -15,6 +15,7 @@
+ #include "sof-audio.h"
+ #include "ipc4-fw-reg.h"
+ #include "ipc4-priv.h"
++#include "ipc4-topology.h"
+ #include "ipc4-telemetry.h"
+ #include "ops.h"
+
+@@ -433,6 +434,23 @@ static int sof_ipc4_tx_msg(struct snd_sof_dev *sdev, void *msg_data, size_t msg_
+ return ret;
+ }
+
++static bool sof_ipc4_tx_payload_for_get_data(struct sof_ipc4_msg *tx)
++{
++ /*
++ * Messages that require TX payload with LARGE_CONFIG_GET.
++ * The TX payload is placed into the IPC message data section by caller,
++ * which needs to be copied to temporary buffer since the received data
++ * will overwrite it.
++ */
++ switch (tx->extension & SOF_IPC4_MOD_EXT_MSG_PARAM_ID_MASK) {
++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_SWITCH_CONTROL_PARAM_ID):
++ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_ENUM_CONTROL_PARAM_ID):
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+ size_t payload_bytes, bool set)
+ {
+@@ -444,6 +462,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+ struct sof_ipc4_msg tx = {{ 0 }};
+ struct sof_ipc4_msg rx = {{ 0 }};
+ size_t remaining = payload_bytes;
++ void *tx_payload_for_get = NULL;
++ size_t tx_data_size = 0;
+ size_t offset = 0;
+ size_t chunk_size;
+ int ret;
+@@ -469,10 +489,20 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+
+ tx.extension |= SOF_IPC4_MOD_EXT_MSG_FIRST_BLOCK(1);
+
++ if (sof_ipc4_tx_payload_for_get_data(&tx)) {
++ tx_data_size = min(ipc4_msg->data_size, payload_limit);
++ tx_payload_for_get = kmemdup(ipc4_msg->data_ptr, tx_data_size,
++ GFP_KERNEL);
++ if (!tx_payload_for_get)
++ return -ENOMEM;
++ }
++
+ /* ensure the DSP is in D0i0 before sending IPC */
+ ret = snd_sof_dsp_set_power_state(sdev, &target_state);
+- if (ret < 0)
++ if (ret < 0) {
++ kfree(tx_payload_for_get);
+ return ret;
++ }
+
+ /* Serialise IPC TX */
+ mutex_lock(&sdev->ipc->tx_mutex);
+@@ -506,7 +536,15 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+ rx.data_size = chunk_size;
+ rx.data_ptr = ipc4_msg->data_ptr + offset;
+
+- tx_size = 0;
++ if (tx_payload_for_get) {
++ tx_size = tx_data_size;
++ tx.data_size = tx_size;
++ tx.data_ptr = tx_payload_for_get;
++ } else {
++ tx_size = 0;
++ tx.data_size = 0;
++ tx.data_ptr = NULL;
++ }
+ rx_size = chunk_size;
+ }
+
+@@ -553,6 +591,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
+
+ mutex_unlock(&sdev->ipc->tx_mutex);
+
++ kfree(tx_payload_for_get);
++
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4be15ea9d30b8269ff738d44bbbaf6b82b2f243d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 11:32:50 +0800
+Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ]
+
+Add check for the return value of devm_regmap_init_mmio() and return the
+error if it fails in order to catch the error.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun50i-dmic.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c
+index bab1e29c99887..eddfebe166169 100644
+--- a/sound/soc/sunxi/sun50i-dmic.c
++++ b/sound/soc/sunxi/sun50i-dmic.c
+@@ -358,6 +358,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev)
+
+ host->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+ &sun50i_dmic_regmap_config);
++ if (IS_ERR(host->regmap))
++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap),
++ "failed to initialise regmap\n");
+
+ /* Clocks */
+ host->bus_clk = devm_clk_get(&pdev->dev, "bus");
+--
+2.51.0
+
--- /dev/null
+From 58dee49bb6437e5379c4448fc8755fd35f2a11cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:08 +0100
+Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ]
+
+This bit is handled by a separate control.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index e9e317ce68982..1040740fc80f8 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1760,7 +1760,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18),
+
+
+ SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0),
+-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA),
++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX),
+
+ SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0),
+ SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA),
+--
+2.51.0
+
--- /dev/null
+From a7f44eac50a89202646b6ca6913eb7b828d3174c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:10 +0100
+Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on
+ plug
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ]
+
+This usually means that a TRS plug with no microphone pin has been plugged
+into a TRRS socket. Cases where a user is plugging in a microphone while
+pressing a button will be handled via incoming interrupt after the user
+releases the button, so the microphone will still be detected once it
+becomes usable.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 1040740fc80f8..bff8644674163 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -67,6 +67,8 @@ struct wm8962_priv {
+ struct mutex dsp2_ena_lock;
+ u16 dsp2_ena;
+
++ int mic_status;
++
+ struct delayed_work mic_work;
+ struct snd_soc_jack *jack;
+
+@@ -3081,8 +3083,16 @@ static void wm8962_mic_work(struct work_struct *work)
+ if (reg & WM8962_MICSHORT_STS) {
+ status |= SND_JACK_BTN_0;
+ irq_pol |= WM8962_MICSCD_IRQ_POL;
++
++ /* Don't report a microphone if it's shorted right after
++ * plugging in, as this may be a TRS plug in a TRRS socket.
++ */
++ if (!(wm8962->mic_status & WM8962_MICDET_STS))
++ status = 0;
+ }
+
++ wm8962->mic_status = status;
++
+ snd_soc_jack_report(wm8962->jack, status,
+ SND_JACK_MICROPHONE | SND_JACK_BTN_0);
+
+--
+2.51.0
+
--- /dev/null
+From b3f16c6d4fa5881725fedae39b7c23468393247e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:46:22 +0800
+Subject: ata: libata: avoid long timeouts on hot-unplugged SATA DAS
+
+From: Henry Tseng <henrytseng@qnap.com>
+
+[ Upstream commit 151cabd140322205e27dae5c4bbf261ede0056e3 ]
+
+When a SATA DAS enclosure is connected behind a Thunderbolt PCIe
+switch, hot-unplugging the whole enclosure causes pciehp to tear down
+the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and
+START STOP UNIT for the disks.
+
+libata still queues these commands and the AHCI driver tries to access
+the HBA registers even though the PCI channel is already offline. This
+results in a series of timeouts and error recovery attempts, e.g.:
+
+ [ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
+ [ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec)
+ [ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec)
+ [ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec)
+ [ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+ ...
+ [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec)
+ [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec)
+ [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec)
+ [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+
+With this patch applied, the same hot-unplug looks like:
+
+ [ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
+ [ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+ ...
+ [ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+
+In this test setup with two disks, the hot-unplug sequence shrinks from
+about 226 seconds (~3.8 minutes) between the Link Down event and the
+last SYNCHRONIZE CACHE failure to under a second. Without this patch the
+total delay grows roughly with the number of disks, because each disk
+gets its own SYNCHRONIZE CACHE and qc timeout series.
+
+If the underlying PCI device is already gone, these commands cannot
+succeed anyway. Avoid issuing them by introducing
+ata_adapter_is_online(), which checks pci_channel_offline() for
+PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL,
+causing the SCSI layer to fail new commands with DID_BAD_TARGET
+immediately, and from ata_qc_issue() to bail out before touching the
+HBA registers.
+
+Since such failures would otherwise trigger libata error handling,
+ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler().
+When the adapter is offline, libata skips ap->ops->error_handler(ap) and
+completes error handling using the existing path, rather than running
+a full EH sequence against a dead adapter.
+
+With this change, SYNCHRONIZE CACHE and START STOP UNIT commands
+issued during hot-unplug fail quickly once the PCI channel is offline,
+without qc timeout spam or long libata EH delays.
+
+Suggested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Henry Tseng <henrytseng@qnap.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 24 ++++++++++++++++++++++++
+ drivers/ata/libata-eh.c | 3 ++-
+ drivers/ata/libata-scsi.c | 3 +++
+ drivers/ata/libata.h | 1 +
+ 4 files changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 50dfce8d8bba0..db74417db75d9 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2359,6 +2359,24 @@ static bool ata_dev_check_adapter(struct ata_device *dev,
+ return false;
+ }
+
++bool ata_adapter_is_online(struct ata_port *ap)
++{
++ struct device *dev;
++
++ if (!ap || !ap->host)
++ return false;
++
++ dev = ap->host->dev;
++ if (!dev)
++ return false;
++
++ if (dev_is_pci(dev) &&
++ pci_channel_offline(to_pci_dev(dev)))
++ return false;
++
++ return true;
++}
++
+ static int ata_dev_config_ncq(struct ata_device *dev,
+ char *desc, size_t desc_sz)
+ {
+@@ -5135,6 +5153,12 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
+ qc->flags |= ATA_QCFLAG_ACTIVE;
+ ap->qc_active |= 1ULL << qc->tag;
+
++ /* Make sure the device is still accessible. */
++ if (!ata_adapter_is_online(ap)) {
++ qc->err_mask |= AC_ERR_HOST_BUS;
++ goto sys_err;
++ }
++
+ /*
+ * We guarantee to LLDs that they will have at least one
+ * non-zero sg if the command is a data command.
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 258e657f3527c..b373cceb95d23 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -752,7 +752,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap)
+ spin_unlock_irqrestore(ap->lock, flags);
+
+ /* invoke EH, skip if unloading or suspended */
+- if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)))
++ if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)) &&
++ ata_adapter_is_online(ap))
+ ap->ops->error_handler(ap);
+ else {
+ /* if unloading, commence suicide */
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 5f9abeb7b2a88..6b954efa9adb1 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3094,6 +3094,9 @@ ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev)
+ {
+ struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev);
+
++ if (!ata_adapter_is_online(ap))
++ return NULL;
++
+ if (unlikely(!dev || !ata_dev_enabled(dev)))
+ return NULL;
+
+diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
+index 60a675df61dc7..9b4e578ad07ec 100644
+--- a/drivers/ata/libata.h
++++ b/drivers/ata/libata.h
+@@ -94,6 +94,7 @@ extern int atapi_check_dma(struct ata_queued_cmd *qc);
+ extern void swap_buf_le16(u16 *buf, unsigned int buf_words);
+ extern bool ata_phys_link_online(struct ata_link *link);
+ extern bool ata_phys_link_offline(struct ata_link *link);
++bool ata_adapter_is_online(struct ata_port *ap);
+ extern void ata_dev_init(struct ata_device *dev);
+ extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp);
+ extern int sata_link_init_spd(struct ata_link *link);
+--
+2.51.0
+
--- /dev/null
+From 5dc6df32fbca7e00a27f91502c9d7bb88ca88b88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 20:49:30 +0100
+Subject: audit: add fchmodat2() to change attributes class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ]
+
+fchmodat2(), introduced in version 6.6 is currently not in the change
+attribute class of audit. Calling fchmodat2() to change a file
+attribute in the same fashion than chmod() or fchmodat() will bypass
+audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds fchmodat2() to the change attributes class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_change_attr.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h
+index cc840537885fb..ddd90bbe40dfc 100644
+--- a/include/asm-generic/audit_change_attr.h
++++ b/include/asm-generic/audit_change_attr.h
+@@ -26,6 +26,9 @@ __NR_fremovexattr,
+ __NR_fchownat,
+ __NR_fchmodat,
+ #endif
++#ifdef __NR_fchmodat2
++__NR_fchmodat2,
++#endif
+ #ifdef __NR_chown32
+ __NR_chown32,
+ __NR_fchown32,
+--
+2.51.0
+
--- /dev/null
+From e16855bde56ab2390f30696c36cf5c94e14aa674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 09:39:24 +0100
+Subject: audit: add missing syscalls to read class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ]
+
+The "at" variant of getxattr() and listxattr() are missing from the
+audit read class. Calling getxattrat() or listxattrat() on a file to
+read its extended attributes will bypass audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds missing syscalls to the audit read class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_read.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h
+index 7bb7b5a83ae2e..fb9991f53fb6f 100644
+--- a/include/asm-generic/audit_read.h
++++ b/include/asm-generic/audit_read.h
+@@ -4,9 +4,15 @@ __NR_readlink,
+ #endif
+ __NR_quotactl,
+ __NR_listxattr,
++#ifdef __NR_listxattrat
++__NR_listxattrat,
++#endif
+ __NR_llistxattr,
+ __NR_flistxattr,
+ __NR_getxattr,
++#ifdef __NR_getxattrat
++__NR_getxattrat,
++#endif
+ __NR_lgetxattr,
+ __NR_fgetxattr,
+ #ifdef __NR_readlinkat
+--
+2.51.0
+
--- /dev/null
+From c053da66a62c842513d4836256b349615b71ac99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 15:29:50 +0100
+Subject: binder: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log. Since commit ad67b74d2469 ("printk: hash
+addresses printed with %p") the regular %p has been improved to avoid
+this issue. Furthermore, restricted pointers ("%pK") were never meant
+to be used through printk(). They can still unintentionally leak raw
+pointers or acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+There are still a few users of %pK left, but these use it through
+seq_file, for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Carlos Llamas <cmllamas@google.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binder.c | 2 +-
+ drivers/android/binder_alloc.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index b356c9b882544..33e4dad0915bb 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4523,7 +4523,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ }
+ }
+ binder_debug(BINDER_DEBUG_DEAD_BINDER,
+- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+ proc->pid, thread->pid, (u64)cookie,
+ death);
+ if (death == NULL) {
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 979c96b74cad3..d5ed64543bbf4 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -81,7 +81,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc,
+ new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: add free buffer, size %zd, at %pK\n",
++ "%d: add free buffer, size %zd, at %p\n",
+ alloc->pid, new_buffer_size, new_buffer);
+
+ while (*p) {
+@@ -572,7 +572,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
+ }
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
+ alloc->pid, size, buffer, buffer_size);
+
+ /*
+@@ -748,7 +748,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
+ ALIGN(buffer->extra_buffers_size, sizeof(void *));
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
++ "%d: binder_free_buf %p size %zd buffer_size %zd\n",
+ alloc->pid, buffer, size, buffer_size);
+
+ BUG_ON(buffer->free);
+--
+2.51.0
+
--- /dev/null
+From 5cb1e917cf390f5a40147996bd0d2657dcc6b64f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 16:05:22 +0800
+Subject: blk-mq-debugfs: add missing debugfs_mutex in
+ blk_mq_debugfs_register_hctxs()
+
+From: Yu Kuai <yukuai@fnnas.com>
+
+[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ]
+
+In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while
+creating debugfs entries for hctxs. Hence add debugfs_mutex there,
+it's safe because queue is not frozen.
+
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index 4896525b1c054..553d93b88e194 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -686,8 +686,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ unsigned long i;
+
++ mutex_lock(&q->debugfs_mutex);
+ queue_for_each_hw_ctx(q, hctx, i)
+ blk_mq_debugfs_register_hctx(q, hctx);
++ mutex_unlock(&q->debugfs_mutex);
+ }
+
+ void blk_mq_debugfs_unregister_hctxs(struct request_queue *q)
+--
+2.51.0
+
--- /dev/null
+From 0c250449a82924600d4829e211ef7580c9d67044 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 16:19:43 +0800
+Subject: blk-mq-sched: unify elevators checking for async requests
+
+From: Yu Kuai <yukuai@fnnas.com>
+
+[ Upstream commit 1db61b0afdd7e8aa9289c423fdff002603b520b5 ]
+
+bfq and mq-deadline consider sync writes as async requests and only
+reserve tags for sync reads by async_depth, however, kyber doesn't
+consider sync writes as async requests for now.
+
+Consider the case there are lots of dirty pages, and user use fsync to
+flush dirty pages. In this case sched_tags can be exhausted by sync writes
+and sync reads can stuck waiting for tag. Hence let kyber follow what
+mq-deadline and bfq did, and unify async requests checking for all
+elevators.
+
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 2 +-
+ block/blk-mq-sched.h | 5 +++++
+ block/kyber-iosched.c | 2 +-
+ block/mq-deadline.c | 2 +-
+ 4 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 6e54b1d3d8bc2..9e9d081e86bb2 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -697,7 +697,7 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ unsigned int limit, act_idx;
+
+ /* Sync reads have full depth available */
+- if (op_is_sync(opf) && !op_is_write(opf))
++ if (blk_mq_is_sync_read(opf))
+ limit = data->q->nr_requests;
+ else
+ limit = bfqd->async_depths[!!bfqd->wr_busy_queues][op_is_sync(opf)];
+diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
+index 02c40a72e9598..5678e15bd33c4 100644
+--- a/block/blk-mq-sched.h
++++ b/block/blk-mq-sched.h
+@@ -137,4 +137,9 @@ static inline void blk_mq_set_min_shallow_depth(struct request_queue *q,
+ depth);
+ }
+
++static inline bool blk_mq_is_sync_read(blk_opf_t opf)
++{
++ return op_is_sync(opf) && !op_is_write(opf);
++}
++
+ #endif
+diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
+index c1b36ffd19ceb..2b3f5b8959af0 100644
+--- a/block/kyber-iosched.c
++++ b/block/kyber-iosched.c
+@@ -556,7 +556,7 @@ static void kyber_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ * We use the scheduler tags as per-hardware queue queueing tokens.
+ * Async requests can be limited at this stage.
+ */
+- if (!op_is_sync(opf)) {
++ if (!blk_mq_is_sync_read(opf)) {
+ struct kyber_queue_data *kqd = data->q->elevator->elevator_data;
+
+ data->shallow_depth = kqd->async_depth;
+diff --git a/block/mq-deadline.c b/block/mq-deadline.c
+index 3e3719093aec7..29d00221fbea6 100644
+--- a/block/mq-deadline.c
++++ b/block/mq-deadline.c
+@@ -495,7 +495,7 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ struct deadline_data *dd = data->q->elevator->elevator_data;
+
+ /* Do not throttle synchronous reads. */
+- if (op_is_sync(opf) && !op_is_write(opf))
++ if (blk_mq_is_sync_read(opf))
+ return;
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 5875d04c3bae21d5e780ec602224ff1fc718de99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 11:40:02 +0800
+Subject: block: decouple secure erase size limit from discard size limit
+
+From: Luke Wang <ziniu.wang_1@nxp.com>
+
+[ Upstream commit ee81212f74a57c5d2b56cf504f40d528dac6faaf ]
+
+Secure erase should use max_secure_erase_sectors instead of being limited
+by max_discard_sectors. Separate the handling of REQ_OP_SECURE_ERASE from
+REQ_OP_DISCARD to allow each operation to use its own size limit.
+
+Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 21 +++++++++++++++++----
+ block/blk.h | 6 +++++-
+ 2 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index d3115d7469df0..bf8faadb0bd46 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -158,8 +158,9 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors)
+ return bio;
+ }
+
+-struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+- unsigned *nsegs)
++static struct bio *__bio_split_discard(struct bio *bio,
++ const struct queue_limits *lim, unsigned *nsegs,
++ unsigned int max_sectors)
+ {
+ unsigned int max_discard_sectors, granularity;
+ sector_t tmp;
+@@ -169,8 +170,7 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+
+ granularity = max(lim->discard_granularity >> 9, 1U);
+
+- max_discard_sectors =
+- min(lim->max_discard_sectors, bio_allowed_max_sectors(lim));
++ max_discard_sectors = min(max_sectors, bio_allowed_max_sectors(lim));
+ max_discard_sectors -= max_discard_sectors % granularity;
+ if (unlikely(!max_discard_sectors))
+ return bio;
+@@ -194,6 +194,19 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+ return bio_submit_split(bio, split_sectors);
+ }
+
++struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
++ unsigned *nsegs)
++{
++ unsigned int max_sectors;
++
++ if (bio_op(bio) == REQ_OP_SECURE_ERASE)
++ max_sectors = lim->max_secure_erase_sectors;
++ else
++ max_sectors = lim->max_discard_sectors;
++
++ return __bio_split_discard(bio, lim, nsegs, max_sectors);
++}
++
+ static inline unsigned int blk_boundary_sectors(const struct queue_limits *lim,
+ bool is_atomic)
+ {
+diff --git a/block/blk.h b/block/blk.h
+index e4c433f62dfc7..4cd5a91346d8a 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -208,10 +208,14 @@ static inline unsigned int blk_queue_get_max_sectors(struct request *rq)
+ struct request_queue *q = rq->q;
+ enum req_op op = req_op(rq);
+
+- if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE))
++ if (unlikely(op == REQ_OP_DISCARD))
+ return min(q->limits.max_discard_sectors,
+ UINT_MAX >> SECTOR_SHIFT);
+
++ if (unlikely(op == REQ_OP_SECURE_ERASE))
++ return min(q->limits.max_secure_erase_sectors,
++ UINT_MAX >> SECTOR_SHIFT);
++
+ if (unlikely(op == REQ_OP_WRITE_ZEROES))
+ return q->limits.max_write_zeroes_sectors;
+
+--
+2.51.0
+
--- /dev/null
+From 8032a4dac54154a260b095d2f71f7d8cf75130ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 12:49:44 -0800
+Subject: block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova
+
+From: Chaitanya Kulkarni <kch@nvidia.com>
+
+[ Upstream commit 81e7223b1a2d63b655ee72577c8579f968d037e3 ]
+
+When dma_iova_link() fails partway through mapping a request's bvec
+list, the function breaks out of the loop without cleaning up
+already mapped segments. Similarly, if dma_iova_sync() fails after
+linking all segments, no cleanup is performed.
+
+This leaves partial IOVA mappings in place. The completion path
+attempts to unmap the full expected size via dma_iova_destroy() or
+nvme_unmap_data(), but only a partial size was actually mapped,
+leading to incorrect unmap operations.
+
+Add an out_unlink error path that calls dma_iova_destroy() to clean
+up partial mappings before returning failure. The dma_iova_destroy()
+function handles both partial unlink and IOVA space freeing. It
+correctly handles the mapped_len == 0 case (first dma_iova_link()
+failure) by only freeing the IOVA allocation without attempting to
+unmap.
+
+Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-dma.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/block/blk-mq-dma.c b/block/blk-mq-dma.c
+index fb018fffffdcc..feead1934301a 100644
+--- a/block/blk-mq-dma.c
++++ b/block/blk-mq-dma.c
+@@ -126,17 +126,20 @@ static bool blk_rq_dma_map_iova(struct request *req, struct device *dma_dev,
+ error = dma_iova_link(dma_dev, state, vec->paddr, mapped,
+ vec->len, dir, attrs);
+ if (error)
+- break;
++ goto out_unlink;
+ mapped += vec->len;
+ } while (blk_map_iter_next(req, &iter->iter, vec));
+
+ error = dma_iova_sync(dma_dev, state, 0, mapped);
+- if (error) {
+- iter->status = errno_to_blk_status(error);
+- return false;
+- }
++ if (error)
++ goto out_unlink;
+
+ return true;
++
++out_unlink:
++ dma_iova_destroy(dma_dev, state, mapped, dir, attrs);
++ iter->status = errno_to_blk_status(error);
++ return false;
+ }
+
+ static inline void blk_rq_map_iter_init(struct request *rq,
+--
+2.51.0
+
--- /dev/null
+From b07ad3fd26fb1dde2fa24acab4e2b37f6246f5c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:13:04 +0100
+Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU
+
+From: Jacopo Scannella <code@charlie.cat>
+
+[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ]
+
+Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek
+RTL8761BU Bluetooth adapter.
+
+Reference:
+https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth
+
+Signed-off-by: Jacopo Scannella <code@charlie.cat>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index f177569978d36..a41bb1e2a279a 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -781,6 +781,7 @@ static const struct usb_device_id quirks_table[] = {
+
+ /* Additional Realtek 8723BU Bluetooth devices */
+ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK },
+
+ /* Additional Realtek 8723DE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
+--
+2.51.0
+
--- /dev/null
+From b0943674350f895dfc221aefd3b77dd8f623ad67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 15:03:35 +1100
+Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE
+
+From: Shell Chen <w27@sorz.org>
+
+[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ]
+
+Add VID:PID 13d3:3612 to the quirks_table.
+
+This ID pair is found in the Realtek RTL8852CE PCIe module
+in an ASUS TUF A14 2025 (FA401KM) laptop.
+
+Tested on aforementioned laptop.
+
+The device info from /sys/kernel/debug/usb/devices is listed as below.
+
+T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3612 Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=Bluetooth Radio
+S: SerialNumber=00e04c000001
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+
+Signed-off-by: Shell Chen <w27@sorz.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 66e266e93cc12..f177569978d36 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -561,6 +561,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
+--
+2.51.0
+
--- /dev/null
+From 9b267775b1aefa6a1beeb312106775728c67d856 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 23:22:25 +0300
+Subject: Bluetooth: btusb: Add support for MediaTek7920 0489:e158
+
+From: Bluecross <elantsew.andrew@gmail.com>
+
+[ Upstream commit 2630bcc8343a9d2a38dc1793068e6754b3156811 ]
+
+Add support for MediaTek7920 0489:e158
+
+/sys/kernel/debug/usb/devices reports for that device:
+
+T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 5 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0489 ProdID=e158 Rev= 1.00
+S: Manufacturer=MediaTek Inc.
+S: Product=Wireless_Device
+S: SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
+I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Andrew Elatsev <elantsew.andrew@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 80ccfa8fd982a..ef08567a7487c 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -639,6 +639,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x0489, 0xe158), .driver_info = BTUSB_MEDIATEK |
++ BTUSB_WIDEBAND_SPEECH },
+
+ /* Additional MediaTek MT7921 Bluetooth devices */
+ { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
+--
+2.51.0
+
--- /dev/null
+From 392823d3b81323bbbcfde0f1c75c8acc1cbc515b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 11:31:29 +0800
+Subject: Bluetooth: btusb: Add USB ID 0489:e112 for Realtek 8851BE
+
+From: Techie Ernie <techieernie@gmail.com>
+
+[ Upstream commit e07094a51ad8faf98ea64320799ce550828e97cd ]
+
+Add USB ID 0489:e112 for the Realtek 8851BE Bluetooth adapter.
+Without this entry, the device is not handled correctly by btusb and Bluetooth fails to initialise.
+Adding the ID enables proper Realtek initialization for Bluetooth to work on various motherboards using this Bluetooth adapter.
+
+The device identifies as:
+ Bus 001 Device XXX: ID 0489:e112 Foxconn / Hon Hai Bluetooth Radio
+
+Tested on Realtek 8851BE. Bluetooth works after this change is made.
+
+Signed-off-by: Techie Ernie <techieernie@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index ef08567a7487c..66e266e93cc12 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -521,6 +521,8 @@ static const struct usb_device_id quirks_table[] = {
+ { USB_DEVICE(0x0bda, 0xb850), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x13d3, 0x3600), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x13d3, 0x3601), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x0489, 0xe112), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+
+ /* Realtek 8851BU Bluetooth devices */
+ { USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK |
+--
+2.51.0
+
--- /dev/null
+From 5355f911c9d4f254ae9e5df5943b6f7bbb9c7bd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:10 +0100
+Subject: Bluetooth: hci_conn: Set link_policy on incoming ACL connections
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d ]
+
+The connection link policy is only set when establishing an outgoing
+ACL connection causing connection idle modes not to be available on
+incoming connections. Move the setting of the link policy to the
+creation of the connection so all ACL connection will use the link
+policy set on the HCI device.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 1 +
+ net/bluetooth/hci_sync.c | 2 --
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 5a4374ccf8e84..98f0461b3dd7d 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1002,6 +1002,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type,
+ switch (type) {
+ case ACL_LINK:
+ conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
++ conn->link_policy = hdev->link_policy;
+ conn->mtu = hdev->acl_mtu;
+ break;
+ case LE_LINK:
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index cbc3a75d73262..334eb4376a266 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -6897,8 +6897,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
+
+ conn->attempt++;
+
+- conn->link_policy = hdev->link_policy;
+-
+ memset(&cp, 0, sizeof(cp));
+ bacpy(&cp.bdaddr, &conn->dst);
+ cp.pscan_rep_mode = 0x02;
+--
+2.51.0
+
--- /dev/null
+From e61b7a724dcde049c2dcb31fc1c042714f37d858 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:09 +0100
+Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ]
+
+hci_conn_enter_active_mode() uses queue_delayed_work() with the
+intention that the work will run after the given timeout. However,
+queue_delayed_work() does nothing if the work is already queued, so
+depending on the link policy we may end up putting the connection
+into idle mode every hdev->idle_timeout ms.
+
+Use mod_delayed_work() instead so the work is queued if not already
+queued, and the timeout is updated otherwise.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 98f0461b3dd7d..dc085856f5e91 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2620,8 +2620,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
+
+ timer:
+ if (hdev->idle_timeout > 0)
+- queue_delayed_work(hdev->workqueue, &conn->idle_work,
+- msecs_to_jiffies(hdev->idle_timeout));
++ mod_delayed_work(hdev->workqueue, &conn->idle_work,
++ msecs_to_jiffies(hdev->idle_timeout));
+ }
+
+ /* Drop all connection on the device */
+--
+2.51.0
+
--- /dev/null
+From 9548f58b32232ace0d20dc02886d7bb44ebb8eed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 11:37:12 +0800
+Subject: Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT_EN is
+ pulled up by hw
+
+From: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
+
+[ Upstream commit fce1a9244a0f85683be8530e623bc729f24c5067 ]
+
+On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw
+and cannot be controlled by the host. As a result, in case of a firmware
+crash, the host cannot trigger a cold reset. Instead, the BT controller
+performs a warm restart on its own, without reloading the firmware.
+
+This leads to the controller remaining in IBS_WAKE state, while the host
+expects it to be in sleep mode. The mismatch causes HCI reset commands
+to time out. Additionally, the driver does not clear internal flags
+QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence.
+If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode
+due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag
+is not cleared, so only the first SSR generates a coredump.
+
+Tell the driver that the BT controller has undergone a proper restart sequence:
+
+- Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR.
+- Add a 50ms delay to allow the controller to complete its warm reset.
+- Reset tx_idle_timer to prevent the host from entering TX sleep mode.
+- Clear memcoredump_flag to allow multiple coredump captures.
+
+Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set,
+which indicates that BT_EN is defined in DTS and cannot be toggled.
+
+Refer to the comment in include/net/bluetooth/hci.h for details on
+HCI_QUIRK_NON_PERSISTENT_SETUP.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 888176b0faa90..a3c217571c3c4 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -1653,6 +1653,39 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
+ skb_queue_purge(&qca->rx_memdump_q);
+ }
+
++ /*
++ * If the BT chip's bt_en pin is connected to a 3.3V power supply via
++ * hardware and always stays high, driver cannot control the bt_en pin.
++ * As a result, during SSR (SubSystem Restart), QCA_SSR_TRIGGERED and
++ * QCA_IBS_DISABLED flags cannot be cleared, which leads to a reset
++ * command timeout.
++ * Add an msleep delay to ensure controller completes the SSR process.
++ *
++ * Host will not download the firmware after SSR, controller to remain
++ * in the IBS_WAKE state, and the host needs to synchronize with it
++ *
++ * Since the bluetooth chip has been reset, clear the memdump state.
++ */
++ if (!hci_test_quirk(hu->hdev, HCI_QUIRK_NON_PERSISTENT_SETUP)) {
++ /*
++ * When the SSR (SubSystem Restart) duration exceeds 2 seconds,
++ * it triggers host tx_idle_delay, which sets host TX state
++ * to sleep. Reset tx_idle_timer after SSR to prevent
++ * host enter TX IBS_Sleep mode.
++ */
++ mod_timer(&qca->tx_idle_timer, jiffies +
++ msecs_to_jiffies(qca->tx_idle_delay));
++
++ /* Controller reset completion time is 50ms */
++ msleep(50);
++
++ clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
++ clear_bit(QCA_IBS_DISABLED, &qca->flags);
++
++ qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
++ qca->memdump_state = QCA_MEMDUMP_IDLE;
++ }
++
+ clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 684331ca7dbe582b2c1dc1a25bada62a5e176bbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 16:30:41 -0800
+Subject: bnxt_en: Allow ntuple filters for drops
+
+From: Joe Damato <joe@dama.to>
+
+[ Upstream commit 61cef6454cfbb9fcdbe41401fb53895f86603081 ]
+
+It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action
+support for ntuple"), bnxt gained support for ntuple filters for packet
+drops.
+
+However, support for this does not seem to work in recent kernels or
+against net-next:
+
+ % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1
+ rmgr: Cannot insert RX class rule: Operation not supported
+ Cannot insert classification rule
+
+The issue is that the existing code uses ethtool_get_flow_spec_ring_vf,
+which will return a non-zero value if the ring_cookie is set to
+RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return
+-EOPNOTSUPP because it thinks the user is trying to set an ntuple filter
+for a vf.
+
+Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC.
+
+After this patch, ntuple filters for drops can be added:
+
+ % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1
+ Added rule with ID 0
+
+ % ethtool -n eth0
+ 44 RX rings available
+ Total 1 rules
+
+ Filter: 0
+ Rule Type: UDP over IPv4
+ Src IP addr: 1.1.1.1 mask: 0.0.0.0
+ Dest IP addr: 0.0.0.0 mask: 255.255.255.255
+ TOS: 0x0 mask: 0xff
+ Src port: 0 mask: 0xffff
+ Dest port: 0 mask: 0xffff
+ Action: Drop
+
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Joe Damato <joe@dama.to>
+Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 068e191ede19e..c76a7623870be 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1346,16 +1346,17 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp,
+ struct bnxt_l2_filter *l2_fltr;
+ struct bnxt_flow_masks *fmasks;
+ struct flow_keys *fkeys;
+- u32 idx, ring;
++ u32 idx;
+ int rc;
+- u8 vf;
+
+ if (!bp->vnic_info)
+ return -EAGAIN;
+
+- vf = ethtool_get_flow_spec_ring_vf(fs->ring_cookie);
+- ring = ethtool_get_flow_spec_ring(fs->ring_cookie);
+- if ((fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) || vf)
++ if (fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT))
++ return -EOPNOTSUPP;
++
++ if (fs->ring_cookie != RX_CLS_FLOW_DISC &&
++ ethtool_get_flow_spec_ring_vf(fs->ring_cookie))
+ return -EOPNOTSUPP;
+
+ if (flow_type == IP_USER_FLOW) {
+@@ -1481,7 +1482,7 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp,
+ if (fs->ring_cookie == RX_CLS_FLOW_DISC)
+ new_fltr->base.flags |= BNXT_ACT_DROP;
+ else
+- new_fltr->base.rxq = ring;
++ new_fltr->base.rxq = ethtool_get_flow_spec_ring(fs->ring_cookie);
+ __set_bit(BNXT_FLTR_VALID, &new_fltr->base.state);
+ rc = bnxt_insert_ntp_filter(bp, new_fltr, idx);
+ if (!rc) {
+--
+2.51.0
+
--- /dev/null
+From fa9ee9159b6458f3cbba4677944774828efaf7aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 08:25:50 +0000
+Subject: bpf: crypto: Use the correct destructor kfunc type
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit b40a5d724f29fc2eed23ff353808a9aae616b48a ]
+
+With CONFIG_CFI enabled, the kernel strictly enforces that indirect
+function calls use a function pointer type that matches the target
+function. I ran into the following type mismatch when running BPF
+self-tests:
+
+ CFI failure at bpf_obj_free_fields+0x190/0x238 (target:
+ bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc)
+ Internal error: Oops - CFI: 00000000f2008228 [#1] SMP
+ ...
+
+As bpf_crypto_ctx_release() is also used in BPF programs and using
+a void pointer as the argument would make the verifier unhappy, add
+a simple stub function with the correct type and register it as the
+destructor kfunc instead.
+
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Tested-by: Viktor Malik <vmalik@redhat.com>
+Link: https://lore.kernel.org/r/20260110082548.113748-7-samitolvanen@google.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/crypto.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/crypto.c b/kernel/bpf/crypto.c
+index 83c4d9943084b..1d024fe7248ac 100644
+--- a/kernel/bpf/crypto.c
++++ b/kernel/bpf/crypto.c
+@@ -261,6 +261,12 @@ __bpf_kfunc void bpf_crypto_ctx_release(struct bpf_crypto_ctx *ctx)
+ call_rcu(&ctx->rcu, crypto_free_cb);
+ }
+
++__bpf_kfunc void bpf_crypto_ctx_release_dtor(void *ctx)
++{
++ bpf_crypto_ctx_release(ctx);
++}
++CFI_NOSEAL(bpf_crypto_ctx_release_dtor);
++
+ static int bpf_crypto_crypt(const struct bpf_crypto_ctx *ctx,
+ const struct bpf_dynptr_kern *src,
+ const struct bpf_dynptr_kern *dst,
+@@ -368,7 +374,7 @@ static const struct btf_kfunc_id_set crypt_kfunc_set = {
+
+ BTF_ID_LIST(bpf_crypto_dtor_ids)
+ BTF_ID(struct, bpf_crypto_ctx)
+-BTF_ID(func, bpf_crypto_ctx_release)
++BTF_ID(func, bpf_crypto_ctx_release_dtor)
+
+ static int __init crypto_kfunc_init(void)
+ {
+--
+2.51.0
+
--- /dev/null
+From 96257de503e94ddc6787f01d063cb2e9a5add68a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 08:25:51 +0000
+Subject: bpf: net_sched: Use the correct destructor kfunc type
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit c99d97b46631c4bea0c14b7581b7a59214601e63 ]
+
+With CONFIG_CFI enabled, the kernel strictly enforces that indirect
+function calls use a function pointer type that matches the
+target function. As bpf_kfree_skb() signature differs from the
+btf_dtor_kfunc_t pointer type used for the destructor calls in
+bpf_obj_free_fields(), add a stub function with the correct type to
+fix the type mismatch.
+
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20260110082548.113748-8-samitolvanen@google.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/bpf_qdisc.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/sched/bpf_qdisc.c b/net/sched/bpf_qdisc.c
+index adcb618a2bfca..e9bea9890777d 100644
+--- a/net/sched/bpf_qdisc.c
++++ b/net/sched/bpf_qdisc.c
+@@ -202,6 +202,12 @@ __bpf_kfunc void bpf_kfree_skb(struct sk_buff *skb)
+ kfree_skb(skb);
+ }
+
++__bpf_kfunc void bpf_kfree_skb_dtor(void *skb)
++{
++ bpf_kfree_skb(skb);
++}
++CFI_NOSEAL(bpf_kfree_skb_dtor);
++
+ /* bpf_qdisc_skb_drop - Drop an skb by adding it to a deferred free list.
+ * @skb: The skb whose reference to be released and dropped.
+ * @to_free_list: The list of skbs to be dropped.
+@@ -449,7 +455,7 @@ static struct bpf_struct_ops bpf_Qdisc_ops = {
+ .owner = THIS_MODULE,
+ };
+
+-BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb)
++BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb_dtor)
+
+ static int __init bpf_qdisc_kfunc_init(void)
+ {
+--
+2.51.0
+
--- /dev/null
+From 9b0e63d203f3af7eb91c50952d8a1172d9b30031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 16:25:43 +0000
+Subject: bpf: Properly mark live registers for indirect jumps
+
+From: Anton Protopopov <a.s.protopopov@gmail.com>
+
+[ Upstream commit d1aab1ca576c90192ba961094d51b0be6355a4d6 ]
+
+For a `gotox rX` instruction the rX register should be marked as used
+in the compute_insn_live_regs() function. Fix this.
+
+Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
+Link: https://lore.kernel.org/r/20260114162544.83253-2-a.s.protopopov@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 1999b8d244f64..783d984d7884d 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -24852,6 +24852,12 @@ static void compute_insn_live_regs(struct bpf_verifier_env *env,
+ case BPF_JMP32:
+ switch (code) {
+ case BPF_JA:
++ def = 0;
++ if (BPF_SRC(insn->code) == BPF_X)
++ use = dst;
++ else
++ use = 0;
++ break;
+ case BPF_JCOND:
+ def = 0;
+ use = 0;
+--
+2.51.0
+
--- /dev/null
+From 897af3ea32c676b1bbab7841e7be455174cd091b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 12:13:57 -0800
+Subject: bpf: Recognize special arithmetic shift in the verifier
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7 ]
+
+cilium bpf_wiregard.bpf.c when compiled with -O1 fails to load
+with the following verifier log:
+
+192: (79) r2 = *(u64 *)(r10 -304) ; R2=pkt(r=40) R10=fp0 fp-304=pkt(r=40)
+...
+227: (85) call bpf_skb_store_bytes#9 ; R0=scalar()
+228: (bc) w2 = w0 ; R0=scalar() R2=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
+229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
+230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
+...
+232: (66) if w2 s> 0xffffffff goto pc+125 ; R2=scalar(smin=umin=umin32=0x80000000,smax=umax=umax32=0xffffff7a,smax32=-134,var_off=(0x80000000; 0x7fffff7a))
+...
+238: (79) r4 = *(u64 *)(r10 -304) ; R4=scalar() R10=fp0 fp-304=scalar()
+239: (56) if w2 != 0xffffff78 goto pc+210 ; R2=0xffffff78 // -136
+...
+258: (71) r1 = *(u8 *)(r4 +0)
+R4 invalid mem access 'scalar'
+
+The error might confuse most bpf authors, since fp-304 slot had 'pkt'
+pointer at insn 192 and became 'scalar' at 238. That happened because
+bpf_skb_store_bytes() clears all packet pointers including those in
+the stack. On the first glance it might look like a bug in the source
+code, since ctx->data pointer should have been reloaded after the call
+to bpf_skb_store_bytes().
+
+The relevant part of cilium source code looks like this:
+
+// bpf/lib/nodeport.h
+int dsr_set_ipip6()
+{
+ if (ctx_adjust_hroom(...))
+ return DROP_INVALID; // -134
+ if (ctx_store_bytes(...))
+ return DROP_WRITE_ERROR; // -141
+ return 0;
+}
+
+bool dsr_fail_needs_reply(int code)
+{
+ if (code == DROP_FRAG_NEEDED) // -136
+ return true;
+ return false;
+}
+
+tail_nodeport_ipv6_dsr()
+{
+ ret = dsr_set_ipip6(...);
+ if (!IS_ERR(ret)) {
+ ...
+ } else {
+ if (dsr_fail_needs_reply(ret))
+ return dsr_reply_icmp6(...);
+ }
+}
+
+The code doesn't have arithmetic shift by 31 and it reloads ctx->data
+every time it needs to access it. So it's not a bug in the source code.
+
+The reason is DAGCombiner::foldSelectCCToShiftAnd() LLVM transformation:
+
+ // If this is a select where the false operand is zero and the compare is a
+ // check of the sign bit, see if we can perform the "gzip trick":
+ // select_cc setlt X, 0, A, 0 -> and (sra X, size(X)-1), A
+ // select_cc setgt X, 0, A, 0 -> and (not (sra X, size(X)-1)), A
+
+The conditional branch in dsr_set_ipip6() and its return values
+are optimized into BPF_ARSH plus BPF_AND:
+
+227: (85) call bpf_skb_store_bytes#9
+228: (bc) w2 = w0
+229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
+230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
+
+after insn 230 the register w2 can only be 0 or -134,
+but the verifier approximates it, since there is no way to
+represent two scalars in bpf_reg_state.
+After fallthough at insn 232 the w2 can only be -134,
+hence the branch at insn
+239: (56) if w2 != -136 goto pc+210
+should be always taken, and trapping insn 258 should never execute.
+LLVM generated correct code, but the verifier follows impossible
+path and rejects valid program. To fix this issue recognize this
+special LLVM optimization and fork the verifier state.
+So after insn 229: (c4) w2 s>>= 31
+the verifier has two states to explore:
+one with w2 = 0 and another with w2 = 0xffffffff
+which makes the verifier accept bpf_wiregard.c
+
+A similar pattern exists were OR operation is used in place of the AND
+operation, the verifier detects that pattern as well by forking the
+state before the OR operation with a scalar in range [-1,0].
+
+Note there are 20+ such patterns in bpf_wiregard.o compiled
+with -O1 and -O2, but they're rarely seen in other production
+bpf programs, so push_stack() approach is not a concern.
+
+Reported-by: Hao Sun <sunhao.th@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Co-developed-by: Puranjay Mohan <puranjay@kernel.org>
+Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
+Link: https://lore.kernel.org/r/20260112201424.816836-2-puranjay@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 7069e9f527eaa..1999b8d244f64 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -15499,6 +15499,35 @@ static bool is_safe_to_compute_dst_reg_range(struct bpf_insn *insn,
+ }
+ }
+
++static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *insn,
++ struct bpf_reg_state *dst_reg)
++{
++ struct bpf_verifier_state *branch;
++ struct bpf_reg_state *regs;
++ bool alu32;
++
++ if (dst_reg->smin_value == -1 && dst_reg->smax_value == 0)
++ alu32 = false;
++ else if (dst_reg->s32_min_value == -1 && dst_reg->s32_max_value == 0)
++ alu32 = true;
++ else
++ return 0;
++
++ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
++ if (IS_ERR(branch))
++ return PTR_ERR(branch);
++
++ regs = branch->frame[branch->curframe]->regs;
++ if (alu32) {
++ __mark_reg32_known(®s[insn->dst_reg], 0);
++ __mark_reg32_known(dst_reg, -1ull);
++ } else {
++ __mark_reg_known(®s[insn->dst_reg], 0);
++ __mark_reg_known(dst_reg, -1ull);
++ }
++ return 0;
++}
++
+ /* WARNING: This function does calculations on 64-bit values, but the actual
+ * execution may occur on 32-bit values. Therefore, things like bitshifts
+ * need extra checks in the 32-bit case.
+@@ -15561,11 +15590,21 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ scalar_min_max_mul(dst_reg, &src_reg);
+ break;
+ case BPF_AND:
++ if (tnum_is_const(src_reg.var_off)) {
++ ret = maybe_fork_scalars(env, insn, dst_reg);
++ if (ret)
++ return ret;
++ }
+ dst_reg->var_off = tnum_and(dst_reg->var_off, src_reg.var_off);
+ scalar32_min_max_and(dst_reg, &src_reg);
+ scalar_min_max_and(dst_reg, &src_reg);
+ break;
+ case BPF_OR:
++ if (tnum_is_const(src_reg.var_off)) {
++ ret = maybe_fork_scalars(env, insn, dst_reg);
++ if (ret)
++ return ret;
++ }
+ dst_reg->var_off = tnum_or(dst_reg->var_off, src_reg.var_off);
+ scalar32_min_max_or(dst_reg, &src_reg);
+ scalar_min_max_or(dst_reg, &src_reg);
+--
+2.51.0
+
--- /dev/null
+From e3386a72442ca933ade149e43245bd6c3aa377b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 18:02:19 +0000
+Subject: bpf: verifier improvement in 32bit shift sign extension pattern
+
+From: Cupertino Miranda <cupertino.miranda@oracle.com>
+
+[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ]
+
+This patch improves the verifier to correctly compute bounds for
+sign extension compiler pattern composed of left shift by 32bits
+followed by a sign right shift by 32bits. Pattern in the verifier was
+limitted to positive value bounds and would reset bound computation for
+negative values. New code allows both positive and negative values for
+sign extension without compromising bound computation and verifier to
+pass.
+
+This change is required by GCC which generate such pattern, and was
+detected in the context of systemd, as described in the following GCC
+bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731
+
+Three new tests were added in verifier_subreg.c.
+
+Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com>
+Signed-off-by: Andrew Pinski <andrew.pinski@oss.qualcomm.com>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Cc: David Faust <david.faust@oracle.com>
+Cc: Jose Marchesi <jose.marchesi@oracle.com>
+Cc: Elena Zannoni <elena.zannoni@oracle.com>
+Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index fe01edfcc34c6..7069e9f527eaa 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -15305,21 +15305,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg,
+ u64 umin_val, u64 umax_val)
+ {
+ /* Special case <<32 because it is a common compiler pattern to sign
+- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are
+- * positive we know this shift will also be positive so we can track
+- * bounds correctly. Otherwise we lose all sign bit information except
+- * what we can pick up from var_off. Perhaps we can generalize this
+- * later to shifts of any length.
++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct
++ * because s32 bounds don't flip sign when shifting to the left by
++ * 32bits.
+ */
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0)
++ if (umin_val == 32 && umax_val == 32) {
+ dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32;
+- else
+- dst_reg->smax_value = S64_MAX;
+-
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0)
+ dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32;
+- else
++ } else {
++ dst_reg->smax_value = S64_MAX;
+ dst_reg->smin_value = S64_MIN;
++ }
+
+ /* If we might shift our top bit out, then we know nothing */
+ if (dst_reg->umax_value > 1ULL << (63 - umax_val)) {
+--
+2.51.0
+
--- /dev/null
+From 6aebc535bda6f9d3297602ea8222782a4802ff2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 13:12:55 -0800
+Subject: bpftool: Fix dependencies for static build
+
+From: Ihor Solodrai <ihor.solodrai@linux.dev>
+
+[ Upstream commit 08a7491843224f8b96518fbe70d9e48163046054 ]
+
+When building selftests/bpf with EXTRA_LDFLAGS=-static the follwoing
+error happens:
+
+ LINK /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool
+/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-dso_dlfcn.o): in function `dlfcn_globallookup':
+ [...]
+/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_expand_block':
+(.text+0xc64): undefined reference to `uncompress'
+/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_compress_block':
+(.text+0xce4): undefined reference to `compress'
+collect2: error: ld returned 1 exit status
+make[1]: *** [Makefile:252: /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool] Error 1
+make: *** [Makefile:327: /ws/linux/tools/testing/selftests/bpf/tools/sbin/bpftool] Error 2
+make: *** Waiting for unfinished jobs....
+
+This is caused by wrong order of dependencies in the Makefile. Fix it.
+
+Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20260128211255.376933-1-ihor.solodrai@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
+index 5442073a2e428..519ea5cb8ab1c 100644
+--- a/tools/bpf/bpftool/Makefile
++++ b/tools/bpf/bpftool/Makefile
+@@ -130,8 +130,8 @@ include $(FEATURES_DUMP)
+ endif
+ endif
+
+-LIBS = $(LIBBPF) -lelf -lz -lcrypto
+-LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lz -lcrypto
++LIBS = $(LIBBPF) -lelf -lcrypto -lz
++LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lcrypto -lz
+
+ ifeq ($(feature-libelf-zstd),1)
+ LIBS += -lzstd
+--
+2.51.0
+
--- /dev/null
+From 7a4fef710a8846b8321e6d07681d2ea1ea8ac633 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 15:46:55 +1030
+Subject: btrfs: do not ASSERT() when the fs flips RO inside
+ btrfs_repair_io_failure()
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3 ]
+
+[BUG]
+There is a bug report that when btrfs hits ENOSPC error in a critical
+path, btrfs flips RO (this part is expected, although the ENOSPC bug
+still needs to be addressed).
+
+The problem is after the RO flip, if there is a read repair pending, we
+can hit the ASSERT() inside btrfs_repair_io_failure() like the following:
+
+ BTRFS info (device vdc): relocating block group 30408704 flags metadata|raid1
+ ------------[ cut here ]------------
+ BTRFS: Transaction aborted (error -28)
+ WARNING: fs/btrfs/extent-tree.c:3235 at __btrfs_free_extent.isra.0+0x453/0xfd0, CPU#1: btrfs/383844
+ Modules linked in: kvm_intel kvm irqbypass
+ [...]
+ ---[ end trace 0000000000000000 ]---
+ BTRFS info (device vdc state EA): 2 enospc errors during balance
+ BTRFS info (device vdc state EA): balance: ended with status: -30
+ BTRFS error (device vdc state EA): parent transid verify failed on logical 30556160 mirror 2 wanted 8 found 6
+ BTRFS error (device vdc state EA): bdev /dev/nvme0n1 errs: wr 0, rd 0, flush 0, corrupt 10, gen 0
+ [...]
+ assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938
+ ------------[ cut here ]------------
+ assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938
+ kernel BUG at fs/btrfs/bio.c:938!
+ Oops: invalid opcode: 0000 [#1] SMP NOPTI
+ CPU: 0 UID: 0 PID: 868 Comm: kworker/u8:13 Tainted: G W N 6.19.0-rc6+ #4788 PREEMPT(full)
+ Tainted: [W]=WARN, [N]=TEST
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
+ Workqueue: btrfs-endio simple_end_io_work
+ RIP: 0010:btrfs_repair_io_failure.cold+0xb2/0x120
+ RSP: 0000:ffffc90001d2bcf0 EFLAGS: 00010246
+ RAX: 0000000000000051 RBX: 0000000000001000 RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: ffffffff8305cf42 RDI: 00000000ffffffff
+ RBP: 0000000000000002 R08: 00000000fffeffff R09: ffffffff837fa988
+ R10: ffffffff8327a9e0 R11: 6f69747265737361 R12: ffff88813018d310
+ R13: ffff888168b8a000 R14: ffffc90001d2bd90 R15: ffff88810a169000
+ FS: 0000000000000000(0000) GS:ffff8885e752c000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ ------------[ cut here ]------------
+
+[CAUSE]
+The cause of -ENOSPC error during the test case btrfs/124 is still
+unknown, although it's known that we still have cases where metadata can
+be over-committed but can not be fulfilled correctly, thus if we hit
+such ENOSPC error inside a critical path, we have no choice but abort
+the current transaction.
+
+This will mark the fs read-only.
+
+The problem is inside the btrfs_repair_io_failure() path that we require
+the fs not to be mount read-only. This is normally fine, but if we are
+doing a read-repair meanwhile the fs flips RO due to a critical error,
+we can enter btrfs_repair_io_failure() with super block set to
+read-only, thus triggering the above crash.
+
+[FIX]
+Just replace the ASSERT() with a proper return if the fs is already
+read-only.
+
+Reported-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/linux-btrfs/20260126045555.GB31641@lst.de/
+Tested-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/bio.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/bio.c b/fs/btrfs/bio.c
+index e4d382d3a7aea..1de1b408c6a6d 100644
+--- a/fs/btrfs/bio.c
++++ b/fs/btrfs/bio.c
+@@ -934,7 +934,6 @@ int btrfs_repair_io_failure(struct btrfs_fs_info *fs_info, u64 ino, u64 fileoff,
+ struct bio *bio = NULL;
+ int ret = 0;
+
+- ASSERT(!(fs_info->sb->s_flags & SB_RDONLY));
+ BUG_ON(!mirror_num);
+
+ /* Basic alignment checks. */
+@@ -946,6 +945,13 @@ int btrfs_repair_io_failure(struct btrfs_fs_info *fs_info, u64 ino, u64 fileoff,
+ ASSERT(step <= length);
+ ASSERT(is_power_of_2(step));
+
++ /*
++ * The fs either mounted RO or hit critical errors, no need
++ * to continue repairing.
++ */
++ if (unlikely(sb_rdonly(fs_info->sb)))
++ return 0;
++
+ if (btrfs_repair_one_zone(fs_info, logical))
+ return 0;
+
+--
+2.51.0
+
--- /dev/null
+From c42213c8f325987b57c8b3f2b196b4baca074c9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 16:37:26 +0000
+Subject: btrfs: don't BUG() on unexpected delayed ref type in
+ run_one_delayed_ref()
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit c7d1d4ff56744074e005771aff193b927392d51f ]
+
+There is no need to BUG(), we can just return an error and log an error
+message.
+
+Reviewed-by: Boris Burkov <boris@bur.io>
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index e4cae34620d19..1bf081243efb2 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1761,32 +1761,36 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_extent_op *extent_op,
+ bool insert_reserved)
+ {
++ struct btrfs_fs_info *fs_info = trans->fs_info;
+ int ret = 0;
+
+ if (TRANS_ABORTED(trans)) {
+ if (insert_reserved) {
+ btrfs_pin_extent(trans, node->bytenr, node->num_bytes);
+- free_head_ref_squota_rsv(trans->fs_info, href);
++ free_head_ref_squota_rsv(fs_info, href);
+ }
+ return 0;
+ }
+
+ if (node->type == BTRFS_TREE_BLOCK_REF_KEY ||
+- node->type == BTRFS_SHARED_BLOCK_REF_KEY)
++ node->type == BTRFS_SHARED_BLOCK_REF_KEY) {
+ ret = run_delayed_tree_ref(trans, href, node, extent_op,
+ insert_reserved);
+- else if (node->type == BTRFS_EXTENT_DATA_REF_KEY ||
+- node->type == BTRFS_SHARED_DATA_REF_KEY)
++ } else if (node->type == BTRFS_EXTENT_DATA_REF_KEY ||
++ node->type == BTRFS_SHARED_DATA_REF_KEY) {
+ ret = run_delayed_data_ref(trans, href, node, extent_op,
+ insert_reserved);
+- else if (node->type == BTRFS_EXTENT_OWNER_REF_KEY)
++ } else if (node->type == BTRFS_EXTENT_OWNER_REF_KEY) {
+ ret = 0;
+- else
+- BUG();
++ } else {
++ ret = -EUCLEAN;
++ btrfs_err(fs_info, "unexpected delayed ref node type: %u", node->type);
++ }
++
+ if (ret && insert_reserved)
+ btrfs_pin_extent(trans, node->bytenr, node->num_bytes);
+ if (ret < 0)
+- btrfs_err(trans->fs_info,
++ btrfs_err(fs_info,
+ "failed to run delayed ref for logical %llu num_bytes %llu type %u action %u ref_mod %d: %d",
+ node->bytenr, node->num_bytes, node->type,
+ node->action, node->ref_mod, ret);
+--
+2.51.0
+
--- /dev/null
+From 29d39391f56c2fb30d091acc97f5c69d66d4b6a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Nov 2025 10:22:16 +1030
+Subject: btrfs: fallback to buffered IO if the data profile has duplication
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 7c2830f00c3e086292c1ee9f27b61efaf8e76c9a ]
+
+[BACKGROUND]
+Inspired by a recent kernel bug report, which is related to direct IO
+buffer modification during writeback, that leads to contents mismatch of
+different RAID1 mirrors.
+
+[CAUSE AND PROBLEMS]
+The root cause is exactly the same explained in commit 968f19c5b1b7
+("btrfs: always fallback to buffered write if the inode requires
+checksum"), that we can not trust direct IO buffer which can be modified
+halfway during writeback.
+
+Unlike data checksum verification, if this happened on inodes without
+data checksum but has the data has extra mirrors, it will lead to
+stealth data mismatch on different mirrors.
+
+This will be way harder to detect without data checksum.
+
+Furthermore for RAID56, we can even have data without checksum and data
+with checksum mixed inside the same full stripe.
+
+In that case if the direct IO buffer got changed halfway for the
+nodatasum part, the data with checksum immediately lost its ability to
+recover, e.g.:
+
+" " = Good old data or parity calculated using good old data
+"X" = Data modified during writeback
+
+ 0 32K 64K
+ Data 1 | | Has csum
+ Data 2 |XXXXXXXXXXXXXXXX | No csum
+ Parity | |
+
+In above case, the parity is calculated using data 1 (has csum, from
+page cache, won't change during writeback), and old data 2 (has no csum,
+direct IO write).
+
+After parity is calculated, but before submission to the storage, direct
+IO buffer of data 2 is modified, causing the range [0, 32K) of data 2
+has a different content.
+
+Now all data is submitted to the storage, and the fs got fully synced.
+
+Then the device of data 1 is lost, has to be rebuilt from data 2 and
+parity. But since the data 2 has some modified data, and the parity is
+calculated using old data, the recovered data is no the same for data 1,
+causing data checksum mismatch.
+
+[FIX]
+Fix the problem by checking the data allocation profile.
+If our data allocation profile is either RAID0 or SINGLE, we can allow
+true zero-copy direct IO and the end user is fully responsible for any
+race.
+
+However this is not going to fix all situations, as it's still possible
+to race with balance where the fs got a new data profile after the data
+allocation profile check.
+But this fix should still greatly reduce the window of the original bug.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=99171
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/direct-io.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/fs/btrfs/direct-io.c b/fs/btrfs/direct-io.c
+index 07e19e88ba4b3..5443d69efe956 100644
+--- a/fs/btrfs/direct-io.c
++++ b/fs/btrfs/direct-io.c
+@@ -814,6 +814,8 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from)
+ ssize_t ret;
+ unsigned int ilock_flags = 0;
+ struct iomap_dio *dio;
++ const u64 data_profile = btrfs_data_alloc_profile(fs_info) &
++ BTRFS_BLOCK_GROUP_PROFILE_MASK;
+
+ if (iocb->ki_flags & IOCB_NOWAIT)
+ ilock_flags |= BTRFS_ILOCK_TRY;
+@@ -827,6 +829,16 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from)
+ if (iocb->ki_pos + iov_iter_count(from) <= i_size_read(inode) && IS_NOSEC(inode))
+ ilock_flags |= BTRFS_ILOCK_SHARED;
+
++ /*
++ * If our data profile has duplication (either extra mirrors or RAID56),
++ * we can not trust the direct IO buffer, the content may change during
++ * writeback and cause different contents written to different mirrors.
++ *
++ * Thus only RAID0 and SINGLE can go true zero-copy direct IO.
++ */
++ if (data_profile != BTRFS_BLOCK_GROUP_RAID0 && data_profile != 0)
++ goto buffered;
++
+ relock:
+ ret = btrfs_inode_lock(BTRFS_I(inode), ilock_flags);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From 92ca26ea5f9525bb1724eb912cb4d83e74869b5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 07:06:40 +0000
+Subject: btrfs: handle user interrupt properly in btrfs_trim_fs()
+
+From: jinbaohong <jinbaohong@synology.com>
+
+[ Upstream commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 ]
+
+When a fatal signal is pending or the process is freezing,
+btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS.
+Currently this is treated as a regular error: the loops continue to the
+next iteration and count it as a block group or device failure.
+
+Instead, break out of the loops immediately and return -ERESTARTSYS to
+userspace without counting it as a failure. Also skip the device loop
+entirely if the block group loop was interrupted.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Robbie Ko <robbieko@synology.com>
+Signed-off-by: jinbaohong <jinbaohong@synology.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 1bf081243efb2..8bdb609f58a7e 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6555,6 +6555,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ range->minlen);
+
+ trimmed += group_trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR) {
++ btrfs_put_block_group(cache);
++ break;
++ }
+ if (ret) {
+ bg_failed++;
+ bg_ret = ret;
+@@ -6568,6 +6572,9 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ "failed to trim %llu block group(s), last error %d",
+ bg_failed, bg_ret);
+
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ return ret;
++
+ mutex_lock(&fs_devices->device_list_mutex);
+ list_for_each_entry(device, &fs_devices->devices, dev_list) {
+ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
+@@ -6576,6 +6583,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ ret = btrfs_trim_free_extents(device, &group_trimmed);
+
+ trimmed += group_trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ break;
+ if (ret) {
+ dev_failed++;
+ dev_ret = ret;
+@@ -6589,6 +6598,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ "failed to trim %llu device(s), last error %d",
+ dev_failed, dev_ret);
+ range->len = trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ return ret;
+ if (bg_ret)
+ return bg_ret;
+ return dev_ret;
+--
+2.51.0
+
--- /dev/null
+From e0b18c890ee6e3d335e358aa74dc6724e60340b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 22:53:57 +0530
+Subject: btrfs: replace BUG() with error handling in __btrfs_balance()
+
+From: Adarsh Das <adarshdas950@gmail.com>
+
+[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ]
+
+We search with offset (u64)-1 which should never match exactly.
+Previously this was handled with BUG(). Now logs an error
+and return -EUCLEAN.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 99e167a697ba8..1cbe7c6a2889c 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4234,8 +4234,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info)
+ * this shouldn't happen, it means the last relocate
+ * failed
+ */
+- if (ret == 0)
+- BUG(); /* FIXME break ? */
++ if (unlikely(ret == 0)) {
++ btrfs_err(fs_info,
++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx",
++ key.offset);
++ mutex_unlock(&fs_info->reclaim_bgs_lock);
++ ret = -EUCLEAN;
++ goto error;
++ }
+
+ ret = btrfs_previous_item(chunk_root, path, 0,
+ BTRFS_CHUNK_ITEM_KEY);
+--
+2.51.0
+
--- /dev/null
+From 4164e74164367b88cf482a93e1bb16a331a6369b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 18:42:06 +0800
+Subject: ceph: supply snapshot context in ceph_uninline_data()
+
+From: ethanwu <ethanwu@synology.com>
+
+[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ]
+
+The ceph_uninline_data function was missing proper snapshot context
+handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and
+CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate
+snapshot context, which could lead to unnecessary object clone.
+
+Reproducer:
+../src/vstart.sh --new -x --localhost --bluestore
+// turn on cephfs inline data
+./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it
+// allow fs_a client to take snapshot
+./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a'
+// mount cephfs with fuse, since kernel cephfs doesn't support inline write
+ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/
+// bump snapshot seq
+mkdir /mnt/mycephfs/.snap/snap1
+echo "foo" > /mnt/mycephfs/test
+// umount and mount it again using kernel cephfs client
+umount /mnt/mycephfs
+mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf
+echo "bar" >> /mnt/mycephfs/test
+./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000
+
+will see this object does unnecessary clone
+1000000000a.00000000 (seq:2):
+cloneid snaps size overlap
+2 2 4 []
+head - 8
+
+but it's expected to see
+10000000000.00000000 (seq:2):
+cloneid snaps size overlap
+head - 8
+
+since there's no snapshot between these 2 writes
+
+clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't
+pass snap context so object is created with snap seq 0, but later data
+writeback is equipped with snapshot context.
+snap.seq(1) > object snap seq(0), so osd does object clone.
+
+This fix properly acquiring the snapshot context before performing
+write operations.
+
+Signed-off-by: ethanwu <ethanwu@synology.com>
+Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/addr.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index 63b75d2142102..faecd9025ee9c 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -2199,6 +2199,7 @@ int ceph_uninline_data(struct file *file)
+ struct ceph_osd_request *req = NULL;
+ struct ceph_cap_flush *prealloc_cf = NULL;
+ struct folio *folio = NULL;
++ struct ceph_snap_context *snapc = NULL;
+ u64 inline_version = CEPH_INLINE_NONE;
+ struct page *pages[1];
+ int err = 0;
+@@ -2226,6 +2227,24 @@ int ceph_uninline_data(struct file *file)
+ if (inline_version == 1) /* initial version, no data */
+ goto out_uninline;
+
++ down_read(&fsc->mdsc->snap_rwsem);
++ spin_lock(&ci->i_ceph_lock);
++ if (__ceph_have_pending_cap_snap(ci)) {
++ struct ceph_cap_snap *capsnap =
++ list_last_entry(&ci->i_cap_snaps,
++ struct ceph_cap_snap,
++ ci_item);
++ snapc = ceph_get_snap_context(capsnap->context);
++ } else {
++ if (!ci->i_head_snapc) {
++ ci->i_head_snapc = ceph_get_snap_context(
++ ci->i_snap_realm->cached_context);
++ }
++ snapc = ceph_get_snap_context(ci->i_head_snapc);
++ }
++ spin_unlock(&ci->i_ceph_lock);
++ up_read(&fsc->mdsc->snap_rwsem);
++
+ folio = read_mapping_folio(inode->i_mapping, 0, file);
+ if (IS_ERR(folio)) {
+ err = PTR_ERR(folio);
+@@ -2241,7 +2260,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 0, 1,
+ CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE,
+- NULL, 0, 0, false);
++ snapc, 0, 0, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+ goto out_unlock;
+@@ -2257,7 +2276,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 1, 3,
+ CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE,
+- NULL, ci->i_truncate_seq,
++ snapc, ci->i_truncate_seq,
+ ci->i_truncate_size, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+@@ -2320,6 +2339,7 @@ int ceph_uninline_data(struct file *file)
+ folio_put(folio);
+ }
+ out:
++ ceph_put_snap_context(snapc);
+ ceph_free_cap_flush(prealloc_cf);
+ doutc(cl, "%llx.%llx inline_version %llu = %d\n",
+ ceph_vinop(inode), inline_version, err);
+--
+2.51.0
+
--- /dev/null
+From ebd8d8ebf66148e81f27a52dfa155a1bf18dda90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 11:00:19 -0500
+Subject: cgroup/cpuset: Don't fail cpuset.cpus change in v2
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 6e6f13f6d5095f3a432da421e78f4d7d51ef39c8 ]
+
+Commit fe8cd2736e75 ("cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE
+until valid partition") introduced a new check to disallow the setting
+of a new cpuset.cpus.exclusive value that is a superset of a sibling's
+cpuset.cpus value so that there will at least be one CPU left in the
+sibling in case the cpuset becomes a valid partition root. This new
+check does have the side effect of failing a cpuset.cpus change that
+make it a subset of a sibling's cpuset.cpus.exclusive value.
+
+With v2, users are supposed to be allowed to set whatever value they
+want in cpuset.cpus without failure. To maintain this rule, the check
+is now restricted to only when cpuset.cpus.exclusive is being changed
+not when cpuset.cpus is changed.
+
+The cgroup-v2.rst doc file is also updated to reflect this change.
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Reviewed-by: Chen Ridong <chenridong@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/admin-guide/cgroup-v2.rst | 8 +++----
+ kernel/cgroup/cpuset.c | 30 ++++++++++++-------------
+ 2 files changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst
+index 7f5b59d95fce5..510df2461aff2 100644
+--- a/Documentation/admin-guide/cgroup-v2.rst
++++ b/Documentation/admin-guide/cgroup-v2.rst
+@@ -2561,10 +2561,10 @@ Cpuset Interface Files
+ Users can manually set it to a value that is different from
+ "cpuset.cpus". One constraint in setting it is that the list of
+ CPUs must be exclusive with respect to "cpuset.cpus.exclusive"
+- of its sibling. If "cpuset.cpus.exclusive" of a sibling cgroup
+- isn't set, its "cpuset.cpus" value, if set, cannot be a subset
+- of it to leave at least one CPU available when the exclusive
+- CPUs are taken away.
++ and "cpuset.cpus.exclusive.effective" of its siblings. Another
++ constraint is that it cannot be a superset of "cpuset.cpus"
++ of its sibling in order to leave at least one CPU available to
++ that sibling when the exclusive CPUs are taken away.
+
+ For a parent cgroup, any one of its exclusive CPUs can only
+ be distributed to at most one of its child cgroups. Having an
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index c06e2e96f79dc..dc3ac38c5d160 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -603,33 +603,31 @@ static inline bool cpusets_are_exclusive(struct cpuset *cs1, struct cpuset *cs2)
+
+ /**
+ * cpus_excl_conflict - Check if two cpusets have exclusive CPU conflicts
+- * @cs1: first cpuset to check
+- * @cs2: second cpuset to check
++ * @trial: the trial cpuset to be checked
++ * @sibling: a sibling cpuset to be checked against
++ * @xcpus_changed: set if exclusive_cpus has been set
+ *
+ * Returns: true if CPU exclusivity conflict exists, false otherwise
+ *
+ * Conflict detection rules:
+ * 1. If either cpuset is CPU exclusive, they must be mutually exclusive
+ * 2. exclusive_cpus masks cannot intersect between cpusets
+- * 3. The allowed CPUs of one cpuset cannot be a subset of another's exclusive CPUs
++ * 3. The allowed CPUs of a sibling cpuset cannot be a subset of the new exclusive CPUs
+ */
+-static inline bool cpus_excl_conflict(struct cpuset *cs1, struct cpuset *cs2)
++static inline bool cpus_excl_conflict(struct cpuset *trial, struct cpuset *sibling,
++ bool xcpus_changed)
+ {
+ /* If either cpuset is exclusive, check if they are mutually exclusive */
+- if (is_cpu_exclusive(cs1) || is_cpu_exclusive(cs2))
+- return !cpusets_are_exclusive(cs1, cs2);
++ if (is_cpu_exclusive(trial) || is_cpu_exclusive(sibling))
++ return !cpusets_are_exclusive(trial, sibling);
+
+ /* Exclusive_cpus cannot intersect */
+- if (cpumask_intersects(cs1->exclusive_cpus, cs2->exclusive_cpus))
++ if (cpumask_intersects(trial->exclusive_cpus, sibling->exclusive_cpus))
+ return true;
+
+- /* The cpus_allowed of one cpuset cannot be a subset of another cpuset's exclusive_cpus */
+- if (!cpumask_empty(cs1->cpus_allowed) &&
+- cpumask_subset(cs1->cpus_allowed, cs2->exclusive_cpus))
+- return true;
+-
+- if (!cpumask_empty(cs2->cpus_allowed) &&
+- cpumask_subset(cs2->cpus_allowed, cs1->exclusive_cpus))
++ /* The cpus_allowed of a sibling cpuset cannot be a subset of the new exclusive_cpus */
++ if (xcpus_changed && !cpumask_empty(sibling->cpus_allowed) &&
++ cpumask_subset(sibling->cpus_allowed, trial->exclusive_cpus))
+ return true;
+
+ return false;
+@@ -666,6 +664,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
+ {
+ struct cgroup_subsys_state *css;
+ struct cpuset *c, *par;
++ bool xcpus_changed;
+ int ret = 0;
+
+ rcu_read_lock();
+@@ -722,10 +721,11 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
+ * overlap. exclusive_cpus cannot overlap with each other if set.
+ */
+ ret = -EINVAL;
++ xcpus_changed = !cpumask_equal(cur->exclusive_cpus, trial->exclusive_cpus);
+ cpuset_for_each_child(c, css, par) {
+ if (c == cur)
+ continue;
+- if (cpus_excl_conflict(trial, c))
++ if (cpus_excl_conflict(trial, c, xcpus_changed))
+ goto out;
+ if (mems_excl_conflict(trial, c))
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From 1d3dcf40a93da62f90214c8c88a5f64f36feb468 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:29 +0100
+Subject: char: tpm: cr50: Remove IRQF_ONESHOT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+
+The flag also prevents force-threading of the primary handler and the
+irq-core will warn about this.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +--
+ drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+index fc6891a0b6936..b48cacacc0664 100644
+--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c
++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+@@ -749,8 +749,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client)
+
+ if (client->irq > 0) {
+ rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler,
+- IRQF_TRIGGER_FALLING | IRQF_ONESHOT |
+- IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
+ dev->driver->name, chip);
+ if (rc < 0) {
+ dev_err(dev, "Failed to probe IRQ %d\n", client->irq);
+diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c
+index f4937280e9406..32920b4cecfb4 100644
+--- a/drivers/char/tpm/tpm_tis_spi_cr50.c
++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c
+@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi)
+ if (spi->irq > 0) {
+ ret = devm_request_irq(&spi->dev, spi->irq,
+ cr50_spi_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ "cr50_spi", cr50_phy);
+ if (ret < 0) {
+ if (ret == -EPROBE_DEFER)
+--
+2.51.0
+
--- /dev/null
+From 3f2e566843bd4b6f2ab2af7e3bb0d2353c2b30f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:59:01 +0800
+Subject: clk: amlogic: remove potentially unsafe flags from S4 video clocks
+
+From: Chuan Liu <chuan.liu@amlogic.com>
+
+[ Upstream commit 4aca7e92023cac5018b4053bae324450f884c937 ]
+
+The video clocks enci, encp, vdac and hdmitx share the same clock
+source. Adding CLK_SET_RATE_PARENT to the mux may unintentionally change
+the shared parent clock, which could affect other video clocks.
+
+Signed-off-by: Chuan Liu <chuan.liu@amlogic.com>
+Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-3-fe223161fb3f@amlogic.com
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/s4-peripherals.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/clk/meson/s4-peripherals.c b/drivers/clk/meson/s4-peripherals.c
+index 6d69b132d1e1f..bab4f5700de47 100644
+--- a/drivers/clk/meson/s4-peripherals.c
++++ b/drivers/clk/meson/s4-peripherals.c
+@@ -1106,7 +1106,6 @@ static struct clk_regmap s4_cts_enci_sel = {
+ .ops = &clk_regmap_mux_ops,
+ .parent_hws = s4_cts_parents,
+ .num_parents = ARRAY_SIZE(s4_cts_parents),
+- .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+@@ -1122,7 +1121,6 @@ static struct clk_regmap s4_cts_encp_sel = {
+ .ops = &clk_regmap_mux_ops,
+ .parent_hws = s4_cts_parents,
+ .num_parents = ARRAY_SIZE(s4_cts_parents),
+- .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+@@ -1138,7 +1136,6 @@ static struct clk_regmap s4_cts_vdac_sel = {
+ .ops = &clk_regmap_mux_ops,
+ .parent_hws = s4_cts_parents,
+ .num_parents = ARRAY_SIZE(s4_cts_parents),
+- .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+@@ -1169,7 +1166,6 @@ static struct clk_regmap s4_hdmi_tx_sel = {
+ .ops = &clk_regmap_mux_ops,
+ .parent_hws = s4_hdmi_tx_parents,
+ .num_parents = ARRAY_SIZE(s4_hdmi_tx_parents),
+- .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From e6200eee5d61a0099002dbba554576e2bf254fcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 14:46:28 -0500
+Subject: clk: microchip: core: correct return value on *_get_parent()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ]
+
+roclk_get_parent() and sclk_get_parent() has the possibility of
+returning -EINVAL, however the framework expects this call to always
+succeed since the return value is unsigned.
+
+If there is no parent map defined, then the current value programmed in
+the hardware is used. Let's use that same value in the case where
+-EINVAL is currently returned.
+
+This index is only used by clk_core_get_parent_by_index(), and it
+validates that it doesn't overflow the number of available parents.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/microchip/clk-core.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c
+index a0163441dfe5c..82f62731fc0ed 100644
+--- a/drivers/clk/microchip/clk-core.c
++++ b/drivers/clk/microchip/clk-core.c
+@@ -283,14 +283,13 @@ static u8 roclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK;
+
+- if (!refo->parent_map)
+- return v;
+-
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (refo->parent_map[i] == v)
+- return i;
++ if (refo->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (refo->parent_map[i] == v)
++ return i;
++ }
+
+- return -EINVAL;
++ return v;
+ }
+
+ static unsigned long roclk_calc_rate(unsigned long parent_rate,
+@@ -817,13 +816,13 @@ static u8 sclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK;
+
+- if (!sclk->parent_map)
+- return v;
++ if (sclk->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (sclk->parent_map[i] == v)
++ return i;
++ }
+
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (sclk->parent_map[i] == v)
+- return i;
+- return -EINVAL;
++ return v;
+ }
+
+ static int sclk_set_parent(struct clk_hw *hw, u8 index)
+--
+2.51.0
+
--- /dev/null
+From 60902cfd2e88699f36a5336b4294b6dba4f84fa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:34:27 +0000
+Subject: clk: renesas: rzg2l: Deassert reset on assert timeout
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 0b0201f259e1158a875c5fd01adf318ae5d32352 ]
+
+If the assert() fails due to timeout error, set the reset register bit
+back to deasserted state. This change is needed especially for handling
+assert error in suspend() callback that expect the device to be in
+operational state in case of failure.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20260108123433.104464-2-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 64d1ef6e4c943..c20ea1212b360 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -1647,6 +1647,7 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
+ u32 mask = BIT(info->resets[id].bit);
+ s8 monbit = info->resets[id].monbit;
+ u32 value = mask << 16;
++ u32 mon;
+ int ret;
+
+ dev_dbg(rcdev->dev, "%s id:%ld offset:0x%x\n",
+@@ -1667,10 +1668,10 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
+ return 0;
+ }
+
+- ret = readl_poll_timeout_atomic(priv->base + reg, value,
+- assert == !!(value & mask), 10, 200);
+- if (ret && !assert) {
+- value = mask << 16;
++ ret = readl_poll_timeout_atomic(priv->base + reg, mon,
++ assert == !!(mon & mask), 10, 200);
++ if (ret) {
++ value ^= mask;
+ writel(value, priv->base + CLK_RST_R(info->resets[id].off));
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 174508a08816695f021d8b7cd92af6c4e3db6cb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 23:13:41 +0100
+Subject: clocksource/drivers/sh_tmu: Always leave device running after probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ]
+
+The TMU device can be used as both a clocksource and a clockevent
+provider. The driver tries to be smart and power itself on and off, as
+well as enabling and disabling its clock when it's not in operation.
+This behavior is slightly altered if the TMU is used as an early
+platform device in which case the device is left powered on after probe,
+but the clock is still enabled and disabled at runtime.
+
+This has worked for a long time, but recent improvements in PREEMPT_RT
+and PROVE_LOCKING have highlighted an issue. As the TMU registers itself
+as a clockevent provider, clockevents_register_device(), it needs to use
+raw spinlocks internally as this is the context of which the clockevent
+framework interacts with the TMU driver. However in the context of
+holding a raw spinlock the TMU driver can't really manage its power
+state or clock with calls to pm_runtime_*() and clk_*() as these calls
+end up in other platform drivers using regular spinlocks to control
+power and clocks.
+
+This mix of spinlock contexts trips a lockdep warning.
+
+ =============================
+ [ BUG: Invalid wait context ]
+ 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted
+ -----------------------------
+ swapper/0/0 is trying to lock:
+ ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88
+ other info that might help us debug this:
+ context-{5:5}
+ 1 lock held by swapper/0/0:
+ ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0
+ #0: ffff8000817ec298
+ ccree e6601000.crypto: ARM ccree device initialized
+ (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT
+ Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
+ Call trace:
+ show_stack+0x14/0x1c (C)
+ dump_stack_lvl+0x6c/0x90
+ dump_stack+0x14/0x1c
+ __lock_acquire+0x904/0x1584
+ lock_acquire+0x220/0x34c
+ _raw_spin_lock_irqsave+0x58/0x80
+ __pm_runtime_resume+0x38/0x88
+ sh_tmu_clock_event_set_oneshot+0x84/0xd4
+ clockevents_switch_state+0xfc/0x13c
+ tick_broadcast_set_event+0x30/0xa4
+ __tick_broadcast_oneshot_control+0x1e0/0x3a8
+ tick_broadcast_oneshot_control+0x30/0x40
+ cpuidle_enter_state+0x40c/0x680
+ cpuidle_enter+0x30/0x40
+ do_idle+0x1f4/0x280
+ cpu_startup_entry+0x34/0x40
+ kernel_init+0x0/0x130
+ do_one_initcall+0x0/0x230
+ __primary_switched+0x88/0x90
+
+For non-PREEMPT_RT builds this is not really an issue, but for
+PREEMPT_RT builds where normal spinlocks can sleep this might be an
+issue. Be cautious and always leave the power and clock running after
+probe.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/sh_tmu.c | 18 ------------------
+ 1 file changed, 18 deletions(-)
+
+diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
+index beffff81c00f3..3fc6ed9b56300 100644
+--- a/drivers/clocksource/sh_tmu.c
++++ b/drivers/clocksource/sh_tmu.c
+@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start)
+
+ static int __sh_tmu_enable(struct sh_tmu_channel *ch)
+ {
+- int ret;
+-
+- /* enable clock */
+- ret = clk_enable(ch->tmu->clk);
+- if (ret) {
+- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n",
+- ch->index);
+- return ret;
+- }
+-
+ /* make sure channel is disabled */
+ sh_tmu_start_stop_ch(ch, 0);
+
+@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch)
+ if (ch->enable_count++ > 0)
+ return 0;
+
+- pm_runtime_get_sync(&ch->tmu->pdev->dev);
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, true);
+
+ return __sh_tmu_enable(ch);
+@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch)
+
+ /* disable interrupts in TMU block */
+ sh_tmu_write(ch, TCR, TCR_TPSC_CLK4);
+-
+- /* stop clock */
+- clk_disable(ch->tmu->clk);
+ }
+
+ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+ __sh_tmu_disable(ch);
+
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, false);
+- pm_runtime_put(&ch->tmu->pdev->dev);
+ }
+
+ static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta,
+@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
+ goto err_clk_unprepare;
+
+ tmu->rate = clk_get_rate(tmu->clk) / 4;
+- clk_disable(tmu->clk);
+
+ /* Map the memory resource. */
+ ret = sh_tmu_map_memory(tmu);
+@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev)
+ out:
+ if (tmu->has_clockevent || tmu->has_clocksource)
+ pm_runtime_irq_safe(&pdev->dev);
+- else
+- pm_runtime_idle(&pdev->dev);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 963402dd0ea6aa5609f463a20625e8819fd201ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 12:17:23 +0100
+Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig
+ dependency on OF
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ]
+
+This driver accesses the of_aliases global variable declared in
+linux/of.h and defined in drivers/base/of.c. It requires OF support or
+will cause a link failure. Add the missing Kconfig dependency.
+
+Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index aa59e5b133510..fd91127065454 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -254,6 +254,7 @@ config KEYSTONE_TIMER
+
+ config INTEGRATOR_AP_TIMER
+ bool "Integrator-AP timer driver" if COMPILE_TEST
++ depends on OF
+ select CLKSRC_MMIO
+ help
+ Enables support for the Integrator-AP timer.
+--
+2.51.0
+
--- /dev/null
+From 250e7d61694011bff7def520b65fa995d5dd402f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 16:25:35 +0100
+Subject: cpufreq: dt-platdev: Block the driver from probing on more QC
+ platforms
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+[ Upstream commit 7b781899072c5701ef9538c365757ee9ab9c00bd ]
+
+Add a number of QC platforms to the blocklist, they all use either the
+qcom-cpufreq-hw driver.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq-dt-platdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index b06a43143d23c..2fecab989dacc 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -169,8 +169,11 @@ static const struct of_device_id blocklist[] __initconst = {
+ { .compatible = "qcom,sdm845", },
+ { .compatible = "qcom,sdx75", },
+ { .compatible = "qcom,sm6115", },
++ { .compatible = "qcom,sm6125", },
++ { .compatible = "qcom,sm6150", },
+ { .compatible = "qcom,sm6350", },
+ { .compatible = "qcom,sm6375", },
++ { .compatible = "qcom,sm7125", },
+ { .compatible = "qcom,sm7225", },
+ { .compatible = "qcom,sm7325", },
+ { .compatible = "qcom,sm8150", },
+--
+2.51.0
+
--- /dev/null
+From 1accc0db8791d1ce84bbfacf821635320d0b70fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 18:18:03 +0800
+Subject: crypto: hisilicon/qm - move the barrier before writing to the mailbox
+ register
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit ebf35d8f9368816c930f5d70783a72716fab5e19 ]
+
+Before sending the data via the mailbox to the hardware, to ensure
+that the data accessed by the hardware is the most up-to-date,
+a write barrier should be added before writing to the mailbox register.
+The current memory barrier is placed after writing to the register,
+the barrier order should be modified to be before writing to the register.
+
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index b8e59f99f7007..cf58d0d01b199 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -609,9 +609,13 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src)
+ }
+
+ #if IS_ENABLED(CONFIG_ARM64)
++ /*
++ * The dmb oshst instruction ensures that the data in the
++ * mailbox is written before it is sent to the hardware.
++ */
+ asm volatile("ldp %0, %1, %3\n"
+- "stp %0, %1, %2\n"
+ "dmb oshst\n"
++ "stp %0, %1, %2\n"
+ : "=&r" (tmp0),
+ "=&r" (tmp1),
+ "+Q" (*((char __iomem *)fun_base))
+--
+2.51.0
+
--- /dev/null
+From cdfe0b2bda136e9397b59a228fdc1283f67b52b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:35:05 -0500
+Subject: dlm: fix recovery pending middle conversion
+
+From: Alexander Aring <aahringo@redhat.com>
+
+[ Upstream commit 1416bd508c78bdfdb9ae0b4511369e5581f348ea ]
+
+During a workload involving conversions between lock modes PR and CW,
+lock recovery can create a "conversion deadlock" state between locks
+that have been recovered. When this occurs, kernel warning messages
+are logged, e.g.
+
+ "dlm: WARN: pending deadlock 1e node 0 2 1bf21"
+
+ "dlm: receive_rcom_lock_args 2e middle convert gr 3 rq 2 remote 2 1e"
+
+After this occurs, the deadlocked conversions both appear on the convert
+queue of the resource being locked, and the conversion requests do not
+complete.
+
+Outside of recovery, conversions that would produce a deadlock are
+resolved immediately, and return -EDEADLK. The locks are not placed
+on the convert queue in the deadlocked state.
+
+To fix this problem, an lkb under conversion between PR/CW is rebuilt
+during recovery on a new master's granted queue, with the currently
+granted mode, rather than being rebuilt on the new master's convert
+queue, with the currently granted mode and the newly requested mode.
+The in-progress convert is then resent to the new master after
+recovery, so the conversion deadlock will be processed outside of
+the recovery context and handled as described above.
+
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lock.c | 19 +------------------
+ 1 file changed, 1 insertion(+), 18 deletions(-)
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index be938fdf17d96..c01a291db401b 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -5014,25 +5014,8 @@ void dlm_receive_buffer(const union dlm_packet *p, int nodeid)
+ static void recover_convert_waiter(struct dlm_ls *ls, struct dlm_lkb *lkb,
+ struct dlm_message *ms_local)
+ {
+- if (middle_conversion(lkb)) {
+- log_rinfo(ls, "%s %x middle convert in progress", __func__,
+- lkb->lkb_id);
+-
+- /* We sent this lock to the new master. The new master will
+- * tell us when it's granted. We no longer need a reply, so
+- * use a fake reply to put the lkb into the right state.
+- */
+- hold_lkb(lkb);
+- memset(ms_local, 0, sizeof(struct dlm_message));
+- ms_local->m_type = cpu_to_le32(DLM_MSG_CONVERT_REPLY);
+- ms_local->m_result = cpu_to_le32(to_dlm_errno(-EINPROGRESS));
+- ms_local->m_header.h_nodeid = cpu_to_le32(lkb->lkb_nodeid);
+- _receive_convert_reply(lkb, ms_local, true);
+- unhold_lkb(lkb);
+-
+- } else if (lkb->lkb_rqmode >= lkb->lkb_grmode) {
++ if (middle_conversion(lkb) || lkb->lkb_rqmode >= lkb->lkb_grmode)
+ set_bit(DLM_IFL_RESEND_BIT, &lkb->lkb_iflags);
+- }
+
+ /* lkb->lkb_rqmode < lkb->lkb_grmode shouldn't happen since down
+ conversions are async; there's no reply from the remote master */
+--
+2.51.0
+
--- /dev/null
+From 0b49ff5358c0a2138828ba0b4d94636ef76370da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:35:06 -0500
+Subject: dlm: validate length in dlm_search_rsb_tree
+
+From: Ezrak1e <ezrakiez@gmail.com>
+
+[ Upstream commit 080e5563f878c64e697b89e7439d730d0daad882 ]
+
+The len parameter in dlm_dump_rsb_name() is not validated and comes
+from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can
+cause out-of-bounds write in dlm_search_rsb_tree().
+
+Add length validation to prevent potential buffer overflow.
+
+Signed-off-by: Ezrak1e <ezrakiez@gmail.com>
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lock.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index c01a291db401b..a393ecaf3442a 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -626,7 +626,8 @@ int dlm_search_rsb_tree(struct rhashtable *rhash, const void *name, int len,
+ struct dlm_rsb **r_ret)
+ {
+ char key[DLM_RESNAME_MAXLEN] = {};
+-
++ if (len > DLM_RESNAME_MAXLEN)
++ return -EINVAL;
+ memcpy(key, name, len);
+ *r_ret = rhashtable_lookup_fast(rhash, &key, dlm_rhash_rsb_params);
+ if (*r_ret)
+--
+2.51.0
+
--- /dev/null
+From 48d52a1a56421d75f5dd5c9a1e154f8a04bca122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 20:03:50 +0800
+Subject: dm: remove fake timeout to avoid leak request
+
+From: Ding Hui <dinghui@sangfor.com.cn>
+
+[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ]
+
+Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
+blk_mq_complete_request"), drivers are responsible for calling
+blk_should_fake_timeout() at appropriate code paths and opportunities.
+
+However, the dm driver does not implement its own timeout handler and
+relies on the timeout handling of its slave devices.
+
+If an io-timeout-fail error is injected to a dm device, the request
+will be leaked and never completed, causing tasks to hang indefinitely.
+
+Reproduce:
+1. prepare dm which has iscsi slave device
+2. inject io-timeout-fail to dm
+ echo 1 >/sys/class/block/dm-0/io-timeout-fail
+ echo 100 >/sys/kernel/debug/fail_io_timeout/probability
+ echo 10 >/sys/kernel/debug/fail_io_timeout/times
+3. read/write dm
+4. iscsiadm -m node -u
+
+Result: hang task like below
+[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
+[ 862.244133] Tainted: G E 6.19.0-rc1+ #51
+[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000
+[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
+[ 862.245264] Call Trace:
+[ 862.245587] <TASK>
+[ 862.245814] __schedule+0x810/0x15c0
+[ 862.246557] schedule+0x69/0x180
+[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120
+[ 862.247688] elevator_change+0x16d/0x460
+[ 862.247893] elevator_set_none+0x87/0xf0
+[ 862.248798] blk_unregister_queue+0x12e/0x2a0
+[ 862.248995] __del_gendisk+0x231/0x7e0
+[ 862.250143] del_gendisk+0x12f/0x1d0
+[ 862.250339] sd_remove+0x85/0x130 [sd_mod]
+[ 862.250650] device_release_driver_internal+0x36d/0x530
+[ 862.250849] bus_remove_device+0x1dd/0x3f0
+[ 862.251042] device_del+0x38a/0x930
+[ 862.252095] __scsi_remove_device+0x293/0x360
+[ 862.252291] scsi_remove_target+0x486/0x760
+[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
+[ 862.252886] process_one_work+0x633/0xe50
+[ 862.253101] worker_thread+0x6df/0xf10
+[ 862.253647] kthread+0x36d/0x720
+[ 862.254533] ret_from_fork+0x2a6/0x470
+[ 862.255852] ret_from_fork_asm+0x1a/0x30
+[ 862.256037] </TASK>
+
+Remove the blk_should_fake_timeout() check from dm, as dm has no
+native timeout handling and should not attempt to fake timeouts.
+
+Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index a6ca92049c10e..5e08546696145 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -278,8 +278,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error)
+ struct dm_rq_target_io *tio = tio_from_request(rq);
+
+ tio->error = error;
+- if (likely(!blk_should_fake_timeout(rq->q)))
+- blk_mq_complete_request(rq);
++ blk_mq_complete_request(rq);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From be7990cd369f355ccae1df7d886eca7fc1dc2619 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 04:49:37 +0100
+Subject: dm: replace -EEXIST with -EBUSY
+
+From: Daniel Gomez <da.gomez@samsung.com>
+
+[ Upstream commit b13ef361d47f09b7aecd18e0383ecc83ff61057e ]
+
+The -EEXIST error code is reserved by the module loading infrastructure
+to indicate that a module is already loaded. When a module's init
+function returns -EEXIST, userspace tools like kmod interpret this as
+"module already loaded" and treat the operation as successful, returning
+0 to the user even though the module initialization actually failed.
+
+This follows the precedent set by commit 54416fd76770 ("netfilter:
+conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
+issue in nf_conntrack_helper_register().
+
+Affected modules:
+ * dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache
+ * dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity
+ * dm_queue_length dm_service_time dm_snapshot
+
+Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-exception-store.c | 2 +-
+ drivers/md/dm-log.c | 2 +-
+ drivers/md/dm-path-selector.c | 2 +-
+ drivers/md/dm-target.c | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
+index c3799757bf4a0..88f119a0a2ae0 100644
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -116,7 +116,7 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type)
+ if (!__find_exception_store_type(type->name))
+ list_add(&type->list, &_exception_store_types);
+ else
+- r = -EEXIST;
++ r = -EBUSY;
+ spin_unlock(&_lock);
+
+ return r;
+diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
+index 9d85d045f9d9d..bced5a783ee33 100644
+--- a/drivers/md/dm-log.c
++++ b/drivers/md/dm-log.c
+@@ -121,7 +121,7 @@ int dm_dirty_log_type_register(struct dm_dirty_log_type *type)
+ if (!__find_dirty_log_type(type->name))
+ list_add(&type->list, &_log_types);
+ else
+- r = -EEXIST;
++ r = -EBUSY;
+ spin_unlock(&_lock);
+
+ return r;
+diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c
+index d0b883fabfeb6..2b0ac200f1c02 100644
+--- a/drivers/md/dm-path-selector.c
++++ b/drivers/md/dm-path-selector.c
+@@ -107,7 +107,7 @@ int dm_register_path_selector(struct path_selector_type *pst)
+
+ if (__find_path_selector_type(pst->name)) {
+ kfree(psi);
+- r = -EEXIST;
++ r = -EBUSY;
+ } else
+ list_add(&psi->list, &_path_selectors);
+
+diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
+index 8fede41adec00..1fd41289de367 100644
+--- a/drivers/md/dm-target.c
++++ b/drivers/md/dm-target.c
+@@ -88,7 +88,7 @@ int dm_register_target(struct target_type *tt)
+ if (__find_target_type(tt->name)) {
+ DMERR("%s: '%s' target already registered",
+ __func__, tt->name);
+- rv = -EEXIST;
++ rv = -EBUSY;
+ } else {
+ list_add(&tt->list, &_targets);
+ }
+--
+2.51.0
+
--- /dev/null
+From 2f4ab75e1eb207161e3dd5356ebe4d3470fa64a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 14:36:56 +0100
+Subject: dmaengine: stm32-dma3: use module_platform_driver
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit 0d41ed4ea496fabbb4dc21171e32d9a924c2a661 ]
+
+Without module_platform_driver(), stm32-dma3 doesn't have a
+module_exit procedure. Once stm32-dma3 module is inserted, it
+can't be removed, marked busy.
+Use module_platform_driver() instead of subsys_initcall() to register
+(insmod) and unregister (rmmod) stm32-dma3 driver.
+
+Reviewed-by: Eugen Hristev <eugen.hristev@linaro.org>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251121-dma3_improv-v2-1-76a207b13ea6@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32/stm32-dma3.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/dma/stm32/stm32-dma3.c b/drivers/dma/stm32/stm32-dma3.c
+index 50e7106c5cb73..9500164c8f688 100644
+--- a/drivers/dma/stm32/stm32-dma3.c
++++ b/drivers/dma/stm32/stm32-dma3.c
+@@ -1914,12 +1914,7 @@ static struct platform_driver stm32_dma3_driver = {
+ },
+ };
+
+-static int __init stm32_dma3_init(void)
+-{
+- return platform_driver_register(&stm32_dma3_driver);
+-}
+-
+-subsys_initcall(stm32_dma3_init);
++module_platform_driver(stm32_dma3_driver);
+
+ MODULE_DESCRIPTION("STM32 DMA3 controller driver");
+ MODULE_AUTHOR("Amelie Delaunay <amelie.delaunay@foss.st.com>");
+--
+2.51.0
+
--- /dev/null
+From fd901a460c8f4f12519e05744a561f307e740b2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 09:15:03 +0100
+Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix
+ warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ]
+
+m2m_hw_period is initialized only when chan_config->m2m_hw is true. This
+triggers a warning:
+‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized]
+Although m2m_hw_period is only used when chan_config->m2m_hw is true and
+ignored otherwise, initialize it unconditionally to 0.
+
+ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not
+empty. This triggers a warning:
+‘ccr’ may be used uninitialized [-Wmaybe-uninitialized]
+Indeed, it could be used uninitialized if the sg list is empty. Initialize
+it to 0.
+
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Reviewed-by: Clément Le Goffic <legoffic.clement@gmail.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32/stm32-mdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/stm32/stm32-mdma.c b/drivers/dma/stm32/stm32-mdma.c
+index 080c1c725216c..b87d41b234df1 100644
+--- a/drivers/dma/stm32/stm32-mdma.c
++++ b/drivers/dma/stm32/stm32-mdma.c
+@@ -731,7 +731,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan,
+ struct stm32_mdma_chan_config *chan_config = &chan->chan_config;
+ struct scatterlist *sg;
+ dma_addr_t src_addr, dst_addr;
+- u32 m2m_hw_period, ccr, ctcr, ctbr;
++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr;
+ int i, ret = 0;
+
+ if (chan_config->m2m_hw)
+--
+2.51.0
+
--- /dev/null
+From 98cd606ff2e32ef83d6585c3d6bcd1f4d6a8e05d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:04:48 +0800
+Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst
+
+From: Chen-Yu Tsai <wens@kernel.org>
+
+[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ]
+
+maxburst, as provided by the client, specifies the largest amount of
+data that is allowed to be transferred in one burst. This limit is
+normally provided to avoid a data burst overflowing the target FIFO.
+It does not mean that the DMA engine can only do bursts in that size.
+
+Let the driver pick the largest supported burst length within the
+given limit. This lets the driver work correctly with some clients that
+give a large maxburst value. In particular, the 8250_dw driver will give
+a quarter of the UART's FIFO size as maxburst. On some systems the FIFO
+size is 256 bytes, giving a maxburst of 64 bytes, while the hardware
+only supports bursts of up to 16 bytes.
+
+Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
+index 2215ff877bf7d..f9d876deb1f05 100644
+--- a/drivers/dma/sun6i-dma.c
++++ b/drivers/dma/sun6i-dma.c
+@@ -583,6 +583,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id)
+ return ret;
+ }
+
++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst)
++{
++ if (!maxburst)
++ return 1;
++
++ if (BIT(maxburst) & burst_lengths)
++ return maxburst;
++
++ /* Hardware only does power-of-two bursts. */
++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2)
++ if (BIT(burst) & burst_lengths)
++ return burst;
++
++ return 1;
++}
++
+ static int set_config(struct sun6i_dma_dev *sdev,
+ struct dma_slave_config *sconfig,
+ enum dma_transfer_direction direction,
+@@ -616,15 +632,13 @@ static int set_config(struct sun6i_dma_dev *sdev,
+ return -EINVAL;
+ if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths))
+ return -EINVAL;
+- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths))
+- return -EINVAL;
+- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths))
+- return -EINVAL;
+
+ src_width = convert_buswidth(src_addr_width);
+ dst_width = convert_buswidth(dst_addr_width);
+- dst_burst = convert_burst(dst_maxburst);
+- src_burst = convert_burst(src_maxburst);
++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst);
++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst);
++ dst_burst = convert_burst(dst_burst);
++ src_burst = convert_burst(src_burst);
+
+ *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) |
+ DMA_CHAN_CFG_DST_WIDTH(dst_width);
+--
+2.51.0
+
--- /dev/null
+From c9b72fb6d5fcb5934d35325ba08078409c9b08ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 11:29:45 +0100
+Subject: driver core: faux: stop using static struct device
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 61b76d07d2b46a86ea91267d36449fc78f8a1f6e ]
+
+faux_bus_root should not have been a static struct device, but rather a
+dynamically created structure so that lockdep and other testing tools do
+not trip over it (as well as being the right thing overall to do.) Fix
+this up by making it properly dynamic.
+
+Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
+Closes: https://lore.kernel.org/lkml/CALbr=LYKJsj6cbrDLA07qioKhWJcRj+gW8=bq5=4ZvpEe2c4Yg@mail.gmail.com/
+Reviewed-by: Danilo Krummrich <dakr@kernel.org>
+Link: https://patch.msgid.link/2026012145-lapping-countless-ef81@gregkh
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/faux.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/base/faux.c b/drivers/base/faux.c
+index 21dd02124231a..23d7258172325 100644
+--- a/drivers/base/faux.c
++++ b/drivers/base/faux.c
+@@ -29,9 +29,7 @@ struct faux_object {
+ };
+ #define to_faux_object(dev) container_of_const(dev, struct faux_object, faux_dev.dev)
+
+-static struct device faux_bus_root = {
+- .init_name = "faux",
+-};
++static struct device *faux_bus_root;
+
+ static int faux_match(struct device *dev, const struct device_driver *drv)
+ {
+@@ -152,7 +150,7 @@ struct faux_device *faux_device_create_with_groups(const char *name,
+ if (parent)
+ dev->parent = parent;
+ else
+- dev->parent = &faux_bus_root;
++ dev->parent = faux_bus_root;
+ dev->bus = &faux_bus_type;
+ dev_set_name(dev, "%s", name);
+ device_set_pm_not_required(dev);
+@@ -236,9 +234,15 @@ int __init faux_bus_init(void)
+ {
+ int ret;
+
+- ret = device_register(&faux_bus_root);
++ faux_bus_root = kzalloc(sizeof(*faux_bus_root), GFP_KERNEL);
++ if (!faux_bus_root)
++ return -ENOMEM;
++
++ dev_set_name(faux_bus_root, "faux");
++
++ ret = device_register(faux_bus_root);
+ if (ret) {
+- put_device(&faux_bus_root);
++ put_device(faux_bus_root);
+ return ret;
+ }
+
+@@ -256,6 +260,6 @@ int __init faux_bus_init(void)
+ bus_unregister(&faux_bus_type);
+
+ error_bus:
+- device_unregister(&faux_bus_root);
++ device_unregister(faux_bus_root);
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 072f7931e8671a178caf584dd14feae9263dea31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 08:22:26 -0500
+Subject: drm: Account property blob allocations to memcg
+
+From: Xiao Kan <814091656@qq.com>
+
+[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ]
+
+DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
+property blobs backed by kernel memory.
+
+Currently, the blob data allocation is not accounted to the allocating
+process's memory cgroup, allowing unprivileged users to trigger unbounded
+kernel memory consumption and potentially cause system-wide OOM.
+
+Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
+is properly charged to the caller's memcg. This ensures existing cgroup
+memory limits apply and prevents uncontrolled kernel memory growth without
+introducing additional policy or per-file limits.
+
+Signed-off-by: Xiao Kan <814091656@qq.com>
+Signed-off-by: Xiao Kan <xiao.kan@samsung.com>
+Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
+index 596272149a359..3c88b5fbdf28c 100644
+--- a/drivers/gpu/drm/drm_property.c
++++ b/drivers/gpu/drm/drm_property.c
+@@ -562,7 +562,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
+ if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
+ return ERR_PTR(-EINVAL);
+
+- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT);
+ if (!blob)
+ return ERR_PTR(-ENOMEM);
+
+--
+2.51.0
+
--- /dev/null
+From c7b75f1036e12731cf42caf9be84d7dc8326d7ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 15:52:39 -0500
+Subject: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
+
+From: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+
+[ Upstream commit c979d8db7b0f293111f2e83795ea353c8ed75de9 ]
+
+Trying to access link enc on a dpia link will cause a crash otherwise
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index e1f5b1a34cde8..f04cbdb3d3814 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -916,10 +916,10 @@ static void dcn401_enable_stream_calc(
+ pipe_ctx->stream->link->cur_link_settings.lane_count;
+ uint32_t active_total_with_borders;
+
+- if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx))
++ if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) {
+ *dp_hpo_inst = pipe_ctx->stream_res.hpo_dp_stream_enc->inst;
+-
+- *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link);
++ *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link);
++ }
+
+ if (dc_is_tmds_signal(pipe_ctx->stream->signal))
+ dcn401_calculate_dccg_tmds_div_value(pipe_ctx, tmds_div);
+--
+2.51.0
+
--- /dev/null
+From 96152782434d1ae883e1e811da540702b15a2df3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 10:18:16 +0800
+Subject: drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
+
+From: LinCheng Ku <lincheng.ku@amd.com>
+
+[ Upstream commit cea573a8e1ed83840a2173d153dd68e172849d44 ]
+
+[Why]
+USB-C DisplayPort Alt Mode with concurrent USB data needs lane count
+limitation to prevent incorrect 4-lane DP configuration when only 2 lanes
+are available due to hardware lane sharing between DP and USB3.
+
+[How]
+Query DMUB for Alt Mode status (is_dp_alt_disable, is_usb, is_dp4) in
+dcn32_link_encoder_get_max_link_cap() and cap DP to 2 lanes when USB is
+active on USB-C port. Added inline documentation explaining the USB-C
+lane sharing constraint.
+
+Reviewed-by: PeiChen Huang <peichen.huang@amd.com>
+Signed-off-by: LinCheng Ku <lincheng.ku@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/dc/dio/dcn32/dcn32_dio_link_encoder.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
+index 06907e8a4eda1..ddc736af776c9 100644
+--- a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
+@@ -188,9 +188,18 @@ void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc,
+ if (!query_dp_alt_from_dmub(enc, &cmd))
+ return;
+
+- if (cmd.query_dp_alt.data.is_usb &&
+- cmd.query_dp_alt.data.is_dp4 == 0)
+- link_settings->lane_count = MIN(LANE_COUNT_TWO, link_settings->lane_count);
++ /*
++ * USB-C DisplayPort Alt Mode lane count limitation logic:
++ * When USB and DP share the same USB-C connector, hardware must allocate
++ * some lanes for USB data, limiting DP to maximum 2 lanes instead of 4.
++ * This ensures USB functionality remains available while DP is active.
++ */
++ if (cmd.query_dp_alt.data.is_dp_alt_disable == 0 &&
++ cmd.query_dp_alt.data.is_usb &&
++ cmd.query_dp_alt.data.is_dp4 == 0) {
++ link_settings->lane_count =
++ MIN(LANE_COUNT_TWO, link_settings->lane_count);
++ }
+ }
+
+
+--
+2.51.0
+
--- /dev/null
+From 8eff84bf25833956c59d3ab09161e8cf7023c2a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 13:21:59 -0500
+Subject: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for
+ TMDS on DCN35
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 75372d75a4e23783583998ed99d5009d555850da ]
+
+[Why]
+A backport of the change made for DCN401 that addresses an issue where
+we turn off the PHY PLL when disabling TMDS output, which causes the
+OTG to remain stuck.
+
+The OTG being stuck can lead to a hang in the DCHVM's ability to ACK
+invalidations when it thinks the HUBP is still on but it's not receiving
+global sync.
+
+The transition to PLL_ON needs to be atomic as there's no guarantee
+that the thread isn't pre-empted or is able to complete before the
+IOMMU watchdog times out.
+
+[How]
+Backport the implementation from dcn401 back to dcn35.
+
+There's a functional difference in when the eDP output is disabled in
+dcn401 code so we don't want to utilize it directly.
+
+Reviewed-by: Yihan Zhu <yihan.zhu@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 52 +++++++++++++++++++
+ .../amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 3 ++
+ .../amd/display/dc/hwss/dcn35/dcn35_init.c | 2 +-
+ 3 files changed, 56 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+index cb2dfd34b5e2e..88542ca715573 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+@@ -1726,3 +1726,55 @@ void dcn35_program_cursor_offload_now(struct dc *dc, const struct pipe_ctx *pipe
+ {
+ dc_dmub_srv_program_cursor_now(dc, pipe);
+ }
++
++static void disable_link_output_symclk_on_tx_off(struct dc_link *link, enum dp_link_encoding link_encoding)
++{
++ struct dc *dc = link->ctx->dc;
++ struct pipe_ctx *pipe_ctx = NULL;
++ uint8_t i;
++
++ for (i = 0; i < MAX_PIPES; i++) {
++ pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[i];
++ if (pipe_ctx->stream && pipe_ctx->stream->link == link && pipe_ctx->top_pipe == NULL) {
++ pipe_ctx->clock_source->funcs->program_pix_clk(
++ pipe_ctx->clock_source,
++ &pipe_ctx->stream_res.pix_clk_params,
++ link_encoding,
++ &pipe_ctx->pll_settings);
++ break;
++ }
++ }
++}
++
++void dcn35_disable_link_output(struct dc_link *link,
++ const struct link_resource *link_res,
++ enum signal_type signal)
++{
++ struct dc *dc = link->ctx->dc;
++ const struct link_hwss *link_hwss = get_link_hwss(link, link_res);
++ struct dmcu *dmcu = dc->res_pool->dmcu;
++
++ if (signal == SIGNAL_TYPE_EDP &&
++ link->dc->hwss.edp_backlight_control &&
++ !link->skip_implict_edp_power_control)
++ link->dc->hwss.edp_backlight_control(link, false);
++ else if (dmcu != NULL && dmcu->funcs->lock_phy)
++ dmcu->funcs->lock_phy(dmcu);
++
++ if (dc_is_tmds_signal(signal) && link->phy_state.symclk_ref_cnts.otg > 0) {
++ disable_link_output_symclk_on_tx_off(link, DP_UNKNOWN_ENCODING);
++ link->phy_state.symclk_state = SYMCLK_ON_TX_OFF;
++ } else {
++ link_hwss->disable_link_output(link, link_res, signal);
++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF;
++ }
++ /*
++ * Add the logic to extract BOTH power up and power down sequences
++ * from enable/disable link output and only call edp panel control
++ * in enable_link_dp and disable_link_dp once.
++ */
++ if (dmcu != NULL && dmcu->funcs->unlock_phy)
++ dmcu->funcs->unlock_phy(dmcu);
++
++ dc->link_srv->dp_trace_source_sequence(link, DPCD_SOURCE_SEQ_AFTER_DISABLE_LINK_PHY);
++}
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h
+index 1ff41dba556c0..e3459546a908a 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h
+@@ -108,5 +108,8 @@ void dcn35_update_cursor_offload_pipe(struct dc *dc, const struct pipe_ctx *pipe
+ void dcn35_notify_cursor_offload_drr_update(struct dc *dc, struct dc_state *context,
+ const struct dc_stream_state *stream);
+ void dcn35_program_cursor_offload_now(struct dc *dc, const struct pipe_ctx *pipe);
++void dcn35_disable_link_output(struct dc_link *link,
++ const struct link_resource *link_res,
++ enum signal_type signal);
+
+ #endif /* __DC_HWSS_DCN35_H__ */
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c
+index 5a66c9db26709..81bd36f3381db 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c
+@@ -113,7 +113,7 @@ static const struct hw_sequencer_funcs dcn35_funcs = {
+ .enable_lvds_link_output = dce110_enable_lvds_link_output,
+ .enable_tmds_link_output = dce110_enable_tmds_link_output,
+ .enable_dp_link_output = dce110_enable_dp_link_output,
+- .disable_link_output = dcn32_disable_link_output,
++ .disable_link_output = dcn35_disable_link_output,
+ .z10_restore = dcn35_z10_restore,
+ .z10_save_init = dcn31_z10_save_init,
+ .set_disp_pattern_generator = dcn30_set_disp_pattern_generator,
+--
+2.51.0
+
--- /dev/null
+From 54bdb50994a1d83c56bf8d2694cc3527d8811d3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 15:51:42 +0800
+Subject: drm/amd/display: avoid dig reg access timeout on usb4 link training
+ fail
+
+From: Zhongwei <Zhongwei.Zhang@amd.com>
+
+[ Upstream commit 15b1d7b77e9836ff4184093163174a1ef28bbdd7 ]
+
+[Why]
+When usb4 link training fails, the dpia sym clock will be disabled and SYMCLK
+source should be changed back to phy clock. In enable_streams, it is
+assumed that link training succeeded and will switch from refclk to
+phy clock. But phy clk here might not be on. Dig reg access timeout
+will occur.
+
+[How]
+When enable_stream is hit, check if link training failed for usb4.
+If it did, fall back to the ref clock to avoid reg access timeout.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Zhongwei <Zhongwei.Zhang@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+index c8ff8ae85a030..517d4c08d34c4 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -3058,9 +3058,17 @@ void dcn20_enable_stream(struct pipe_ctx *pipe_ctx)
+ dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk);
+ }
+ } else {
+- if (dccg->funcs->enable_symclk_se)
+- dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst,
++ if (dccg->funcs->enable_symclk_se && link_enc) {
++ if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA
++ && link->cur_link_settings.link_rate == LINK_RATE_UNKNOWN
++ && !link->link_status.link_active) {
++ if (dccg->funcs->disable_symclk_se)
++ dccg->funcs->disable_symclk_se(dccg, stream_enc->stream_enc_inst,
+ link_enc->transmitter - TRANSMITTER_UNIPHY_A);
++ } else
++ dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst,
++ link_enc->transmitter - TRANSMITTER_UNIPHY_A);
++ }
+ }
+
+ if (dc->res_pool->dccg->funcs->set_pixel_rate_div)
+--
+2.51.0
+
--- /dev/null
+From 2168145075750e916be2f350d9c26f3a15570ac4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 14:47:01 +0800
+Subject: drm/amd/display: Avoid updating surface with the same surface under
+ MPO
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ]
+
+[Why & How]
+Although it's dummy updates of surface update for committing stream
+updates, we should not have dummy_updates[j].surface all indicating
+to the same surface under multiple surfaces case. Otherwise,
+copy_surface_update_to_plane() in update_planes_and_stream_state()
+will update to the same surface only.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index b6eee94861477..e84ec4365ca6b 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10961,7 +10961,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
+ continue;
+ }
+ for (j = 0; j < status->plane_count; j++)
+- dummy_updates[j].surface = status->plane_states[0];
++ dummy_updates[j].surface = status->plane_states[j];
+
+ sort(dummy_updates, status->plane_count,
+ sizeof(*dummy_updates), dm_plane_layer_index_cmp, NULL);
+--
+2.51.0
+
--- /dev/null
+From 14b6670122c9609cb70502d46a785928f47dfbfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 11:40:06 -0500
+Subject: drm/amd/display: bypass post csc for additional color spaces in dal
+
+From: Clay King <clayking@amd.com>
+
+[ Upstream commit 7d9ec9dc20ecdb1661f4538cd9112cd3d6a5f15a ]
+
+[Why]
+For RGB BT2020 full and limited color spaces, overlay adjustments were
+applied twice (once by MM and once by DAL). This results in incorrect
+colours and a noticeable difference between mpo and non-mpo cases.
+
+[How]
+Add RGB BT2020 full and limited color spaces to list that bypasses post
+csc adjustment.
+
+Reviewed-by: Aric Cyr <aric.cyr@amd.com>
+Signed-off-by: Clay King <clayking@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 21 ++++++++++++++++---
+ .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h | 4 ++++
+ .../amd/display/dc/dpp/dcn401/dcn401_dpp.c | 6 +++---
+ 3 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
+index ef4a161171814..c7923531da83d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
+@@ -376,10 +376,10 @@ void dpp3_cnv_setup (
+
+ tbl_entry.color_space = input_color_space;
+
+- if (color_space >= COLOR_SPACE_YCBCR601)
+- select = INPUT_CSC_SELECT_ICSC;
+- else
++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space))
+ select = INPUT_CSC_SELECT_BYPASS;
++ else
++ select = INPUT_CSC_SELECT_ICSC;
+
+ dpp3_program_post_csc(dpp_base, color_space, select,
+ &tbl_entry);
+@@ -1541,3 +1541,18 @@ bool dpp3_construct(
+ return true;
+ }
+
++bool dpp3_should_bypass_post_csc_for_colorspace(enum dc_color_space dc_color_space)
++{
++ switch (dc_color_space) {
++ case COLOR_SPACE_UNKNOWN:
++ case COLOR_SPACE_SRGB:
++ case COLOR_SPACE_XR_RGB:
++ case COLOR_SPACE_SRGB_LIMITED:
++ case COLOR_SPACE_MSREF_SCRGB:
++ case COLOR_SPACE_2020_RGB_FULLRANGE:
++ case COLOR_SPACE_2020_RGB_LIMITEDRANGE:
++ return true;
++ default:
++ return false;
++ }
++}
+diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
+index d4a70b4379eaf..6a61b99d6a798 100644
+--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
+@@ -644,4 +644,8 @@ void dpp3_program_cm_dealpha(
+
+ void dpp3_cm_get_gamut_remap(struct dpp *dpp_base,
+ struct dpp_grph_csc_adjustment *adjust);
++
++bool dpp3_should_bypass_post_csc_for_colorspace(
++ enum dc_color_space dc_color_space);
++
+ #endif /* __DC_HWSS_DCN30_H__ */
+diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
+index 96c2c853de42c..2d6a646462e21 100644
+--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
+@@ -206,10 +206,10 @@ void dpp401_dpp_setup(
+
+ tbl_entry.color_space = input_color_space;
+
+- if (color_space >= COLOR_SPACE_YCBCR601)
+- select = INPUT_CSC_SELECT_ICSC;
+- else
++ if (dpp3_should_bypass_post_csc_for_colorspace(color_space))
+ select = INPUT_CSC_SELECT_BYPASS;
++ else
++ select = INPUT_CSC_SELECT_ICSC;
+
+ dpp3_program_post_csc(dpp_base, color_space, select,
+ &tbl_entry);
+--
+2.51.0
+
--- /dev/null
+From edc85de31f9fa86a9cb012f5845a2cac4f3d825f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 15:21:46 -0500
+Subject: drm/amd/display: Correct DSC padding accounting
+
+From: Relja Vojvodic <rvojvodi@amd.com>
+
+[ Upstream commit c7062be3380cb20c8b1c4a935a13f1848ead0719 ]
+
+[WHY]
+- After the addition of all OVT patches, DSC padding was being accounted
+ for multiple times, effectively doubling the padding
+- This caused compliance failures or corruption
+
+[HOW]
+- Add padding to DSC pic width when required by HW, and do not re-add
+ when calculating reg values
+- Do not add padding when computing PPS values, and instead track padding
+ separately to add when calculating slice width values
+
+Reviewed-by: Chris Park <chris.park@amd.com>
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Relja Vojvodic <rvojvodi@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 2 +-
+ drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 2 +-
+ drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 2 +-
+ drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 ++-
+ .../gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c | 6 +++---
+ 5 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
+index 4ee6ed610de0b..3e239124c17d8 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
+@@ -108,7 +108,7 @@ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
+ dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
+ ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0);
+ dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
+- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
++ dsc_cfg.dsc_padding = 0;
+
+ dsc->funcs->dsc_set_config(dsc, &dsc_cfg, &dsc_optc_cfg);
+ dsc->funcs->dsc_enable(dsc, pipe_ctx->stream_res.opp->inst);
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+index be1f3caf4096f..24af5e94c7fce 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+@@ -1063,7 +1063,7 @@ void dcn32_update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
+ dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
+ ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0);
+ dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
+- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
++ dsc_cfg.dsc_padding = 0;
+
+ if (should_use_dto_dscclk)
+ dccg->funcs->set_dto_dscclk(dccg, dsc->inst, dsc_cfg.dc_dsc_cfg.num_slices_h);
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+index 7aa0f452e8f7a..cb2dfd34b5e2e 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+@@ -364,7 +364,7 @@ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
+ dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
+ ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0);
+ dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
+- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
++ dsc_cfg.dsc_padding = 0;
+
+ dsc->funcs->dsc_set_config(dsc, &dsc_cfg, &dsc_optc_cfg);
+ dsc->funcs->dsc_enable(dsc, pipe_ctx->stream_res.opp->inst);
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+index 635f614c06734..770c9cd128ae8 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+@@ -841,7 +841,7 @@ void link_set_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
+ dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
+ ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0);
+ dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
+- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
++ dsc_cfg.dsc_padding = 0;
+
+ if (should_use_dto_dscclk)
+ dccg->funcs->set_dto_dscclk(dccg, dsc->inst, dsc_cfg.dc_dsc_cfg.num_slices_h);
+@@ -857,6 +857,7 @@ void link_set_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
+ }
+ dsc_cfg.dc_dsc_cfg.num_slices_h *= opp_cnt;
+ dsc_cfg.pic_width *= opp_cnt;
++ dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
+
+ optc_dsc_mode = dsc_optc_cfg.is_pixel_format_444 ? OPTC_DSC_ENABLED_444 : OPTC_DSC_ENABLED_NATIVE_SUBSAMPLED;
+
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
+index 6679c1a14f2fe..8d10aac9c510c 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
+@@ -1660,8 +1660,8 @@ bool dcn20_validate_dsc(struct dc *dc, struct dc_state *new_ctx)
+ if (pipe_ctx->top_pipe || pipe_ctx->prev_odm_pipe || !stream || !stream->timing.flags.DSC)
+ continue;
+
+- dsc_cfg.pic_width = (stream->timing.h_addressable + stream->timing.h_border_left
+- + stream->timing.h_border_right) / opp_cnt;
++ dsc_cfg.pic_width = (stream->timing.h_addressable + pipe_ctx->dsc_padding_params.dsc_hactive_padding
++ + stream->timing.h_border_left + stream->timing.h_border_right) / opp_cnt;
+ dsc_cfg.pic_height = stream->timing.v_addressable + stream->timing.v_border_top
+ + stream->timing.v_border_bottom;
+ dsc_cfg.pixel_encoding = stream->timing.pixel_encoding;
+@@ -1669,7 +1669,7 @@ bool dcn20_validate_dsc(struct dc *dc, struct dc_state *new_ctx)
+ dsc_cfg.is_odm = pipe_ctx->next_odm_pipe ? true : false;
+ dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
+ dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
+- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
++ dsc_cfg.dsc_padding = 0;
+
+ if (!pipe_ctx->stream_res.dsc->funcs->dsc_validate_stream(pipe_ctx->stream_res.dsc, &dsc_cfg))
+ return false;
+--
+2.51.0
+
--- /dev/null
+From 170405f41a0fa712df0df04b206b139c4cef6333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 15:18:50 +0800
+Subject: drm/amd/display: Correct FIXED_VS Link Rate Toggle Condition
+
+From: Jing Zhou <Jing.Zhou@amd.com>
+
+[ Upstream commit 531fe6e0fee85a1bdb5b8223a706fff654ed0a61 ]
+
+[WHY&HOW]
+The condition is only perform toggle if FIXED_VS LTTPR reports
+no IEEE OUI.
+The literal "\x0,\x0,\x0" contains commas changes the
+bytes being compared to {0x00,0x2C,0X00}.
+The correct literal should be "\x00\x00\x00" without commas.
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Jing Zhou <Jing.Zhou@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
+index ce174ce5579c0..6a7c4a59ff4c7 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
+@@ -271,7 +271,7 @@ enum link_training_result dp_perform_fixed_vs_pe_training_sequence(
+ rate = get_dpcd_link_rate(<_settings->link_settings);
+
+ // Only perform toggle if FIXED_VS LTTPR reports no IEEE OUI
+- if (memcmp("\x0,\x0,\x0", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) {
++ if (memcmp("\x00\x00\x00", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) {
+ /* Vendor specific: Toggle link rate */
+ toggle_rate = (rate == 0x6) ? 0xA : 0x6;
+
+--
+2.51.0
+
--- /dev/null
+From d66ef7a48dc8ea15e7d45f38744cd2e519878f65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 17:48:59 -0500
+Subject: drm/amd/display: Disable FEC when powering down encoders
+
+From: Ovidiu Bunea <ovidiu.bunea@amd.com>
+
+[ Upstream commit 8cee62904caf95e5698fa0f2d420f5f22b4dea15 ]
+
+[why & how]
+VBIOS DMCUB FW can enable FEC for capable eDPs, but S/W DC state is
+only updated for link0 when transitioning into OS with driver loaded.
+This causes issues when the eDP is immediately hidden and DIG0 is
+assigned to another link that does not support FEC. Driver will
+attempt to disable FEC but FEC enablement occurs based on the link
+state, which does not have fec_state updated since it is a different
+link. Thus, FEC disablement on DIG0 will get skipped and cause no
+light up.
+
+Reviewed-by: Karen Chen <karen.chen@amd.com>
+Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 9f7087ac41f21..3d2673a22759a 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -59,6 +59,7 @@
+ #include "dc_state_priv.h"
+ #include "dpcd_defs.h"
+ #include "dsc.h"
++#include "dc_dp_types.h"
+ /* include DCE11 register header files */
+ #include "dce/dce_11_0_d.h"
+ #include "dce/dce_11_0_sh_mask.h"
+@@ -1736,20 +1737,25 @@ static void power_down_encoders(struct dc *dc)
+ int i;
+
+ for (i = 0; i < dc->link_count; i++) {
+- enum signal_type signal = dc->links[i]->connector_signal;
+-
+- dc->link_srv->blank_dp_stream(dc->links[i], false);
++ struct dc_link *link = dc->links[i];
++ struct link_encoder *link_enc = link->link_enc;
++ enum signal_type signal = link->connector_signal;
+
++ dc->link_srv->blank_dp_stream(link, false);
+ if (signal != SIGNAL_TYPE_EDP)
+ signal = SIGNAL_TYPE_NONE;
+
+- if (dc->links[i]->ep_type == DISPLAY_ENDPOINT_PHY)
+- dc->links[i]->link_enc->funcs->disable_output(
+- dc->links[i]->link_enc, signal);
++ if (link->ep_type == DISPLAY_ENDPOINT_PHY)
++ link_enc->funcs->disable_output(link_enc, signal);
++
++ if (link->fec_state == dc_link_fec_enabled) {
++ link_enc->funcs->fec_set_enable(link_enc, false);
++ link_enc->funcs->fec_set_ready(link_enc, false);
++ link->fec_state = dc_link_fec_not_ready;
++ }
+
+- dc->links[i]->link_status.link_active = false;
+- memset(&dc->links[i]->cur_link_settings, 0,
+- sizeof(dc->links[i]->cur_link_settings));
++ link->link_status.link_active = false;
++ memset(&link->cur_link_settings, 0, sizeof(link->cur_link_settings));
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 268c34d848bc64ae76749a3321284a68f5f82e56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Nov 2025 11:19:36 +0800
+Subject: drm/amd/display: Don't disable DPCD mst_en if sink connected
+
+From: Peichen Huang <PeiChen.Huang@amd.com>
+
+[ Upstream commit 9aeb31b2456452257ad1ff7ec566f21bab1f3e8a ]
+
+[WHY]
+User may connect mst dock with multi monitors and do quick unplug
+and plug in one of the monitor. This operatioin may create CSN from
+dock to display driver. Then display driver would disable and then enable
+mst link and also disable/enable DPCD mst_en bit in dock RX. However,
+when mst_en bit being disabled, if dock has another CSN message to
+transmit then the message would be removed because of the disabling of
+mst_en. In this case, the message is missing and it ends up no display in
+the replugged monitor.
+
+[HOW]
+Don't disable mst_en bit when link still has sink connected.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Peichen Huang <PeiChen.Huang@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+index 770c9cd128ae8..a36762915943b 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+@@ -1931,7 +1931,7 @@ static void disable_link_dp(struct dc_link *link,
+ link->dc->hwss.edp_power_control(link, false);
+ }
+
+- if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
++ if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST && link->sink_count == 0)
+ /* set the sink to SST mode after disabling the link */
+ enable_mst_on_sink(link, false);
+
+@@ -2082,7 +2082,12 @@ static enum dc_status enable_link_dp(struct dc_state *state,
+ pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT &&
+ link->dc->debug.set_mst_en_for_sst) {
+ enable_mst_on_sink(link, true);
++ } else if (link->dpcd_caps.is_mst_capable &&
++ pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT) {
++ /* disable mst on sink */
++ enable_mst_on_sink(link, false);
+ }
++
+ if (pipe_ctx->stream->signal == SIGNAL_TYPE_EDP) {
+ /*in case it is not on*/
+ if (!link->dc->config.edp_no_power_sequencing)
+@@ -2380,9 +2385,9 @@ void link_set_dpms_off(struct pipe_ctx *pipe_ctx)
+ if (pipe_ctx->stream->sink) {
+ if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL &&
+ pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) {
+- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__,
++ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__,
+ pipe_ctx->stream->sink->edid_caps.display_name,
+- pipe_ctx->stream->signal, link->link_index);
++ pipe_ctx->stream->signal, link->link_index, link->sink_count);
+ }
+ }
+
+@@ -2496,10 +2501,11 @@ void link_set_dpms_on(
+ if (pipe_ctx->stream->sink) {
+ if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL &&
+ pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) {
+- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__,
++ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__,
+ pipe_ctx->stream->sink->edid_caps.display_name,
+ pipe_ctx->stream->signal,
+- link->link_index);
++ link->link_index,
++ link->sink_count);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c89390c58da3b1fdb5364ba9b0237c7ae2a28c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 11:11:19 -0500
+Subject: drm/amd/display: Ensure link output is disabled in backend reset for
+ PLL_ON
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 4589712e0111352973131bad975023b25569287c ]
+
+[Why]
+We're missing the code to actually disable the link output when we have
+to leave the SYMCLK_ON but the TX remains OFF.
+
+[How]
+Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable
+the link output when the backend is reset.
+
+Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
+index d1ecdb92b072b..20f700b59847c 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
+@@ -546,8 +546,22 @@ static void dcn31_reset_back_end_for_pipe(
+ if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass)
+ pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
+ pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
++ /*
++ * TODO - convert symclk_ref_cnts for otg to a bit map to solve
++ * the case where the same symclk is shared across multiple otg
++ * instances
++ */
+ if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal))
+- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0;
++ link->phy_state.symclk_ref_cnts.otg = 0;
++
++ if (pipe_ctx->top_pipe == NULL) {
++ if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) {
++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res);
++
++ link_hwss->disable_link_output(link, &pipe_ctx->link_res, pipe_ctx->stream->signal);
++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF;
++ }
++ }
+
+ set_drr_and_clear_adjust_pending(pipe_ctx, pipe_ctx->stream, NULL);
+
+--
+2.51.0
+
--- /dev/null
+From 67a5ad564365da359679aae2474704eaf1c79565 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 19:38:31 -0500
+Subject: drm/amd/display: Fix DP no audio issue
+
+From: Charlene Liu <Charlene.Liu@amd.com>
+
+[ Upstream commit bf5e396957acafd46003318965500914d5f4edfa ]
+
+[why]
+need to enable APG_CLOCK_ENABLE enable first
+also need to wake up az from D3 before access az block
+
+Reviewed-by: Swapnil Patel <swapnil.patel@amd.com>
+Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index 12ce3789f5130..e1f5b1a34cde8 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -297,7 +297,6 @@ void dcn401_init_hw(struct dc *dc)
+ }
+ }
+ }
+-
+ for (i = 0; i < res_pool->audio_count; i++) {
+ struct audio *audio = res_pool->audios[i];
+
+--
+2.51.0
+
--- /dev/null
+From d15d3288518fae5149e192f2c6faf71572065140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 17:01:17 -0500
+Subject: drm/amd/display: Fix dsc eDP issue
+
+From: Charlene Liu <Charlene.Liu@amd.com>
+
+[ Upstream commit 878a4b73c11111ff5f820730f59a7f8c6fd59374 ]
+
+[why]
+Need to add function hook check before use
+
+Reviewed-by: Mohit Bawa <mohit.bawa@amd.com>
+Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 5896ce5511ab1..9f7087ac41f21 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1797,6 +1797,9 @@ static void disable_vga_and_power_gate_all_controllers(
+ struct timing_generator *tg;
+ struct dc_context *ctx = dc->ctx;
+
++ if (dc->caps.ips_support)
++ return;
++
+ for (i = 0; i < dc->res_pool->timing_generator_count; i++) {
+ tg = dc->res_pool->timing_generators[i];
+
+@@ -1873,13 +1876,16 @@ static void clean_up_dsc_blocks(struct dc *dc)
+ /* disable DSC in OPTC */
+ if (i < dc->res_pool->timing_generator_count) {
+ tg = dc->res_pool->timing_generators[i];
+- tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0);
++ if (tg->funcs->set_dsc_config)
++ tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0);
+ }
+ /* disable DSC in stream encoder */
+ if (i < dc->res_pool->stream_enc_count) {
+ se = dc->res_pool->stream_enc[i];
+- se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0);
+- se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true);
++ if (se->funcs->dp_set_dsc_config)
++ se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0);
++ if (se->funcs->dp_set_dsc_pps_info_packet)
++ se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true);
+ }
+ /* disable DSC block */
+ if (dccg->funcs->set_ref_dscclk)
+--
+2.51.0
+
--- /dev/null
+From f5c80d4bd937229120919b1ac3cbe581fe04066f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:32:42 -0500
+Subject: drm/amd/display: Fix GFX12 family constant checks
+
+From: Matthew Stewart <Matthew.Stewart2@amd.com>
+
+[ Upstream commit bdad08670278829771626ea7b57c4db531e2544f ]
+
+Using >=, <= for checking the family is not always correct.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 62622aa622066..209a6e5c713ca 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -11853,7 +11853,7 @@ static int dm_check_cursor_fb(struct amdgpu_crtc *new_acrtc,
+ * check tiling flags when the FB doesn't have a modifier.
+ */
+ if (!(fb->flags & DRM_MODE_FB_MODIFIERS)) {
+- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) {
++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) {
+ linear = AMDGPU_TILING_GET(afb->tiling_flags, GFX12_SWIZZLE_MODE) == 0;
+ } else if (adev->family >= AMDGPU_FAMILY_AI) {
+ linear = AMDGPU_TILING_GET(afb->tiling_flags, SWIZZLE_MODE) == 0;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+index f0946e67aef97..7474f1bc1d0b8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+@@ -278,7 +278,7 @@ static int amdgpu_dm_plane_validate_dcc(struct amdgpu_device *adev,
+ if (!dcc->enable)
+ return 0;
+
+- if (adev->family < AMDGPU_FAMILY_GC_12_0_0 &&
++ if (adev->family != AMDGPU_FAMILY_GC_12_0_0 &&
+ format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN)
+ return -EINVAL;
+
+@@ -901,7 +901,7 @@ int amdgpu_dm_plane_fill_plane_buffer_attributes(struct amdgpu_device *adev,
+ upper_32_bits(chroma_addr);
+ }
+
+- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) {
++ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) {
+ ret = amdgpu_dm_plane_fill_gfx12_plane_attributes_from_modifiers(adev, afb, format,
+ rotation, plane_size,
+ tiling_info, dcc,
+--
+2.51.0
+
--- /dev/null
+From bc1352ed942d4a217fcce66bc742105d48985ff4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 14:08:56 -0500
+Subject: drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast
+ path
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit af3303970da5ce5bfe6dffdd07f38f42aad603e0 ]
+
+[Why]
+The evaluation for whether we need to use the DMUB HW lock isn't the
+same as whether we need to unlock which results in a hang when the
+fast path is used for ASIC without FAMS support.
+
+[How]
+Store a flag that indicates whether we should use the lock and use
+that same flag to specify whether unlocking is needed.
+
+Reviewed-by: Swapnil Patel <swapnil.patel@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+index e2763b60482a0..052d573408c3e 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+@@ -741,6 +741,7 @@ void hwss_build_fast_sequence(struct dc *dc,
+ struct dce_hwseq *hws = dc->hwseq;
+ struct pipe_ctx *current_pipe = NULL;
+ struct pipe_ctx *current_mpc_pipe = NULL;
++ bool is_dmub_lock_required = false;
+ unsigned int i = 0;
+
+ *num_steps = 0; // Initialize to 0
+@@ -763,11 +764,12 @@ void hwss_build_fast_sequence(struct dc *dc,
+ (*num_steps)++;
+ }
+ if (dc->hwss.dmub_hw_control_lock_fast) {
++ is_dmub_lock_required = dc_state_is_fams2_in_use(dc, context) ||
++ dmub_hw_lock_mgr_does_link_require_lock(dc, stream->link);
++
+ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.dc = dc;
+ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.lock = true;
+- block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required =
+- dc_state_is_fams2_in_use(dc, context) ||
+- dmub_hw_lock_mgr_does_link_require_lock(dc, stream->link);
++ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = is_dmub_lock_required;
+ block_sequence[*num_steps].func = DMUB_HW_CONTROL_LOCK_FAST;
+ (*num_steps)++;
+ }
+@@ -906,7 +908,7 @@ void hwss_build_fast_sequence(struct dc *dc,
+ if (dc->hwss.dmub_hw_control_lock_fast) {
+ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.dc = dc;
+ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.lock = false;
+- block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = dc_state_is_fams2_in_use(dc, context);
++ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = is_dmub_lock_required;
+ block_sequence[*num_steps].func = DMUB_HW_CONTROL_LOCK_FAST;
+ (*num_steps)++;
+ }
+--
+2.51.0
+
--- /dev/null
+From 3b2a473e195cb5747fbf87bd6fd058806caa8964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 18:10:31 +0800
+Subject: drm/amd/display: Fix system resume lag issue
+
+From: Tom Chung <chiahsuan.chung@amd.com>
+
+[ Upstream commit 64c94cd9be2e188ed07efeafa6a109bce638c967 ]
+
+[Why]
+System will try to apply idle power optimizations setting during
+system resume. But system power state is still in D3 state, and
+it will cause the idle power optimizations command not actually
+to be sent to DMUB and cause some platforms to go into IPS.
+
+[How]
+Set power state to D0 first before calling the
+dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false)
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 150cc3fc7b2a9..b6eee94861477 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3468,7 +3468,17 @@ static int dm_resume(struct amdgpu_ip_block *ip_block)
+ struct dc_commit_streams_params commit_params = {};
+
+ if (dm->dc->caps.ips_support) {
++ if (!amdgpu_in_reset(adev))
++ mutex_lock(&dm->dc_lock);
++
++ /* Need to set POWER_STATE_D0 first or it will not execute
++ * idle_power_optimizations command to DMUB.
++ */
++ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0);
+ dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false);
++
++ if (!amdgpu_in_reset(adev))
++ mutex_unlock(&dm->dc_lock);
+ }
+
+ if (amdgpu_in_reset(adev)) {
+--
+2.51.0
+
--- /dev/null
+From 1b20876c86f7c3dbd881e9ba6dc9cc2a8034453f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 17:20:31 -0700
+Subject: drm/amd/display: Fix writeback on DCN 3.2+
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit 9ef84a307582a92ef055ef0bd3db10fd8ac75960 ]
+
+[WHAT]
+1. Set no scaling for writeback as they are hardcoded in DCN3.2+.
+2. Set no fast plane update for writeback commits.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 209a6e5c713ca..150cc3fc7b2a9 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10648,10 +10648,10 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm,
+
+ wb_info->dwb_params.capture_rate = dwb_capture_rate_0;
+
+- wb_info->dwb_params.scaler_taps.h_taps = 4;
+- wb_info->dwb_params.scaler_taps.v_taps = 4;
+- wb_info->dwb_params.scaler_taps.h_taps_c = 2;
+- wb_info->dwb_params.scaler_taps.v_taps_c = 2;
++ wb_info->dwb_params.scaler_taps.h_taps = 1;
++ wb_info->dwb_params.scaler_taps.v_taps = 1;
++ wb_info->dwb_params.scaler_taps.h_taps_c = 1;
++ wb_info->dwb_params.scaler_taps.v_taps_c = 1;
+ wb_info->dwb_params.subsample_position = DWB_INTERSTITIAL_SUBSAMPLING;
+
+ wb_info->mcif_buf_params.luma_pitch = afb->base.pitches[0];
+@@ -11667,6 +11667,8 @@ static bool should_reset_plane(struct drm_atomic_state *state,
+ struct drm_crtc_state *old_crtc_state, *new_crtc_state;
+ struct dm_crtc_state *old_dm_crtc_state, *new_dm_crtc_state;
+ struct amdgpu_device *adev = drm_to_adev(plane->dev);
++ struct drm_connector_state *new_con_state;
++ struct drm_connector *connector;
+ int i;
+
+ /*
+@@ -11677,6 +11679,15 @@ static bool should_reset_plane(struct drm_atomic_state *state,
+ state->allow_modeset)
+ return true;
+
++ /* Check for writeback commit */
++ for_each_new_connector_in_state(state, connector, new_con_state, i) {
++ if (connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK)
++ continue;
++
++ if (new_con_state->writeback_job)
++ return true;
++ }
++
+ if (amdgpu_in_reset(adev) && state->allow_modeset)
+ return true;
+
+--
+2.51.0
+
--- /dev/null
+From 38fe64b18a96b7653397c59af48a738d47b605d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 10:58:19 -0500
+Subject: drm/amd/display: Fix wrong x_pos and y_pos for cursor offload
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit c02288724b98cbc018231200891d66578f83f848 ]
+
+[Why]
+The hubp401_cursor_set_position function programs a different value
+than it stores for use with cursor offload.
+
+This can cause a desync when switching between cursor programming paths.
+
+[How]
+We do the translation to destination space currently twice: once in the
+HWSS layer, and then again in the HUBP layer since we never store the
+translated result.
+
+HUBP expects to program the pos->x and pos->y directly for other ASIC,
+so follow that pattern here as well.
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c | 14 ++++++--------
+ .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 3 +++
+ 2 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c b/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
+index f01eae50d02f7..c205500290ecd 100644
+--- a/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
++++ b/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
+@@ -733,10 +733,8 @@ void hubp401_cursor_set_position(
+ const struct dc_cursor_mi_param *param)
+ {
+ struct dcn20_hubp *hubp2 = TO_DCN20_HUBP(hubp);
+- int x_pos = pos->x - param->recout.x;
+- int y_pos = pos->y - param->recout.y;
+- int rec_x_offset = x_pos - pos->x_hotspot;
+- int rec_y_offset = y_pos - pos->y_hotspot;
++ int rec_x_offset = pos->x - pos->x_hotspot;
++ int rec_y_offset = pos->y - pos->y_hotspot;
+ int dst_x_offset;
+ int x_pos_viewport = 0;
+ int x_hot_viewport = 0;
+@@ -748,10 +746,10 @@ void hubp401_cursor_set_position(
+ * within preceeding ODM slices.
+ */
+ if (param->recout.width) {
+- x_pos_viewport = x_pos * param->viewport.width / param->recout.width;
++ x_pos_viewport = pos->x * param->viewport.width / param->recout.width;
+ x_hot_viewport = pos->x_hotspot * param->viewport.width / param->recout.width;
+ } else {
+- ASSERT(!cur_en || x_pos == 0);
++ ASSERT(!cur_en || pos->x == 0);
+ ASSERT(!cur_en || pos->x_hotspot == 0);
+ }
+
+@@ -790,8 +788,8 @@ void hubp401_cursor_set_position(
+
+ if (!hubp->cursor_offload) {
+ REG_SET_2(CURSOR_POSITION, 0,
+- CURSOR_X_POSITION, x_pos,
+- CURSOR_Y_POSITION, y_pos);
++ CURSOR_X_POSITION, pos->x,
++ CURSOR_Y_POSITION, pos->y);
+
+ REG_SET_2(CURSOR_HOT_SPOT, 0,
+ CURSOR_HOT_SPOT_X, pos->x_hotspot,
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index 5eda7648d0d2b..5ffe41a96864a 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -1215,6 +1215,9 @@ void dcn401_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ if (recout_y_pos + (int)hubp->curs_attr.height <= 0)
+ pos_cpy.enable = false; /* not visible beyond top edge*/
+
++ pos_cpy.x = x_pos;
++ pos_cpy.y = y_pos;
++
+ hubp->funcs->set_cursor_position(hubp, &pos_cpy, ¶m);
+ dpp->funcs->set_cursor_position(dpp, &pos_cpy, ¶m, hubp->curs_attr.width, hubp->curs_attr.height);
+ }
+--
+2.51.0
+
--- /dev/null
+From 378952889ce6bf06836fe11e024f55a8da56847c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Nov 2025 20:58:23 +0000
+Subject: drm/amd/display: Guard FAMS2 configuration updates
+
+From: Dillon Varone <Dillon.Varone@amd.com>
+
+[ Upstream commit 7dedb906cdfec100061daf41f8e54266e975987d ]
+
+[WHY&HOW]
+If DMCUB is not initialized or FAMS2 is not supported, the
+interface should not be called.
+
+Reviewed-by: Sridevi Arvindekar <sridevi.arvindekar@amd.com>
+Signed-off-by: Dillon Varone <Dillon.Varone@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index 5ffe41a96864a..12ce3789f5130 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -1774,7 +1774,8 @@ void dcn401_unblank_stream(struct pipe_ctx *pipe_ctx,
+ void dcn401_hardware_release(struct dc *dc)
+ {
+ if (!dc->debug.disable_force_pstate_allow_on_hw_release) {
+- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
++ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable)
++ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
+
+ /* If pstate unsupported, or still supported
+ * by firmware, force it supported by dcn
+@@ -1794,7 +1795,9 @@ void dcn401_hardware_release(struct dc *dc)
+ dc->clk_mgr->clks.p_state_change_support = false;
+ dc->clk_mgr->funcs->update_clocks(dc->clk_mgr, dc->current_state, true);
+ }
+- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
++
++ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable)
++ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f58a9cfb18704dfd0e5ed1dcb7b5d5ab4e0bade2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 16:38:50 -0500
+Subject: drm/amd/display: only power down dig on phy endpoints
+
+From: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+
+[ Upstream commit 0839d8d24e6f1fc2587c4a976f44da9fa69ae3d0 ]
+
+This avoids any issues with dpia endpoints
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index f04cbdb3d3814..1ce61f0570201 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -287,6 +287,8 @@ void dcn401_init_hw(struct dc *dc)
+ for (i = 0; i < dc->link_count; i++) {
+ struct dc_link *link = dc->links[i];
+
++ if (link->ep_type != DISPLAY_ENDPOINT_PHY)
++ continue;
+ if (link->link_enc->funcs->is_dig_enabled &&
+ link->link_enc->funcs->is_dig_enabled(link->link_enc) &&
+ hws->funcs.power_down) {
+--
+2.51.0
+
--- /dev/null
+From ff01c09defad777dff09ad0e28acafdb6fbc9b27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 22:05:16 -0700
+Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ]
+
+[Why]
+Shaper programming has high chance to fail on first time after
+power-on or reboot. This can be verified by running IGT's kms_colorop.
+
+[How]
+Always power on the shaper and 3DLUT before programming by
+removing the debug flag of low power mode.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
+index 83bbbf34bcac7..badcef027b846 100644
+--- a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
+@@ -724,8 +724,7 @@ bool mpc32_program_shaper(
+ return false;
+ }
+
+- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc)
+- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
+
+ current_mode = mpc32_get_shaper_current(mpc, mpcc_id);
+
+--
+2.51.0
+
--- /dev/null
+From bd7b2d0af411faa1bda336bd1cfd6b6f251e0868 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 13:04:48 +0800
+Subject: drm/amd/display: Revert "init dispclk from bootup clock for DCN314"
+
+From: Wang, Sung-huai <Danny.Wang@amd.com>
+
+[ Upstream commit bdc26342c49e1dc1afb48feeb20c9d74d15b784c ]
+
+[Why&How]
+This reverts commit f082daf08f2f.
+Due to the change, the display shows garbage on startup.
+
+We have an alternative solution for the original issue:
+d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not")
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Wang, Sung-huai <Danny.Wang@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 133 +-----------------
+ .../dc/clk_mgr/dcn314/dcn314_clk_mgr.h | 5 -
+ 2 files changed, 4 insertions(+), 134 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
+index db687a13174d5..0cb37827a62b6 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
+@@ -77,7 +77,6 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0,
+ #undef DC_LOGGER
+ #define DC_LOGGER \
+ clk_mgr->base.base.ctx->logger
+-
+ #define regCLK1_CLK_PLL_REQ 0x0237
+ #define regCLK1_CLK_PLL_REQ_BASE_IDX 0
+
+@@ -88,70 +87,8 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0,
+ #define CLK1_CLK_PLL_REQ__PllSpineDiv_MASK 0x0000F000L
+ #define CLK1_CLK_PLL_REQ__FbMult_frac_MASK 0xFFFF0000L
+
+-#define regCLK1_CLK0_DFS_CNTL 0x0269
+-#define regCLK1_CLK0_DFS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK1_DFS_CNTL 0x026c
+-#define regCLK1_CLK1_DFS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK2_DFS_CNTL 0x026f
+-#define regCLK1_CLK2_DFS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK3_DFS_CNTL 0x0272
+-#define regCLK1_CLK3_DFS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK4_DFS_CNTL 0x0275
+-#define regCLK1_CLK4_DFS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK5_DFS_CNTL 0x0278
+-#define regCLK1_CLK5_DFS_CNTL_BASE_IDX 0
+-
+-#define regCLK1_CLK0_CURRENT_CNT 0x02fb
+-#define regCLK1_CLK0_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK1_CURRENT_CNT 0x02fc
+-#define regCLK1_CLK1_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK2_CURRENT_CNT 0x02fd
+-#define regCLK1_CLK2_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK3_CURRENT_CNT 0x02fe
+-#define regCLK1_CLK3_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK4_CURRENT_CNT 0x02ff
+-#define regCLK1_CLK4_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK5_CURRENT_CNT 0x0300
+-#define regCLK1_CLK5_CURRENT_CNT_BASE_IDX 0
+-
+-#define regCLK1_CLK0_BYPASS_CNTL 0x028a
+-#define regCLK1_CLK0_BYPASS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK1_BYPASS_CNTL 0x0293
+-#define regCLK1_CLK1_BYPASS_CNTL_BASE_IDX 0
+ #define regCLK1_CLK2_BYPASS_CNTL 0x029c
+ #define regCLK1_CLK2_BYPASS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK3_BYPASS_CNTL 0x02a5
+-#define regCLK1_CLK3_BYPASS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK4_BYPASS_CNTL 0x02ae
+-#define regCLK1_CLK4_BYPASS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK5_BYPASS_CNTL 0x02b7
+-#define regCLK1_CLK5_BYPASS_CNTL_BASE_IDX 0
+-
+-#define regCLK1_CLK0_DS_CNTL 0x0283
+-#define regCLK1_CLK0_DS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK1_DS_CNTL 0x028c
+-#define regCLK1_CLK1_DS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK2_DS_CNTL 0x0295
+-#define regCLK1_CLK2_DS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK3_DS_CNTL 0x029e
+-#define regCLK1_CLK3_DS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK4_DS_CNTL 0x02a7
+-#define regCLK1_CLK4_DS_CNTL_BASE_IDX 0
+-#define regCLK1_CLK5_DS_CNTL 0x02b0
+-#define regCLK1_CLK5_DS_CNTL_BASE_IDX 0
+-
+-#define regCLK1_CLK0_ALLOW_DS 0x0284
+-#define regCLK1_CLK0_ALLOW_DS_BASE_IDX 0
+-#define regCLK1_CLK1_ALLOW_DS 0x028d
+-#define regCLK1_CLK1_ALLOW_DS_BASE_IDX 0
+-#define regCLK1_CLK2_ALLOW_DS 0x0296
+-#define regCLK1_CLK2_ALLOW_DS_BASE_IDX 0
+-#define regCLK1_CLK3_ALLOW_DS 0x029f
+-#define regCLK1_CLK3_ALLOW_DS_BASE_IDX 0
+-#define regCLK1_CLK4_ALLOW_DS 0x02a8
+-#define regCLK1_CLK4_ALLOW_DS_BASE_IDX 0
+-#define regCLK1_CLK5_ALLOW_DS 0x02b1
+-#define regCLK1_CLK5_ALLOW_DS_BASE_IDX 0
+
+ #define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_SEL__SHIFT 0x0
+ #define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_DIV__SHIFT 0x10
+@@ -248,8 +185,6 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr)
+ {
+ struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr);
+ uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
+- struct clk_mgr_dcn314 *clk_mgr_dcn314 = TO_CLK_MGR_DCN314(clk_mgr_int);
+- struct clk_log_info log_info = {0};
+
+ memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
+ // Assumption is that boot state always supports pstate
+@@ -265,9 +200,6 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr)
+ dce_adjust_dp_ref_freq_for_ss(clk_mgr_int, clk_mgr->dprefclk_khz);
+ else
+ clk_mgr->dp_dto_source_clock_in_khz = clk_mgr->dprefclk_khz;
+-
+- dcn314_dump_clk_registers(&clk_mgr->boot_snapshot, &clk_mgr_dcn314->base.base, &log_info);
+- clk_mgr->clks.dispclk_khz = clk_mgr->boot_snapshot.dispclk * 1000;
+ }
+
+ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+@@ -278,7 +210,7 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+ struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
+ struct dc_clocks *new_clocks = &context->bw_ctx.bw.dcn.clk;
+ struct dc *dc = clk_mgr_base->ctx->dc;
+- int display_count;
++ int display_count = 0;
+ bool update_dppclk = false;
+ bool update_dispclk = false;
+ bool dpp_clock_lowered = false;
+@@ -287,7 +219,6 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+ return;
+
+ display_count = dcn314_get_active_display_cnt_wa(dc, context);
+-
+ /*
+ * if it is safe to lower, but we are already in the lower state, we don't have to do anything
+ * also if safe to lower is false, we just go in the higher state
+@@ -363,7 +294,7 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+ }
+
+ if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) &&
+- (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) {
++ (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) {
+ int requested_dispclk_khz = new_clocks->dispclk_khz;
+
+ dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, true);
+@@ -374,7 +305,6 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+
+ dcn314_smu_set_dispclk(clk_mgr, requested_dispclk_khz);
+ clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz;
+-
+ dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, false);
+
+ update_dispclk = true;
+@@ -462,65 +392,10 @@ bool dcn314_are_clock_states_equal(struct dc_clocks *a,
+ return true;
+ }
+
+-
+-static void dcn314_dump_clk_registers_internal(struct dcn35_clk_internal *internal, struct clk_mgr *clk_mgr_base)
+-{
+- struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
+-
+- // read dtbclk
+- internal->CLK1_CLK4_CURRENT_CNT = REG_READ(CLK1_CLK4_CURRENT_CNT);
+- internal->CLK1_CLK4_BYPASS_CNTL = REG_READ(CLK1_CLK4_BYPASS_CNTL);
+-
+- // read dcfclk
+- internal->CLK1_CLK3_CURRENT_CNT = REG_READ(CLK1_CLK3_CURRENT_CNT);
+- internal->CLK1_CLK3_BYPASS_CNTL = REG_READ(CLK1_CLK3_BYPASS_CNTL);
+-
+- // read dcf deep sleep divider
+- internal->CLK1_CLK3_DS_CNTL = REG_READ(CLK1_CLK3_DS_CNTL);
+- internal->CLK1_CLK3_ALLOW_DS = REG_READ(CLK1_CLK3_ALLOW_DS);
+-
+- // read dppclk
+- internal->CLK1_CLK1_CURRENT_CNT = REG_READ(CLK1_CLK1_CURRENT_CNT);
+- internal->CLK1_CLK1_BYPASS_CNTL = REG_READ(CLK1_CLK1_BYPASS_CNTL);
+-
+- // read dprefclk
+- internal->CLK1_CLK2_CURRENT_CNT = REG_READ(CLK1_CLK2_CURRENT_CNT);
+- internal->CLK1_CLK2_BYPASS_CNTL = REG_READ(CLK1_CLK2_BYPASS_CNTL);
+-
+- // read dispclk
+- internal->CLK1_CLK0_CURRENT_CNT = REG_READ(CLK1_CLK0_CURRENT_CNT);
+- internal->CLK1_CLK0_BYPASS_CNTL = REG_READ(CLK1_CLK0_BYPASS_CNTL);
+-}
+-
+-void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
++static void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
+ struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info)
+ {
+-
+- struct dcn35_clk_internal internal = {0};
+-
+- dcn314_dump_clk_registers_internal(&internal, clk_mgr_base);
+-
+- regs_and_bypass->dcfclk = internal.CLK1_CLK3_CURRENT_CNT / 10;
+- regs_and_bypass->dcf_deep_sleep_divider = internal.CLK1_CLK3_DS_CNTL / 10;
+- regs_and_bypass->dcf_deep_sleep_allow = internal.CLK1_CLK3_ALLOW_DS;
+- regs_and_bypass->dprefclk = internal.CLK1_CLK2_CURRENT_CNT / 10;
+- regs_and_bypass->dispclk = internal.CLK1_CLK0_CURRENT_CNT / 10;
+- regs_and_bypass->dppclk = internal.CLK1_CLK1_CURRENT_CNT / 10;
+- regs_and_bypass->dtbclk = internal.CLK1_CLK4_CURRENT_CNT / 10;
+-
+- regs_and_bypass->dppclk_bypass = internal.CLK1_CLK1_BYPASS_CNTL & 0x0007;
+- if (regs_and_bypass->dppclk_bypass > 4)
+- regs_and_bypass->dppclk_bypass = 0;
+- regs_and_bypass->dcfclk_bypass = internal.CLK1_CLK3_BYPASS_CNTL & 0x0007;
+- if (regs_and_bypass->dcfclk_bypass > 4)
+- regs_and_bypass->dcfclk_bypass = 0;
+- regs_and_bypass->dispclk_bypass = internal.CLK1_CLK0_BYPASS_CNTL & 0x0007;
+- if (regs_and_bypass->dispclk_bypass > 4)
+- regs_and_bypass->dispclk_bypass = 0;
+- regs_and_bypass->dprefclk_bypass = internal.CLK1_CLK2_BYPASS_CNTL & 0x0007;
+- if (regs_and_bypass->dprefclk_bypass > 4)
+- regs_and_bypass->dprefclk_bypass = 0;
+-
++ return;
+ }
+
+ static struct clk_bw_params dcn314_bw_params = {
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
+index 0577eb527bc36..002c28e807208 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
+@@ -65,9 +65,4 @@ void dcn314_clk_mgr_construct(struct dc_context *ctx,
+
+ void dcn314_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr_int);
+
+-
+-void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
+- struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info);
+-
+-
+ #endif //__DCN314_CLK_MGR_H__
+--
+2.51.0
+
--- /dev/null
+From dd0cdacc2d3d9d0fb6f39371ee10222b400a6b48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 11:01:38 +0800
+Subject: drm/amd/display: Revert "init dispclk from bootup clock for DCN315"
+
+From: Wang, Sung-huai <Danny.Wang@amd.com>
+
+[ Upstream commit a625dc4989a2affb8f06e7b418bf30e1474b99c1 ]
+
+[Why&How]
+This reverts commit 14bb17cc37e0.
+Due to the change, the display shows garbage on startup.
+
+We have an alternative solution for the original issue:
+d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not")
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Wang, Sung-huai <Danny.Wang@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 90 +------------------
+ .../dc/clk_mgr/dcn315/dcn315_clk_mgr.h | 1 -
+ 2 files changed, 3 insertions(+), 88 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+index 3a881451e9da4..c49268db85f68 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+@@ -40,7 +40,7 @@
+ #include "dm_helpers.h"
+
+ #include "dc_dmub_srv.h"
+-#include "reg_helper.h"
++
+ #include "logger_types.h"
+ #undef DC_LOGGER
+ #define DC_LOGGER \
+@@ -48,43 +48,9 @@
+
+ #include "link_service.h"
+
+-#define MAX_INSTANCE 7
+-#define MAX_SEGMENT 8
+-
+-struct IP_BASE_INSTANCE {
+- unsigned int segment[MAX_SEGMENT];
+-};
+-
+-struct IP_BASE {
+- struct IP_BASE_INSTANCE instance[MAX_INSTANCE];
+-};
+-
+-static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0, 0, 0, 0 } },
+- { { 0x00016E00, 0x02401C00, 0, 0, 0, 0, 0, 0 } },
+- { { 0x00017000, 0x02402000, 0, 0, 0, 0, 0, 0 } },
+- { { 0x00017200, 0x02402400, 0, 0, 0, 0, 0, 0 } },
+- { { 0x0001B000, 0x0242D800, 0, 0, 0, 0, 0, 0 } },
+- { { 0x0001B200, 0x0242DC00, 0, 0, 0, 0, 0, 0 } } } };
+-
+-#define regCLK1_CLK0_CURRENT_CNT 0x0314
+-#define regCLK1_CLK0_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK1_CURRENT_CNT 0x0315
+-#define regCLK1_CLK1_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK2_CURRENT_CNT 0x0316
+-#define regCLK1_CLK2_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK3_CURRENT_CNT 0x0317
+-#define regCLK1_CLK3_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK4_CURRENT_CNT 0x0318
+-#define regCLK1_CLK4_CURRENT_CNT_BASE_IDX 0
+-#define regCLK1_CLK5_CURRENT_CNT 0x0319
+-#define regCLK1_CLK5_CURRENT_CNT_BASE_IDX 0
+-
+ #define TO_CLK_MGR_DCN315(clk_mgr)\
+ container_of(clk_mgr, struct clk_mgr_dcn315, base)
+
+-#define REG(reg_name) \
+- (CLK_BASE.instance[0].segment[reg ## reg_name ## _BASE_IDX] + reg ## reg_name)
+-
+ #define UNSUPPORTED_DCFCLK 10000000
+ #define MIN_DPP_DISP_CLK 100000
+
+@@ -172,7 +138,7 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
+ if (dc->work_arounds.skip_clock_update)
+ return;
+
+- clk_mgr_base->clks.zstate_support = new_clocks->zstate_support;
++ display_count = dcn315_get_active_display_cnt_wa(dc, context);
+ /*
+ * if it is safe to lower, but we are already in the lower state, we don't have to do anything
+ * also if safe to lower is false, we just go in the higher state
+@@ -185,7 +151,6 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
+ }
+ /* check that we're not already in lower */
+ if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_LOW_POWER) {
+- display_count = dcn315_get_active_display_cnt_wa(dc, context);
+ /* if we can go lower, go lower */
+ if (display_count == 0) {
+ union display_idle_optimization_u idle_info = { 0 };
+@@ -279,38 +244,9 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
+ dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
+ }
+
+-static void dcn315_dump_clk_registers_internal(struct dcn35_clk_internal *internal, struct clk_mgr *clk_mgr_base)
+-{
+- struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
+-
+- // read dtbclk
+- internal->CLK1_CLK4_CURRENT_CNT = REG_READ(CLK1_CLK4_CURRENT_CNT);
+-
+- // read dcfclk
+- internal->CLK1_CLK3_CURRENT_CNT = REG_READ(CLK1_CLK3_CURRENT_CNT);
+-
+- // read dppclk
+- internal->CLK1_CLK1_CURRENT_CNT = REG_READ(CLK1_CLK1_CURRENT_CNT);
+-
+- // read dprefclk
+- internal->CLK1_CLK2_CURRENT_CNT = REG_READ(CLK1_CLK2_CURRENT_CNT);
+-
+- // read dispclk
+- internal->CLK1_CLK0_CURRENT_CNT = REG_READ(CLK1_CLK0_CURRENT_CNT);
+-}
+-
+ static void dcn315_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
+ struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info)
+ {
+- struct dcn35_clk_internal internal = {0};
+-
+- dcn315_dump_clk_registers_internal(&internal, clk_mgr_base);
+-
+- regs_and_bypass->dcfclk = internal.CLK1_CLK3_CURRENT_CNT / 10;
+- regs_and_bypass->dprefclk = internal.CLK1_CLK2_CURRENT_CNT / 10;
+- regs_and_bypass->dispclk = internal.CLK1_CLK0_CURRENT_CNT / 10;
+- regs_and_bypass->dppclk = internal.CLK1_CLK1_CURRENT_CNT / 10;
+- regs_and_bypass->dtbclk = internal.CLK1_CLK4_CURRENT_CNT / 10;
+ return;
+ }
+
+@@ -657,32 +593,13 @@ static struct clk_mgr_funcs dcn315_funcs = {
+ .get_dp_ref_clk_frequency = dce12_get_dp_ref_freq_khz,
+ .get_dtb_ref_clk_frequency = dcn31_get_dtb_ref_freq_khz,
+ .update_clocks = dcn315_update_clocks,
+- .init_clocks = dcn315_init_clocks,
++ .init_clocks = dcn31_init_clocks,
+ .enable_pme_wa = dcn315_enable_pme_wa,
+ .are_clock_states_equal = dcn31_are_clock_states_equal,
+ .notify_wm_ranges = dcn315_notify_wm_ranges
+ };
+ extern struct clk_mgr_funcs dcn3_fpga_funcs;
+
+-void dcn315_init_clocks(struct clk_mgr *clk_mgr)
+-{
+- struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr);
+- uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
+- struct clk_mgr_dcn315 *clk_mgr_dcn315 = TO_CLK_MGR_DCN315(clk_mgr_int);
+- struct clk_log_info log_info = {0};
+-
+- memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
+- // Assumption is that boot state always supports pstate
+- clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk; // restore ref_dtbclk
+- clk_mgr->clks.p_state_change_support = true;
+- clk_mgr->clks.prev_p_state_change_support = true;
+- clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN;
+- clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN;
+-
+- dcn315_dump_clk_registers(&clk_mgr->boot_snapshot, &clk_mgr_dcn315->base.base, &log_info);
+- clk_mgr->clks.dispclk_khz = clk_mgr->boot_snapshot.dispclk * 1000;
+-}
+-
+ void dcn315_clk_mgr_construct(
+ struct dc_context *ctx,
+ struct clk_mgr_dcn315 *clk_mgr,
+@@ -743,7 +660,6 @@ void dcn315_clk_mgr_construct(
+ /* Saved clocks configured at boot for debug purposes */
+ dcn315_dump_clk_registers(&clk_mgr->base.base.boot_snapshot,
+ &clk_mgr->base.base, &log_info);
+- clk_mgr->base.base.clks.dispclk_khz = clk_mgr->base.base.boot_snapshot.dispclk * 1000;
+
+ clk_mgr->base.base.dprefclk_khz = 600000;
+ clk_mgr->base.base.dprefclk_khz = dcn315_smu_get_dpref_clk(&clk_mgr->base);
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h
+index 642ae3d4a7909..ac36ddf5dd1af 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h
+@@ -44,7 +44,6 @@ void dcn315_clk_mgr_construct(struct dc_context *ctx,
+ struct pp_smu_funcs *pp_smu,
+ struct dccg *dccg);
+
+-void dcn315_init_clocks(struct clk_mgr *clk_mgr);
+ void dcn315_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr_int);
+
+ #endif //__DCN315_CLK_MGR_H__
+--
+2.51.0
+
--- /dev/null
+From 47496c002897f3c2ba1d35b7be0acf9eac34e12a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 13:32:40 +0800
+Subject: drm/amd/display: set enable_legacy_fast_update to false for DCN36
+
+From: YiLing Chen <yi-lchen@amd.com>
+
+[ Upstream commit d0728aee5090853d0b9982757f5fb1b13e2e2b27 ]
+
+[Why/How]
+Align the default value of the flag with DCN35/351.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: YiLing Chen <yi-lchen@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c
+index 6469d5fe2e6d4..a1132102afde4 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c
+@@ -769,7 +769,7 @@ static const struct dc_debug_options debug_defaults_drv = {
+ };
+
+ static const struct dc_check_config config_defaults = {
+- .enable_legacy_fast_update = true,
++ .enable_legacy_fast_update = false,
+ };
+
+ static const struct dc_panel_config panel_config_defaults = {
+--
+2.51.0
+
--- /dev/null
+From 89ef51a181196d59e22c9830b910996c4487be23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 16:42:11 +0800
+Subject: drm/amd/pm: Fix null pointer dereference issue
+
+From: Jinzhou Su <jinzhou.su@amd.com>
+
+[ Upstream commit 1197366cca89a4c44c541ddedb8ce8bf0757993d ]
+
+If SMU is disabled, during RAS initialization,
+there will be null pointer dereference issue here.
+
+Signed-off-by: Jinzhou Su <jinzhou.su@amd.com>
+Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+index f51fa265230b3..2a0e826d0317d 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -618,6 +618,9 @@ int amdgpu_smu_ras_send_msg(struct amdgpu_device *adev, enum smu_message_type ms
+ struct smu_context *smu = adev->powerplay.pp_handle;
+ int ret = -EOPNOTSUPP;
+
++ if (!smu)
++ return ret;
++
+ if (smu->ppt_funcs && smu->ppt_funcs->ras_send_msg)
+ ret = smu->ppt_funcs->ras_send_msg(smu, msg, param, read_arg);
+
+--
+2.51.0
+
--- /dev/null
+From dbae7b06f456ae1751643dd39555d7d9c2dc3650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:24:01 +0000
+Subject: drm/amdgpu: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for amdgpu.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 695432d3045ff..2d8d86efe2e73 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3464,6 +3464,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((adev->pdev->device == 0x666f) &&
++ (adev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (adev->asic_type == CHIP_OLAND) {
+ if ((adev->pdev->revision == 0xC7) ||
+ (adev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From 0740fbcad27cc5c313973f5e1341f4bc1f83c990 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 10:46:47 +0800
+Subject: drm/amdgpu: add support for HDP IP version 6.1.1
+
+From: Tim Huang <tim.huang@amd.com>
+
+[ Upstream commit e2fd14f579b841f54a9b7162fef15234d8c0627a ]
+
+This initializes HDP IP version 6.1.1.
+
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Tim Huang <tim.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index fa2a22dfa0487..f9e0e80c4c186 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -3059,6 +3059,7 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ case IP_VERSION(6, 0, 0):
+ case IP_VERSION(6, 0, 1):
+ case IP_VERSION(6, 1, 0):
++ case IP_VERSION(6, 1, 1):
+ adev->hdp.funcs = &hdp_v6_0_funcs;
+ break;
+ case IP_VERSION(7, 0, 0):
+--
+2.51.0
+
--- /dev/null
+From bf21231e1d83a28751bda3e092fbf8d938bc7ed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 15:32:01 +0800
+Subject: drm/amdgpu: Adjust usleep_range in fence wait
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ]
+
+Tune the sleep interval in the PSP fence wait loop from 10-100us to
+60-100us.This adjustment results in an overall wait window of 1.2s
+(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations),
+which guarantees that we can retrieve the correct fence value
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 0b10497d487c3..81bdd6aaad2a1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -726,7 +726,7 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ ras_intr = amdgpu_ras_intr_triggered();
+ if (ras_intr)
+ break;
+- usleep_range(10, 100);
++ usleep_range(60, 100);
+ amdgpu_device_invalidate_hdp(psp->adev, NULL);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 87148f81fd75c43422641019303ff98a3c6766c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 11:46:48 -0500
+Subject: drm/amdgpu: avoid a warning in timedout job handler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74 ]
+
+Only set an error on the fence if the fence is not
+signalled. We can end up with a warning if the
+per queue reset path signals the fence and sets an error
+as part of the reset, but fails to recover.
+
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+index 7ccb724b2488d..aaf5477fcd7ac 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -147,7 +147,8 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job)
+ dev_err(adev->dev, "Ring %s reset failed\n", ring->sched.name);
+ }
+
+- dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
++ if (dma_fence_get_status(&s_job->s_fence->finished) == 0)
++ dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
+
+ if (amdgpu_device_should_recover_gpu(ring->adev)) {
+ struct amdgpu_reset_context reset_context;
+--
+2.51.0
+
--- /dev/null
+From 918f4c9d069add5cb2e2e3204afe373e9093dabb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 23:15:04 +0800
+Subject: drm/amdgpu: avoid sdma ring reset in sriov
+
+From: Victor Zhao <Victor.Zhao@amd.com>
+
+[ Upstream commit 5cc7bbd9f1b74d9fe2f7ac08d6ba0477e8d2d65f ]
+
+sdma ring reset is not supported in SRIOV. kfd driver does not check
+reset mask, and could queue sdma ring reset during unmap_queues_cpsch.
+
+Avoid the ring reset for sriov.
+
+Signed-off-by: Victor Zhao <Victor.Zhao@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
+index 8b8a04138711c..321310ba2c08e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
+@@ -558,6 +558,9 @@ int amdgpu_sdma_reset_engine(struct amdgpu_device *adev, uint32_t instance_id,
+ struct amdgpu_ring *gfx_ring = &sdma_instance->ring;
+ struct amdgpu_ring *page_ring = &sdma_instance->page;
+
++ if (amdgpu_sriov_vf(adev))
++ return -EOPNOTSUPP;
++
+ mutex_lock(&sdma_instance->engine_reset_mutex);
+
+ if (!caller_handles_kernel_queues) {
+--
+2.51.0
+
--- /dev/null
+From 1a12f40247477abce80075d1012155ab8379228f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2024 11:07:40 +0800
+Subject: drm/amdgpu: fix NULL pointer issue buffer funcs
+
+From: Likun Gao <Likun.Gao@amd.com>
+
+[ Upstream commit 9877a865d62c9c3e0f4cc369dc9ca9f7f24f5ee9 ]
+
+If SDMA block not enabled, buffer_funcs will not initialize,
+fix the null pointer issue if buffer_funcs not initialized.
+
+Signed-off-by: Likun Gao <Likun.Gao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index d2c3885de711f..ba6fb23b840a0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3309,7 +3309,8 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
+ if (r)
+ goto init_failed;
+
+- if (adev->mman.buffer_funcs_ring->sched.ready)
++ if (adev->mman.buffer_funcs_ring &&
++ adev->mman.buffer_funcs_ring->sched.ready)
+ amdgpu_ttm_set_buffer_funcs_status(adev, true);
+
+ /* Don't init kfd if whole hive need to be reset during init */
+--
+2.51.0
+
--- /dev/null
+From e4904bd8d5b07141509e4bd74b0110d9bd0dea24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 15:21:43 +0800
+Subject: drm/amdgpu: fix the calculation of RAS bad page number
+
+From: Tao Zhou <tao.zhou1@amd.com>
+
+[ Upstream commit f752e79d38857011f1293fcb6c810409c3b669ee ]
+
+__amdgpu_ras_restore_bad_pages is responsible for the maintenance of bad
+page number, drop the unnecessary bad page number update in the error
+handling path of add_bad_pages.
+
+Signed-off-by: Tao Zhou <tao.zhou1@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 8de9f68f7bea6..9c21401c9b830 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -3249,8 +3249,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev,
+ /* deal with retire_unit records a time */
+ ret = __amdgpu_ras_convert_rec_array_from_rom(adev,
+ &bps[i], &err_data, nps);
+- if (ret)
+- con->bad_page_num -= adev->umc.retire_unit;
+ i += (adev->umc.retire_unit - 1);
+ } else {
+ break;
+@@ -3263,8 +3261,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev,
+ for (; i < pages; i++) {
+ ret = __amdgpu_ras_convert_rec_from_rom(adev,
+ &bps[i], &err_data, nps);
+- if (ret)
+- con->bad_page_num -= adev->umc.retire_unit;
+ }
+
+ con->eh_data->count_saved = con->eh_data->count;
+--
+2.51.0
+
--- /dev/null
+From b441092103f2dbaa4da882e8330e6f9dfec97d16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 11:32:08 +0800
+Subject: drm/amdgpu: mark invalid records with U64_MAX
+
+From: Gangliang Xie <ganglxie@amd.com>
+
+[ Upstream commit 0028b86b52f7609e36af635ef6cb908925306233 ]
+
+set retired_page of invalid ras records to U64_MAX, and skip
+them when reading ras records
+
+Signed-off-by: Gangliang Xie <ganglxie@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 6b069dc4bab06..ee4d08b0988d3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -2777,6 +2777,10 @@ static int amdgpu_ras_badpages_read(struct amdgpu_device *adev,
+ if (!data->bps[i].ts)
+ continue;
+
++ /* U64_MAX is used to mark the record as invalid */
++ if (data->bps[i].retired_page == U64_MAX)
++ continue;
++
+ bps[r].bp = data->bps[i].retired_page;
+ r++;
+ if (r >= count)
+@@ -3083,6 +3087,8 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev,
+
+ if (amdgpu_ras_check_bad_page_unlock(con,
+ bps[j].retired_page << AMDGPU_GPU_PAGE_SHIFT)) {
++ /* set to U64_MAX to mark it as invalid */
++ data->bps[data->count].retired_page = U64_MAX;
+ data->count++;
+ data->space_left--;
+ continue;
+--
+2.51.0
+
--- /dev/null
+From 38f038d1574037108a74efe89e1945ab594b4574 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 00:46:23 +0800
+Subject: drm/amdgpu/ras: Move ras data alloc before bad page check
+
+From: Asad Kamal <asad.kamal@amd.com>
+
+[ Upstream commit bd68a1404b6fa2e7e9957b38ba22616faba43e75 ]
+
+In the rare event if eeprom has only invalid address entries,
+allocation is skipped, this causes following NULL pointer issue
+[ 547.103445] BUG: kernel NULL pointer dereference, address: 0000000000000010
+[ 547.118897] #PF: supervisor read access in kernel mode
+[ 547.130292] #PF: error_code(0x0000) - not-present page
+[ 547.141689] PGD 124757067 P4D 0
+[ 547.148842] Oops: 0000 [#1] PREEMPT SMP NOPTI
+[ 547.158504] CPU: 49 PID: 8167 Comm: cat Tainted: G OE 6.8.0-38-generic #38-Ubuntu
+[ 547.177998] Hardware name: Supermicro AS -8126GS-TNMR/H14DSG-OD, BIOS 1.7 09/12/2025
+[ 547.195178] RIP: 0010:amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu]
+[ 547.210375] Code: e8 63 78 82 c0 45 31 d2 45 3b 75 08 48 8b 45 a0 73 44 44 89 f1 48 8b 7d 88 48 89 ca 48 c1 e2 05 48 29 ca 49 8b 4d 00 48 01 d1 <48> 83 79 10 00 74 17 49 63 f2 48 8b 49 08 41 83 c2 01 48 8d 34 76
+[ 547.252045] RSP: 0018:ffa0000067287ac0 EFLAGS: 00010246
+[ 547.263636] RAX: ff11000167c28130 RBX: ff11000127600000 RCX: 0000000000000000
+[ 547.279467] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff11000125b1c800
+[ 547.295298] RBP: ffa0000067287b50 R08: 0000000000000000 R09: 0000000000000000
+[ 547.311129] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
+[ 547.326959] R13: ff11000217b1de00 R14: 0000000000000000 R15: 0000000000000092
+[ 547.342790] FS: 0000746e59d14740(0000) GS:ff11017dfda80000(0000) knlGS:0000000000000000
+[ 547.360744] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 547.373489] CR2: 0000000000000010 CR3: 000000019585e001 CR4: 0000000000f71ef0
+[ 547.389321] PKRU: 55555554
+[ 547.395316] Call Trace:
+[ 547.400737] <TASK>
+[ 547.405386] ? show_regs+0x6d/0x80
+[ 547.412929] ? __die+0x24/0x80
+[ 547.419697] ? page_fault_oops+0x99/0x1b0
+[ 547.428588] ? do_user_addr_fault+0x2ee/0x6b0
+[ 547.438249] ? exc_page_fault+0x83/0x1b0
+[ 547.446949] ? asm_exc_page_fault+0x27/0x30
+[ 547.456225] ? amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu]
+[ 547.470040] ? mas_wr_modify+0xcd/0x140
+[ 547.478548] sysfs_kf_bin_read+0x63/0xb0
+[ 547.487248] kernfs_file_read_iter+0xa1/0x190
+[ 547.496909] kernfs_fop_read_iter+0x25/0x40
+[ 547.506182] vfs_read+0x255/0x390
+
+This also result in space left assigned to negative values.
+Moving data alloc call before bad page check resolves both the issue.
+
+Signed-off-by: Asad Kamal <asad.kamal@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 9c21401c9b830..6b069dc4bab06 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -3076,6 +3076,11 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev,
+ struct ras_err_handler_data *data = con->eh_data;
+
+ for (j = 0; j < count; j++) {
++ if (!data->space_left &&
++ amdgpu_ras_realloc_eh_data_space(adev, data, 256)) {
++ return -ENOMEM;
++ }
++
+ if (amdgpu_ras_check_bad_page_unlock(con,
+ bps[j].retired_page << AMDGPU_GPU_PAGE_SHIFT)) {
+ data->count++;
+@@ -3083,11 +3088,6 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev,
+ continue;
+ }
+
+- if (!data->space_left &&
+- amdgpu_ras_realloc_eh_data_space(adev, data, 256)) {
+- return -ENOMEM;
+- }
+-
+ amdgpu_ras_reserve_page(adev, bps[j].retired_page);
+
+ memcpy(&data->bps[data->count], &(bps[j]),
+--
+2.51.0
+
--- /dev/null
+From 73f68920eff188d272a895fa46a81237a3bf8833 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 21:25:20 +0530
+Subject: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence
+ Update and Timeline Management v4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit bd8150a1b3370a9f7761c5814202a3fe5a79f44f ]
+
+This commit simplifies the amdgpu_gem_va_ioctl function, key updates
+include:
+ - Moved the logic for managing the last update fence directly into
+ amdgpu_gem_va_update_vm.
+ - Introduced checks for the timeline point to enable conditional
+ replacement or addition of fences.
+
+v2: Addressed review comments from Christian.
+v3: Updated comments (Christian).
+v4: The previous version selected the fence too early and did not manage its
+ reference correctly, which could lead to stale or freed fences being used.
+ This resulted in refcount underflows and could crash when updating GPU
+ timelines.
+ The fence is now chosen only after the VA mapping work is completed, and its
+ reference is taken safely. After exporting it to the VM timeline syncobj, the
+ driver always drops its local fence reference, ensuring balanced refcounting
+ and avoiding use-after-free on dma_fence.
+
+ Crash signature:
+ [ 205.828135] refcount_t: underflow; use-after-free.
+ [ 205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
+ ...
+ [ 206.074014] Call Trace:
+ [ 206.076488] <TASK>
+ [ 206.078608] amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu]
+ [ 206.084040] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]
+ [ 206.089994] drm_ioctl_kernel+0x86/0xe0 [drm]
+ [ 206.094415] drm_ioctl+0x26e/0x520 [drm]
+ [ 206.098424] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]
+ [ 206.104402] amdgpu_drm_ioctl+0x4b/0x80 [amdgpu]
+ [ 206.109387] __x64_sys_ioctl+0x96/0xe0
+ [ 206.113156] do_syscall_64+0x66/0x2d0
+ ...
+ [ 206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90
+ ...
+ [ 206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0
+ ...
+ [ 206.553405] Call Trace:
+ [ 206.553409] <IRQ>
+ [ 206.553415] ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched]
+ [ 206.553424] dma_fence_signal+0x30/0x60
+ [ 206.553427] drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched]
+ [ 206.553434] dma_fence_signal_timestamp_locked+0x6e/0xe0
+ [ 206.553437] dma_fence_signal+0x30/0x60
+ [ 206.553441] amdgpu_fence_process+0xd8/0x150 [amdgpu]
+ [ 206.553854] sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu]
+ [ 206.554353] edac_mce_amd(E) ee1004(E)
+ [ 206.554270] amdgpu_irq_dispatch+0x150/0x230 [amdgpu]
+ [ 206.554702] amdgpu_ih_process+0x6a/0x180 [amdgpu]
+ [ 206.555101] amdgpu_irq_handler+0x23/0x60 [amdgpu]
+ [ 206.555500] __handle_irq_event_percpu+0x4a/0x1c0
+ [ 206.555506] handle_irq_event+0x38/0x80
+ [ 206.555509] handle_edge_irq+0x92/0x1e0
+ [ 206.555513] __common_interrupt+0x3e/0xb0
+ [ 206.555519] common_interrupt+0x80/0xa0
+ [ 206.555525] </IRQ>
+ [ 206.555527] <TASK>
+ ...
+ [ 206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0
+ ...
+ [ 206.555667] Kernel panic - not syncing: Fatal exception in interrupt
+
+Link: https://patchwork.freedesktop.org/patch/654669/
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Suggested-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 135 ++++++++++++++----------
+ 1 file changed, 82 insertions(+), 53 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+index 5a93cbadc4f44..f30e32fbff99a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+@@ -112,47 +112,6 @@ amdgpu_gem_update_timeline_node(struct drm_file *filp,
+ return 0;
+ }
+
+-static void
+-amdgpu_gem_update_bo_mapping(struct drm_file *filp,
+- struct amdgpu_bo_va *bo_va,
+- uint32_t operation,
+- uint64_t point,
+- struct dma_fence *fence,
+- struct drm_syncobj *syncobj,
+- struct dma_fence_chain *chain)
+-{
+- struct amdgpu_bo *bo = bo_va ? bo_va->base.bo : NULL;
+- struct amdgpu_fpriv *fpriv = filp->driver_priv;
+- struct amdgpu_vm *vm = &fpriv->vm;
+- struct dma_fence *last_update;
+-
+- if (!syncobj)
+- return;
+-
+- /* Find the last update fence */
+- switch (operation) {
+- case AMDGPU_VA_OP_MAP:
+- case AMDGPU_VA_OP_REPLACE:
+- if (bo && (bo->tbo.base.resv == vm->root.bo->tbo.base.resv))
+- last_update = vm->last_update;
+- else
+- last_update = bo_va->last_pt_update;
+- break;
+- case AMDGPU_VA_OP_UNMAP:
+- case AMDGPU_VA_OP_CLEAR:
+- last_update = fence;
+- break;
+- default:
+- return;
+- }
+-
+- /* Add fence to timeline */
+- if (!point)
+- drm_syncobj_replace_fence(syncobj, last_update);
+- else
+- drm_syncobj_add_point(syncobj, chain, last_update, point);
+-}
+-
+ static vm_fault_t amdgpu_gem_fault(struct vm_fault *vmf)
+ {
+ struct ttm_buffer_object *bo = vmf->vma->vm_private_data;
+@@ -761,16 +720,19 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
+ struct amdgpu_bo_va *bo_va,
+ uint32_t operation)
+ {
+- struct dma_fence *fence = dma_fence_get_stub();
++ struct dma_fence *clear_fence = dma_fence_get_stub();
++ struct dma_fence *last_update = NULL;
+ int r;
+
+ if (!amdgpu_vm_ready(vm))
+- return fence;
++ return clear_fence;
+
+- r = amdgpu_vm_clear_freed(adev, vm, &fence);
++ /* First clear freed BOs and get a fence for that work, if any. */
++ r = amdgpu_vm_clear_freed(adev, vm, &clear_fence);
+ if (r)
+ goto error;
+
++ /* For MAP/REPLACE we also need to update the BO mappings. */
+ if (operation == AMDGPU_VA_OP_MAP ||
+ operation == AMDGPU_VA_OP_REPLACE) {
+ r = amdgpu_vm_bo_update(adev, bo_va, false);
+@@ -778,13 +740,59 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
+ goto error;
+ }
+
++ /* Always update PDEs after we touched the mappings. */
+ r = amdgpu_vm_update_pdes(adev, vm, false);
++ if (r)
++ goto error;
++
++ /*
++ * Decide which fence represents the "last update" for this VM/BO:
++ *
++ * - For MAP/REPLACE we want the PT update fence, which is tracked as
++ * either vm->last_update (for always-valid BOs) or bo_va->last_pt_update
++ * (for per-BO updates).
++ *
++ * - For UNMAP/CLEAR we rely on the fence returned by
++ * amdgpu_vm_clear_freed(), which already covers the page table work
++ * for the removed mappings.
++ */
++ switch (operation) {
++ case AMDGPU_VA_OP_MAP:
++ case AMDGPU_VA_OP_REPLACE:
++ if (bo_va && bo_va->base.bo) {
++ if (amdgpu_vm_is_bo_always_valid(vm, bo_va->base.bo)) {
++ if (vm->last_update)
++ last_update = dma_fence_get(vm->last_update);
++ } else {
++ if (bo_va->last_pt_update)
++ last_update = dma_fence_get(bo_va->last_pt_update);
++ }
++ }
++ break;
++ case AMDGPU_VA_OP_UNMAP:
++ case AMDGPU_VA_OP_CLEAR:
++ if (clear_fence)
++ last_update = dma_fence_get(clear_fence);
++ break;
++ default:
++ break;
++ }
+
+ error:
+ if (r && r != -ERESTARTSYS)
+ DRM_ERROR("Couldn't update BO_VA (%d)\n", r);
+
+- return fence;
++ /*
++ * If we managed to pick a more specific last-update fence, prefer it
++ * over the generic clear_fence and drop the extra reference to the
++ * latter.
++ */
++ if (last_update) {
++ dma_fence_put(clear_fence);
++ return last_update;
++ }
++
++ return clear_fence;
+ }
+
+ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+@@ -810,6 +818,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ uint64_t vm_size;
+ int r = 0;
+
++ /* Validate virtual address range against reserved regions. */
+ if (args->va_address < AMDGPU_VA_RESERVED_BOTTOM) {
+ dev_dbg(dev->dev,
+ "va_address 0x%llx is in reserved area 0x%llx\n",
+@@ -843,6 +852,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ return -EINVAL;
+ }
+
++ /* Validate operation type. */
+ switch (args->operation) {
+ case AMDGPU_VA_OP_MAP:
+ case AMDGPU_VA_OP_UNMAP:
+@@ -866,6 +876,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ abo = NULL;
+ }
+
++ /* Add input syncobj fences (if any) for synchronization. */
+ r = amdgpu_gem_add_input_fence(filp,
+ args->input_fence_syncobj_handles,
+ args->num_syncobj_handles);
+@@ -888,6 +899,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ goto error;
+ }
+
++ /* Resolve the BO-VA mapping for this VM/BO combination. */
+ if (abo) {
+ bo_va = amdgpu_vm_bo_find(&fpriv->vm, abo);
+ if (!bo_va) {
+@@ -900,6 +912,11 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ bo_va = NULL;
+ }
+
++ /*
++ * Prepare the timeline syncobj node if the user requested a VM
++ * timeline update. This only allocates/looks up the syncobj and
++ * chain node; the actual fence is attached later.
++ */
+ r = amdgpu_gem_update_timeline_node(filp,
+ args->vm_timeline_syncobj_out,
+ args->vm_timeline_point,
+@@ -931,18 +948,30 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ default:
+ break;
+ }
++
++ /*
++ * Once the VA operation is done, update the VM and obtain the fence
++ * that represents the last relevant update for this mapping. This
++ * fence can then be exported to the user-visible VM timeline.
++ */
+ if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE) && !adev->debug_vm) {
+ fence = amdgpu_gem_va_update_vm(adev, &fpriv->vm, bo_va,
+ args->operation);
+
+- if (timeline_syncobj)
+- amdgpu_gem_update_bo_mapping(filp, bo_va,
+- args->operation,
+- args->vm_timeline_point,
+- fence, timeline_syncobj,
+- timeline_chain);
+- else
+- dma_fence_put(fence);
++ if (timeline_syncobj && fence) {
++ if (!args->vm_timeline_point) {
++ /* Replace the existing fence when no point is given. */
++ drm_syncobj_replace_fence(timeline_syncobj,
++ fence);
++ } else {
++ /* Attach the last-update fence at a specific point. */
++ drm_syncobj_add_point(timeline_syncobj,
++ timeline_chain,
++ fence,
++ args->vm_timeline_point);
++ }
++ }
++ dma_fence_put(fence);
+
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a2f6e8219b703b029661397b81be9c154f0f23da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 17:32:00 +0800
+Subject: drm/amdgpu: return when ras table checksum is error
+
+From: Gangliang Xie <ganglxie@amd.com>
+
+[ Upstream commit 044f8d3b1fac6ac89c560f61415000e6bdab3a03 ]
+
+end the function flow when ras table checksum is error
+
+Signed-off-by: Gangliang Xie <ganglxie@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+index 64dd7a81bff5f..710a8fe79fccd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+@@ -1701,10 +1701,12 @@ int amdgpu_ras_eeprom_check(struct amdgpu_ras_eeprom_control *control)
+ }
+
+ res = __verify_ras_table_checksum(control);
+- if (res)
++ if (res) {
+ dev_err(adev->dev,
+ "RAS table incorrect checksum or error:%d\n",
+ res);
++ return -EINVAL;
++ }
+
+ /* Warn if we are at 90% of the threshold or above
+ */
+--
+2.51.0
+
--- /dev/null
+From 12df04c69ad4503bf235cfb06c18871cd11e69d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 15:16:27 +0800
+Subject: drm/amdgpu: Skip loading SDMA_RS64 in VF
+
+From: YuBiao Wang <YuBiao.Wang@amd.com>
+
+[ Upstream commit 39c21b81112321cbe1267b02c77ecd2161ce19aa ]
+
+VFs use the PF SDMA ucode and are unable to load SDMA_RS64.
+
+Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com>
+Signed-off-by: Victor Skvortsov <Victor.Skvortsov@amd.com>
+Reviewed-by: Gavin Wan <gavin.wan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index 47a6ce4fdc744..292e2706286a1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -1261,6 +1261,7 @@ bool amdgpu_virt_fw_load_skip_check(struct amdgpu_device *adev, uint32_t ucode_i
+ || ucode_id == AMDGPU_UCODE_ID_SDMA5
+ || ucode_id == AMDGPU_UCODE_ID_SDMA6
+ || ucode_id == AMDGPU_UCODE_ID_SDMA7
++ || ucode_id == AMDGPU_UCODE_ID_SDMA_RS64
+ || ucode_id == AMDGPU_UCODE_ID_RLC_G
+ || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL
+ || ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM
+--
+2.51.0
+
--- /dev/null
+From 77c574f7ad641dab57827a3889dfe5eeb7360558 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 12:11:49 +0530
+Subject: drm/amdgpu: Skip vcn poison irq release on VF
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 8980be03b3f9a4b58197ef95d3b37efa41a25331 ]
+
+VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid
+call trace during deinitialization.
+
+[ 71.913601] [drm] clean up the vf2pf work item
+[ 71.915088] ------------[ cut here ]------------
+[ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu]
+[ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd
+[ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu
+[ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014
+[ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu]
+[ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 <0f> 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00
+[ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246
+[ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000
+[ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000
+[ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000
+[ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
+[ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000
+[ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0
+[ 71.915800] PKRU: 55555554
+[ 71.915802] Call Trace:
+[ 71.915805] <TASK>
+[ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu]
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+index cebee453871c1..006a154511971 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+@@ -521,7 +521,9 @@ static int vcn_v2_5_hw_fini(struct amdgpu_ip_block *ip_block)
+ RREG32_SOC15(VCN, i, mmUVD_STATUS)))
+ vinst->set_pg_state(vinst, AMD_PG_STATE_GATE);
+
+- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
++ /* VF doesn't enable interrupt operations for RAS */
++ if (!amdgpu_sriov_vf(adev) &&
++ amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
+ amdgpu_irq_put(adev, &vinst->ras_poison_irq, 0);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a21721bd2214370239899c67524ebae4a4b1f2d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 11:35:57 +0800
+Subject: drm/amdgpu: validate user queue size constraints
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jesse.Zhang <Jesse.Zhang@amd.com>
+
+[ Upstream commit 8079b87c02e531cc91601f72ea8336dd2262fdf1 ]
+
+Add validation to ensure user queue sizes meet hardware requirements:
+- Size must be a power of two for efficient ring buffer wrapping
+- Size must be at least AMDGPU_GPU_PAGE_SIZE to prevent undersized allocations
+
+This prevents invalid configurations that could lead to GPU faults or
+unexpected behavior.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Jesse Zhang <jesse.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+index 58b26c78b6425..ab934723579c9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+@@ -860,6 +860,17 @@ static int amdgpu_userq_input_args_validate(struct drm_device *dev,
+ drm_file_err(filp, "invalidate userq queue va or size\n");
+ return -EINVAL;
+ }
++
++ if (!is_power_of_2(args->in.queue_size)) {
++ drm_file_err(filp, "Queue size must be a power of 2\n");
++ return -EINVAL;
++ }
++
++ if (args->in.queue_size < AMDGPU_GPU_PAGE_SIZE) {
++ drm_file_err(filp, "Queue size smaller than AMDGPU_GPU_PAGE_SIZE\n");
++ return -EINVAL;
++ }
++
+ if (!args->in.wptr_va || !args->in.rptr_va) {
+ drm_file_err(filp, "invalidate userq queue rptr or wptr\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From e9e9cf2760db5f7ca830ad6baf7bf5a8885a4a25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 19:36:56 +0530
+Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in
+ svm_migrate_gart_map()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ]
+
+In svm_migrate_gart_map(), while migrating GART mapping, the number of
+bytes copied for the GART table only accounts for CPU pages. On non-4K
+systems, each CPU page can contain multiple GPU pages, and the GART
+requires one 8-byte PTE per GPU page. As a result, an incorrect size was
+passed to the DMA, causing only a partial update of the GART table.
+
+Fix this function to work correctly on non-4K page-size systems by
+accounting for the number of GPU pages per CPU page when calculating the
+number of bytes to be copied.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index 6ada7b4af7c68..5086caac3fd06 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -61,7 +61,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, u64 npages,
+ *gart_addr = adev->gmc.gart_start;
+
+ num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8);
+- num_bytes = npages * 8;
++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE;
+
+ r = amdgpu_job_alloc_with_ib(adev, &adev->mman.high_pr,
+ AMDGPU_FENCE_OWNER_UNDEFINED,
+--
+2.51.0
+
--- /dev/null
+From 5e42b91d91eab91dc61b1cdc67527cc6d65f005a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:32:45 -0500
+Subject: drm/amdkfd: Handle GPU reset and drain retry fault race
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 5b57c3c3f22336e8fd5edb7f0fef3c7823f8eac1 ]
+
+Only check and drain IH1 ring if CAM is not enabled.
+
+If GPU is under reset, don't access IH to drain retry fault.
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 79ea138897fcf..a10cf8650c92b 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -33,6 +33,7 @@
+ #include "amdgpu_hmm.h"
+ #include "amdgpu.h"
+ #include "amdgpu_xgmi.h"
++#include "amdgpu_reset.h"
+ #include "kfd_priv.h"
+ #include "kfd_svm.h"
+ #include "kfd_migrate.h"
+@@ -2349,6 +2350,9 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms)
+
+ pr_debug("drain retry fault gpu %d svms %p\n", i, svms);
+
++ if (!down_read_trylock(&pdd->dev->adev->reset_domain->sem))
++ continue;
++
+ amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev,
+ pdd->dev->adev->irq.retry_cam_enabled ?
+ &pdd->dev->adev->irq.ih :
+@@ -2358,6 +2362,7 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms)
+ amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev,
+ &pdd->dev->adev->irq.ih_soft);
+
++ up_read(&pdd->dev->adev->reset_domain->sem);
+
+ pr_debug("drain retry fault gpu %d svms 0x%p done\n", i, svms);
+ }
+@@ -2541,7 +2546,7 @@ svm_range_unmap_from_cpu(struct mm_struct *mm, struct svm_range *prange,
+ adev = pdd->dev->adev;
+
+ /* Check and drain ih1 ring if cam not available */
+- if (adev->irq.ih1.ring_size) {
++ if (!adev->irq.retry_cam_enabled && adev->irq.ih1.ring_size) {
+ ih = &adev->irq.ih1;
+ checkpoint_wptr = amdgpu_ih_get_wptr(adev, ih);
+ if (ih->rptr != checkpoint_wptr) {
+--
+2.51.0
+
--- /dev/null
+From e982a7e5e041ee0301579fef00a21a7e5e1f44ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 19:36:54 +0530
+Subject: drm/amdkfd: Relax size checking during queue buffer get
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 42ea9cf2f16b7131cb7302acb3dac510968f8bdc ]
+
+HW-supported EOP buffer sizes are 4K and 32K. On systems that do not
+use 4K pages, the minimum buffer object (BO) allocation size is
+PAGE_SIZE (for example, 64K). During queue buffer acquisition, the driver
+currently checks the allocated BO size against the supported EOP buffer
+size. Since the allocated BO is larger than the expected size, this check
+fails, preventing queue creation.
+
+Relax the strict size validation and allow PAGE_SIZE-sized BOs to be used.
+Only the required 4K region of the buffer will be used as the EOP buffer
+and avoids queue creation failures on non-4K page systems.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Suggested-by: Philip Yang <yangp@amd.com>
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+index 80c4fa2b0975d..2822c90bd7be4 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+@@ -275,8 +275,8 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
+
+ /* EOP buffer is not required for all ASICs */
+ if (properties->eop_ring_buffer_address) {
+- if (properties->eop_ring_buffer_size != topo_dev->node_props.eop_buffer_size) {
+- pr_debug("queue eop bo size 0x%x not equal to node eop buf size 0x%x\n",
++ if (properties->eop_ring_buffer_size < topo_dev->node_props.eop_buffer_size) {
++ pr_debug("queue eop bo size 0x%x is less than node eop buf size 0x%x\n",
+ properties->eop_ring_buffer_size,
+ topo_dev->node_props.eop_buffer_size);
+ err = -EINVAL;
+@@ -284,7 +284,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
+ }
+ err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address,
+ &properties->eop_buf_bo,
+- properties->eop_ring_buffer_size);
++ ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE));
+ if (err)
+ goto out_err_unreserve;
+ }
+--
+2.51.0
+
--- /dev/null
+From 6a161b5aea0f137a604e04f7c043803fd68d0906 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 21:05:04 +0100
+Subject: drm/ast: Swap framebuffer writes on big-endian machines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 50c26c301c5176cc8b431044390e10ec862b9b77 ]
+
+Swap the pixel data when writing to framebuffer memory on big-endian
+machines. Fixes incorrect output. Aspeed graphics does not appear to
+support big-endian framebuffers after AST2400, although the feature
+has been documented.
+
+There's a lengthy discussion at [1].
+
+v5:
+- avoid restricted cast from __be16 (kernel test robot)
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Link: https://lore.kernel.org/dri-devel/20251202.170626.2134482663677806825.rene@exactco.de/ # [1]
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patch.msgid.link/20251212.210504.1355099120650239629.rene@exactco.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ast/ast_cursor.c | 11 ++++++++---
+ drivers/gpu/drm/ast/ast_mode.c | 11 +++++++++--
+ 2 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/ast/ast_cursor.c b/drivers/gpu/drm/ast/ast_cursor.c
+index 2d3ad7610c2e9..7da0a2d463e6c 100644
+--- a/drivers/gpu/drm/ast/ast_cursor.c
++++ b/drivers/gpu/drm/ast/ast_cursor.c
+@@ -92,12 +92,17 @@ static void ast_set_cursor_image(struct ast_device *ast, const u8 *src,
+ unsigned int width, unsigned int height)
+ {
+ u8 __iomem *dst = ast_plane_vaddr(&ast->cursor_plane.base);
+- u32 csum;
+-
+- csum = ast_cursor_calculate_checksum(src, width, height);
++ u32 csum = ast_cursor_calculate_checksum(src, width, height);
+
+ /* write pixel data */
++#if defined(__BIG_ENDIAN)
++ unsigned int i;
++
++ for (i = 0; i < AST_HWC_SIZE; i += 2)
++ writew(swab16(*(const __u16 *)&src[i]), &dst[i]);
++#else
+ memcpy_toio(dst, src, AST_HWC_SIZE);
++#endif
+
+ /* write checksum + signature */
+ dst += AST_HWC_SIZE;
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index cd08990a10f93..57c6fbc3232b0 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -526,12 +526,18 @@ static int ast_primary_plane_helper_atomic_check(struct drm_plane *plane,
+
+ static void ast_handle_damage(struct ast_plane *ast_plane, struct iosys_map *src,
+ struct drm_framebuffer *fb,
+- const struct drm_rect *clip)
++ const struct drm_rect *clip,
++ struct drm_format_conv_state *fmtcnv_state)
+ {
+ struct iosys_map dst = IOSYS_MAP_INIT_VADDR_IOMEM(ast_plane_vaddr(ast_plane));
+
+ iosys_map_incr(&dst, drm_fb_clip_offset(fb->pitches[0], fb->format, clip));
++
++#if defined(__BIG_ENDIAN)
++ drm_fb_swab(&dst, fb->pitches, src, fb, clip, !src[0].is_iomem, fmtcnv_state);
++#else
+ drm_fb_memcpy(&dst, fb->pitches, src, fb, clip);
++#endif
+ }
+
+ static void ast_primary_plane_helper_atomic_update(struct drm_plane *plane,
+@@ -561,7 +567,8 @@ static void ast_primary_plane_helper_atomic_update(struct drm_plane *plane,
+ if (drm_gem_fb_begin_cpu_access(fb, DMA_FROM_DEVICE) == 0) {
+ drm_atomic_helper_damage_iter_init(&iter, old_plane_state, plane_state);
+ drm_atomic_for_each_plane_damage(&iter, &damage) {
+- ast_handle_damage(ast_plane, shadow_plane_state->data, fb, &damage);
++ ast_handle_damage(ast_plane, shadow_plane_state->data, fb, &damage,
++ &shadow_plane_state->fmtcnv_state);
+ }
+
+ drm_gem_fb_end_cpu_access(fb, DMA_FROM_DEVICE);
+--
+2.51.0
+
--- /dev/null
+From 8a8aec063324a4fb4ade739692077dcf3d3cec68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 14:26:06 +0100
+Subject: drm/atmel-hlcdc: destroy properly the plane state in the reset
+ callback
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 81af99cbd9e4f238011af811d544fff75641fc25 ]
+
+If there is a plane state to destroy when doing a plane reset, destroy
+it using the atmel_hlcdc_plane_destroy_state() function. So we call
+__drm_atomic_helper_plane_destroy_state() and avoid code duplication.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-8-df837aba878f@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 52 +++++++++----------
+ 1 file changed, 26 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 92132be9823f1..0ffec44c6d317 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -1155,32 +1155,6 @@ static int atmel_hlcdc_plane_alloc_dscrs(struct drm_plane *p,
+ return -ENOMEM;
+ }
+
+-static void atmel_hlcdc_plane_reset(struct drm_plane *p)
+-{
+- struct atmel_hlcdc_plane_state *state;
+-
+- if (p->state) {
+- state = drm_plane_state_to_atmel_hlcdc_plane_state(p->state);
+-
+- if (state->base.fb)
+- drm_framebuffer_put(state->base.fb);
+-
+- kfree(state);
+- p->state = NULL;
+- }
+-
+- state = kzalloc(sizeof(*state), GFP_KERNEL);
+- if (state) {
+- if (atmel_hlcdc_plane_alloc_dscrs(p, state)) {
+- kfree(state);
+- drm_err(p->dev,
+- "Failed to allocate initial plane state\n");
+- return;
+- }
+- __drm_atomic_helper_plane_reset(p, &state->base);
+- }
+-}
+-
+ static struct drm_plane_state *
+ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
+ {
+@@ -1222,6 +1196,32 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
+ kfree(state);
+ }
+
++static void atmel_hlcdc_plane_reset(struct drm_plane *p)
++{
++ struct atmel_hlcdc_plane_state *state;
++ struct atmel_hlcdc_dc *dc = p->dev->dev_private;
++ struct atmel_hlcdc_plane *plane = drm_plane_to_atmel_hlcdc_plane(p);
++
++ if (p->state) {
++ atmel_hlcdc_plane_atomic_destroy_state(p, p->state);
++ p->state = NULL;
++ }
++
++ state = kzalloc(sizeof(*state), GFP_KERNEL);
++ if (state) {
++ if (atmel_hlcdc_plane_alloc_dscrs(p, state)) {
++ kfree(state);
++ drm_err(p->dev,
++ "Failed to allocate initial plane state\n");
++ return;
++ }
++ __drm_atomic_helper_plane_reset(p, &state->base);
++ }
++
++ if (plane->layer.desc->layout.csc)
++ dc->desc->ops->lcdc_csc_init(plane, plane->layer.desc);
++}
++
+ static const struct drm_plane_funcs layer_plane_funcs = {
+ .update_plane = drm_atomic_helper_update_plane,
+ .disable_plane = drm_atomic_helper_disable_plane,
+--
+2.51.0
+
--- /dev/null
+From 81bb504e8dd4a40f5c5b8c9a5e41493c6deaaf94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 11:38:25 +0100
+Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has
+ fractional parts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ]
+
+Don’t reject the commit when the source rectangle has fractional parts.
+This can occur due to scaling: drm_atomic_helper_check_plane_state() calls
+drm_rect_clip_scaled(), which may introduce fractional parts while
+computing the clipped source rectangle. This does not imply the commit is
+invalid, so we should accept it instead of discarding it.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index c0075894dc422..ec1fb5f9549a2 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -79,8 +79,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s)
+ return container_of(s, struct atmel_hlcdc_plane_state, base);
+ }
+
+-#define SUBPIXEL_MASK 0xffff
+-
+ static uint32_t rgb_formats[] = {
+ DRM_FORMAT_C8,
+ DRM_FORMAT_XRGB4444,
+@@ -745,24 +743,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p,
+ if (ret || !s->visible)
+ return ret;
+
+- hstate->src_x = s->src.x1;
+- hstate->src_y = s->src.y1;
+- hstate->src_w = drm_rect_width(&s->src);
+- hstate->src_h = drm_rect_height(&s->src);
++ hstate->src_x = s->src.x1 >> 16;
++ hstate->src_y = s->src.y1 >> 16;
++ hstate->src_w = drm_rect_width(&s->src) >> 16;
++ hstate->src_h = drm_rect_height(&s->src) >> 16;
+ hstate->crtc_x = s->dst.x1;
+ hstate->crtc_y = s->dst.y1;
+ hstate->crtc_w = drm_rect_width(&s->dst);
+ hstate->crtc_h = drm_rect_height(&s->dst);
+
+- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) &
+- SUBPIXEL_MASK)
+- return -EINVAL;
+-
+- hstate->src_x >>= 16;
+- hstate->src_y >>= 16;
+- hstate->src_w >>= 16;
+- hstate->src_h >>= 16;
+-
+ hstate->nplanes = fb->format->num_planes;
+ if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 129967d9e50eb5d5cc723589bcf3dff034569f42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:52 +0200
+Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state
+ callback
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ]
+
+After several commits, the slab memory increases. Some drm_crtc_commit
+objects are not freed. The atomic_destroy_state callback only put the
+framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
+to put all the objects that are no longer needed.
+
+It has been seen after hours of usage of a graphics application or using
+kmemleak:
+
+unreferenced object 0xc63a6580 (size 64):
+ comm "egt_basic", pid 171, jiffies 4294940784
+ hex dump (first 32 bytes):
+ 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.
+ 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.
+ backtrace (crc c25aa925):
+ kmemleak_alloc+0x34/0x3c
+ __kmalloc_cache_noprof+0x150/0x1a4
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 0ffec44c6d317..c0075894dc422 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -1190,8 +1190,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
+ state->dscrs[i]->self);
+ }
+
+- if (s->fb)
+- drm_framebuffer_put(s->fb);
++ __drm_atomic_helper_plane_destroy_state(s);
+
+ kfree(state);
+ }
+--
+2.51.0
+
--- /dev/null
+From f50291ff8477842a40ae53a8ebe14e8d9aff2747 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:53 +0200
+Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ]
+
+The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
+the atmel_hlcdc_plane state structure without properly duplicating the
+drm_plane_state. In particular, state->commit remained set to the old
+state commit, which can lead to a use-after-free in the next
+drm_atomic_commit() call.
+
+Fix this by calling
+__drm_atomic_helper_duplicate_plane_state(), which correctly clones
+the base drm_plane_state (including the ->commit pointer).
+
+It has been seen when closing and re-opening the device node while
+another DRM client (e.g. fbdev) is still attached:
+
+=============================================================================
+BUG kmalloc-64 (Not tainted): Poison overwritten
+-----------------------------------------------------------------------------
+
+0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b
+FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b
+Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0
+pid=29
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_framebuffer_remove+0x4cc/0x5a8
+ drm_mode_rmfb_work_fn+0x6c/0x80
+ process_one_work+0x12c/0x2cc
+ worker_thread+0x2a8/0x400
+ kthread+0xc0/0xdc
+ ret_from_fork+0x14/0x28
+Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0
+pid=169
+ drm_atomic_helper_commit_hw_done+0x100/0x150
+ drm_atomic_helper_commit_tail+0x64/0x8c
+ commit_tail+0x168/0x18c
+ drm_atomic_helper_commit+0x138/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0
+flags=0x200(workingset|zone=0)
+Object 0xc611b340 @offset=832 fp=0xc611b7c0
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index ec1fb5f9549a2..e55e88d44e829 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -1160,8 +1160,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
+ return NULL;
+ }
+
+- if (copy->base.fb)
+- drm_framebuffer_get(copy->base.fb);
++ __drm_atomic_helper_plane_duplicate_state(p, ©->base);
+
+ return ©->base;
+ }
+--
+2.51.0
+
--- /dev/null
+From dbb8a61a5d2d415631c92aee94b9b5abeba6838a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Dec 2025 14:37:28 -0300
+Subject: drm/panel-edp: Add AUO B140QAX01.H panel
+
+From: Val Packett <val@packett.cool>
+
+[ Upstream commit bcd752c706c357229185a330ab450b86236d9031 ]
+
+A 14-inch 2560x1600 60Hz matte touch panel, found on a Dell Latitude 7455
+laptop (second-source with BOE NE14QDM), according to online sources it's
+also found on the Latitude 7440 and some ASUS models.
+
+Raw EDID dump:
+
+00 ff ff ff ff ff ff 00 06 af a4 0b 00 00 00 00
+00 20 01 04 a5 1e 13 78 03 ad f5 a8 54 47 9c 24
+0e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
+01 01 01 01 01 01 f0 68 00 a0 a0 40 2e 60 30 20
+35 00 2d bc 10 00 00 1a f3 53 00 a0 a0 40 2e 60
+30 20 35 00 2d bc 10 00 00 1a 00 00 00 fe 00 36
+39 52 31 57 80 42 31 34 30 51 41 58 00 00 00 00
+00 02 41 21 a8 00 01 00 00 1a 41 0a 20 20 00 a1
+
+Don't have datasheet access, but the same timing as for other panels from
+the same manufacturer works fine.
+
+Signed-off-by: Val Packett <val@packett.cool>
+[dianders: Moved to the right location in the table]
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20251206173739.2222940-1-val@packett.cool
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 2c35970377431..85dd3f4cb8e1c 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1880,6 +1880,7 @@ static const struct panel_delay delay_80_500_e50_d50 = {
+ */
+ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x04a4, &delay_200_500_e50, "B122UAN01.0"),
++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x0ba4, &delay_200_500_e50, "B140QAX01.H"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x105c, &delay_200_500_e50, "B116XTN01.0"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x1062, &delay_200_500_e50, "B120XAN01.0"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x125c, &delay_200_500_e50, "Unknown"),
+--
+2.51.0
+
--- /dev/null
+From 2988d06c656392d7901b5648f8d43dd6c3f5ee09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 16:51:34 +0100
+Subject: drm/panel: edp: add BOE NV140WUM-T08 panel
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit 349d4efadc1f831ebc0b872ba1e3a2b7dd58b72b ]
+
+Add powerseq timing info for the BOE NV140WUM-T08 panel used on Lenovo
+Thinkpad T14s gen 6 (Snapdragon X1 Elite) laptops.
+
+edid-decode (hex):
+
+00 ff ff ff ff ff ff 00 09 e5 26 0c 00 00 00 00
+0a 21 01 04 a5 1e 13 78 03 d6 62 99 5e 5a 8e 27
+25 53 58 00 00 00 01 01 01 01 01 01 01 01 01 01
+01 01 01 01 01 01 33 3f 80 dc 70 b0 3c 40 30 20
+36 00 2e bc 10 00 00 1a 00 00 00 fd 00 28 3c 4c
+4c 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42
+4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fe
+00 4e 56 31 34 30 57 55 4d 2d 54 30 38 0a 00 fa
+
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20260105155134.83266-1-johannes.goede@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 85dd3f4cb8e1c..679f4af5246d8 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1730,6 +1730,12 @@ static const struct panel_delay delay_200_500_p2e100 = {
+ .prepare_to_enable = 100,
+ };
+
++static const struct panel_delay delay_200_500_p2e200 = {
++ .hpd_absent = 200,
++ .unprepare = 500,
++ .prepare_to_enable = 200,
++};
++
+ static const struct panel_delay delay_200_500_e50 = {
+ .hpd_absent = 200,
+ .unprepare = 500,
+@@ -1977,6 +1983,7 @@ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b56, &delay_200_500_e80, "NT140FHM-N47"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b66, &delay_200_500_e80, "NE140WUM-N6G"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c20, &delay_200_500_e80, "NT140FHM-N47"),
++ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c26, &delay_200_500_p2e200, "NV140WUM-T08"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c93, &delay_200_500_e200, "Unknown"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cb6, &delay_200_500_e200, "NT116WHM-N44"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cf2, &delay_200_500_e200, "NV156FHM-N4S"),
+--
+2.51.0
+
--- /dev/null
+From 602b6923533913bca7dde192a39876901ef36f71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 20:16:01 +0800
+Subject: drm/panel-edp: Add CSW MNE007QB3-1
+
+From: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
+
+[ Upstream commit b1ea3babb67dcb8b0881c2ab49dfba88b1445856 ]
+
+Add support for the CSW MNE007QB3-1, pleace the EDID here for
+subsequent reference.
+
+00 ff ff ff ff ff ff 00 0e 77 7c 14 00 00 00 00
+00 23 01 04 a5 1e 13 78 07 ee 95 a3 54 4c 99 26
+0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
+01 01 01 01 01 01 35 3c 80 a0 70 b0 23 40 30 20
+36 00 2d bc 10 00 00 18 2b 30 80 a0 70 b0 23 40
+30 20 36 00 2d bc 10 00 00 18 00 00 00 fd 00 28
+3c 4a 4a 0f 01 0a 20 20 20 20 20 20 00 00 00 fc
+00 4d 4e 45 30 30 37 51 42 33 2d 31 0a 20 01 5b
+
+70 20 79 02 00 21 00 1d c8 0b 5d 07 80 07 b0 04
+00 3d 8a 54 cd a4 99 66 62 0f 02 45 54 40 5e 40
+5e 00 44 12 78 2e 00 06 00 44 40 5e 40 5e 81 00
+20 74 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c
+00 00 00 00 8d 00 e3 05 04 00 e6 06 01 00 60 60
+ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 90
+
+Signed-off-by: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20251127121601.1608379-1-yelangyan@huaqin.corp-partner.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 415b894890ad7..023fbbb10eb4f 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -2033,6 +2033,7 @@ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1462, &delay_200_500_e50, "MNE007QS5-2"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1468, &delay_200_500_e50, "MNE007QB2-2"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x146e, &delay_80_500_e50_d50, "MNE007QB3-1"),
++ EDP_PANEL_ENTRY('C', 'S', 'W', 0x147c, &delay_200_500_e50_d100, "MNE007QB3-1"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1519, &delay_200_500_e80_d50, "MNF601BS1-3"),
+
+ EDP_PANEL_ENTRY('E', 'T', 'C', 0x0000, &delay_50_500_e200_d200_po2e335, "LP079QX1-SP0V"),
+--
+2.51.0
+
--- /dev/null
+From e62deb8ede4023a2f4b959b2475e6e4e61aae800 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 20:09:55 +0800
+Subject: drm/panel: Fix a possible null-pointer dereference in
+ jdi_panel_dsi_remove()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit 95eed73b871111123a8b1d31cb1fce7e902e49ea ]
+
+In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it
+may be NULL:
+
+ if (!jdi)
+ mipi_dsi_detach(dsi);
+
+However, when jdi is NULL, the function does not return and continues by
+calling jdi_panel_disable():
+
+ err = jdi_panel_disable(&jdi->base);
+
+Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can
+lead to a NULL-pointer dereference:
+
+ struct jdi_panel *jdi = to_panel_jdi(panel);
+ backlight_disable(jdi->backlight);
+
+To prevent such a potential NULL-pointer dereference, return early from
+jdi_panel_dsi_remove() when jdi is NULL.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patch.msgid.link/20251218120955.11185-1-islituo@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
+index 23462065d726b..ea975170fafff 100644
+--- a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
++++ b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
+@@ -434,8 +434,10 @@ static void jdi_panel_dsi_remove(struct mipi_dsi_device *dsi)
+ int err;
+
+ /* only detach from host for the DSI-LINK2 interface */
+- if (!jdi)
++ if (!jdi) {
+ mipi_dsi_detach(dsi);
++ return;
++ }
+
+ err = jdi_panel_disable(&jdi->base);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From 2b443a112df0cdaf9420e7c3186cab878d07f912 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 09:48:35 +0100
+Subject: drm/panthor: Always wait after sending a command to an AS
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+[ Upstream commit d2c6fde56d451ca48a5e03428535ce3dbc8fc910 ]
+
+There's currently no situation where we want to issue a command to an
+AS and not wait for this command to complete. The wait is either
+explicitly done (LOCK, UNLOCK) or it's missing (UPDATE). So let's
+turn write_cmd() into as_send_cmd_and_wait() that has the wait after
+a command is sent.
+
+v2:
+- New patch
+
+v3:
+- Collect R-b
+
+v4:
+- No changes
+
+Reviewed-by: Steven Price <steven.price@arm.com>
+Link: https://patch.msgid.link/20251128084841.3804658-2-boris.brezillon@collabora.com
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_mmu.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
+index 9194bad4b6196..c15d2a3906db9 100644
+--- a/drivers/gpu/drm/panthor/panthor_mmu.c
++++ b/drivers/gpu/drm/panthor/panthor_mmu.c
+@@ -510,27 +510,29 @@ static int wait_ready(struct panthor_device *ptdev, u32 as_nr)
+ return ret;
+ }
+
+-static int write_cmd(struct panthor_device *ptdev, u32 as_nr, u32 cmd)
++static int as_send_cmd_and_wait(struct panthor_device *ptdev, u32 as_nr, u32 cmd)
+ {
+ int status;
+
+ /* write AS_COMMAND when MMU is ready to accept another command */
+ status = wait_ready(ptdev, as_nr);
+- if (!status)
++ if (!status) {
+ gpu_write(ptdev, AS_COMMAND(as_nr), cmd);
++ status = wait_ready(ptdev, as_nr);
++ }
+
+ return status;
+ }
+
+-static void lock_region(struct panthor_device *ptdev, u32 as_nr,
+- u64 region_start, u64 size)
++static int lock_region(struct panthor_device *ptdev, u32 as_nr,
++ u64 region_start, u64 size)
+ {
+ u8 region_width;
+ u64 region;
+ u64 region_end = region_start + size;
+
+ if (!size)
+- return;
++ return 0;
+
+ /*
+ * The locked region is a naturally aligned power of 2 block encoded as
+@@ -553,7 +555,7 @@ static void lock_region(struct panthor_device *ptdev, u32 as_nr,
+
+ /* Lock the region that needs to be updated */
+ gpu_write64(ptdev, AS_LOCKADDR(as_nr), region);
+- write_cmd(ptdev, as_nr, AS_COMMAND_LOCK);
++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_LOCK);
+ }
+
+ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,
+@@ -586,9 +588,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,
+ * power it up
+ */
+
+- lock_region(ptdev, as_nr, iova, size);
+-
+- ret = wait_ready(ptdev, as_nr);
++ ret = lock_region(ptdev, as_nr, iova, size);
+ if (ret)
+ return ret;
+
+@@ -601,10 +601,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,
+ * at the end of the GPU_CONTROL cache flush command, unlike
+ * AS_COMMAND_FLUSH_MEM or AS_COMMAND_FLUSH_PT.
+ */
+- write_cmd(ptdev, as_nr, AS_COMMAND_UNLOCK);
+-
+- /* Wait for the unlock command to complete */
+- return wait_ready(ptdev, as_nr);
++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UNLOCK);
+ }
+
+ static int mmu_hw_do_operation(struct panthor_vm *vm,
+@@ -633,7 +630,7 @@ static int panthor_mmu_as_enable(struct panthor_device *ptdev, u32 as_nr,
+ gpu_write64(ptdev, AS_MEMATTR(as_nr), memattr);
+ gpu_write64(ptdev, AS_TRANSCFG(as_nr), transcfg);
+
+- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE);
++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE);
+ }
+
+ static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr)
+@@ -648,7 +645,7 @@ static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr)
+ gpu_write64(ptdev, AS_MEMATTR(as_nr), 0);
+ gpu_write64(ptdev, AS_TRANSCFG(as_nr), AS_TRANSCFG_ADRMODE_UNMAPPED);
+
+- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE);
++ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE);
+ }
+
+ static u32 panthor_mmu_fault_mask(struct panthor_device *ptdev, u32 value)
+--
+2.51.0
+
--- /dev/null
+From 2b6328693e408ad1d16182cceec48ca871f78d70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:26:00 +0000
+Subject: drm/radeon: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for radeon.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 9deb91970d4df..f12227145ef08 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2925,6 +2925,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((rdev->pdev->device == 0x666f) &&
++ (rdev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (rdev->family == CHIP_OLAND) {
+ if ((rdev->pdev->revision == 0xC7) ||
+ (rdev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From c0a76ce48ffe333a7db358a11a3706b7f1865a81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 10:43:18 -0500
+Subject: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for
+ some panels
+
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+
+[ Upstream commit 64aa8b3a60a825134f7d866adf05c024bbe0c24c ]
+
+Since commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L")
+we may get the following kernel panic, for some panels, when rebooting:
+
+ systemd-shutdown[1]: Rebooting.
+ Call trace:
+ ...
+ do_serror+0x28/0x68
+ el1h_64_error_handler+0x34/0x50
+ el1h_64_error+0x6c/0x70
+ rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)
+ mipi_dsi_device_transfer+0x44/0x58
+ mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4
+ ili9881c_unprepare+0x38/0x88
+ drm_panel_unprepare+0xbc/0x108
+
+This happens for panels that need to send MIPI-DSI commands in their
+unprepare() callback. Since the MIPI-DSI interface is stopped at that
+point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.
+
+Fix by moving rzg2l_mipi_dsi_stop() to new callback function
+rzg2l_mipi_dsi_atomic_post_disable().
+
+With this change we now have the correct power-down/stop sequence:
+
+ systemd-shutdown[1]: Rebooting.
+ rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry
+ ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry
+ rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry
+ reboot: Restarting system
+
+Suggested-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Tested-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20260112154333.655352-1-hugo@hugovil.com
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
+index 3b52dfc0ea1e0..b164e3a62cc2f 100644
+--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
+@@ -646,6 +646,13 @@ static void rzg2l_mipi_dsi_atomic_disable(struct drm_bridge *bridge,
+
+ rzg2l_mipi_dsi_stop_video(dsi);
+ rzg2l_mipi_dsi_stop_hs_clock(dsi);
++}
++
++static void rzg2l_mipi_dsi_atomic_post_disable(struct drm_bridge *bridge,
++ struct drm_atomic_state *state)
++{
++ struct rzg2l_mipi_dsi *dsi = bridge_to_rzg2l_mipi_dsi(bridge);
++
+ rzg2l_mipi_dsi_stop(dsi);
+ }
+
+@@ -681,6 +688,7 @@ static const struct drm_bridge_funcs rzg2l_mipi_dsi_bridge_ops = {
+ .atomic_pre_enable = rzg2l_mipi_dsi_atomic_pre_enable,
+ .atomic_enable = rzg2l_mipi_dsi_atomic_enable,
+ .atomic_disable = rzg2l_mipi_dsi_atomic_disable,
++ .atomic_post_disable = rzg2l_mipi_dsi_atomic_post_disable,
+ .mode_valid = rzg2l_mipi_dsi_bridge_mode_valid,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 142b8a9ba4ef15c7c9050962325d550ea78bff95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 21:03:23 +0800
+Subject: drm/v3d: Set DMA segment size to avoid debug warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ]
+
+When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
+kernel occasionally reports a segment size mismatch. This is because
+'max_seg_size' is not set. The kernel defaults to 64K. setting
+'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
+from complaining about the over-mapping of the V3D segment length.
+
+DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device
+ claims to support [len=8290304] [max=65536]
+WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388
+CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1
+Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : debug_dma_map_sg+0x330/0x388
+lr : debug_dma_map_sg+0x330/0x388
+sp : ffff8000829a3ac0
+x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000
+x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000
+x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002
+x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff
+x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573
+x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000
+x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c
+x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001
+x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280
+Call trace:
+ debug_dma_map_sg+0x330/0x388
+ __dma_map_sg_attrs+0xc0/0x278
+ dma_map_sgtable+0x30/0x58
+ drm_gem_shmem_get_pages_sgt+0xb4/0x140
+ v3d_bo_create_finish+0x28/0x130 [v3d]
+ v3d_create_bo_ioctl+0x54/0x180 [v3d]
+ drm_ioctl_kernel+0xc8/0x140
+ drm_ioctl+0x2d4/0x4d8
+
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
+index e8a46c8bad8a2..f469de456f9bb 100644
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -378,6 +378,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ if (ret)
+ goto clk_disable;
+
++ dma_set_max_seg_size(&pdev->dev, UINT_MAX);
++
+ v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH);
+
+ ident1 = V3D_READ(V3D_HUB_IDENT1);
+--
+2.51.0
+
--- /dev/null
+From 95314ab60c79deb1cfab0cff2fd9e3c2893ccf56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 17:25:02 -0800
+Subject: drm/xe: Covert return of -EBUSY to -ENOMEM in VM bind IOCTL
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit 6028f59620927aee2e15a424004012ae05c50684 ]
+
+xe_vma_userptr_pin_pages can return -EBUSY but -EBUSY has special
+meaning in VM bind IOCTLs that user fence is pending that is attached to
+the VMA. Convert -EBUSY to -ENOMEM in this case as -EBUSY in practice
+means we are low or out of memory.
+
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+Link: https://patch.msgid.link/20251122012502.382587-2-matthew.brost@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_vm.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
+index 095bb197e8b05..9781209dd26ed 100644
+--- a/drivers/gpu/drm/xe/xe_vm.c
++++ b/drivers/gpu/drm/xe/xe_vm.c
+@@ -2451,8 +2451,17 @@ static struct xe_vma *new_vma(struct xe_vm *vm, struct drm_gpuva_op_map *op,
+ if (IS_ERR(vma))
+ return vma;
+
+- if (xe_vma_is_userptr(vma))
++ if (xe_vma_is_userptr(vma)) {
+ err = xe_vma_userptr_pin_pages(to_userptr_vma(vma));
++ /*
++ * -EBUSY has dedicated meaning that a user fence
++ * attached to the VMA is busy, in practice
++ * xe_vma_userptr_pin_pages can only fail with -EBUSY if
++ * we are low on memory so convert this to -ENOMEM.
++ */
++ if (err == -EBUSY)
++ err = -ENOMEM;
++ }
+ }
+ if (err) {
+ prep_vma_destroy(vm, vma, false);
+--
+2.51.0
+
--- /dev/null
+From e9142af165af6c86b011792c1dd8be2c351313d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Nov 2025 08:44:01 -0800
+Subject: drm/xe/ggtt: Use scope-based runtime pm
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit 8a579f4b2476fd1df07e2bca9fedc82a39a56a65 ]
+
+Switch the GGTT code to scope-based runtime PM for consistency with
+other parts of the driver.
+
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://patch.msgid.link/20251118164338.3572146-51-matthew.d.roper@intel.com
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_ggtt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_ggtt.c b/drivers/gpu/drm/xe/xe_ggtt.c
+index 793d7324a395d..9e6b4e9835424 100644
+--- a/drivers/gpu/drm/xe/xe_ggtt.c
++++ b/drivers/gpu/drm/xe/xe_ggtt.c
+@@ -396,9 +396,8 @@ static void ggtt_node_remove_work_func(struct work_struct *work)
+ delayed_removal_work);
+ struct xe_device *xe = tile_to_xe(node->ggtt->tile);
+
+- xe_pm_runtime_get(xe);
++ guard(xe_pm_runtime)(xe);
+ ggtt_node_remove(node);
+- xe_pm_runtime_put(xe);
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From f1ff2b1b4211aec4cabb01cefe23b1cbc951e150 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 17:27:35 -0800
+Subject: drm/xe: Only toggle scheduling in TDR if GuC is running
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit dd1ef5e2456558876244795bb22a4d90cb24f160 ]
+
+If the firmware is not running during TDR (e.g., when the driver is
+unloading), there's no need to toggle scheduling in the GuC. In such
+cases, skip this step.
+
+v4:
+ - Bail on wait UC not running (Niranjana)
+
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
+Link: https://patch.msgid.link/20260110012739.2888434-4-matthew.brost@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_submit.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index f6ba2b0f074d2..ced13f17fb720 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1304,7 +1304,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
+ if (exec_queue_reset(q))
+ err = -EIO;
+
+- if (!exec_queue_destroyed(q)) {
++ if (!exec_queue_destroyed(q) && xe_uc_fw_is_running(&guc->fw)) {
+ /*
+ * Wait for any pending G2H to flush out before
+ * modifying state
+@@ -1339,6 +1339,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
+ */
+ smp_rmb();
+ ret = wait_event_timeout(guc->ct.wq,
++ !xe_uc_fw_is_running(&guc->fw) ||
+ !exec_queue_pending_disable(q) ||
+ xe_guc_read_stopped(guc) ||
+ vf_recovery(guc), HZ * 5);
+--
+2.51.0
+
--- /dev/null
+From a7549fff630f0fac877f933ef638339dd1efe31c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 13:26:28 +0530
+Subject: drm/xe/vm: Skip ufence association for CPU address mirror VMA during
+ MAP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+
+[ Upstream commit 7f08cc5b3cc3bf6416f8b55bff906f67ed75637d ]
+
+The MAP operation for a CPU address mirror VMA does not require ufence
+association because such mappings are not GPU-synchronized and do not
+participate in GPU job completion signaling.
+
+Remove the unnecessary ufence addition for this case to avoid -EBUSY
+failure in check_ufence of unbind ops.
+
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20251125075628.1182481-6-himal.prasad.ghimiray@intel.com
+Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_vm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
+index 9781209dd26ed..612fc5b2539cd 100644
+--- a/drivers/gpu/drm/xe/xe_vm.c
++++ b/drivers/gpu/drm/xe/xe_vm.c
+@@ -3223,7 +3223,8 @@ static void op_add_ufence(struct xe_vm *vm, struct xe_vma_op *op,
+ {
+ switch (op->base.op) {
+ case DRM_GPUVA_OP_MAP:
+- vma_add_ufence(op->map.vma, ufence);
++ if (!xe_vma_is_cpu_addr_mirror(op->map.vma))
++ vma_add_ufence(op->map.vma, ufence);
+ break;
+ case DRM_GPUVA_OP_REMAP:
+ if (op->remap.prev)
+--
+2.51.0
+
--- /dev/null
+From 4d4919d06d3d7c767e91b607a3d66b7f9d425d43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 15:38:23 +0530
+Subject: drm/xe/xe3_lpg: Apply Wa_16028005424
+
+From: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
+
+[ Upstream commit 9d94c1cf6ef938abd4b849b66f8eab11e3c537ef ]
+
+Applied Wa_16028005424 to Graphics version from 30.00 to 30.05
+
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
+Link: https://patch.msgid.link/20251121100822.20076-2-balasubramani.vivekanandan@intel.com
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/regs/xe_guc_regs.h | 3 +++
+ drivers/gpu/drm/xe/xe_wa.c | 5 +++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/regs/xe_guc_regs.h b/drivers/gpu/drm/xe/regs/xe_guc_regs.h
+index 2118f7dec287f..87984713dd126 100644
+--- a/drivers/gpu/drm/xe/regs/xe_guc_regs.h
++++ b/drivers/gpu/drm/xe/regs/xe_guc_regs.h
+@@ -90,6 +90,9 @@
+ #define GUC_SEND_INTERRUPT XE_REG(0xc4c8)
+ #define GUC_SEND_TRIGGER REG_BIT(0)
+
++#define GUC_INTR_CHICKEN XE_REG(0xc50c)
++#define DISABLE_SIGNALING_ENGINES REG_BIT(1)
++
+ #define GUC_BCS_RCS_IER XE_REG(0xc550)
+ #define GUC_VCS2_VCS1_IER XE_REG(0xc554)
+ #define GUC_WD_VECS_IER XE_REG(0xc558)
+diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c
+index c7eab0c4af7a8..68238e73015b7 100644
+--- a/drivers/gpu/drm/xe/xe_wa.c
++++ b/drivers/gpu/drm/xe/xe_wa.c
+@@ -15,6 +15,7 @@
+
+ #include "regs/xe_engine_regs.h"
+ #include "regs/xe_gt_regs.h"
++#include "regs/xe_guc_regs.h"
+ #include "regs/xe_regs.h"
+ #include "xe_device_types.h"
+ #include "xe_force_wake.h"
+@@ -315,6 +316,10 @@ static const struct xe_rtp_entry_sr gt_was[] = {
+ XE_RTP_ACTIONS(SET(VDBOX_CGCTL3F10(0), RAMDFTUNIT_CLKGATE_DIS)),
+ XE_RTP_ENTRY_FLAG(FOREACH_ENGINE),
+ },
++ { XE_RTP_NAME("16028005424"),
++ XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3005)),
++ XE_RTP_ACTIONS(SET(GUC_INTR_CHICKEN, DISABLE_SIGNALING_ENGINES))
++ },
+ };
+
+ static const struct xe_rtp_entry_sr engine_was[] = {
+--
+2.51.0
+
--- /dev/null
+From 6c746b87eb8a296a0eabeeeee7f7a1c299a8f275 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 21:15:37 +0800
+Subject: EDAC/igen6: Add more Intel Panther Lake-H SoCs support
+
+From: Lili Li <lili.li@intel.com>
+
+[ Upstream commit 4c36e6106997b6ad8f4a279b4bdbca3ed6f53c6c ]
+
+Add more Intel Panther Lake-H SoC compute die IDs for EDAC support.
+
+Signed-off-by: Lili Li <lili.li@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Reviewed-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Link: https://patch.msgid.link/20251124131537.3633983-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/igen6_edac.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c
+index 553c31a2d9226..839b6dd3629e9 100644
+--- a/drivers/edac/igen6_edac.c
++++ b/drivers/edac/igen6_edac.c
+@@ -274,6 +274,16 @@ static struct work_struct ecclog_work;
+ #define DID_PTL_H_SKU1 0xb000
+ #define DID_PTL_H_SKU2 0xb001
+ #define DID_PTL_H_SKU3 0xb002
++#define DID_PTL_H_SKU4 0xb003
++#define DID_PTL_H_SKU5 0xb004
++#define DID_PTL_H_SKU6 0xb005
++#define DID_PTL_H_SKU7 0xb008
++#define DID_PTL_H_SKU8 0xb011
++#define DID_PTL_H_SKU9 0xb014
++#define DID_PTL_H_SKU10 0xb015
++#define DID_PTL_H_SKU11 0xb028
++#define DID_PTL_H_SKU12 0xb029
++#define DID_PTL_H_SKU13 0xb02a
+
+ /* Compute die IDs for Wildcat Lake with IBECC */
+ #define DID_WCL_SKU1 0xfd00
+@@ -636,6 +646,16 @@ static struct pci_device_id igen6_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU1), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU2), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU3), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU4), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU5), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU6), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU7), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU8), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU9), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU10), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU11), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU12), (kernel_ulong_t)&mtl_p_cfg },
++ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU13), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_WCL_SKU1), (kernel_ulong_t)&wcl_cfg },
+ { },
+ };
+--
+2.51.0
+
--- /dev/null
+From c0b0f3016f8d26c48a9b22cec47cddb8a9633103 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 14:54:56 +0800
+Subject: EDAC/igen6: Add two Intel Amston Lake SoCs support
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 41ca2155d62b0b0d217f59e1bce18362d0c2446f ]
+
+Intel Amston Lake SoCs with IBECC (In-Band ECC) capability share the same
+IBECC registers as Alder Lake-N SoCs. Add two new compute die IDs for
+Amston Lake SoC products to enable EDAC support.
+
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Jianfeng Gao <jianfeng.gao@intel.com>
+Link: https://patch.msgid.link/20251124065457.3630949-2-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/igen6_edac.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c
+index 839b6dd3629e9..f2c9270c1893c 100644
+--- a/drivers/edac/igen6_edac.c
++++ b/drivers/edac/igen6_edac.c
+@@ -246,6 +246,8 @@ static struct work_struct ecclog_work;
+
+ /* Compute did IDs for Amston Lake with IBECC */
+ #define DID_ASL_SKU1 0x464a
++#define DID_ASL_SKU2 0x4646
++#define DID_ASL_SKU3 0x4652
+
+ /* Compute die IDs for Raptor Lake-P with IBECC */
+ #define DID_RPL_P_SKU1 0xa706
+@@ -628,6 +630,8 @@ static struct pci_device_id igen6_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, DID_ADL_N_SKU12), (kernel_ulong_t)&adl_n_cfg },
+ { PCI_VDEVICE(INTEL, DID_AZB_SKU1), (kernel_ulong_t)&adl_n_cfg },
+ { PCI_VDEVICE(INTEL, DID_ASL_SKU1), (kernel_ulong_t)&adl_n_cfg },
++ { PCI_VDEVICE(INTEL, DID_ASL_SKU2), (kernel_ulong_t)&adl_n_cfg },
++ { PCI_VDEVICE(INTEL, DID_ASL_SKU3), (kernel_ulong_t)&adl_n_cfg },
+ { PCI_VDEVICE(INTEL, DID_RPL_P_SKU1), (kernel_ulong_t)&rpl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_RPL_P_SKU2), (kernel_ulong_t)&rpl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_RPL_P_SKU3), (kernel_ulong_t)&rpl_p_cfg },
+--
+2.51.0
+
--- /dev/null
+From 358c253a97e05a0d1c96510580e9003e92c3f7d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:06 +0100
+Subject: EFI/CPER: don't dump the entire memory region
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ]
+
+The current logic at cper_print_fw_err() doesn't check if the
+error record length is big enough to handle offset. On a bad firmware,
+if the ofset is above the actual record, length -= offset will
+underflow, making it dump the entire memory.
+
+The end result can be:
+
+ - the logic taking a lot of time dumping large regions of memory;
+ - data disclosure due to the memory dumps;
+ - an OOPS, if it tries to dump an unmapped memory region.
+
+Fix it by checking if the section length is too small before doing
+a hex dump.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index bd99802cb0cad..09a4f0168df80 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -560,6 +560,11 @@ static void cper_print_fw_err(const char *pfx,
+ } else {
+ offset = sizeof(*fw_err);
+ }
++ if (offset > length) {
++ printk("%s""error section length is too small: offset=%d, length=%d\n",
++ pfx, offset, length);
++ return;
++ }
+
+ buf += offset;
+ length -= offset;
+--
+2.51.0
+
--- /dev/null
+From 905f3b6d77c3277553c2c8611f0628bccaff6522 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:04 +0100
+Subject: EFI/CPER: don't go past the ARM processor CPER record buffer
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ]
+
+There's a logic inside GHES/CPER to detect if the section_length
+is too small, but it doesn't detect if it is too big.
+
+Currently, if the firmware receives an ARM processor CPER record
+stating that a section length is big, kernel will blindly trust
+section_length, producing a very long dump. For instance, a 67
+bytes record with ERR_INFO_NUM set 46198 and section length
+set to 854918320 would dump a lot of data going a way past the
+firmware memory-mapped area.
+
+Fix it by adding a logic to prevent it to go past the buffer
+if ERR_INFO_NUM is too big, making it report instead:
+
+ [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+ [Hardware Error]: event severity: recoverable
+ [Hardware Error]: Error 0, type: recoverable
+ [Hardware Error]: section_type: ARM processor error
+ [Hardware Error]: MIDR: 0xff304b2f8476870a
+ [Hardware Error]: section length: 854918320, CPER size: 67
+ [Hardware Error]: section length is too big
+ [Hardware Error]: firmware-generated error record is incorrect
+ [Hardware Error]: ERR_INFO_NUM is 46198
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject and changelog tweaks ]
+Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper-arm.c | 12 ++++++++----
+ drivers/firmware/efi/cper.c | 3 ++-
+ include/linux/cper.h | 3 ++-
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
+index 76542a53e2027..b21cb1232d820 100644
+--- a/drivers/firmware/efi/cper-arm.c
++++ b/drivers/firmware/efi/cper-arm.c
+@@ -226,7 +226,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
+ }
+
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc)
++ const struct cper_sec_proc_arm *proc,
++ u32 length)
+ {
+ int i, len, max_ctx_type;
+ struct cper_arm_err_info *err_info;
+@@ -238,9 +239,12 @@ void cper_print_proc_arm(const char *pfx,
+
+ len = proc->section_length - (sizeof(*proc) +
+ proc->err_info_num * (sizeof(*err_info)));
+- if (len < 0) {
+- printk("%ssection length: %d\n", pfx, proc->section_length);
+- printk("%ssection length is too small\n", pfx);
++
++ if (len < 0 || proc->section_length > length) {
++ printk("%ssection length: %d, CPER size: %d\n",
++ pfx, proc->section_length, length);
++ printk("%ssection length is too %s\n", pfx,
++ (len < 0) ? "small" : "big");
+ printk("%sfirmware-generated error record is incorrect\n", pfx);
+ printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num);
+ return;
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 09a4f0168df80..06b4fdb59917a 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -664,7 +664,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata
+
+ printk("%ssection_type: ARM processor error\n", newpfx);
+ if (gdata->error_data_length >= sizeof(*arm_err))
+- cper_print_proc_arm(newpfx, arm_err);
++ cper_print_proc_arm(newpfx, arm_err,
++ gdata->error_data_length);
+ else
+ goto err_section_too_small;
+ #endif
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index 5b1236d8c65bb..440b35e459e53 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -595,7 +595,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *,
+ const char *cper_mem_err_unpack(struct trace_seq *,
+ struct cper_mem_err_compact *);
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc);
++ const struct cper_sec_proc_arm *proc,
++ u32 length);
+ void cper_print_proc_ia(const char *pfx,
+ const struct cper_sec_proc_ia *proc);
+ int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg);
+--
+2.51.0
+
--- /dev/null
+From 60c92601fddbcc97c070556020c177cafbe321ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:41 +0800
+Subject: ext4: mark group add fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ]
+
+Fast commits only log operations that have dedicated replay support.
+Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group
+descriptor metadata without going through the fast commit tracking
+paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+ext4_ioctl_group_add() adds new block groups.
+This forces those transactions to fall back to a full commit,
+ensuring that the filesystem geometry updates are captured by the
+normal journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_ADD safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted
+ filesystem and checked the resize ineligible reason:
+ ./group_add_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows "Resize": > 0.
+3. Fsynced a file on the resized filesystem and verified that the fast
+ commit stats report at least one ineligible commit:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+ shows fc stats ineligible > 0.
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 7ce0fc40aec2f..5109b005e0286 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -966,6 +966,7 @@ static long ext4_ioctl_group_add(struct file *file,
+
+ err = ext4_group_add(sb, input);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From 8256b200b302f1922b63fd1b65db529f69ff986f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:42 +0800
+Subject: ext4: mark group extend fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ]
+
+Fast commits only log operations that have dedicated replay support.
+EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last
+block group and updates the same on-disk metadata without going
+through the fast commit tracking paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+EXT4_IOC_GROUP_EXTEND grows the filesystem.
+This forces those transactions to fall back to a full commit,
+ensuring that the group extension changes are captured by the normal
+journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_EXTEND safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Extended the filesystem to the end of the last block group using a
+ helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem
+ and checked fc_info:
+ ./group_extend_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows the "Resize" ineligible reason increased.
+3. Fsynced a file on the resized filesystem and confirmed that the fast
+ commit ineligible counter incremented for the resize transaction:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 5109b005e0286..e5e197ac7d88b 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1612,6 +1612,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+
+ err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE,
++ NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From 1f2480c1a4893345624cbbf73869099f73e94b4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 21:31:16 +0800
+Subject: ext4: move ext4_percpu_param_init() before ext4_mb_init()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 270564513489d98b721a1e4a10017978d5213bff ]
+
+When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the
+`DOUBLE_CHECK` macro defined, the following panic is triggered:
+
+==================================================================
+EXT4-fs error (device vdc): ext4_validate_block_bitmap:423:
+ comm mount: bg 0: bad block bitmap checksum
+BUG: unable to handle page fault for address: ff110000fa2cc000
+PGD 3e01067 P4D 3e02067 PUD 0
+Oops: Oops: 0000 [#1] SMP NOPTI
+CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W
+ 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none)
+RIP: 0010:percpu_counter_add_batch+0x13/0xa0
+Call Trace:
+ <TASK>
+ ext4_mark_group_bitmap_corrupted+0xcb/0xe0
+ ext4_validate_block_bitmap+0x2a1/0x2f0
+ ext4_read_block_bitmap+0x33/0x50
+ mb_group_bb_bitmap_alloc+0x33/0x80
+ ext4_mb_add_groupinfo+0x190/0x250
+ ext4_mb_init_backend+0x87/0x290
+ ext4_mb_init+0x456/0x640
+ __ext4_fill_super+0x1072/0x1680
+ ext4_fill_super+0xd3/0x280
+ get_tree_bdev_flags+0x132/0x1d0
+ vfs_get_tree+0x29/0xd0
+ vfs_cmd_create+0x59/0xe0
+ __do_sys_fsconfig+0x4f6/0x6b0
+ do_syscall_64+0x50/0x1f0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+==================================================================
+
+This issue can be reproduced using the following commands:
+ mkfs.ext4 -F -q -b 1024 /dev/sda 5G
+ tune2fs -O quota,project /dev/sda
+ mount /dev/sda /tmp/test
+
+With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads
+and validates the block bitmap. When the validation fails,
+ext4_mark_group_bitmap_corrupted() attempts to update
+sbi->s_freeclusters_counter. However, this percpu_counter has not been
+initialized yet at this point, which leads to the panic described above.
+
+Fix this by moving the execution of ext4_percpu_param_init() to occur
+before ext4_mb_init(), ensuring the per-CPU counters are initialized
+before they are used.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 87205660c5d02..5c2e931d8a533 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5604,6 +5604,10 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ clear_opt2(sb, MB_OPTIMIZE_SCAN);
+ }
+
++ err = ext4_percpu_param_init(sbi);
++ if (err)
++ goto failed_mount5;
++
+ err = ext4_mb_init(sb);
+ if (err) {
+ ext4_msg(sb, KERN_ERR, "failed to initialize mballoc (%d)",
+@@ -5619,10 +5623,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ sbi->s_journal->j_commit_callback =
+ ext4_journal_commit_callback;
+
+- err = ext4_percpu_param_init(sbi);
+- if (err)
+- goto failed_mount6;
+-
+ if (ext4_has_feature_flex_bg(sb))
+ if (!ext4_fill_flex_info(sb)) {
+ ext4_msg(sb, KERN_ERR,
+@@ -5704,8 +5704,8 @@ failed_mount8: __maybe_unused
+ failed_mount6:
+ ext4_mb_release(sb);
+ ext4_flex_groups_free(sbi);
+- ext4_percpu_param_destroy(sbi);
+ failed_mount5:
++ ext4_percpu_param_destroy(sbi);
+ ext4_ext_release(sb);
+ ext4_release_system_zone(sb);
+ failed_mount4a:
+--
+2.51.0
+
--- /dev/null
+From 03a448026d82bd6a7ee0944e5b1b32f2a4f2f7f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 11:55:35 +0530
+Subject: ext4: propagate flags to convert_initialized_extent()
+
+From: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+
+[ Upstream commit 3fffa44b6ebf65be92a562a5063303979385a1c9 ]
+
+Currently, ext4_zero_range passes EXT4_EX_NOCACHE flag to avoid caching
+extents however this is not respected by convert_initialized_extent().
+Hence, modify it to accept flags from the caller and to pass the flags
+on to other extent manipulation functions it calls. This makes
+sure the NOCACHE flag is respected throughout the code path.
+
+Also, we no longer explicitly pass CONVERT_UNWRITTEN as the caller takes
+care of this.
+
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Link: https://patch.msgid.link/07008fbb14db727fddcaf4c30e2346c49f6c8fe0.1769149131.git.ojaswin@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 418c4351ef40c..986e85902d06a 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3857,6 +3857,7 @@ static struct ext4_ext_path *
+ convert_initialized_extent(handle_t *handle, struct inode *inode,
+ struct ext4_map_blocks *map,
+ struct ext4_ext_path *path,
++ int flags,
+ unsigned int *allocated)
+ {
+ struct ext4_extent *ex;
+@@ -3882,11 +3883,11 @@ convert_initialized_extent(handle_t *handle, struct inode *inode,
+
+ if (ee_block != map->m_lblk || ee_len > map->m_len) {
+ path = ext4_split_convert_extents(handle, inode, map, path,
+- EXT4_GET_BLOCKS_CONVERT_UNWRITTEN, NULL);
++ flags, NULL);
+ if (IS_ERR(path))
+ return path;
+
+- path = ext4_find_extent(inode, map->m_lblk, path, 0);
++ path = ext4_find_extent(inode, map->m_lblk, path, flags);
+ if (IS_ERR(path))
+ return path;
+ depth = ext_depth(inode);
+@@ -4298,7 +4299,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
+ if ((!ext4_ext_is_unwritten(ex)) &&
+ (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN)) {
+ path = convert_initialized_extent(handle,
+- inode, map, path, &allocated);
++ inode, map, path, flags, &allocated);
+ if (IS_ERR(path))
+ err = PTR_ERR(path);
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From 4988768c6be33f1a95d662e6c7279543ea1c3250 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 09:45:16 +0800
+Subject: ext4: use reserved metadata blocks when splitting extent on endio
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit 01942af95ab6c9d98e64ae01fdc243a03e4b973f ]
+
+When performing buffered writes, we may need to split and convert an
+unwritten extent into a written one during the end I/O process. However,
+we do not reserve space specifically for these metadata changes, we only
+reserve 2% of space or 4096 blocks. To address this, we use
+EXT4_GET_BLOCKS_PRE_IO to potentially split extents in advance and
+EXT4_GET_BLOCKS_METADATA_NOFAIL to utilize reserved space if necessary.
+
+These two approaches can reduce the likelihood of running out of space
+and losing data. However, these methods are merely best efforts, we
+could still run out of space, and there is not much difference between
+converting an extent during the writeback process and the end I/O
+process, it won't increase the risk of losing data if we postpone the
+conversion.
+
+Therefore, also use EXT4_GET_BLOCKS_METADATA_NOFAIL in
+ext4_convert_unwritten_extents_endio() to prepare for the buffered I/O
+iomap conversion, which may perform extent conversion during the end I/O
+process.
+
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Link: https://patch.msgid.link/20260105014522.1937690-2-yi.zhang@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 18b39eed75267..418c4351ef40c 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3809,6 +3809,8 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode,
+ * illegal.
+ */
+ if (ee_block != map->m_lblk || ee_len > map->m_len) {
++ int flags = EXT4_GET_BLOCKS_CONVERT |
++ EXT4_GET_BLOCKS_METADATA_NOFAIL;
+ #ifdef CONFIG_EXT4_DEBUG
+ ext4_warning(inode->i_sb, "Inode (%ld) finished: extent logical block %llu,"
+ " len %u; IO logical block %llu, len %u",
+@@ -3816,7 +3818,7 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode,
+ (unsigned long long)map->m_lblk, map->m_len);
+ #endif
+ path = ext4_split_convert_extents(handle, inode, map, path,
+- EXT4_GET_BLOCKS_CONVERT, NULL);
++ flags, NULL);
+ if (IS_ERR(path))
+ return path;
+
+--
+2.51.0
+
--- /dev/null
+From 7880c17f905fe40291108e459ed8f027164e1846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 11:16:56 +0800
+Subject: firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 9fda364cb78c8b9e1abe4029f877300c94655742 ]
+
+ffa_init() maps the Rx/Tx buffers via ffa_rxtx_map() but on the
+partition setup failure path it never unmaps them.
+
+Add the missing ffa_rxtx_unmap() call in the error path so that
+the Rx/Tx buffers are properly released before freeing the backing
+pages.
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Message-Id: <20251210031656.56194-1-lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
+index c501c3104b3a4..11a702e7f641c 100644
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -2093,6 +2093,7 @@ static int __init ffa_init(void)
+
+ pr_err("failed to setup partitions\n");
+ ffa_notifications_cleanup();
++ ffa_rxtx_unmap(drv_info->vm_id);
+ free_pages:
+ if (drv_info->tx_buffer)
+ free_pages_exact(drv_info->tx_buffer, rxtx_bufsz);
+--
+2.51.0
+
--- /dev/null
+From c48c232fdf45ce4985cc217f1119f580e619ae35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 13:11:24 +0100
+Subject: fix it87_wdt early reboot by reporting running timer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ]
+
+Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87
+wdt enabled by the firmware and a broken BIOS option that does not
+allow to change the time or turn it off. As this makes installing
+Linux rather difficult, change the it87_wdt to report it running to
+the watchdog core.
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/it87_wdt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
+index 3b8488c86a2f3..1d9f8591f38d8 100644
+--- a/drivers/watchdog/it87_wdt.c
++++ b/drivers/watchdog/it87_wdt.c
+@@ -188,6 +188,12 @@ static void _wdt_update_timeout(unsigned int t)
+ superio_outb(t >> 8, WDTVALMSB);
+ }
+
++/* Internal function, should be called after superio_select(GPIO) */
++static bool _wdt_running(void)
++{
++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB));
++}
++
+ static int wdt_update_timeout(unsigned int t)
+ {
+ int ret;
+@@ -374,6 +380,12 @@ static int __init it87_wdt_init(void)
+ }
+ }
+
++ /* wdt already left running by firmware? */
++ if (_wdt_running()) {
++ pr_info("Left running by firmware.\n");
++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status);
++ }
++
+ superio_exit();
+
+ if (timeout < 1 || timeout > max_units * 60) {
+--
+2.51.0
+
--- /dev/null
+From 7431dc711a6ddc1aa70508cb2c79987adc677a0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 16:58:48 +0100
+Subject: fpga: of-fpga-region: Fail if any bridge is missing
+
+From: Romain Gantois <romain.gantois@bootlin.com>
+
+[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ]
+
+When parsing the region bridge list from the "fpga-bridges" device tree
+property, the of-fpga-region driver will silently ignore bridges which fail
+to be obtained, for example due to a missing bridge driver or invalid
+phandle.
+
+This can lead to hardware issues if a region bridge stays coupled when
+partial programming is performed.
+
+Fail if any of the bridges specified in "fpga-bridges" cannot be obtained.
+
+Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
+Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com
+Reviewed-by: Xu Yilun <yilun.xu@intel.com>
+Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/of-fpga-region.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
+index 43db4bb77138a..caa091224dc54 100644
+--- a/drivers/fpga/of-fpga-region.c
++++ b/drivers/fpga/of-fpga-region.c
+@@ -83,7 +83,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np)
+ * done with the bridges.
+ *
+ * Return: 0 for success (even if there are no bridges specified)
+- * or -EBUSY if any of the bridges are in use.
++ * or an error code if any of the bridges are not available.
+ */
+ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ {
+@@ -130,10 +130,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ ®ion->bridge_list);
+ of_node_put(br);
+
+- /* If any of the bridges are in use, give up */
+- if (ret == -EBUSY) {
++ /* If any of the bridges are not available, give up */
++ if (ret) {
+ fpga_bridges_put(®ion->bridge_list);
+- return -EBUSY;
++ return ret;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3125db45a22d2c831ff80c2b7ca07334a75d90fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 18:42:11 +0530
+Subject: fs/buffer: add alert in try_to_free_buffers() for folios without
+ buffers
+
+From: Deepakkumar Karn <dkarn@redhat.com>
+
+[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ]
+
+try_to_free_buffers() can be called on folios with no buffers attached
+when filemap_release_folio() is invoked on a folio belonging to a mapping
+with AS_RELEASE_ALWAYS set but no release_folio operation defined.
+
+In such cases, folio_needs_release() returns true because of the
+AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This
+causes try_to_free_buffers() to call drop_buffers() on a folio with no
+buffers, leading to a null pointer dereference.
+
+Adding a check in try_to_free_buffers() to return early if the folio has no
+buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.
+This provides defensive hardening.
+
+Signed-off-by: Deepakkumar Karn <dkarn@redhat.com>
+Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/buffer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 838c0c5710229..28e4d53f17173 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2948,6 +2948,10 @@ bool try_to_free_buffers(struct folio *folio)
+ if (folio_test_writeback(folio))
+ return false;
+
++ /* Misconfigured folio check */
++ if (WARN_ON_ONCE(!folio_buffers(folio)))
++ return true;
++
+ if (mapping == NULL) { /* can this still happen? */
+ ret = drop_buffers(folio, &buffers_to_free);
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From 802b713c4a9c880ddad30294ecf4f1a628f2ecbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 16:07:32 +0100
+Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in
+ ntfs_read_run_nb_ra()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ]
+
+When ntfs_read_run_nb_ra() is invoked with run == NULL the code later
+assumes run is valid and may call run_get_entry(NULL, ...), and also
+uses clen/idx without initializing them. Smatch reported uninitialized
+variable warnings and this can lead to undefined behaviour. This patch
+fixes it.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fsntfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index bd67ba7b50153..ea5b673462c35 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -1252,6 +1252,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run,
+
+ } while (len32);
+
++ if (!run) {
++ err = -EINVAL;
++ goto out;
++ }
++
++ /* Get next fragment to read. */
+ vcn_next = vcn + clen;
+ if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) ||
+ vcn != vcn_next) {
+--
+2.51.0
+
--- /dev/null
+From 34564054bd7812b16ff17b03cd3fdb38594e3d2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 19:59:59 +0900
+Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed dentry in the ntfs3 filesystem can cause the kernel to hang
+during the lookup operations. By setting the HAS_SUB_NODE flag in an
+INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the
+VCN pointer, an attacker can cause the indx_find() function to repeatedly
+read the same block, allocating 4 KB of memory each time. The kernel lacks
+VCN loop detection and depth limits, causing memory exhaustion and an OOM
+crash.
+
+This patch adds a return value check for fnd_push() to prevent a memory
+exhaustion vulnerability caused by infinite loops. When the index exceeds the
+size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()
+function checks this return value and stops processing, preventing further
+memory allocation.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 7157cfd70fdcb..75b94beac1613 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1190,7 +1190,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni,
+ return -EINVAL;
+ }
+
+- fnd_push(fnd, node, e);
++ err = fnd_push(fnd, node, e);
++
++ if (err) {
++ put_indx_node(node);
++ return err;
++ }
+ }
+
+ *entry = e;
+--
+2.51.0
+
--- /dev/null
+From 1f7a6617f3dcd1ee0ed5473580e9e664b24070d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 14:27:48 +0300
+Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ]
+
+Do not keep preallocated clusters for sparsed and compressed files.
+Preserving preallocation in these cases causes fsx failures when running
+with sparse files and preallocation enabled.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index c45880ab23912..0cd15a0983fee 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -448,8 +448,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type,
+
+ is_ext = is_attr_ext(attr_b);
+ align = sbi->cluster_size;
+- if (is_ext)
++ if (is_ext) {
+ align <<= attr_b->nres.c_unit;
++ keep_prealloc = false;
++ }
+
+ old_valid = le64_to_cpu(attr_b->nres.valid_size);
+ old_size = le64_to_cpu(attr_b->nres.data_size);
+--
+2.51.0
+
--- /dev/null
+From 9db13a9143f86d3678ae8096b09a41dcb1e497ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:09 +0900
+Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
+ metadata
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an attribute header
+indicates an empty run list, while directory entries reference it as
+containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way
+to represent an empty run list, and run_unpack() correctly handles this by
+checking if evcn + 1 equals svcn and returning early without parsing any run
+data. However, this creates a problem when there is metadata inconsistency,
+where the attribute header claims to be empty (evcn=-1) but the caller
+expects to read actual data. When run_unpack() immediately returns success
+upon seeing this condition, it leaves the runs_tree uninitialized with
+run->runs as a NULL. The calling function attr_load_runs_range() assumes
+that a successful return means that the runs were loaded and sets clen to 0,
+expecting the next run_lookup_entry() call to succeed. Because runs_tree
+remains uninitialized, run_lookup_entry() continues to fail, and the loop
+increments vcn by zero (vcn += 0), leading to an infinite loop.
+
+This patch adds a retry counter to detect when run_lookup_entry() fails
+consecutively after attr_load_runs_vcn(). If the run is still not found on
+the second attempt, it indicates corrupted metadata and returns -EINVAL,
+preventing the Denial-of-Service (DoS) vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index 980ae9157248d..c45880ab23912 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -1354,19 +1354,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type,
+ CLST vcn;
+ CLST vcn_last = (to - 1) >> cluster_bits;
+ CLST lcn, clen;
+- int err;
++ int err = 0;
++ int retry = 0;
+
+ for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) {
+ if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) {
++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */
++ err = -EINVAL;
++ break;
++ }
+ err = attr_load_runs_vcn(ni, type, name, name_len, run,
+ vcn);
+ if (err)
+- return err;
++ break;
++
+ clen = 0; /* Next run_lookup_entry(vcn) must be success. */
++ retry++;
+ }
++ else
++ retry = 0;
+ }
+
+- return 0;
++ return err;
+ }
+
+ #ifdef CONFIG_NTFS3_LZX_XPRESS
+--
+2.51.0
+
--- /dev/null
+From c7feeb777b38426b734bfecc5688516d00b5d57a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:46 +0900
+Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
+indicates a zero data size while the driver allocates memory for it.
+
+When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
+to zero, it still allocates memory because of al_aligned(0). This creates an
+inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
+non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
+list exists and enumerates only the primary MFT record. When it finds
+ATTR_LIST, the code reloads it and restarts the enumeration, repeating
+indefinitely. The mount operation never completes, hanging the kernel thread.
+
+This patch adds validation to ensure that data_size is non-zero before memory
+allocation. When a zero-sized ATTR_LIST is detected, the function returns
+-EINVAL, preventing a DoS vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrlist.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
+index a4d74bed74fab..098bd7e8c3d64 100644
+--- a/fs/ntfs3/attrlist.c
++++ b/fs/ntfs3/attrlist.c
+@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+
+ if (!attr->non_res) {
+ lsize = le32_to_cpu(attr->res.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ /* attr is resident: lsize < record_size (1K or 4K) */
+ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+ u16 run_off = le16_to_cpu(attr->nres.run_off);
+
+ lsize = le64_to_cpu(attr->nres.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
+
+ run_init(&ni->attr_list.run);
+
+--
+2.51.0
+
--- /dev/null
+From 217068a672b0ec92634dda869b775b87e35644b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 14:33:19 +0300
+Subject: fs/ntfs3: handle attr_set_size() errors when truncating files
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 576248a34b927e93b2fd3fff7df735ba73ad7d01 ]
+
+If attr_set_size() fails while truncating down, the error is silently
+ignored and the inode may be left in an inconsistent state.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/file.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
+index 5120bd7851694..13d014b878f6c 100644
+--- a/fs/ntfs3/file.c
++++ b/fs/ntfs3/file.c
+@@ -505,8 +505,8 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
+ {
+ struct super_block *sb = inode->i_sb;
+ struct ntfs_inode *ni = ntfs_i(inode);
+- int err, dirty = 0;
+ u64 new_valid;
++ int err;
+
+ if (!S_ISREG(inode->i_mode))
+ return 0;
+@@ -522,7 +522,6 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
+ }
+
+ new_valid = ntfs_up_block(sb, min_t(u64, ni->i_valid, new_size));
+-
+ truncate_setsize(inode, new_size);
+
+ ni_lock(ni);
+@@ -536,20 +535,19 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
+ ni->i_valid = new_valid;
+
+ ni_unlock(ni);
++ if (unlikely(err))
++ return err;
+
+ ni->std_fa |= FILE_ATTRIBUTE_ARCHIVE;
+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
+ if (!IS_DIRSYNC(inode)) {
+- dirty = 1;
++ mark_inode_dirty(inode);
+ } else {
+ err = ntfs_sync_inode(inode);
+ if (err)
+ return err;
+ }
+
+- if (dirty)
+- mark_inode_dirty(inode);
+-
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d6fa28d40b4be72789997e52bcb197734167e97e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 20:38:07 +0000
+Subject: gendwarfksyms: Fix build on 32-bit hosts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit ddc54f912a551f6eb0bbcfc3880f45fe27a252cb ]
+
+We have interchangeably used unsigned long for some of the types
+defined in elfutils, assuming they're always 64-bit. This obviously
+fails when building gendwarfksyms on 32-bit hosts. Fix the types.
+
+Reported-by: Michal Suchánek <msuchanek@suse.de>
+Closes: https://lore.kernel.org/linux-modules/aRcxzPxtJblVSh1y@kitsune.suse.cz/
+Tested-by: Michal Suchánek <msuchanek@suse.de>
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gendwarfksyms/dwarf.c | 4 +++-
+ scripts/gendwarfksyms/symbols.c | 5 +++--
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/scripts/gendwarfksyms/dwarf.c b/scripts/gendwarfksyms/dwarf.c
+index 3538a7d9cb070..e76d732f5f602 100644
+--- a/scripts/gendwarfksyms/dwarf.c
++++ b/scripts/gendwarfksyms/dwarf.c
+@@ -750,6 +750,7 @@ static void process_enumerator_type(struct state *state, struct die *cache,
+ Dwarf_Die *die)
+ {
+ bool overridden = false;
++ unsigned long override;
+ Dwarf_Word value;
+
+ if (stable) {
+@@ -761,7 +762,8 @@ static void process_enumerator_type(struct state *state, struct die *cache,
+ return;
+
+ overridden = kabi_get_enumerator_value(
+- state->expand.current_fqn, cache->fqn, &value);
++ state->expand.current_fqn, cache->fqn, &override);
++ value = override;
+ }
+
+ process_list_comma(state, cache);
+diff --git a/scripts/gendwarfksyms/symbols.c b/scripts/gendwarfksyms/symbols.c
+index ecddcb5ffcdfb..42cd27c9cec4f 100644
+--- a/scripts/gendwarfksyms/symbols.c
++++ b/scripts/gendwarfksyms/symbols.c
+@@ -3,6 +3,7 @@
+ * Copyright (C) 2024 Google LLC
+ */
+
++#include <inttypes.h>
+ #include "gendwarfksyms.h"
+
+ #define SYMBOL_HASH_BITS 12
+@@ -242,7 +243,7 @@ static void elf_for_each_global(int fd, elf_symbol_callback_t func, void *arg)
+ error("elf_getdata failed: %s", elf_errmsg(-1));
+
+ if (shdr->sh_entsize != sym_size)
+- error("expected sh_entsize (%lu) to be %zu",
++ error("expected sh_entsize (%" PRIu64 ") to be %zu",
+ shdr->sh_entsize, sym_size);
+
+ nsyms = shdr->sh_size / shdr->sh_entsize;
+@@ -292,7 +293,7 @@ static void set_symbol_addr(struct symbol *sym, void *arg)
+ hash_add(symbol_addrs, &sym->addr_hash,
+ symbol_addr_hash(&sym->addr));
+
+- debug("%s -> { %u, %lx }", sym->name, sym->addr.section,
++ debug("%s -> { %u, %" PRIx64 " }", sym->name, sym->addr.section,
+ sym->addr.address);
+ } else if (sym->addr.section != addr->section ||
+ sym->addr.address != addr->address) {
+--
+2.51.0
+
--- /dev/null
+From 12ee336910eab0b604d874b45fbb3a69980fe5c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 22:37:27 +0800
+Subject: genirq/cpuhotplug: Notify about affinity changes breaking the
+ affinity mask
+
+From: Imran Khan <imran.f.khan@oracle.com>
+
+[ Upstream commit dd9f6d30c64001ca4dde973ac04d8d155e856743 ]
+
+During CPU offlining the interrupts affined to that CPU are moved to other
+online CPUs, which might break the original affinity mask if the outgoing
+CPU was the last online CPU in that mask. This change is not propagated to
+irq_desc::affinity_notify(), which leaves users of the affinity notifier
+mechanism with stale information.
+
+Avoid this by scheduling affinity change notification work for interrupts
+that were affined to the CPU being offlined, if the new target CPU is not
+part of the original affinity mask.
+
+Since irq_set_affinity_locked() uses the same logic to schedule affinity
+change notification work, split out this logic into a dedicated function
+and use that at both places.
+
+[ tglx: Removed the EXPORT(), removed the !SMP stub, moved the prototype,
+ added a lockdep assert instead of a comment, fixed up coding style
+ and name space. Polished and clarified the change log ]
+
+Signed-off-by: Imran Khan <imran.f.khan@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260113143727.1041265-1-imran.f.khan@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/cpuhotplug.c | 6 ++++--
+ kernel/irq/internals.h | 2 +-
+ kernel/irq/manage.c | 26 ++++++++++++++++++--------
+ 3 files changed, 23 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c
+index 755346ea98196..cd5689e383b00 100644
+--- a/kernel/irq/cpuhotplug.c
++++ b/kernel/irq/cpuhotplug.c
+@@ -177,9 +177,11 @@ void irq_migrate_all_off_this_cpu(void)
+ bool affinity_broken;
+
+ desc = irq_to_desc(irq);
+- scoped_guard(raw_spinlock, &desc->lock)
++ scoped_guard(raw_spinlock, &desc->lock) {
+ affinity_broken = migrate_one_irq(desc);
+-
++ if (affinity_broken && desc->affinity_notify)
++ irq_affinity_schedule_notify_work(desc);
++ }
+ if (affinity_broken) {
+ pr_debug_ratelimited("IRQ %u: no longer affine to CPU%u\n",
+ irq, smp_processor_id());
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index 0164ca48da59e..5568ed3a8b852 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -135,6 +135,7 @@ extern bool irq_can_set_affinity_usr(unsigned int irq);
+
+ extern int irq_do_set_affinity(struct irq_data *data,
+ const struct cpumask *dest, bool force);
++extern void irq_affinity_schedule_notify_work(struct irq_desc *desc);
+
+ #ifdef CONFIG_SMP
+ extern int irq_setup_affinity(struct irq_desc *desc);
+@@ -142,7 +143,6 @@ extern int irq_setup_affinity(struct irq_desc *desc);
+ static inline int irq_setup_affinity(struct irq_desc *desc) { return 0; }
+ #endif
+
+-
+ #define for_each_action_of_desc(desc, act) \
+ for (act = desc->action; act; act = act->next)
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 349ae7979da0e..4873b0f73df96 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -347,6 +347,21 @@ static bool irq_set_affinity_deactivated(struct irq_data *data,
+ return true;
+ }
+
++/**
++ * irq_affinity_schedule_notify_work - Schedule work to notify about affinity change
++ * @desc: Interrupt descriptor whose affinity changed
++ */
++void irq_affinity_schedule_notify_work(struct irq_desc *desc)
++{
++ lockdep_assert_held(&desc->lock);
++
++ kref_get(&desc->affinity_notify->kref);
++ if (!schedule_work(&desc->affinity_notify->work)) {
++ /* Work was already scheduled, drop our extra ref */
++ kref_put(&desc->affinity_notify->kref, desc->affinity_notify->release);
++ }
++}
++
+ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
+ bool force)
+ {
+@@ -367,14 +382,9 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
+ irq_copy_pending(desc, mask);
+ }
+
+- if (desc->affinity_notify) {
+- kref_get(&desc->affinity_notify->kref);
+- if (!schedule_work(&desc->affinity_notify->work)) {
+- /* Work was already scheduled, drop our extra ref */
+- kref_put(&desc->affinity_notify->kref,
+- desc->affinity_notify->release);
+- }
+- }
++ if (desc->affinity_notify)
++ irq_affinity_schedule_notify_work(desc);
++
+ irqd_set(data, IRQD_AFFINITY_SET);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 9eaa75258aca60dc91ba53b0c64a1e5809797f34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 15:52:57 +0100
+Subject: gfs2: fiemap page fault fix
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ]
+
+In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode
+glock. This can lead to recursive glock taking if the fiemap buffer is
+memory mapped to the same inode and accessing it triggers a page fault.
+
+Fix by disabling page faults for iomap_fiemap() and faulting in the
+buffer by hand if necessary.
+
+Fixes xfstest generic/742.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/inode.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index b6ed069b34872..4d65e4a752626 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -2192,6 +2192,14 @@ static int gfs2_getattr(struct mnt_idmap *idmap,
+ return 0;
+ }
+
++static bool fault_in_fiemap(struct fiemap_extent_info *fi)
++{
++ struct fiemap_extent __user *dest = fi->fi_extents_start;
++ size_t size = sizeof(*dest) * fi->fi_extents_max;
++
++ return fault_in_safe_writeable((char __user *)dest, size) == 0;
++}
++
+ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ u64 start, u64 len)
+ {
+@@ -2201,14 +2209,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+
+ inode_lock_shared(inode);
+
++retry:
+ ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh);
+ if (ret)
+ goto out;
+
++ pagefault_disable();
+ ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops);
++ pagefault_enable();
+
+ gfs2_glock_dq_uninit(&gh);
+
++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) {
++ fieinfo->fi_extents_mapped = 0;
++ goto retry;
++ }
++
+ out:
+ inode_unlock_shared(inode);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 27dc99fe47651f34265e7341a5d26cbc5935e157 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:26:26 +0800
+Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ]
+
+Use module_platform_driver() to replace module_platform_driver_probe().
+The former utilizes platform_driver_register(), which allows the driver to
+defer probing when it doesn't acquire the necessary resources due to probe
+order. In contrast, the latter uses __platform_driver_probe(), which
+includes the comment "Note that this is incompatible with deferred
+probing." Since our SGPIO driver requires access to the clock resource, the
+former is more suitable.
+
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed-sgpio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
+index 7622f9e9f54af..318cd0e397416 100644
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -516,7 +516,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = {
+
+ MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table);
+
+-static int __init aspeed_sgpio_probe(struct platform_device *pdev)
++static int aspeed_sgpio_probe(struct platform_device *pdev)
+ {
+ u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask;
+ const struct aspeed_sgpio_pdata *pdata;
+@@ -611,11 +611,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ }
+
+ static struct platform_driver aspeed_sgpio_driver = {
++ .probe = aspeed_sgpio_probe,
+ .driver = {
+ .name = KBUILD_MODNAME,
+ .of_match_table = aspeed_sgpio_of_table,
+ },
+ };
+
+-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe);
++module_platform_driver(aspeed_sgpio_driver);
+ MODULE_DESCRIPTION("Aspeed Serial GPIO Driver");
+--
+2.51.0
+
--- /dev/null
+From 853dee20eb9f4edc5ba62a054a34c8eb85af2dcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 08:39:35 +0100
+Subject: gpio: pca953x: Add support for TCAL6408 TCAL6416
+
+From: Jan Remmet <j.remmet@phytec.de>
+
+[ Upstream commit a30a9cb9bca4296d25f253619883e7013b6be158 ]
+
+TCAL6408 and TCAL6416 supports latchable inputs and maskable interrupt.
+Tested on a TCAL6416, checked datasheets for the TCAL6408.
+
+They use the same programming model ad the NXP PCAL64xx, but
+support a lower supply power (1.08V to 3.6V) compared to PCAL
+(1.65V to 5.5V)
+
+Datasheet: https://www.ti.com/lit/ds/symlink/tcal6408.pdf
+Datasheet: https://www.ti.com/lit/ds/symlink/tcal6416.pdf
+
+Signed-off-by: Jan Remmet <j.remmet@phytec.de>
+Link: https://lore.kernel.org/r/20251216-wip-jremmet-tcal6416rtw-v2-3-6516d98a9836@phytec.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/Kconfig | 4 ++--
+ drivers/gpio/gpio-pca953x.c | 6 ++++++
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
+index bd185482a7fdf..3439e025ba1c6 100644
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -1193,11 +1193,11 @@ config GPIO_PCA953X
+
+ 8 bits: max7310, max7315, pca6107, pca9534, pca9538, pca9554,
+ pca9556, pca9557, pca9574, tca6408, tca9554, xra1202,
+- pcal6408, pcal9554b, tca9538
++ pcal6408, pcal9554b, tca9538, tcal6408
+
+ 16 bits: max7312, max7313, pca9535, pca9539, pca9555, pca9575,
+ tca6416, pca6416, pcal6416, pcal9535, pcal9555a, max7318,
+- tca9539
++ tca9539, tcal6416
+
+ 18 bits: tca6418
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index f93a3dbb2daaf..52e96cc5f67bb 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -126,6 +126,9 @@ static const struct i2c_device_id pca953x_id[] = {
+ { "tca9539", 16 | PCA953X_TYPE | PCA_INT, },
+ { "tca9554", 8 | PCA953X_TYPE | PCA_INT, },
+ { "xra1202", 8 | PCA953X_TYPE },
++
++ { "tcal6408", 8 | PCA953X_TYPE | PCA_LATCH_INT, },
++ { "tcal6416", 16 | PCA953X_TYPE | PCA_LATCH_INT, },
+ { }
+ };
+ MODULE_DEVICE_TABLE(i2c, pca953x_id);
+@@ -1469,6 +1472,9 @@ static const struct of_device_id pca953x_dt_ids[] = {
+ { .compatible = "ti,tca9538", .data = OF_953X( 8, PCA_INT), },
+ { .compatible = "ti,tca9539", .data = OF_953X(16, PCA_INT), },
+
++ { .compatible = "ti,tcal6408", .data = OF_953X( 8, PCA_LATCH_INT), },
++ { .compatible = "ti,tcal6416", .data = OF_953X(16, PCA_LATCH_INT), },
++
+ { .compatible = "onnn,cat9554", .data = OF_953X( 8, PCA_INT), },
+ { .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), },
+ { .compatible = "onnn,pca9655", .data = OF_953X(16, PCA_INT), },
+--
+2.51.0
+
--- /dev/null
+From 8b14ad16d2dd92b369eec2c12edfd14e1e89608f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 07:45:55 +0000
+Subject: gpu/panel-edp: add AUO panel entry for B140HAN06.4
+
+From: Alexey Klimov <alexey.klimov@linaro.org>
+
+[ Upstream commit 2976aeb0de77da599ad37691963efbdcb07435ce ]
+
+Add an eDP panel entry for AUO B140HAN06.4 that is also used in
+some variants of Lenovo Flex 5G with Qcom SC8180 SoC.
+
+The raw edid of the panel is:
+
+00 ff ff ff ff ff ff 00 06 af 3d 64 00 00 00 00
+2b 1d 01 04 a5 1f 11 78 03 b8 1a a6 54 4a 9b 26
+0e 52 55 00 00 00 01 01 01 01 01 01 01 01 01 01
+01 01 01 01 01 01 14 37 80 b8 70 38 24 40 10 10
+3e 00 35 ae 10 00 00 18 10 2c 80 b8 70 38 24 40
+10 10 3e 00 35 ae 10 00 00 18 00 00 00 fe 00 41
+55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe
+00 42 31 34 30 48 41 4e 30 36 2e 34 20 0a 00 eb
+
+I do not have access to the datasheet and but it is tested on above
+mentioned laptop for a few weeks and seems to work just fine with
+timing info of similar panels.
+
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20251203074555.690613-1-alexey.klimov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 023fbbb10eb4f..2c35970377431 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1904,6 +1904,7 @@ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x635c, &delay_200_500_e50, "B116XAN06.3"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x639c, &delay_200_500_e50, "B140HAK02.7"),
++ EDP_PANEL_ENTRY('A', 'U', 'O', 0x643d, &delay_200_500_e50, "B140HAN06.4"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x723c, &delay_200_500_e50, "B140XTN07.2"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x73aa, &delay_200_500_e50, "B116XTN02.3"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x8594, &delay_200_500_e50, "B133UAN01.0"),
+--
+2.51.0
+
--- /dev/null
+From 4565f3559a6fea2e483710e1eb701d917da79d8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 04:57:17 +0000
+Subject: gro: change the BUG_ON() in gro_pull_from_frag0()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ]
+
+Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE()
+
+$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2
+add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116)
+Function old new delta
+gro_try_pull_from_frag0 - 196 +196
+napi_gro_frags 771 929 +158
+__pfx_gro_try_pull_from_frag0 - 16 +16
+__pfx_gro_pull_from_frag0 16 - -16
+dev_gro_receive 1514 1464 -50
+gro_pull_from_frag0 188 - -188
+Total: Before=22565899, After=22566015, chg +0.00%
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/gro.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/gro.c b/net/core/gro.c
+index 482fa7d7f5981..ef61695fbdbb6 100644
+--- a/net/core/gro.c
++++ b/net/core/gro.c
+@@ -417,7 +417,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow)
+ {
+ struct skb_shared_info *pinfo = skb_shinfo(skb);
+
+- BUG_ON(skb->end - skb->tail < grow);
++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow);
+
+ memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
+
+--
+2.51.0
+
--- /dev/null
+From 2037b1ef27b4a2dc3b92ff43fd004dcd1add2f25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 20:10:06 +0100
+Subject: hfs: Replace BUG_ON with error handling for CNID count checks
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit b226804532a875c10276168dc55ce752944096bd ]
+
+In a06ec283e125 next_id, folder_count, and file_count in the super block
+info were expanded to 64 bits, and BUG_ONs were added to detect
+overflow. This triggered an error reported by syzbot: if the MDB is
+corrupted, the BUG_ON is triggered. This patch replaces this mechanism
+with proper error handling and resolves the syzbot reported bug.
+
+Singed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Reported-by: syzbot+17cc9bb6d8d69b4139f0@syzkaller.appspotmail.com
+Closes: https://syzbot.org/bug?extid=17cc9bb6d8d69b4139f0
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/20251220191006.2465256-1-jkoolstra@xs4all.nl
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/dir.c | 15 +++++++++++----
+ fs/hfs/hfs_fs.h | 1 +
+ fs/hfs/inode.c | 30 ++++++++++++++++++++++++------
+ fs/hfs/mdb.c | 31 +++++++++++++++++++++++++++----
+ fs/hfs/super.c | 3 +++
+ 5 files changed, 66 insertions(+), 14 deletions(-)
+
+diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
+index 86a6b317b474a..0c615c078650c 100644
+--- a/fs/hfs/dir.c
++++ b/fs/hfs/dir.c
+@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
+ int res;
+
+ inode = hfs_new_inode(dir, &dentry->d_name, mode);
+- if (!inode)
+- return -ENOMEM;
++ if (IS_ERR(inode))
++ return PTR_ERR(inode);
+
+ res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
+ if (res) {
+@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+ int res;
+
+ inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
+- if (!inode)
+- return ERR_PTR(-ENOMEM);
++ if (IS_ERR(inode))
++ return ERR_CAST(inode);
+
+ res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
+ if (res) {
+@@ -254,11 +254,18 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+ */
+ static int hfs_remove(struct inode *dir, struct dentry *dentry)
+ {
++ struct super_block *sb = dir->i_sb;
+ struct inode *inode = d_inode(dentry);
+ int res;
+
+ if (S_ISDIR(inode->i_mode) && inode->i_size != 2)
+ return -ENOTEMPTY;
++
++ if (unlikely(!is_hfs_cnid_counts_valid(sb))) {
++ pr_err("cannot remove file/folder\n");
++ return -ERANGE;
++ }
++
+ res = hfs_cat_delete(inode->i_ino, dir, &dentry->d_name);
+ if (res)
+ return res;
+diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
+index e94dbc04a1e43..ac0e83f77a0f1 100644
+--- a/fs/hfs/hfs_fs.h
++++ b/fs/hfs/hfs_fs.h
+@@ -199,6 +199,7 @@ extern void hfs_delete_inode(struct inode *inode);
+ extern const struct xattr_handler * const hfs_xattr_handlers[];
+
+ /* mdb.c */
++extern bool is_hfs_cnid_counts_valid(struct super_block *sb);
+ extern int hfs_mdb_get(struct super_block *sb);
+ extern void hfs_mdb_commit(struct super_block *sb);
+ extern void hfs_mdb_close(struct super_block *sb);
+diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
+index 524db1389737d..878535db64d67 100644
+--- a/fs/hfs/inode.c
++++ b/fs/hfs/inode.c
+@@ -187,16 +187,23 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
+ s64 next_id;
+ s64 file_count;
+ s64 folder_count;
++ int err = -ENOMEM;
+
+ if (!inode)
+- return NULL;
++ goto out_err;
++
++ err = -ERANGE;
+
+ mutex_init(&HFS_I(inode)->extents_lock);
+ INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
+ spin_lock_init(&HFS_I(inode)->open_dir_lock);
+ hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
+ next_id = atomic64_inc_return(&HFS_SB(sb)->next_id);
+- BUG_ON(next_id > U32_MAX);
++ if (next_id > U32_MAX) {
++ atomic64_dec(&HFS_SB(sb)->next_id);
++ pr_err("cannot create new inode: next CNID exceeds limit\n");
++ goto out_discard;
++ }
+ inode->i_ino = (u32)next_id;
+ inode->i_mode = mode;
+ inode->i_uid = current_fsuid();
+@@ -210,7 +217,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
+ if (S_ISDIR(mode)) {
+ inode->i_size = 2;
+ folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
+- BUG_ON(folder_count > U32_MAX);
++ if (folder_count> U32_MAX) {
++ atomic64_dec(&HFS_SB(sb)->folder_count);
++ pr_err("cannot create new inode: folder count exceeds limit\n");
++ goto out_discard;
++ }
+ if (dir->i_ino == HFS_ROOT_CNID)
+ HFS_SB(sb)->root_dirs++;
+ inode->i_op = &hfs_dir_inode_operations;
+@@ -220,7 +231,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
+ } else if (S_ISREG(mode)) {
+ HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
+ file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
+- BUG_ON(file_count > U32_MAX);
++ if (file_count > U32_MAX) {
++ atomic64_dec(&HFS_SB(sb)->file_count);
++ pr_err("cannot create new inode: file count exceeds limit\n");
++ goto out_discard;
++ }
+ if (dir->i_ino == HFS_ROOT_CNID)
+ HFS_SB(sb)->root_files++;
+ inode->i_op = &hfs_file_inode_operations;
+@@ -244,6 +259,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
+ hfs_mark_mdb_dirty(sb);
+
+ return inode;
++
++ out_discard:
++ iput(inode);
++ out_err:
++ return ERR_PTR(err);
+ }
+
+ void hfs_delete_inode(struct inode *inode)
+@@ -252,7 +272,6 @@ void hfs_delete_inode(struct inode *inode)
+
+ hfs_dbg("ino %lu\n", inode->i_ino);
+ if (S_ISDIR(inode->i_mode)) {
+- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
+ atomic64_dec(&HFS_SB(sb)->folder_count);
+ if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
+ HFS_SB(sb)->root_dirs--;
+@@ -261,7 +280,6 @@ void hfs_delete_inode(struct inode *inode)
+ return;
+ }
+
+- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
+ atomic64_dec(&HFS_SB(sb)->file_count);
+ if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
+ HFS_SB(sb)->root_files--;
+diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
+index f28cd24dee842..a97cea35ca2e1 100644
+--- a/fs/hfs/mdb.c
++++ b/fs/hfs/mdb.c
+@@ -64,6 +64,27 @@ static int hfs_get_last_session(struct super_block *sb,
+ return 0;
+ }
+
++bool is_hfs_cnid_counts_valid(struct super_block *sb)
++{
++ struct hfs_sb_info *sbi = HFS_SB(sb);
++ bool corrupted = false;
++
++ if (unlikely(atomic64_read(&sbi->next_id) > U32_MAX)) {
++ pr_warn("next CNID exceeds limit\n");
++ corrupted = true;
++ }
++ if (unlikely(atomic64_read(&sbi->file_count) > U32_MAX)) {
++ pr_warn("file count exceeds limit\n");
++ corrupted = true;
++ }
++ if (unlikely(atomic64_read(&sbi->folder_count) > U32_MAX)) {
++ pr_warn("folder count exceeds limit\n");
++ corrupted = true;
++ }
++
++ return !corrupted;
++}
++
+ /*
+ * hfs_mdb_get()
+ *
+@@ -159,6 +180,11 @@ int hfs_mdb_get(struct super_block *sb)
+ atomic64_set(&HFS_SB(sb)->file_count, be32_to_cpu(mdb->drFilCnt));
+ atomic64_set(&HFS_SB(sb)->folder_count, be32_to_cpu(mdb->drDirCnt));
+
++ if (!is_hfs_cnid_counts_valid(sb)) {
++ pr_warn("filesystem possibly corrupted, running fsck.hfs is recommended. Mounting read-only.\n");
++ sb->s_flags |= SB_RDONLY;
++ }
++
+ /* TRY to get the alternate (backup) MDB. */
+ sect = part_start + part_size - 2;
+ bh = sb_bread512(sb, sect, mdb2);
+@@ -212,7 +238,7 @@ int hfs_mdb_get(struct super_block *sb)
+
+ attrib = mdb->drAtrb;
+ if (!(attrib & cpu_to_be16(HFS_SB_ATTRIB_UNMNT))) {
+- pr_warn("filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only.\n");
++ pr_warn("filesystem was not cleanly unmounted, running fsck.hfs is recommended. Mounting read-only.\n");
+ sb->s_flags |= SB_RDONLY;
+ }
+ if ((attrib & cpu_to_be16(HFS_SB_ATTRIB_SLOCK))) {
+@@ -270,15 +296,12 @@ void hfs_mdb_commit(struct super_block *sb)
+ /* These parameters may have been modified, so write them back */
+ mdb->drLsMod = hfs_mtime();
+ mdb->drFreeBks = cpu_to_be16(HFS_SB(sb)->free_ablocks);
+- BUG_ON(atomic64_read(&HFS_SB(sb)->next_id) > U32_MAX);
+ mdb->drNxtCNID =
+ cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->next_id));
+ mdb->drNmFls = cpu_to_be16(HFS_SB(sb)->root_files);
+ mdb->drNmRtDirs = cpu_to_be16(HFS_SB(sb)->root_dirs);
+- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
+ mdb->drFilCnt =
+ cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->file_count));
+- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
+ mdb->drDirCnt =
+ cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->folder_count));
+
+diff --git a/fs/hfs/super.c b/fs/hfs/super.c
+index df289cbdd4e85..97546d6b41f47 100644
+--- a/fs/hfs/super.c
++++ b/fs/hfs/super.c
+@@ -34,6 +34,7 @@ MODULE_LICENSE("GPL");
+
+ static int hfs_sync_fs(struct super_block *sb, int wait)
+ {
++ is_hfs_cnid_counts_valid(sb);
+ hfs_mdb_commit(sb);
+ return 0;
+ }
+@@ -65,6 +66,8 @@ static void flush_mdb(struct work_struct *work)
+ sbi->work_queued = 0;
+ spin_unlock(&sbi->work_lock);
+
++ is_hfs_cnid_counts_valid(sb);
++
+ hfs_mdb_commit(sb);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3b402182bea5ee91bc2b9f6aeccdd972d1c17048 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 16:00:55 -0800
+Subject: hfsplus: fix volume corruption issue for generic/480
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit bea4429eb30190c59b5ac7c8ff6c90176c7c110f ]
+
+The xfstests' test-case generic/480 leaves HFS+ volume
+in corrupted state:
+
+sudo ./check generic/480
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.17.0-rc1+ #4 SMP PREEMPT_DYNAMIC Wed Oct 1 15:02:44 PDT 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/480 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
+(see XFSTESTS-2/xfstests-dev/results//generic/480.full for details)
+
+Ran: generic/480
+Failures: generic/480
+Failed 1 of 1 tests
+
+sudo fsck.hfsplus -d /dev/loop51
+** /dev/loop51
+Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+Executing fsck_hfs (version 540.1-Linux).
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+Incorrect number of file hard links
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+invalid VHB nextCatalogID
+Volume header needs minor repair
+(2, 0)
+Verify Status: VIStat = 0x8000, ABTStat = 0x0000 EBTStat = 0x0000
+CBTStat = 0x0000 CatStat = 0x00000002
+** Repairing volume.
+Incorrect flags for file hard link (id = 19)
+(It should be 0x22 instead of 0x2)
+Incorrect flags for file inode (id = 18)
+(It should be 0x22 instead of 0x2)
+first link ID=0 is < 16 for fileinode=18
+Error getting first link ID for inode = 18 (result=2)
+Invalid first link in hard link chain (id = 18)
+(It should be 19 instead of 0)
+Indirect node 18 needs link count adjustment
+(It should be 1 instead of 2)
+** Rechecking volume.
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled was repaired successfully.
+
+The generic/480 test executes such steps on final phase:
+
+"Now remove of the links of our file and create
+a new file with the same name and in the same
+parent directory, and finally fsync this new file."
+
+unlink $SCRATCH_MNT/testdir/bar
+touch $SCRATCH_MNT/testdir/bar
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/testdir/bar
+
+"Simulate a power failure and mount the filesystem
+to check that replaying the fsync log/journal
+succeeds, that is the mount operation does not fail."
+
+_flakey_drop_and_remount
+
+The key issue in HFS+ logic is that hfsplus_link(),
+hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(),
+and hfsplus_mknod() methods don't call
+hfsplus_cat_write_inode() for the case of modified
+inode objects. As a result, even if hfsplus_file_fsync()
+is trying to flush the dirty Catalog File, but because of
+not calling hfsplus_cat_write_inode() not all modified
+inodes save the new state into Catalog File's records.
+Finally, simulation of power failure results in inconsistent
+state of Catalog File and FSCK tool reports about
+volume corruption.
+
+This patch adds calling of hfsplus_cat_write_inode()
+method for modified inodes in hfsplus_link(),
+hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(),
+and hfsplus_mknod() methods. Also, it adds debug output
+in several methods.
+
+sudo ./check generic/480
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/480 16s ... 16s
+Ran: generic/480
+Passed all 1 tests
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20251205000054.3670326-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/dir.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
+ fs/hfsplus/inode.c | 5 +++++
+ 2 files changed, 50 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
+index cadf0b5f93422..ca5f74a140ec1 100644
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -313,6 +313,9 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
+ if (!S_ISREG(inode->i_mode))
+ return -EPERM;
+
++ hfs_dbg("src_dir->i_ino %lu, dst_dir->i_ino %lu, inode->i_ino %lu\n",
++ src_dir->i_ino, dst_dir->i_ino, inode->i_ino);
++
+ mutex_lock(&sbi->vh_mutex);
+ if (inode->i_ino == (u32)(unsigned long)src_dentry->d_fsdata) {
+ for (;;) {
+@@ -332,7 +335,7 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
+ cnid = sbi->next_cnid++;
+ src_dentry->d_fsdata = (void *)(unsigned long)cnid;
+ res = hfsplus_create_cat(cnid, src_dir,
+- &src_dentry->d_name, inode);
++ &src_dentry->d_name, inode);
+ if (res)
+ /* panic? */
+ goto out;
+@@ -350,6 +353,21 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
+ mark_inode_dirty(inode);
+ sbi->file_count++;
+ hfsplus_mark_mdb_dirty(dst_dir->i_sb);
++
++ res = hfsplus_cat_write_inode(src_dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(dst_dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(sbi->hidden_dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(inode);
++
+ out:
+ mutex_unlock(&sbi->vh_mutex);
+ return res;
+@@ -367,6 +385,9 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry)
+ if (HFSPLUS_IS_RSRC(inode))
+ return -EPERM;
+
++ hfs_dbg("dir->i_ino %lu, inode->i_ino %lu\n",
++ dir->i_ino, inode->i_ino);
++
+ mutex_lock(&sbi->vh_mutex);
+ cnid = (u32)(unsigned long)dentry->d_fsdata;
+ if (inode->i_ino == cnid &&
+@@ -408,6 +429,15 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry)
+ inode_set_ctime_current(inode);
+ mark_inode_dirty(inode);
+ out:
++ if (!res) {
++ res = hfsplus_cat_write_inode(dir);
++ if (!res) {
++ res = hfsplus_cat_write_inode(sbi->hidden_dir);
++ if (!res)
++ res = hfsplus_cat_write_inode(inode);
++ }
++ }
++
+ mutex_unlock(&sbi->vh_mutex);
+ return res;
+ }
+@@ -429,6 +459,8 @@ static int hfsplus_rmdir(struct inode *dir, struct dentry *dentry)
+ inode_set_ctime_current(inode);
+ hfsplus_delete_inode(inode);
+ mark_inode_dirty(inode);
++
++ res = hfsplus_cat_write_inode(dir);
+ out:
+ mutex_unlock(&sbi->vh_mutex);
+ return res;
+@@ -465,6 +497,12 @@ static int hfsplus_symlink(struct mnt_idmap *idmap, struct inode *dir,
+
+ hfsplus_instantiate(dentry, inode, inode->i_ino);
+ mark_inode_dirty(inode);
++
++ res = hfsplus_cat_write_inode(dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(inode);
+ goto out;
+
+ out_err:
+@@ -506,6 +544,12 @@ static int hfsplus_mknod(struct mnt_idmap *idmap, struct inode *dir,
+
+ hfsplus_instantiate(dentry, inode, inode->i_ino);
+ mark_inode_dirty(inode);
++
++ res = hfsplus_cat_write_inode(dir);
++ if (res)
++ goto out;
++
++ res = hfsplus_cat_write_inode(inode);
+ goto out;
+
+ failed_mknod:
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 7ae6745ca7ae1..c762bf909d1aa 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -328,6 +328,9 @@ int hfsplus_file_fsync(struct file *file, loff_t start, loff_t end,
+ struct hfsplus_vh *vhdr = sbi->s_vhdr;
+ int error = 0, error2;
+
++ hfs_dbg("inode->i_ino %lu, start %llu, end %llu\n",
++ inode->i_ino, start, end);
++
+ error = file_write_and_wait_range(file, start, end);
+ if (error)
+ return error;
+@@ -616,6 +619,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ hfsplus_cat_entry entry;
+ int res = 0;
+
++ hfs_dbg("inode->i_ino %lu\n", inode->i_ino);
++
+ if (HFSPLUS_IS_RSRC(inode))
+ main_inode = HFSPLUS_I(inode)->rsrc_inode;
+
+--
+2.51.0
+
--- /dev/null
+From dd56cf4c1086ff51f1b992ed8806d5721a858d9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Dec 2025 19:58:22 -0800
+Subject: hfsplus: fix volume corruption issue for generic/498
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ]
+
+The xfstests' test-case generic/498 leaves HFS+ volume
+in corrupted state:
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
+(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details)
+
+Ran: generic/498
+Failures: generic/498
+Failed 1 of 1 tests
+
+sudo fsck.hfsplus -d /dev/loop51
+** /dev/loop51
+Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+Executing fsck_hfs (version 540.1-Linux).
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+Invalid leaf record count
+(It should be 16 instead of 2)
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
+CBTStat = 0x8000 CatStat = 0x00000000
+** Repairing volume.
+** Rechecking volume.
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled was repaired successfully.
+
+The generic/498 test executes such steps on final phase:
+
+mkdir $SCRATCH_MNT/A
+mkdir $SCRATCH_MNT/B
+mkdir $SCRATCH_MNT/A/C
+touch $SCRATCH_MNT/B/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo
+
+ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A
+
+"Simulate a power failure and mount the filesystem
+to check that what we explicitly fsync'ed exists."
+
+_flakey_drop_and_remount
+
+The FSCK tool complains about "Invalid leaf record count".
+HFS+ b-tree header contains leaf_count field is updated
+by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert()
+is involved into hard link creation process. However,
+modified in-core leaf_count field is stored into HFS+
+b-tree header by hfs_btree_write() method. But,
+unfortunately, hfs_btree_write() hasn't been called
+by hfsplus_cat_write_inode() and hfsplus_file_fsync()
+stores not fully consistent state of the Catalog File's
+b-tree.
+
+This patch adds calling hfs_btree_write() method in
+the hfsplus_cat_write_inode() with the goal of
+storing consistent state of Catalog File's b-tree.
+Finally, it makes FSCK tool happy.
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 33s ... 31s
+Ran: generic/498
+Passed all 1 tests
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/inode.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index c762bf909d1aa..6153e5cc6eb65 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -615,6 +615,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ int hfsplus_cat_write_inode(struct inode *inode)
+ {
+ struct inode *main_inode = inode;
++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree;
+ struct hfs_find_data fd;
+ hfsplus_cat_entry entry;
+ int res = 0;
+@@ -627,7 +628,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ if (!main_inode->i_nlink)
+ return 0;
+
+- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd))
++ if (hfs_find_init(tree, &fd))
+ /* panic? */
+ return -EIO;
+
+@@ -692,6 +693,15 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags);
+ out:
+ hfs_find_exit(&fd);
++
++ if (!res) {
++ res = hfs_btree_write(tree);
++ if (res) {
++ pr_err("b-tree write err: %d, ino %lu\n",
++ res, inode->i_ino);
++ }
++ }
++
+ return res;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2d664d032e03f359574c8814b595d0507730598d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 18:39:33 +0900
+Subject: hfsplus: pretend special inodes as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index aaffa9e060a0a..7f327b777ece8 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -53,6 +53,12 @@ static int hfsplus_system_read_inode(struct inode *inode)
+ return -EIO;
+ }
+
++ /*
++ * Assign a dummy file type, for may_open() requires that
++ * an inode has a valid file type.
++ */
++ inode->i_mode = S_IFREG;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 20bc82c3571874da0bd5e41723448d0c0656f251 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 06:06:23 +0000
+Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple
+ keyboards
+
+From: Joey Bednar <linux@joeybednar.com>
+
+[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ]
+
+The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium
+Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX
+KN85 Keyboard" to the list of non-apple keyboards fixes the function
+keys.
+
+Signed-off-by: Joey Bednar <linux@joeybednar.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 57da4f86a9fa7..233e367cce1d1 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -354,6 +354,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+ };
+
+ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
++ { "SONiX KN85 Keyboard" },
+ { "SONiX USB DEVICE" },
+ { "SONiX AK870 PRO" },
+ { "Keychron" },
+--
+2.51.0
+
--- /dev/null
+From 9501a2defebf46d2b3d30b7daf2ffb95294c8c54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 12:56:09 +0900
+Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
+
+From: David Phillips <david@profile.sh>
+
+[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ]
+
+New model in the ELECOM HUGE trackball line that has 8 buttons but the
+report descriptor specifies only 5. The HUGE Plus supports connecting via
+Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable.
+Each connection type reports a different device id, 01AA for cable,
+01AB for USB dongle, and 01AC for Bluetooth.
+
+This patch adds these device IDs and applies the fixups similar to the
+other ELECOM devices to get all 8 buttons working for all 3 connection
+types.
+
+For reference, the usbhid-dump output:
+001:013:001:DESCRIPTOR 1769085639.598405
+ 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01
+ 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01
+ 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10
+ 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06
+ 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0
+ C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01
+ 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01
+ 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03
+ 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00
+ A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81
+ 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26
+ FF 00 75 08 95 07 B1 02 C0
+
+Signed-off-by: David Phillips <david@profile.sh>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-elecom.c | 16 ++++++++++++++++
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 3 +++
+ 4 files changed, 23 insertions(+)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 920a64b66b25b..6ff4a3ad34cbf 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -369,6 +369,7 @@ config HID_ELECOM
+ - EX-G Trackballs (M-XT3DRBK, M-XT3URBK)
+ - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ - HUGE Plus Trackball (M-HT1MRBK)
+
+ config HID_ELO
+ tristate "ELO USB 4000/4500 touchscreen"
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index 2003d2dcda7cc..37d88ce57f671 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -5,6 +5,7 @@
+ * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK)
+ * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ * - HUGE Plus Trackball (M-HT1MRBK)
+ *
+ * Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
+ * Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
+@@ -123,12 +124,25 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
+ break;
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC:
++ /*
++ * Report descriptor format:
++ * 24: button bit count
++ * 28: padding bit count
++ * 22: button report size
++ * 16: button usage maximum
++ */
++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8);
++ break;
+ }
+ return rdesc;
+ }
+
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+@@ -142,6 +156,8 @@ static const struct hid_device_id elecom_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, elecom_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6d8b64872cefe..85ab1ac511096 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -466,6 +466,9 @@
+ #define USB_DEVICE_ID_ELECOM_M_HT1URBK_019B 0x019b
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac
+
+ #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34
+ #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 11438039cdb7f..3217e436c052c 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -420,6 +420,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC) },
+@@ -432,6 +433,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_ELO)
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
+--
+2.51.0
+
--- /dev/null
+From c6b565abbaca06e1eb3c40e86c32b49ed06330aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 17:40:41 +0800
+Subject: HID: i2c-hid: Add FocalTech FT8112
+
+From: Daniel Peng <Daniel_Peng@pegatron.corp-partner.google.com>
+
+[ Upstream commit 3d9586f1f90c9101b1abf5b0e9d70ca45f5f16db ]
+
+Information for touchscreen model HKO/RB116AS01-2 as below:
+- HID :FTSC1000
+- slave address:0X38
+- Interface:HID over I2C
+- Touch control lC:FT8112
+- I2C ID: PNP0C50
+
+Signed-off-by: Daniel Peng <Daniel_Peng@pegatron.corp-partner.google.com>
+Acked-by: Jiri Kosina <jkosina@suse.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patch.msgid.link/20251117094041.300083-2-Daniel_Peng@pegatron.corp-partner.google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-of-elan.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+index 0215f217f6d86..b81fcc6ff49ee 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c
++++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+@@ -168,6 +168,13 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = {
+ .power_after_backlight = true,
+ };
+
++static const struct elan_i2c_hid_chip_data focaltech_ft8112_chip_data = {
++ .post_power_delay_ms = 10,
++ .post_gpio_reset_on_delay_ms = 150,
++ .hid_descriptor_address = 0x0001,
++ .main_supply_name = "vcc33",
++};
++
+ static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = {
+ .post_power_delay_ms = 1,
+ .post_gpio_reset_on_delay_ms = 200,
+@@ -191,6 +198,7 @@ static const struct elan_i2c_hid_chip_data ilitek_ili2901_chip_data = {
+ static const struct of_device_id elan_i2c_hid_of_match[] = {
+ { .compatible = "elan,ekth6915", .data = &elan_ekth6915_chip_data },
+ { .compatible = "elan,ekth6a12nay", .data = &elan_ekth6a12nay_chip_data },
++ { .compatible = "focaltech,ft8112", .data = &focaltech_ft8112_chip_data },
+ { .compatible = "ilitek,ili9882t", .data = &ilitek_ili9882t_chip_data },
+ { .compatible = "ilitek,ili2901", .data = &ilitek_ili2901_chip_data },
+ { }
+--
+2.51.0
+
--- /dev/null
+From 829d3b7b961c0a877b3e403d99bb082a5d15562f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 13:12:02 +0100
+Subject: HID: logitech-hidpp: Add support for Logitech K980
+
+From: Bastien Nocera <hadess@hadess.net>
+
+[ Upstream commit af4fe07a9d963a72438ade96cf090e84b3399d0c ]
+
+Add support for the solar-charging Logitech K980 keyboard, over
+Bluetooth. Bolt traffic doesn't get routed through logitech-dj, so
+this code isn't triggered when Bolt is used.
+
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index e871f1729d4b3..ca96102121b85 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -4666,6 +4666,8 @@ static const struct hid_device_id hidpp_devices[] = {
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb037) },
+ { /* MX Anywhere 3SB mouse over Bluetooth */
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) },
++ { /* Slim Solar+ K980 Keyboard over Bluetooth */
++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 20212c5b55112c40fb681ee667f312570e3f788c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 09:57:05 +0100
+Subject: HID: multitouch: add eGalaxTouch EXC3188 support
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ]
+
+Add support for the for the EXC3188 touchscreen from eGalaxy.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 5a18cb41e6d79..6d8b64872cefe 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -437,6 +437,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
+
+ #define USB_VENDOR_ID_EDIFIER 0x2d99
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index f21850f7d89e4..7daa8f6d81870 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2212,6 +2212,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
++ { .driver_data = MT_CLS_EGALAX_SERIAL,
++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) },
+ { .driver_data = MT_CLS_EGALAX,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
+--
+2.51.0
+
--- /dev/null
+From 4e5be94779a2b1d5152744133cf7aea3c0c24e53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 21:35:47 -0500
+Subject: HID: multitouch: add quirks for Lenovo Yoga Book 9i
+
+From: Brian Howard <blhoward2@gmail.com>
+
+[ Upstream commit 822bc5b3744b0b2c2c9678aa1d80b2cf04fdfabf ]
+
+The Lenovo Yoga Book 9i is a dual-screen laptop, with a single composite
+USB device providing both touch and tablet interfaces for both screens.
+All inputs report through a single device, differentiated solely by report
+numbers. As there is no way for udev to differentiate the inputs based on
+USB vendor/product ID or interface numbers, custom naming is required to
+match against for downstream configuration. A firmware bug also results
+in an erroneous InRange message report being received after the stylus
+leaves proximity, blocking later touch events. Add required quirks for
+Gen 8 to Gen 10 models, including a new quirk providing for custom input
+device naming and dropping erroneous InRange reports.
+
+Signed-off-by: Brian Howard <blhoward2@gmail.com>
+Tested-by: Brian Howard <blhoward2@gmail.com>
+Tested-by: Kris Fredrick <linux.baguette800@slmail.me>
+Reported-by: Andrei Shumailov <gentoo1993@gmail.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220386
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 72 ++++++++++++++++++++++++++++++++++++
+ 2 files changed, 73 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 9c2bf584d9f6f..5a18cb41e6d79 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -841,6 +841,7 @@
+ #define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5
+ #define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe
+ #define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae
++#define USB_DEVICE_ID_LENOVO_YOGABOOK9I 0x6161
+ #define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E 0x600e
+ #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d
+ #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index b1c3ef1290587..f21850f7d89e4 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -76,6 +76,7 @@ MODULE_LICENSE("GPL");
+ #define MT_QUIRK_DISABLE_WAKEUP BIT(21)
+ #define MT_QUIRK_ORIENTATION_INVERT BIT(22)
+ #define MT_QUIRK_APPLE_TOUCHBAR BIT(23)
++#define MT_QUIRK_YOGABOOK9I BIT(24)
+
+ #define MT_INPUTMODE_TOUCHSCREEN 0x02
+ #define MT_INPUTMODE_TOUCHPAD 0x03
+@@ -231,6 +232,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app);
+ #define MT_CLS_RAZER_BLADE_STEALTH 0x0112
+ #define MT_CLS_SMART_TECH 0x0113
+ #define MT_CLS_APPLE_TOUCHBAR 0x0114
++#define MT_CLS_YOGABOOK9I 0x0115
+ #define MT_CLS_SIS 0x0457
+
+ #define MT_DEFAULT_MAXCONTACT 10
+@@ -427,6 +429,14 @@ static const struct mt_class mt_classes[] = {
+ .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
+ MT_QUIRK_ALWAYS_VALID |
+ MT_QUIRK_CONTACT_CNT_ACCURATE,
++ },
++ { .name = MT_CLS_YOGABOOK9I,
++ .quirks = MT_QUIRK_ALWAYS_VALID |
++ MT_QUIRK_FORCE_MULTI_INPUT |
++ MT_QUIRK_SEPARATE_APP_REPORT |
++ MT_QUIRK_HOVERING |
++ MT_QUIRK_YOGABOOK9I,
++ .export_all_inputs = true
+ },
+ { }
+ };
+@@ -1576,6 +1586,38 @@ static void mt_report(struct hid_device *hid, struct hid_report *report)
+ if (rdata && rdata->is_mt_collection)
+ return mt_touch_report(hid, rdata);
+
++ /* Lenovo Yoga Book 9i requires consuming and dropping certain bogus reports */
++ if (rdata && rdata->application &&
++ (rdata->application->quirks & MT_QUIRK_YOGABOOK9I)) {
++
++ bool all_zero_report = true;
++
++ for (int f = 0; f < report->maxfield && all_zero_report; f++) {
++ struct hid_field *fld = report->field[f];
++
++ for (int i = 0; i < fld->report_count; i++) {
++ unsigned int usage = fld->usage[i].hid;
++
++ if (usage == HID_DG_INRANGE ||
++ usage == HID_DG_TIPSWITCH ||
++ usage == HID_DG_BARRELSWITCH ||
++ usage == HID_DG_BARRELSWITCH2 ||
++ usage == HID_DG_CONTACTID ||
++ usage == HID_DG_TILT_X ||
++ usage == HID_DG_TILT_Y) {
++
++ if (fld->value[i] != 0) {
++ all_zero_report = false;
++ break;
++ }
++ }
++ }
++ }
++
++ if (all_zero_report)
++ return;
++ }
++
+ if (field && field->hidinput && field->hidinput->input)
+ input_sync(field->hidinput->input);
+ }
+@@ -1772,6 +1814,30 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ break;
+ }
+
++ /* Lenovo Yoga Book 9i requires custom naming to allow differentiation in udev */
++ if (hi->report && td->mtclass.quirks & MT_QUIRK_YOGABOOK9I) {
++ switch (hi->report->id) {
++ case 48:
++ suffix = "Touchscreen Top";
++ break;
++ case 56:
++ suffix = "Touchscreen Bottom";
++ break;
++ case 20:
++ suffix = "Stylus Top";
++ break;
++ case 40:
++ suffix = "Stylus Bottom";
++ break;
++ case 80:
++ suffix = "Emulated Touchpad";
++ break;
++ default:
++ suffix = "";
++ break;
++ }
++ }
++
+ if (suffix) {
+ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
+ "%s %s", hdev->name, suffix);
+@@ -2277,6 +2343,12 @@ static const struct hid_device_id mt_devices[] = {
+ USB_VENDOR_ID_LENOVO,
+ USB_DEVICE_ID_LENOVO_X12_TAB2) },
+
++ /* Lenovo Yoga Book 9i */
++ { .driver_data = MT_CLS_YOGABOOK9I,
++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
++ USB_VENDOR_ID_LENOVO,
++ USB_DEVICE_ID_LENOVO_YOGABOOK9I) },
++
+ /* Logitech devices */
+ { .driver_data = MT_CLS_NSMU,
+ HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8,
+--
+2.51.0
+
--- /dev/null
+From de6e7bb6fe811dbac9dbcfd1f4a2c564fcbb012e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Nov 2025 19:46:14 +0100
+Subject: HID: pidff: Do not set out of range trigger button
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+
+[ Upstream commit e01a029654f7fb67d7151365410aa22be4e63dbe ]
+
+Some games (mainly observed with Kylotonn's WRC Serises) set trigger
+button to a random value, or always the same one, out of range.
+I observed 307 and other values but, for example, my Moza R9 only
+exposes 128 buttons AND it's trigger button field is 8-bit. This causes
+errors to appear in dmesg.
+
+Only set the trigger button and trigger interval in the trigger button
+is in range of the field.
+
+Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/usbhid/hid-pidff.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
+index 95377c5f63356..a4e700b40ba9b 100644
+--- a/drivers/hid/usbhid/hid-pidff.c
++++ b/drivers/hid/usbhid/hid-pidff.c
+@@ -523,9 +523,19 @@ static void pidff_set_effect_report(struct pidff_device *pidff,
+ pidff_set_duration(&pidff->set_effect[PID_DURATION],
+ effect->replay.length);
+
+- pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = effect->trigger.button;
+- pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT],
+- effect->trigger.interval);
++ /* Some games set this to random values that can be out of range */
++ s32 trigger_button_max =
++ pidff->set_effect[PID_TRIGGER_BUTTON].field->logical_maximum;
++ if (effect->trigger.button <= trigger_button_max) {
++ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] =
++ effect->trigger.button;
++ pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT],
++ effect->trigger.interval);
++ } else {
++ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = 0;
++ pidff->set_effect[PID_TRIGGER_REPEAT_INT].value[0] = 0;
++ }
++
+ pidff->set_effect[PID_GAIN].value[0] =
+ pidff->set_effect[PID_GAIN].field->logical_maximum;
+
+--
+2.51.0
+
--- /dev/null
+From 00effe05d74df54eec15eed76bfb0e4f6abe1b29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 10:02:05 +0800
+Subject: hisi_acc_vfio_pci: fix the queue parameter anomaly issue
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit c3cbc276c2a33b04fc78a86cdb2ddce094cb3614 ]
+
+When the number of QPs initialized by the device, as read via vft, is zero,
+it indicates either an abnormal device configuration or an abnormal read
+result.
+Returning 0 directly in this case would allow the live migration operation
+to complete successfully, leading to incorrect parameter configuration after
+migration and preventing the service from recovering normal functionality.
+Therefore, in such situations, an error should be returned to roll back the
+live migration operation.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/20260122020205.2884497-5-liulongfang@huawei.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+index 8a05fb91929fb..2b8ac97cef2d2 100644
+--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+@@ -426,7 +426,7 @@ static int vf_qm_check_match(struct hisi_acc_vf_core_device *hisi_acc_vdev,
+ ret = qm_get_vft(vf_qm, &vf_qm->qp_base);
+ if (ret <= 0) {
+ dev_err(dev, "failed to get vft qp nums\n");
+- return ret;
++ return ret < 0 ? ret : -EINVAL;
+ }
+
+ if (ret != vf_data->qp_num) {
+--
+2.51.0
+
--- /dev/null
+From 6b2c231f885a99453419811786272625895a616a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 10:02:04 +0800
+Subject: hisi_acc_vfio_pci: resolve duplicate migration states
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit 8c6ac1730a977234dff74cc1753b4a953f59be7b ]
+
+In special scenarios involving duplicate migrations, after the
+first migration is completed, if the original VF device is used
+again and then migrated to another destination, the state indicating
+data migration completion for the VF device is not reset.
+This results in the second migration to the destination being skipped
+without performing data migration.
+After the modification, it ensures that a complete data migration
+is performed after the subsequent migration.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/20260122020205.2884497-4-liulongfang@huawei.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+index d1e8053640a98..8a05fb91929fb 100644
+--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+@@ -1570,6 +1570,7 @@ static int hisi_acc_vfio_pci_open_device(struct vfio_device *core_vdev)
+ }
+ hisi_acc_vdev->mig_state = VFIO_DEVICE_STATE_RUNNING;
+ hisi_acc_vdev->dev_opened = true;
++ hisi_acc_vdev->match_done = 0;
+ mutex_unlock(&hisi_acc_vdev->open_mutex);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4ce83b809da1b965d2d96133b96440de272b1065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 10:02:03 +0800
+Subject: hisi_acc_vfio_pci: update status after RAS error
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ]
+
+After a RAS error occurs on the accelerator device, the accelerator
+device will be reset. The live migration state will be abnormal
+after reset, and the original state needs to be restored during
+the reset process.
+Therefore, reset processing needs to be performed in a live
+migration scenario.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+index 2b8ac97cef2d2..e61df3fe0db99 100644
+--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+@@ -1215,8 +1215,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev)
+ if (hisi_acc_vdev->set_reset_flag)
+ clear_bit(QM_RESETTING, &qm->misc_ctl);
+
+- if (hisi_acc_vdev->core_device.vdev.migration_flags !=
+- VFIO_MIGRATION_STOP_COPY)
++ if (!hisi_acc_vdev->core_device.vdev.mig_ops)
+ return;
+
+ mutex_lock(&hisi_acc_vdev->state_mutex);
+--
+2.51.0
+
--- /dev/null
+From e24c1de7e9efb115cd6303084832c46f200fdaf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Dec 2025 21:03:43 +0100
+Subject: hwmon: (asus-ec-sensors) add Pro WS TRX50-SAGE WIFI A
+
+From: Robert McIntyre <rjmcinty@hotmail.com>
+
+[ Upstream commit af7e57d444141ac9e77b57296d59c3e965c4c4fa ]
+
+Adding support for Pro WS TRX50-SAGE WIFI A, which is identical
+sensors-wise to Pro WS TRX50-SAGE WIFI
+
+Signed-off-by: Robert McIntyre <rjmcinty@hotmail.com>
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20251213200531.259435-4-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hwmon/asus_ec_sensors.rst | 1 +
+ drivers/hwmon/asus-ec-sensors.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/Documentation/hwmon/asus_ec_sensors.rst b/Documentation/hwmon/asus_ec_sensors.rst
+index 232885f24430d..b5e1bc7ac0643 100644
+--- a/Documentation/hwmon/asus_ec_sensors.rst
++++ b/Documentation/hwmon/asus_ec_sensors.rst
+@@ -10,6 +10,7 @@ Supported boards:
+ * PRIME X670E-PRO WIFI
+ * PRIME Z270-A
+ * Pro WS TRX50-SAGE WIFI
++ * Pro WS TRX50-SAGE WIFI A
+ * Pro WS X570-ACE
+ * Pro WS WRX90E-SAGE SE
+ * ProArt X570-CREATOR WIFI
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index 61b18b88ee8ff..a1445799e23d8 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -793,6 +793,8 @@ static const struct dmi_system_id dmi_table[] = {
+ &board_info_pro_art_x870E_creator_wifi),
+ DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS TRX50-SAGE WIFI",
+ &board_info_pro_ws_trx50_sage_wifi),
++ DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS TRX50-SAGE WIFI A",
++ &board_info_pro_ws_trx50_sage_wifi),
+ DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS WRX90E-SAGE SE",
+ &board_info_pro_ws_wrx90e_sage_se),
+ DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS X570-ACE",
+--
+2.51.0
+
--- /dev/null
+From 7e63abbd4eeac6ebbf892223f21b202aa5f3fa6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jan 2026 01:06:10 +0100
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7080
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 46c3e87a79179454f741f797c274dd25f5c6125e ]
+
+The Dell OptiPlex 7080 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/16
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Acked-by: Pali Rohár <pali@kernel.org>
+Link: https://lore.kernel.org/r/20260104000654.6406-1-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 93143cfc157cf..038edffc1ac74 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1325,6 +1325,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "MP061"),
+ },
+ },
++ {
++ .ident = "Dell OptiPlex 7080",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7080"),
++ },
++ },
+ {
+ .ident = "Dell OptiPlex 7060",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 8cc3cc98a691a99f13ea847786bb876674366834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 21:51:48 +0800
+Subject: hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child
+
+From: Felix Gu <gu_0233@qq.com>
+
+[ Upstream commit 2954ce672b7623478c1cfeb69e6a6e4042a3656e ]
+
+When calling of_parse_phandle_with_args(), the caller is responsible
+to call of_node_put() to release the reference of device node.
+In emc2305_of_parse_pwm_child, it does not release the reference,
+causing a resource leak.
+
+Signed-off-by: Felix Gu <gu_0233@qq.com>
+Link: https://lore.kernel.org/r/tencent_738BA80BBF28F3440301EEE6F9E470165105@qq.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/emc2305.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c
+index ceae96c07ac45..67e82021da210 100644
+--- a/drivers/hwmon/emc2305.c
++++ b/drivers/hwmon/emc2305.c
+@@ -578,6 +578,7 @@ static int emc2305_of_parse_pwm_child(struct device *dev,
+ data->pwm_output_mask |= EMC2305_OPEN_DRAIN << ch;
+ }
+
++ of_node_put(args.np);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2bba701462cc1da5f3eeba182f15546e6ee56624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 13:10:40 +0800
+Subject: hwmon: (f71882fg) Add F81968 support
+
+From: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+
+[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ]
+
+Add hardware monitoring support for the Fintek F81968 Super I/O chip.
+It is fully compatible with F81866.
+
+Several products share compatibility with the F81866. To better distinguish
+between them, ensure that the Product ID is displayed when the device is
+probed.
+
+Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/f71882fg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
+index df83f9866fbcf..204059d2de6cd 100644
+--- a/drivers/hwmon/f71882fg.c
++++ b/drivers/hwmon/f71882fg.c
+@@ -51,6 +51,7 @@
+ #define SIO_F81866_ID 0x1010 /* Chipset ID */
+ #define SIO_F71858AD_ID 0x0903 /* Chipset ID */
+ #define SIO_F81966_ID 0x1502 /* Chipset ID */
++#define SIO_F81968_ID 0x1806 /* Chipset ID */
+
+ #define REGION_LENGTH 8
+ #define ADDR_REG_OFFSET 5
+@@ -2570,6 +2571,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ break;
+ case SIO_F81866_ID:
+ case SIO_F81966_ID:
++ case SIO_F81968_ID:
+ sio_data->type = f81866a;
+ break;
+ default:
+@@ -2599,9 +2601,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */
+
+ err = address;
+- pr_info("Found %s chip at %#x, revision %d\n",
++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n",
+ f71882fg_names[sio_data->type], (unsigned int)address,
+- (int)superio_inb(sioaddr, SIO_REG_DEVREV));
++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid);
+ exit:
+ superio_exit(sioaddr);
+ return err;
+--
+2.51.0
+
--- /dev/null
+From fecebdd33f75a79bf7d2f8c0f1f886f4796fa5c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 09:09:42 +1100
+Subject: hwmon: (nct6683) Add customer ID for ASRock Z590 Taichi
+
+From: Anj Duvnjak <avian@extremenerds.net>
+
+[ Upstream commit c0fa7879c9850bd4597740a79d4fac5ebfcf69cc ]
+
+Add support for customer ID 0x1621 found on ASRock Z590 Taichi
+boards using the Nuvoton NCT6686D embedded controller.
+
+This allows the driver to instantiate without requiring the
+force=1 module parameter.
+
+Tested on two separate ASRock Z590 Taichi boards, both with
+EC firmware version 1.0 build 01/25/21.
+
+Signed-off-by: Anj Duvnjak <avian@extremenerds.net>
+Link: https://lore.kernel.org/r/20251222220942.10762-1-avian@extremenerds.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hwmon/nct6683.rst | 1 +
+ drivers/hwmon/nct6683.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/Documentation/hwmon/nct6683.rst b/Documentation/hwmon/nct6683.rst
+index 3e549ba95a15a..45eec9dd349aa 100644
+--- a/Documentation/hwmon/nct6683.rst
++++ b/Documentation/hwmon/nct6683.rst
+@@ -65,6 +65,7 @@ AMD BC-250 NCT6686D EC firmware version 1.0 build 07/28/21
+ ASRock X570 NCT6683D EC firmware version 1.0 build 06/28/19
+ ASRock X670E NCT6686D EC firmware version 1.0 build 05/19/22
+ ASRock B650 Steel Legend WiFi NCT6686D EC firmware version 1.0 build 11/09/23
++ASRock Z590 Taichi NCT6686D EC firmware version 1.0 build 01/25/21
+ MSI B550 NCT6687D EC firmware version 1.0 build 05/07/20
+ MSI X670-P NCT6687D EC firmware version 0.0 build 09/27/22
+ MSI X870E NCT6687D EC firmware version 0.0 build 11/13/24
+diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
+index 6cda35388b24c..4a83804140386 100644
+--- a/drivers/hwmon/nct6683.c
++++ b/drivers/hwmon/nct6683.c
+@@ -181,6 +181,7 @@ superio_exit(int ioreg)
+ #define NCT6683_CUSTOMER_ID_ASROCK2 0xe1b
+ #define NCT6683_CUSTOMER_ID_ASROCK3 0x1631
+ #define NCT6683_CUSTOMER_ID_ASROCK4 0x163e
++#define NCT6683_CUSTOMER_ID_ASROCK5 0x1621
+
+ #define NCT6683_REG_BUILD_YEAR 0x604
+ #define NCT6683_REG_BUILD_MONTH 0x605
+@@ -1242,6 +1243,8 @@ static int nct6683_probe(struct platform_device *pdev)
+ break;
+ case NCT6683_CUSTOMER_ID_ASROCK4:
+ break;
++ case NCT6683_CUSTOMER_ID_ASROCK5:
++ break;
+ default:
+ if (!force)
+ return -ENODEV;
+--
+2.51.0
+
--- /dev/null
+From 059aeea30152a39947eda299cd12be327427baac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 17:53:14 +0200
+Subject: hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
+
+From: Denis Pauk <pauk.denis@gmail.com>
+
+[ Upstream commit 246167b17c14e8a5142368ac6457e81622055e0a ]
+
+Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's
+no use of it because of resource conflict with WMI method.
+
+Add the board to the WMI monitoring list.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807
+Signed-off-by: Denis Pauk <pauk.denis@gmail.com>
+Tested-by: Marcus <shoes2ga@gmail.com>
+Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775-platform.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c
+index c3a719aef1ace..555029dfe713f 100644
+--- a/drivers/hwmon/nct6775-platform.c
++++ b/drivers/hwmon/nct6775-platform.c
+@@ -1357,6 +1357,7 @@ static const char * const asus_msi_boards[] = {
+ "Pro WS W680-ACE IPMI",
+ "Pro WS W790-ACE",
+ "Pro WS W790E-SAGE SE",
++ "Pro WS WRX90E-SAGE SE",
+ "ProArt B650-CREATOR",
+ "ProArt B660-CREATOR D4",
+ "ProArt B760-CREATOR D4",
+--
+2.51.0
+
--- /dev/null
+From f44486736a4f8f4cbcb52ef8f08c97fed343502c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 21:54:15 +0800
+Subject: hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin
+
+From: Felix Gu <gu_0233@qq.com>
+
+[ Upstream commit 4923bbff0bcffe488b3aa76829c829bd15b02585 ]
+
+When calling of_parse_phandle_with_args(), the caller is responsible
+to call of_node_put() to release the reference of device node.
+In nct7363_present_pwm_fanin, it does not release the reference,
+causing a resource leak.
+
+Signed-off-by: Felix Gu <gu_0233@qq.com>
+Link: https://lore.kernel.org/r/tencent_9717645269E4C07D3D131F52201E12E5E10A@qq.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct7363.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/nct7363.c b/drivers/hwmon/nct7363.c
+index 71cef794835df..47fc1b4a0f3f9 100644
+--- a/drivers/hwmon/nct7363.c
++++ b/drivers/hwmon/nct7363.c
+@@ -349,6 +349,7 @@ static int nct7363_present_pwm_fanin(struct device *dev,
+ if (ret)
+ return ret;
+
++ of_node_put(args.np);
+ if (args.args[0] >= NCT7363_PWM_COUNT)
+ return -EINVAL;
+ data->pwm_mask |= BIT(args.args[0]);
+--
+2.51.0
+
--- /dev/null
+From 152bac995f1bc286b39c9db9a5220cd9632f6599 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:44 +0100
+Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ]
+
+The unpacked union within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value'
+ is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)'
+ and is usually due to 'struct hv_kvp_exchg_msg_value' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 361 | union {
+ | ^
+
+With the recent changes to compile-test the UAPI headers in more cases,
+this warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warning.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/hyperv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h
+index aaa502a7bff46..1749b35ab2c21 100644
+--- a/include/uapi/linux/hyperv.h
++++ b/include/uapi/linux/hyperv.h
+@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value {
+ __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE];
+ __u32 value_u32;
+ __u64 value_u64;
+- };
++ } __attribute__((packed));
+ } __attribute__((packed));
+
+ struct hv_kvp_msg_enumerate {
+--
+2.51.0
+
--- /dev/null
+From 65fa03ce6f37b45c9bc936f1a6e5131e610b14ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:08:51 -0500
+Subject: i3c: master: svc: Initialize 'dev' to NULL in
+ svc_i3c_master_ibi_isr()
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ]
+
+Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add
+a NULL check in the error path.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index a62f22ff8b576..857504d36e186 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -533,8 +533,8 @@ static int svc_i3c_master_handle_ibi_won(struct svc_i3c_master *master, u32 msta
+ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
+ {
+ struct svc_i3c_i2c_dev_data *data;
++ struct i3c_dev_desc *dev = NULL;
+ unsigned int ibitype, ibiaddr;
+- struct i3c_dev_desc *dev;
+ u32 status, val;
+ int ret;
+
+@@ -627,7 +627,7 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
+ * for the slave to interrupt again.
+ */
+ if (svc_i3c_master_error(master)) {
+- if (master->ibi.tbq_slot) {
++ if (master->ibi.tbq_slot && dev) {
+ data = i3c_dev_get_master_data(dev);
+ i3c_generic_ibi_recycle_slot(data->ibi_pool,
+ master->ibi.tbq_slot);
+--
+2.51.0
+
--- /dev/null
+From 2b0d2b441dcc08640ef2b7f0245affafcf76e300 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 09:26:42 +0200
+Subject: i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 78f63ae4a82db173f93adca462e63d11ba06b126 ]
+
+The MIPI I3C HCI specification does not define reset values for
+RING_OPERATION1 fields, and some controllers (e.g., Intel) do not clear
+them during a software reset. Ensure the ring pointers are explicitly
+set to zero during bus initialization to avoid inconsistent state.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260113072702.16268-2-adrian.hunter@intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/dma.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
+index c401a9425cdc5..951abfea5a6fd 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
+@@ -342,6 +342,14 @@ static int hci_dma_init(struct i3c_hci *hci)
+ rh_reg_write(INTR_SIGNAL_ENABLE, regval);
+
+ ring_ready:
++ /*
++ * The MIPI I3C HCI specification does not document reset values for
++ * RING_OPERATION1 fields and some controllers (e.g. Intel controllers)
++ * do not reset the values, so ensure the ring pointers are set to zero
++ * here.
++ */
++ rh_reg_write(RING_OPERATION1, 0);
++
+ rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE |
+ RING_CTRL_RUN_STOP);
+ }
+--
+2.51.0
+
--- /dev/null
+From cf96a5e97f16c6fa54cda456ce0190d3e560e36d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 18:44:07 +0200
+Subject: i3c: mipi-i3c-hci: Stop reading Extended Capabilities if capability
+ ID is 0
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 0818e4aa8fdeeed5973e0a8faeddc9da599fc897 ]
+
+Extended Capability ID value 0 is special. It signifies the end of the
+list. Stop reading Extended Capabilities if capability ID is 0.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260106164416.67074-3-adrian.hunter@intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/ext_caps.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c
+index 7714f00ea9cc0..533a495e14c86 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c
++++ b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c
+@@ -272,7 +272,7 @@ int i3c_hci_parse_ext_caps(struct i3c_hci *hci)
+ cap_length = FIELD_GET(CAP_HEADER_LENGTH, cap_header);
+ dev_dbg(&hci->master.dev, "id=0x%02x length=%d",
+ cap_id, cap_length);
+- if (!cap_length)
++ if (!cap_id || !cap_length)
+ break;
+ if (curr_cap + cap_length * 4 >= end) {
+ dev_err(&hci->master.dev,
+--
+2.51.0
+
--- /dev/null
+From 13154b53af98b99fa15461b1b681146038bb0afb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 05:45:19 +0000
+Subject: iio: bmi270_i2c: Add MODULE_DEVICE_TABLE for BMI260/270
+
+From: Derek J. Clark <derekjohn.clark@gmail.com>
+
+[ Upstream commit f69b5ac682dbc61e6aca806c22ce2ae74d598e45 ]
+
+Currently BMI260 & BMI270 devices do not automatically load this
+driver. To fix this, add missing MODULE_DEVICE_TABLE for the i2c,
+acpi, and of device tables so the driver will load when the hardware
+is detected.
+
+Tested on my OneXPlayer F1 Pro.
+
+Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bmi270/bmi270_i2c.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iio/imu/bmi270/bmi270_i2c.c b/drivers/iio/imu/bmi270/bmi270_i2c.c
+index b909a421ad017..b92da4e0776fa 100644
+--- a/drivers/iio/imu/bmi270/bmi270_i2c.c
++++ b/drivers/iio/imu/bmi270/bmi270_i2c.c
+@@ -37,6 +37,7 @@ static const struct i2c_device_id bmi270_i2c_id[] = {
+ { "bmi270", (kernel_ulong_t)&bmi270_chip_info },
+ { }
+ };
++MODULE_DEVICE_TABLE(i2c, bmi270_i2c_id);
+
+ static const struct acpi_device_id bmi270_acpi_match[] = {
+ /* GPD Win Mini, Aya Neo AIR Pro, OXP Mini Pro, etc. */
+@@ -45,12 +46,14 @@ static const struct acpi_device_id bmi270_acpi_match[] = {
+ { "BMI0260", (kernel_ulong_t)&bmi260_chip_info },
+ { }
+ };
++MODULE_DEVICE_TABLE(acpi, bmi270_acpi_match);
+
+ static const struct of_device_id bmi270_of_match[] = {
+ { .compatible = "bosch,bmi260", .data = &bmi260_chip_info },
+ { .compatible = "bosch,bmi270", .data = &bmi270_chip_info },
+ { }
+ };
++MODULE_DEVICE_TABLE(of, bmi270_of_match);
+
+ static struct i2c_driver bmi270_i2c_driver = {
+ .driver = {
+--
+2.51.0
+
--- /dev/null
+From 872d916f432aaf291c5ebc1aa509c7302c55c20e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:38 +0100
+Subject: iio: magnetometer: Remove IRQF_ONESHOT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+The force-threading functionality is required on PREEMPT_RT because the
+handler is using locks with can sleep on PREEMPT_RT.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index 3fd0171e5d69b..d30315ad85ded 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -581,7 +581,7 @@ static int ak8975_setup_irq(struct ak8975_data *data)
+ irq = gpiod_to_irq(data->eoc_gpiod);
+
+ rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ dev_name(&client->dev), data);
+ if (rc < 0) {
+ dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc);
+--
+2.51.0
+
--- /dev/null
+From 72ca19ce906bc97aa6e8dfbf8a24e01fc16c275d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:36 +0100
+Subject: iio: Use IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ]
+
+The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke
+other interrupt handler and this supposed to happen from within the
+hardirq.
+
+Use IRQF_NO_THREAD to forbid forced-threading.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/bma180.c | 5 +++--
+ drivers/iio/adc/ad7766.c | 2 +-
+ drivers/iio/gyro/itg3200_buffer.c | 8 +++-----
+ drivers/iio/light/si1145.c | 2 +-
+ 4 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
+index 8925f5279e627..7bc6761f51354 100644
+--- a/drivers/iio/accel/bma180.c
++++ b/drivers/iio/accel/bma180.c
+@@ -986,8 +986,9 @@ static int bma180_probe(struct i2c_client *client)
+ }
+
+ ret = devm_request_irq(dev, client->irq,
+- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING,
+- "bma180_event", data->trig);
++ iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "bma180_event", data->trig);
+ if (ret) {
+ dev_err(dev, "unable to request IRQ\n");
+ goto err_trigger_free;
+diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c
+index 4d570383ef025..1e6bfe8765ab3 100644
+--- a/drivers/iio/adc/ad7766.c
++++ b/drivers/iio/adc/ad7766.c
+@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi)
+ * don't enable the interrupt to avoid extra load on the system
+ */
+ ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq,
+- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD,
+ dev_name(&spi->dev),
+ ad7766->trig);
+ if (ret < 0)
+diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
+index a624400a239cb..cf97adfa97274 100644
+--- a/drivers/iio/gyro/itg3200_buffer.c
++++ b/drivers/iio/gyro/itg3200_buffer.c
+@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev)
+ if (!st->trig)
+ return -ENOMEM;
+
+- ret = request_irq(st->i2c->irq,
+- &iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_RISING,
+- "itg3200_data_rdy",
+- st->trig);
++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "itg3200_data_rdy", st->trig);
+ if (ret)
+ goto error_free_trig;
+
+diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c
+index f8eb251eca8dc..ef0abc4499b74 100644
+--- a/drivers/iio/light/si1145.c
++++ b/drivers/iio/light/si1145.c
+@@ -1248,7 +1248,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev)
+
+ ret = devm_request_irq(&client->dev, client->irq,
+ iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_FALLING,
++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD,
+ "si1145_irq",
+ trig);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From 77d5d5b7287cffe74455743ea6c3989d258395ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 15:54:06 +0100
+Subject: include: uapi: netfilter_bridge.h: Cover for musl libc
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ]
+
+Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
+zero. To avoid struct redefinition errors, user space is therefore
+supposed to include netinet/if_ether.h before (or instead of)
+linux/if_ether.h. To relieve them from this burden, include the libc
+header here if not building for kernel space.
+
+Reported-by: Alyssa Ross <hi@alyssa.is>
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter_bridge.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 1610fdbab98df..ad520d3e9df8f 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -5,6 +5,10 @@
+ /* bridge-specific defines for netfilter.
+ */
+
++#ifndef __KERNEL__
++#include <netinet/if_ether.h> /* for __UAPI_DEF_ETHHDR if defined */
++#endif
++
+ #include <linux/in.h>
+ #include <linux/netfilter.h>
+ #include <linux/if_ether.h>
+--
+2.51.0
+
--- /dev/null
+From ced0759f528817f941d9fbf4578c1dfd7332c201 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Feb 2026 18:35:34 -0700
+Subject: io_uring: add IORING_OP_URING_CMD128 to opcode checks
+
+From: Caleb Sander Mateos <csander@purestorage.com>
+
+[ Upstream commit 42a6bd57ee9f930a72c26f863c72f666d6ed9ea5 ]
+
+io_should_commit(), io_uring_classic_poll(), and io_do_iopoll() compare
+struct io_kiocb's opcode against IORING_OP_URING_CMD to implement
+special treatment for uring_cmds. The recently added opcode
+IORING_OP_URING_CMD128 is meant to be equivalent to IORING_OP_URING_CMD,
+so treat it the same way in these functions.
+
+Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED")
+Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
+Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
+Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/io_uring.h | 6 ++++++
+ io_uring/kbuf.c | 2 +-
+ io_uring/rw.c | 4 ++--
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
+index a790c16854d32..0f096f44d34bf 100644
+--- a/io_uring/io_uring.h
++++ b/io_uring/io_uring.h
+@@ -595,6 +595,12 @@ static inline bool io_file_can_poll(struct io_kiocb *req)
+ return false;
+ }
+
++static inline bool io_is_uring_cmd(const struct io_kiocb *req)
++{
++ return req->opcode == IORING_OP_URING_CMD ||
++ req->opcode == IORING_OP_URING_CMD128;
++}
++
+ static inline ktime_t io_get_time(struct io_ring_ctx *ctx)
+ {
+ if (ctx->clockid == CLOCK_MONOTONIC)
+diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
+index 67d4fe576473a..dae5b4ab3819c 100644
+--- a/io_uring/kbuf.c
++++ b/io_uring/kbuf.c
+@@ -171,7 +171,7 @@ static bool io_should_commit(struct io_kiocb *req, unsigned int issue_flags)
+ return true;
+
+ /* uring_cmd commits kbuf upfront, no need to auto-commit */
+- if (!io_file_can_poll(req) && req->opcode != IORING_OP_URING_CMD)
++ if (!io_file_can_poll(req) && !io_is_uring_cmd(req))
+ return true;
+ return false;
+ }
+diff --git a/io_uring/rw.c b/io_uring/rw.c
+index 28555bc85ba0f..01367ac09531a 100644
+--- a/io_uring/rw.c
++++ b/io_uring/rw.c
+@@ -1253,7 +1253,7 @@ static int io_uring_classic_poll(struct io_kiocb *req, struct io_comp_batch *iob
+ {
+ struct file *file = req->file;
+
+- if (req->opcode == IORING_OP_URING_CMD) {
++ if (io_is_uring_cmd(req)) {
+ struct io_uring_cmd *ioucmd;
+
+ ioucmd = io_kiocb_to_cmd(req, struct io_uring_cmd);
+@@ -1376,7 +1376,7 @@ int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin)
+ break;
+ nr_events++;
+ req->cqe.flags = io_put_kbuf(req, req->cqe.res, NULL);
+- if (req->opcode != IORING_OP_URING_CMD)
++ if (!io_is_uring_cmd(req))
+ io_req_rw_cleanup(req, 0);
+ }
+ if (unlikely(!nr_events))
+--
+2.51.0
+
--- /dev/null
+From b766b4a1150fa92e19c3f00cfc7164801da0b3b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 09:53:43 -0700
+Subject: io_uring/timeout: annotate data race in io_flush_timeouts()
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 42b12cb5fd4554679bac06bbdd05dc8b643bcc42 ]
+
+syzbot correctly reports this as a KCSAN race, as ctx->cached_cq_tail
+should be read under ->uring_lock. This isn't immediately feasible in
+io_flush_timeouts(), but as long as we read a stable value, that should
+be good enough. If two io-wq threads compete on this value, then they
+will both end up calling io_flush_timeouts() and at least one of them
+will see the correct value.
+
+Reported-by: syzbot+6c48db7d94402407301e@syzkaller.appspotmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/timeout.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/timeout.c b/io_uring/timeout.c
+index d8fbbaf31cf35..84dda24f3eb24 100644
+--- a/io_uring/timeout.c
++++ b/io_uring/timeout.c
+@@ -130,7 +130,7 @@ __cold void io_flush_timeouts(struct io_ring_ctx *ctx)
+ u32 seq;
+
+ raw_spin_lock_irq(&ctx->timeout_lock);
+- seq = ctx->cached_cq_tail - atomic_read(&ctx->cq_timeouts);
++ seq = READ_ONCE(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts);
+
+ list_for_each_entry_safe(timeout, tmp, &ctx->timeout_list, list) {
+ struct io_kiocb *req = cmd_to_io_kiocb(timeout);
+--
+2.51.0
+
--- /dev/null
+From 417226f5eefb92eda4fe1c62bf20e54e25966300 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 14:39:40 +0000
+Subject: iommu/amd: move wait_on_sem() out of spinlock
+
+From: Ankit Soni <Ankit.Soni@amd.com>
+
+[ Upstream commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf ]
+
+With iommu.strict=1, the existing completion wait path can cause soft
+lockups under stressed environment, as wait_on_sem() busy-waits under the
+spinlock with interrupts disabled.
+
+Move the completion wait in iommu_completion_wait() out of the spinlock.
+wait_on_sem() only polls the hardware-updated cmd_sem and does not require
+iommu->lock, so holding the lock during the busy wait unnecessarily
+increases contention and extends the time with interrupts disabled.
+
+Signed-off-by: Ankit Soni <Ankit.Soni@amd.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 0f9045ce93af1..c5f7e003d01c9 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -1180,7 +1180,12 @@ static int wait_on_sem(struct amd_iommu *iommu, u64 data)
+ {
+ int i = 0;
+
+- while (*iommu->cmd_sem != data && i < LOOP_TIMEOUT) {
++ /*
++ * cmd_sem holds a monotonically non-decreasing completion sequence
++ * number.
++ */
++ while ((__s64)(READ_ONCE(*iommu->cmd_sem) - data) < 0 &&
++ i < LOOP_TIMEOUT) {
+ udelay(1);
+ i += 1;
+ }
+@@ -1432,14 +1437,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+
+ ret = __iommu_queue_command_sync(iommu, &cmd, false);
++ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++
+ if (ret)
+- goto out_unlock;
++ return ret;
+
+ ret = wait_on_sem(iommu, data);
+
+-out_unlock:
+- raw_spin_unlock_irqrestore(&iommu->lock, flags);
+-
+ return ret;
+ }
+
+@@ -3115,13 +3119,18 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+ ret = __iommu_queue_command_sync(iommu, &cmd, true);
+ if (ret)
+- goto out;
++ goto out_err;
+ ret = __iommu_queue_command_sync(iommu, &cmd2, false);
+ if (ret)
+- goto out;
++ goto out_err;
++ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++
+ wait_on_sem(iommu, data);
+-out:
++ return;
++
++out_err:
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++ return;
+ }
+
+ static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data)
+--
+2.51.0
+
--- /dev/null
+From 43bf5fba7bb71fd497de8590c4eea2bb66c44d9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 15:30:38 +0000
+Subject: iommu/amd: serialize sequence allocation under concurrent TLB
+ invalidations
+
+From: Ankit Soni <Ankit.Soni@amd.com>
+
+[ Upstream commit 9e249c48412828e807afddc21527eb734dc9bd3d ]
+
+With concurrent TLB invalidations, completion wait randomly gets timed out
+because cmd_sem_val was incremented outside the IOMMU spinlock, allowing
+CMD_COMPL_WAIT commands to be queued out of sequence and breaking the
+ordering assumption in wait_on_sem().
+Move the cmd_sem_val increment under iommu->lock so completion sequence
+allocation is serialized with command queuing.
+And remove the unnecessary return.
+
+Fixes: d2a0cac10597 ("iommu/amd: move wait_on_sem() out of spinlock")
+
+Tested-by: Srikanth Aithal <sraithal@amd.com>
+Reported-by: Srikanth Aithal <sraithal@amd.com>
+Signed-off-by: Ankit Soni <Ankit.Soni@amd.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/amd_iommu_types.h | 2 +-
+ drivers/iommu/amd/init.c | 2 +-
+ drivers/iommu/amd/iommu.c | 18 ++++++++++++------
+ 3 files changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
+index 320733e7d8b42..3b09da3ffb74f 100644
+--- a/drivers/iommu/amd/amd_iommu_types.h
++++ b/drivers/iommu/amd/amd_iommu_types.h
+@@ -706,7 +706,7 @@ struct amd_iommu {
+
+ u32 flags;
+ volatile u64 *cmd_sem;
+- atomic64_t cmd_sem_val;
++ u64 cmd_sem_val;
+ /*
+ * Track physical address to directly use it in build_completion_wait()
+ * and avoid adding any special checks and handling for kdump.
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 62a7a718acf8f..58d6f5ae155f2 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -1877,7 +1877,7 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h,
+ iommu->pci_seg = pci_seg;
+
+ raw_spin_lock_init(&iommu->lock);
+- atomic64_set(&iommu->cmd_sem_val, 0);
++ iommu->cmd_sem_val = 0;
+
+ /* Add IOMMU to internal data structures */
+ list_add_tail(&iommu->list, &amd_iommu_list);
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index c5f7e003d01c9..e216b5a13d49d 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -1417,6 +1417,12 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd)
+ return iommu_queue_command_sync(iommu, cmd, true);
+ }
+
++static u64 get_cmdsem_val(struct amd_iommu *iommu)
++{
++ lockdep_assert_held(&iommu->lock);
++ return ++iommu->cmd_sem_val;
++}
++
+ /*
+ * This function queues a completion wait command into the command
+ * buffer of an IOMMU
+@@ -1431,11 +1437,11 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
+ if (!iommu->need_sync)
+ return 0;
+
+- data = atomic64_inc_return(&iommu->cmd_sem_val);
+- build_completion_wait(&cmd, iommu, data);
+-
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+
++ data = get_cmdsem_val(iommu);
++ build_completion_wait(&cmd, iommu, data);
++
+ ret = __iommu_queue_command_sync(iommu, &cmd, false);
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
+
+@@ -3113,10 +3119,11 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
+ return;
+
+ build_inv_irt(&cmd, devid);
+- data = atomic64_inc_return(&iommu->cmd_sem_val);
+- build_completion_wait(&cmd2, iommu, data);
+
+ raw_spin_lock_irqsave(&iommu->lock, flags);
++ data = get_cmdsem_val(iommu);
++ build_completion_wait(&cmd2, iommu, data);
++
+ ret = __iommu_queue_command_sync(iommu, &cmd, true);
+ if (ret)
+ goto out_err;
+@@ -3130,7 +3137,6 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
+
+ out_err:
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
+- return;
+ }
+
+ static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data)
+--
+2.51.0
+
--- /dev/null
+From 186b094d204682ba2f6ec569ee19bb55a866daca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 13:28:57 -0800
+Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
+
+From: Alexander Grest <Alexander.Grest@microsoft.com>
+
+[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ]
+
+The SMMU CMDQ lock is highly contentious when there are multiple CPUs
+issuing commands and the queue is nearly full.
+
+The lock has the following states:
+ - 0: Unlocked
+ - >0: Shared lock held with count
+ - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters
+ - INT_MIN: Exclusive lock held, no shared waiters
+
+When multiple CPUs are polling for space in the queue, they attempt to
+grab the exclusive lock to update the cons pointer from the hardware. If
+they fail to get the lock, they will spin until either the cons pointer
+is updated by another CPU.
+
+The current code allows the possibility of shared lock starvation
+if there is a constant stream of CPUs trying to grab the exclusive lock.
+This leads to severe latency issues and soft lockups.
+
+Consider the following scenario where CPU1's attempt to acquire the
+shared lock is starved by CPU2 and CPU0 contending for the exclusive
+lock.
+
+CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock`
+--------------------------------------------------------------------------
+trylock() //takes | | | 0
+ | shared_lock() | | INT_MIN
+ | fetch_inc() | | INT_MIN
+ | no return | | INT_MIN + 1
+ | spins // VAL >= 0 | | INT_MIN + 1
+unlock() | spins... | | INT_MIN + 1
+set_release(0) | spins... | | 0 see[NOTE]
+(done) | (sees 0) | trylock() // takes | 0
+ | *exits loop* | cmpxchg(0, INT_MIN) | 0
+ | | *cuts in* | INT_MIN
+ | cmpxchg(0, 1) | | INT_MIN
+ | fails // != 0 | | INT_MIN
+ | spins // VAL >= 0 | | INT_MIN
+ | *starved* | | INT_MIN
+
+[NOTE] The current code resets the exclusive lock to 0 regardless of the
+state of the lock. This causes two problems:
+1. It opens the possibility of back-to-back exclusive locks and the
+ downstream effect of starving shared lock.
+2. The count of shared lock waiters are lost.
+
+To mitigate this, we release the exclusive lock by only clearing the sign
+bit while retaining the shared lock waiter count as a way to avoid
+starving the shared lock waiters.
+
+Also deleted cmpxchg loop while trying to acquire the shared lock as it
+is not needed. The waiters can see the positive lock count and proceed
+immediately after the exclusive lock is released.
+
+Exclusive lock is not starved in that submitters will try exclusive lock
+first when new spaces become available.
+
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Alexander Grest <Alexander.Grest@microsoft.com>
+Signed-off-by: Jacob Pan <jacob.pan@linux.microsoft.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++-------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+index d16d35c78c068..7a6aea3b61c11 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+@@ -487,20 +487,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
+ */
+ static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq)
+ {
+- int val;
+-
+ /*
+- * We can try to avoid the cmpxchg() loop by simply incrementing the
+- * lock counter. When held in exclusive state, the lock counter is set
+- * to INT_MIN so these increments won't hurt as the value will remain
+- * negative.
++ * When held in exclusive state, the lock counter is set to INT_MIN
++ * so these increments won't hurt as the value will remain negative.
++ * The increment will also signal the exclusive locker that there are
++ * shared waiters.
+ */
+ if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0)
+ return;
+
+- do {
+- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0);
+- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val);
++ /*
++ * Someone else is holding the lock in exclusive state, so wait
++ * for them to finish. Since we already incremented the lock counter,
++ * no exclusive lock can be acquired until we finish. We don't need
++ * the return value since we only care that the exclusive lock is
++ * released (i.e. the lock counter is non-negative).
++ * Once the exclusive locker releases the lock, the sign bit will
++ * be cleared and our increment will make the lock counter positive,
++ * allowing us to proceed.
++ */
++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0);
+ }
+
+ static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq)
+@@ -527,9 +533,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq)
+ __ret; \
+ })
+
++/*
++ * Only clear the sign bit when releasing the exclusive lock this will
++ * allow any shared_lock() waiters to proceed without the possibility
++ * of entering the exclusive lock in a tight loop.
++ */
+ #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \
+ ({ \
+- atomic_set_release(&cmdq->lock, 0); \
++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \
+ local_irq_restore(flags); \
+ })
+
+--
+2.51.0
+
--- /dev/null
+From 8eb9631facdf2e122aef8f0c6da5c420233ab48e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 04:35:24 +0000
+Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ]
+
+syzbot reported that struct fib_alias.fa_state can be
+modified locklessly by RCU readers. [0]
+
+Let's use READ_ONCE()/WRITE_ONCE() properly.
+
+[0]:
+BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup
+
+write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0:
+ fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline]
+ fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1:
+ fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline]
+ fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+value changed: 0x00 -> 0x01
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
+
+Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/fib_lookup.h | 6 ++++--
+ net/ipv4/fib_trie.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
+index f9b9e26c32c19..0b72796dd1ad3 100644
+--- a/net/ipv4/fib_lookup.h
++++ b/net/ipv4/fib_lookup.h
+@@ -28,8 +28,10 @@ struct fib_alias {
+ /* Don't write on fa_state unless needed, to keep it shared on all cpus */
+ static inline void fib_alias_accessed(struct fib_alias *fa)
+ {
+- if (!(fa->fa_state & FA_S_ACCESSED))
+- fa->fa_state |= FA_S_ACCESSED;
++ u8 fa_state = READ_ONCE(fa->fa_state);
++
++ if (!(fa_state & FA_S_ACCESSED))
++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED);
+ }
+
+ /* Exported by fib_semantics.c */
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 7e2c17fec3fc4..1308213791f19 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1280,7 +1280,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
+ new_fa->fa_dscp = fa->fa_dscp;
+ new_fa->fa_info = fi;
+ new_fa->fa_type = cfg->fc_type;
+- state = fa->fa_state;
++ state = READ_ONCE(fa->fa_state);
+ new_fa->fa_state = state & ~FA_S_ACCESSED;
+ new_fa->fa_slen = fa->fa_slen;
+ new_fa->tb_id = tb->tb_id;
+@@ -1745,7 +1745,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb,
+
+ fib_remove_alias(t, tp, l, fa_to_delete);
+
+- if (fa_to_delete->fa_state & FA_S_ACCESSED)
++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED)
+ rt_cache_flush(cfg->fc_nlinfo.nl_net);
+
+ fib_release_info(fa_to_delete->fa_info);
+--
+2.51.0
+
--- /dev/null
+From 74aedc818e5d21089b86d27fbc6b8463cad0f5b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 17:22:47 +0000
+Subject: ipv4: igmp: annotate data-races around idev->mr_maxdelay
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit e4faaf65a75f650ac4366ddff5dabb826029ca5a ]
+
+idev->mr_maxdelay is read and written locklessly,
+add READ_ONCE()/WRITE_ONCE() annotations.
+
+While we are at it, make this field an u32.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/inetdevice.h | 2 +-
+ net/ipv4/igmp.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index 5730ba6b1cfaf..dccbeb25f7014 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -38,11 +38,11 @@ struct in_device {
+ struct ip_mc_list *mc_tomb;
+ unsigned long mr_v1_seen;
+ unsigned long mr_v2_seen;
+- unsigned long mr_maxdelay;
+ unsigned long mr_qi; /* Query Interval */
+ unsigned long mr_qri; /* Query Response Interval */
+ unsigned char mr_qrv; /* Query Robustness Variable */
+ unsigned char mr_gq_running;
++ u32 mr_maxdelay;
+ u32 mr_ifc_count;
+ struct timer_list mr_gq_timer; /* general query timer */
+ struct timer_list mr_ifc_timer; /* interface change timer */
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 7182f1419c2a4..0adc993c211d7 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -227,7 +227,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
+
+ static void igmp_gq_start_timer(struct in_device *in_dev)
+ {
+- int tv = get_random_u32_below(in_dev->mr_maxdelay);
++ int tv = get_random_u32_below(READ_ONCE(in_dev->mr_maxdelay));
+ unsigned long exp = jiffies + tv + 2;
+
+ if (in_dev->mr_gq_running &&
+@@ -1009,7 +1009,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
+ if (!max_delay)
+ max_delay = 1; /* can't mod w/ 0 */
+- in_dev->mr_maxdelay = max_delay;
++ WRITE_ONCE(in_dev->mr_maxdelay, max_delay);
+
+ /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently
+ * received value was zero, use the default or statically
+--
+2.51.0
+
--- /dev/null
+From b92d2c96e0eed9ccd9d157fb9524a8260b4a934f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:37 +0000
+Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ]
+
+Add missing READ_ONCE() when reading sysctl values.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ipv6.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 6a933690e0ff5..e759a00dbde19 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -1010,11 +1010,11 @@ static inline int ip6_default_np_autolabel(struct net *net)
+ #if IS_ENABLED(CONFIG_IPV6)
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_policy;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy);
+ }
+ static inline u32 ip6_multipath_hash_fields(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_fields;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields);
+ }
+ #else
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+--
+2.51.0
+
--- /dev/null
+From dc79e005d1c5edd292ca6a814c00e806cd008b5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:41 +0000
+Subject: ipv6: annotate data-races in net/ipv6/route.c
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f062e8e25102324364aada61b8283356235bc3c1 ]
+
+sysctls are read while their values can change,
+add READ_ONCE() annotations.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-9-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index e3a260a5564ba..cd229974b7974 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2895,7 +2895,7 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu)
+
+ dst_metric_set(&rt->dst, RTAX_MTU, mtu);
+ rt->rt6i_flags |= RTF_MODIFIED;
+- rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
++ rt6_update_expires(rt, READ_ONCE(net->ipv6.sysctl.ip6_rt_mtu_expires));
+ }
+
+ static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
+@@ -3256,8 +3256,8 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
+ rcu_read_lock();
+
+ net = dst_dev_net_rcu(dst);
+- if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
+- mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
++ mtu = max_t(unsigned int, mtu,
++ READ_ONCE(net->ipv6.sysctl.ip6_rt_min_advmss));
+
+ rcu_read_unlock();
+
+@@ -3359,10 +3359,10 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
+ static void ip6_dst_gc(struct dst_ops *ops)
+ {
+ struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
+- int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
+- int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
+- int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
+- unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
++ int rt_min_interval = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_min_interval);
++ int rt_elasticity = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_elasticity);
++ int rt_gc_timeout = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_timeout);
++ unsigned long rt_last_gc = READ_ONCE(net->ipv6.ip6_rt_last_gc);
+ unsigned int val;
+ int entries;
+
+@@ -5008,7 +5008,7 @@ void rt6_sync_down_dev(struct net_device *dev, unsigned long event)
+ };
+ struct net *net = dev_net(dev);
+
+- if (net->ipv6.sysctl.skip_notify_on_dev_down)
++ if (READ_ONCE(net->ipv6.sysctl.skip_notify_on_dev_down))
+ fib6_clean_all_skip_notify(net, fib6_ifdown, &arg);
+ else
+ fib6_clean_all(net, fib6_ifdown, &arg);
+@@ -6408,6 +6408,7 @@ void fib6_rt_update(struct net *net, struct fib6_info *rt,
+ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,
+ bool offload, bool trap, bool offload_failed)
+ {
++ u8 fib_notify_on_flag_change;
+ struct sk_buff *skb;
+ int err;
+
+@@ -6419,8 +6420,9 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,
+ WRITE_ONCE(f6i->offload, offload);
+ WRITE_ONCE(f6i->trap, trap);
+
++ fib_notify_on_flag_change = READ_ONCE(net->ipv6.sysctl.fib_notify_on_flag_change);
+ /* 2 means send notifications only if offload_failed was changed. */
+- if (net->ipv6.sysctl.fib_notify_on_flag_change == 2 &&
++ if (fib_notify_on_flag_change == 2 &&
+ READ_ONCE(f6i->offload_failed) == offload_failed)
+ return;
+
+@@ -6432,7 +6434,7 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,
+ */
+ return;
+
+- if (!net->ipv6.sysctl.fib_notify_on_flag_change)
++ if (!fib_notify_on_flag_change)
+ return;
+
+ skb = nlmsg_new(rt6_nlmsg_size(f6i), GFP_KERNEL);
+@@ -6529,7 +6531,7 @@ static int ipv6_sysctl_rtcache_flush(const struct ctl_table *ctl, int write,
+ return ret;
+
+ net = (struct net *)ctl->extra1;
+- delay = net->ipv6.sysctl.flush_delay;
++ delay = READ_ONCE(net->ipv6.sysctl.flush_delay);
+ fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 3f3ced5132677e010c3532658571c137342aa5fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:38 +0000
+Subject: ipv6: annotate data-races over sysctl.flowlabel_reflect
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5ade47c974b46eb2a1279185962a0ffa15dc5450 ]
+
+Add missing READ_ONCE() when reading ipv6.sysctl.flowlabel_reflect,
+as its value can be changed under us.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-6-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/af_inet6.c | 4 ++--
+ net/ipv6/icmp.c | 3 ++-
+ net/ipv6/tcp_ipv6.c | 3 ++-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index d3534bdb805da..56d453a598ec6 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -224,8 +224,8 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
+ inet6_set_bit(MC6_LOOP, sk);
+ inet6_set_bit(MC6_ALL, sk);
+ np->pmtudisc = IPV6_PMTUDISC_WANT;
+- inet6_assign_bit(REPFLOW, sk, net->ipv6.sysctl.flowlabel_reflect &
+- FLOWLABEL_REFLECT_ESTABLISHED);
++ inet6_assign_bit(REPFLOW, sk, READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
++ FLOWLABEL_REFLECT_ESTABLISHED);
+ sk->sk_ipv6only = net->ipv6.sysctl.bindv6only;
+ sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash);
+
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index 55b1aa75ab802..0f41ca6f3d83e 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -953,7 +953,8 @@ static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb)
+ tmp_hdr.icmp6_type = type;
+
+ memset(&fl6, 0, sizeof(fl6));
+- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
++ FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
+ fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb));
+
+ fl6.flowi6_proto = IPPROTO_ICMPV6;
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 280fe59785598..4ae664b05fa91 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1085,7 +1085,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb,
+ txhash = inet_twsk(sk)->tw_txhash;
+ }
+ } else {
+- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_TCP_RESET)
++ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
++ FLOWLABEL_REFLECT_TCP_RESET)
+ label = ip6_flowlabel(ipv6h);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1e05fc117b409547bce99a94e2e489ba93599fda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:40 +0000
+Subject: ipv6: exthdrs: annotate data-race over multiple sysctl
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ]
+
+Following four sysctls can change under us, add missing READ_ONCE().
+
+- ipv6.sysctl.max_dst_opts_len
+- ipv6.sysctl.max_dst_opts_cnt
+- ipv6.sysctl.max_hbh_opts_len
+- ipv6.sysctl.max_hbh_opts_cnt
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/exthdrs.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index a23eb8734e151..54088fa0c09d0 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -314,7 +314,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_dst_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len))
+ goto fail_and_free;
+
+ opt->lastopt = opt->dst1 = skb_network_header_len(skb);
+@@ -322,7 +322,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ dstbuf = opt->dst1;
+ #endif
+
+- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) {
++ if (ip6_parse_tlv(false, skb,
++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ #if IS_ENABLED(CONFIG_IPV6_MIP6)
+@@ -1049,11 +1050,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len))
+ goto fail_and_free;
+
+ opt->flags |= IP6SKB_HOPBYHOP;
+- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) {
++ if (ip6_parse_tlv(true, skb,
++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ opt->nhoff = sizeof(struct ipv6hdr);
+--
+2.51.0
+
--- /dev/null
+From 3f1bd0876ee1c6c0f6d9305a51ce1ef6c5977a06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:07:40 +0800
+Subject: irqchip/riscv-imsic: Add a CPU pm notifier to restore the IMSIC on
+ exit
+
+From: Nick Hu <nick.hu@sifive.com>
+
+[ Upstream commit f48b4bd0915bf61ac12b8c65c7939ebd03bc8abf ]
+
+The IMSIC might be reset when the system enters a low power state, but on
+exit nothing restores the registers, which prevents interrupt delivery.
+
+Solve this by registering a CPU power management notifier, which restores
+the IMSIC on exit.
+
+Signed-off-by: Nick Hu <nick.hu@sifive.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Reviewed-by: Cyan Yang <cyan.yang@sifive.com>
+Reviewed-by: Anup Patel <anup@brainfault.org>
+Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
+Link: https://patch.msgid.link/20251202-preserve-aplic-imsic-v3-1-1844fbf1fe92@sifive.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-riscv-imsic-early.c | 39 ++++++++++++++++++++-----
+ 1 file changed, 31 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/irqchip/irq-riscv-imsic-early.c b/drivers/irqchip/irq-riscv-imsic-early.c
+index 6bac67cc0b6d9..ba903fa689bd5 100644
+--- a/drivers/irqchip/irq-riscv-imsic-early.c
++++ b/drivers/irqchip/irq-riscv-imsic-early.c
+@@ -7,6 +7,7 @@
+ #define pr_fmt(fmt) "riscv-imsic: " fmt
+ #include <linux/acpi.h>
+ #include <linux/cpu.h>
++#include <linux/cpu_pm.h>
+ #include <linux/export.h>
+ #include <linux/interrupt.h>
+ #include <linux/init.h>
+@@ -123,14 +124,8 @@ static void imsic_handle_irq(struct irq_desc *desc)
+ chained_irq_exit(chip, desc);
+ }
+
+-static int imsic_starting_cpu(unsigned int cpu)
++static void imsic_hw_states_init(void)
+ {
+- /* Mark per-CPU IMSIC state as online */
+- imsic_state_online();
+-
+- /* Enable per-CPU parent interrupt */
+- enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq));
+-
+ /* Setup IPIs */
+ imsic_ipi_starting_cpu();
+
+@@ -142,6 +137,18 @@ static int imsic_starting_cpu(unsigned int cpu)
+
+ /* Enable local interrupt delivery */
+ imsic_local_delivery(true);
++}
++
++static int imsic_starting_cpu(unsigned int cpu)
++{
++ /* Mark per-CPU IMSIC state as online */
++ imsic_state_online();
++
++ /* Enable per-CPU parent interrupt */
++ enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq));
++
++ /* Initialize the IMSIC registers to enable the interrupt delivery */
++ imsic_hw_states_init();
+
+ return 0;
+ }
+@@ -157,6 +164,22 @@ static int imsic_dying_cpu(unsigned int cpu)
+ return 0;
+ }
+
++static int imsic_pm_notifier(struct notifier_block *self, unsigned long cmd, void *v)
++{
++ switch (cmd) {
++ case CPU_PM_EXIT:
++ /* Initialize the IMSIC registers to enable the interrupt delivery */
++ imsic_hw_states_init();
++ break;
++ }
++
++ return NOTIFY_OK;
++}
++
++static struct notifier_block imsic_pm_notifier_block = {
++ .notifier_call = imsic_pm_notifier,
++};
++
+ static int __init imsic_early_probe(struct fwnode_handle *fwnode)
+ {
+ struct irq_domain *domain;
+@@ -194,7 +217,7 @@ static int __init imsic_early_probe(struct fwnode_handle *fwnode)
+ cpuhp_setup_state(CPUHP_AP_IRQ_RISCV_IMSIC_STARTING, "irqchip/riscv/imsic:starting",
+ imsic_starting_cpu, imsic_dying_cpu);
+
+- return 0;
++ return cpu_pm_register_notifier(&imsic_pm_notifier_block);
+ }
+
+ static int __init imsic_early_dt_init(struct device_node *node, struct device_node *parent)
+--
+2.51.0
+
--- /dev/null
+From 538cdf2c25bc9ff90c19aa39aa0f5be8f9888e5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 19:38:01 +0800
+Subject: jfs: Add missing set_freezable() for freezable kthread
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ]
+
+The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(),
+causing it to remain non-freezable by default. This prevents proper
+freezing during system suspend.
+
+Add set_freezable() to make the thread freezable as intended.
+
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_logmgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
+index b343c5ea11592..5b1c5da041630 100644
+--- a/fs/jfs/jfs_logmgr.c
++++ b/fs/jfs/jfs_logmgr.c
+@@ -2311,6 +2311,7 @@ int jfsIOWait(void *arg)
+ {
+ struct lbuf *bp;
+
++ set_freezable();
+ do {
+ spin_lock_irq(&log_redrive_lock);
+ while ((bp = log_redrive_list)) {
+--
+2.51.0
+
--- /dev/null
+From 684f96a0085aa6d77a19e4f0e6616c17e57215f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 13:22:12 +0100
+Subject: jfs: nlink overflow in jfs_rename
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ]
+
+If nlink is maximal for a directory (-1) and inside that directory you
+perform a rename for some child directory (not moving from the parent),
+then the nlink of the first directory is first incremented and later
+decremented. Normally this is fine, but when nlink = -1 this causes a
+wrap around to 0, and then drop_nlink issues a warning.
+
+After applying the patch syzbot no longer issues any warnings. I also
+ran some basic fs tests to look for any regressions.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
+Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/namei.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
+index 65a218eba8faf..7879c049632b3 100644
+--- a/fs/jfs/namei.c
++++ b/fs/jfs/namei.c
+@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ jfs_err("jfs_rename: dtInsert returned -EIO");
+ goto out_tx;
+ }
+- if (S_ISDIR(old_ip->i_mode))
++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
+ inc_nlink(new_dir);
+ }
+ /*
+@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ goto out_tx;
+ }
+ if (S_ISDIR(old_ip->i_mode)) {
+- drop_nlink(old_dir);
++ if (new_ip || old_dir != new_dir)
++ drop_nlink(old_dir);
++
+ if (old_dir != new_dir) {
+ /*
+ * Change inode number of parent for moved directory
+--
+2.51.0
+
--- /dev/null
+From ef8165d95fedbd2d98ce19f60caaa7cace3b3155 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 14:20:22 +0530
+Subject: kselftest/kublk: include message in _Static_assert for C11
+ compatibility
+
+From: Clint George <clintbgeorge@gmail.com>
+
+[ Upstream commit 3e6ad272bb8b3199bad952e7b077102af2d8df03 ]
+
+Add descriptive message in the _Static_assert to comply with the C11
+standard requirement to prevent compiler from throwing out error. The
+compiler throws an error when _Static_assert is used without a message as
+that is a C23 extension.
+
+[] Testing:
+The diff between before and after of running the kselftest test of the
+module shows no regression on system with x86 architecture
+
+[] Error log:
+~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk$ make LLVM=1 W=1
+ CC kublk
+In file included from kublk.c:6:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from null.c:3:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from file_backed.c:3:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from common.c:3:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from stripe.c:3:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+In file included from fault_inject.c:11:
+./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
+ 220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ | ^
+ | , ""
+1 error generated.
+make: *** [../lib.mk:225: ~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk/kublk] Error 1
+
+Link: https://lore.kernel.org/r/20251215085022.7642-1-clintbgeorge@gmail.com
+Signed-off-by: Clint George <clintbgeorge@gmail.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ublk/kublk.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ublk/kublk.h b/tools/testing/selftests/ublk/kublk.h
+index 8a83b90ec603a..cae2e30f0cdd5 100644
+--- a/tools/testing/selftests/ublk/kublk.h
++++ b/tools/testing/selftests/ublk/kublk.h
+@@ -223,7 +223,7 @@ static inline __u64 build_user_data(unsigned tag, unsigned op,
+ unsigned tgt_data, unsigned q_id, unsigned is_target_io)
+ {
+ /* we only have 7 bits to encode q_id */
+- _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
++ _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7, "UBLK_MAX_QUEUES_SHIFT must be <= 7");
+ assert(!(tag >> 16) && !(op >> 8) && !(tgt_data >> 16) && !(q_id >> 7));
+
+ return tag | (op << 16) | (tgt_data << 24) |
+--
+2.51.0
+
--- /dev/null
+From 4dcbc95f995888d39bd5fbfb00c42fae16518ad3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 16:30:50 +0200
+Subject: libceph: define and enforce CEPH_MAX_KEY_LEN
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ]
+
+When decoding the key, verify that the key material would fit into
+a fixed-size buffer in process_auth_done() and generally has a sane
+length.
+
+The new CEPH_MAX_KEY_LEN check replaces the existing check for a key
+with no key material which is a) not universal since CEPH_CRYPTO_NONE
+has to be excluded and b) doesn't provide much value since a smaller
+than needed key is just as invalid as no key -- this has to be handled
+elsewhere anyway.
+
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/crypto.c | 8 +++++---
+ net/ceph/crypto.h | 2 +-
+ net/ceph/messenger_v2.c | 2 +-
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
+index 01b2ce1e8fc06..5601732cf4faa 100644
+--- a/net/ceph/crypto.c
++++ b/net/ceph/crypto.c
+@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf)
+ return -ENOTSUPP;
+ }
+
+- if (!key->len)
+- return -EINVAL;
+-
+ key->key = kmemdup(buf, key->len, GFP_NOIO);
+ if (!key->key) {
+ ret = -ENOMEM;
+@@ -83,6 +80,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
+ ceph_decode_copy(p, &key->created, sizeof(key->created));
+ key->len = ceph_decode_16(p);
+ ceph_decode_need(p, end, key->len, bad);
++ if (key->len > CEPH_MAX_KEY_LEN) {
++ pr_err("secret too big %d\n", key->len);
++ return -EINVAL;
++ }
++
+ ret = set_secret(key, *p);
+ memzero_explicit(*p, key->len);
+ *p += key->len;
+diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h
+index 23de29fc613cf..a20bad6d1e964 100644
+--- a/net/ceph/crypto.h
++++ b/net/ceph/crypto.h
+@@ -5,7 +5,7 @@
+ #include <linux/ceph/types.h>
+ #include <linux/ceph/buffer.h>
+
+-#define CEPH_KEY_LEN 16
++#define CEPH_MAX_KEY_LEN 16
+ #define CEPH_MAX_CON_SECRET_LEN 64
+
+ /*
+diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
+index c9d50c0dcd33a..31e042dc1b3f2 100644
+--- a/net/ceph/messenger_v2.c
++++ b/net/ceph/messenger_v2.c
+@@ -2360,7 +2360,7 @@ static int process_auth_reply_more(struct ceph_connection *con,
+ */
+ static int process_auth_done(struct ceph_connection *con, void *p, void *end)
+ {
+- u8 session_key_buf[CEPH_KEY_LEN + 16];
++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16];
+ u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16];
+ u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16);
+ u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16);
+--
+2.51.0
+
--- /dev/null
+From 8fd189335ce117ee54e418802790af4d838e72b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:09:18 -0800
+Subject: libperf build: Always place libperf includes first
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ]
+
+When building tools/perf the CFLAGS can contain a directory for the
+installed headers.
+
+As the headers may be being installed while building libperf.a this can
+cause headers to be partially installed and found in the include path
+while building an object file for libperf.a.
+
+The installed header may reference other installed headers that are
+missing given the partial nature of the install and then the build fails
+with a missing header file.
+
+Avoid this by ensuring the libperf source headers are always first in
+the CFLAGS.
+
+Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index 7fbb50b74c00b..5c64122bf5374 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -51,9 +51,9 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
++override CFLAGS := $(INCLUDES) $(CFLAGS)
+ override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+-override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += $(EXTRA_CFLAGS)
+--
+2.51.0
+
--- /dev/null
+From 002db3b1bfb26ae45abddf88a04c0b1451cb77c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 16:36:32 -0500
+Subject: libsubcmd: Fix null intersection case in exclude_cmds()
+
+From: Sri Jayaramappa <sjayaram@akamai.com>
+
+[ Upstream commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8 ]
+
+When there is no exclusion occurring from the cmds list - for example -
+cmds contains ["read-vdso32"] and excludes contains ["archive"] - the
+main loop completes with ci == cj == 0. In the original code the loop
+processing the remaining elements in the list was conditional:
+
+ if (ci != cj) { ...}
+
+So we end up in the assertion loop since ci < cmds->cnt and we
+incorrectly try to assert the list elements to be NULL and fail with
+the following error
+
+ help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+Fix this by moving the if (ci != cj) check inside of a broader loop.
+If ci != cj, left shift the list elements, as before, and then
+unconditionally advance the ci and cj indicies which also covers the
+ci == cj case.
+
+Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()")
+Reviewed-by: Guilherme Amadio <amadio@gentoo.org>
+Signed-off-by: Sri Jayaramappa <sjayaram@akamai.com>
+Tested-by: Guilherme Amadio <amadio@gentoo.org>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: Joshua Hunt <johunt@akamai.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index ddaeb4eb3e249..db94aa685b73b 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -97,11 +97,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ ei++;
+ }
+ }
+- if (ci != cj) {
+- while (ci < cmds->cnt) {
+- cmds->names[cj++] = cmds->names[ci];
+- cmds->names[ci++] = NULL;
++ while (ci < cmds->cnt) {
++ if (ci != cj) {
++ cmds->names[cj] = cmds->names[ci];
++ cmds->names[ci] = NULL;
+ }
++ ci++;
++ cj++;
+ }
+ for (ci = cj; ci < cmds->cnt; ci++)
+ assert(cmds->names[ci] == NULL);
+--
+2.51.0
+
--- /dev/null
+From b357d8f3771a9c3f92b2cbfdab4cf1e4dfd59fc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Dec 2025 21:04:01 +0900
+Subject: m68k: nommu: fix memmove() with differently aligned src and dest for
+ 68000
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ]
+
+68000 has different alignment needs to 68020+.
+memcpy() checks if the destination is aligned and does a smaller copy
+to fix the alignment and then critically for 68000 it checks if the
+source is still unaligned and if it is reverts to smaller copies.
+
+memmove() does not currently do the second part and malfunctions if
+one of the pointers is aligned and the other isn't.
+
+This is apparently getting triggered by printk. If I put breakpoints
+into the new checks added by this commit the first hit looks like this:
+
+memmove (n=205, src=0x2f3971 <printk_shared_pbufs+205>, dest=0x2f3980 <printk_shared_pbufs+220>) at arch/m68k/lib/memmove.c:82
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Signed-off-by: Greg Ungerer <gerg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/lib/memmove.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c
+index 6519f7f349f66..e33f00b02e4c0 100644
+--- a/arch/m68k/lib/memmove.c
++++ b/arch/m68k/lib/memmove.c
+@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *cdest++ = *csrc++;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *--cdest = *--csrc;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+--
+2.51.0
+
--- /dev/null
+From b1e4381c6c0de944def6f68e072b77856c63aff5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:24 +0100
+Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ]
+
+request_threaded_irq() is invoked with a primary and a secondary handler
+and no flags are passed. The primary handler is the same as
+irq_default_primary_handler() so there is no need to have an identical
+copy.
+
+The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt
+source is not masked while the threaded handler is active. This means,
+especially on LEVEL typed interrupt lines, the interrupt can fire again
+before the threaded handler had a chance to run.
+
+Use the default primary interrupt handler by specifying NULL and set
+IRQF_ONESHOT so the interrupt source is masked until the secondary handler
+is done.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index 41f79e51d9e5a..4255fefc3a5a0 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset)
+
+ /* ====== FlexRM interrupt handler ===== */
+
+-static irqreturn_t flexrm_irq_event(int irq, void *dev_id)
+-{
+- /* We only have MSI for completions so just wakeup IRQ thread */
+- /* Ring related errors will be informed via completion descriptors */
+-
+- return IRQ_WAKE_THREAD;
+-}
+-
+ static irqreturn_t flexrm_irq_thread(int irq, void *dev_id)
+ {
+ flexrm_process_completions(dev_id);
+@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan)
+ ret = -ENODEV;
+ goto fail_free_cmpl_memory;
+ }
+- ret = request_threaded_irq(ring->irq,
+- flexrm_irq_event,
+- flexrm_irq_thread,
+- 0, dev_name(ring->mbox->dev), ring);
++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread,
++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring);
+ if (ret) {
+ dev_err(ring->mbox->dev,
+ "failed to request ring%d IRQ\n", ring->num);
+--
+2.51.0
+
--- /dev/null
+From 9f24311e211defd7d842782c4d8c79b3f3e16bf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 16:00:54 +0800
+Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP
+
+From: Jacky Bai <ping.bai@nxp.com>
+
+[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ]
+
+In current imx-mailbox driver, the MU IRQ is configured with
+'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow,
+the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx:
+fix wakeup failure from freeze mode"), if the MU IRQ is triggered after
+the priv->suspended flag has been set, the system suspend will be
+aborted.
+
+On i.MX7ULP platform, certain drivers that depend on rpmsg may need
+to send rpmsg request and receive an acknowledgment from the remote
+core during the late_suspend stage. Early suspend abort is not
+expected, and the i.MX7ULP already has additional hardware and
+software to make sure the system can be wakeup from freeze mode
+correctly when MU IRQ is trigger.
+
+Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the
+early abort when doing suspend.
+
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/imx-mailbox.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
+index 6778afc64a048..003f9236c35e0 100644
+--- a/drivers/mailbox/imx-mailbox.c
++++ b/drivers/mailbox/imx-mailbox.c
+@@ -122,6 +122,7 @@ struct imx_mu_dcfg {
+ u32 xRR; /* Receive Register0 */
+ u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */
+ u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */
++ bool skip_suspend_flag;
+ };
+
+ #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x))))
+@@ -988,6 +989,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = {
+ .xRR = 0x40,
+ .xSR = {0x60, 0x60, 0x60, 0x60},
+ .xCR = {0x64, 0x64, 0x64, 0x64, 0x64},
++ .skip_suspend_flag = true,
+ };
+
+ static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = {
+@@ -1071,7 +1073,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev)
+ priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = true;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = true;
+
+ return 0;
+ }
+@@ -1094,7 +1097,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev)
+ imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = false;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = false;
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 2aaa874b22ccaa39ceee55e5996bbb1c09b525f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 13:49:22 +0000
+Subject: mailbox: mchp-ipc-sbi: fix out-of-bounds access in
+ mchp_ipc_get_cluster_aggr_irq()
+
+From: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+
+[ Upstream commit f7c330a8c83c9b0332fd524097eaf3e69148164d ]
+
+The cluster_cfg array is dynamically allocated to hold per-CPU
+configuration structures, with its size based on the number of online
+CPUs. Previously, this array was indexed using hartid, which may be
+non-contiguous or exceed the bounds of the array, leading to
+out-of-bounds access.
+Switch to using cpuid as the index, as it is guaranteed to be within
+the valid range provided by for_each_online_cpu().
+
+Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mailbox-mchp-ipc-sbi.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+index a6e52009a4245..d444491a584e8 100644
+--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c
++++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+@@ -180,20 +180,20 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data)
+ /* Find out the hart that originated the irq */
+ for_each_online_cpu(i) {
+ hartid = cpuid_to_hartid_map(i);
+- if (irq == ipc->cluster_cfg[hartid].irq)
++ if (irq == ipc->cluster_cfg[i].irq)
+ break;
+ }
+
+ status_msg.cluster = hartid;
+- memcpy(ipc->cluster_cfg[hartid].buf_base, &status_msg, sizeof(struct mchp_ipc_status));
++ memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status));
+
+- ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[hartid].buf_base_addr);
++ ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr);
+ if (ret < 0) {
+ dev_err_ratelimited(ipc->dev, "could not get IHC irq status ret=%d\n", ret);
+ return IRQ_HANDLED;
+ }
+
+- memcpy(&status_msg, ipc->cluster_cfg[hartid].buf_base, sizeof(struct mchp_ipc_status));
++ memcpy(&status_msg, ipc->cluster_cfg[i].buf_base, sizeof(struct mchp_ipc_status));
+
+ /*
+ * Iterate over each bit set in the IHC interrupt status register (IRQ_STATUS) to identify
+@@ -385,21 +385,21 @@ static int mchp_ipc_get_cluster_aggr_irq(struct mchp_ipc_sbi_mbox *ipc)
+ if (ret <= 0)
+ continue;
+
+- ipc->cluster_cfg[hartid].irq = ret;
+- ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[hartid].irq,
++ ipc->cluster_cfg[cpuid].irq = ret;
++ ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[cpuid].irq,
+ mchp_ipc_cluster_aggr_isr, IRQF_SHARED,
+ "miv-ihc-irq", ipc);
+ if (ret)
+ return ret;
+
+- ipc->cluster_cfg[hartid].buf_base = devm_kmalloc(ipc->dev,
+- sizeof(struct mchp_ipc_status),
+- GFP_KERNEL);
++ ipc->cluster_cfg[cpuid].buf_base = devm_kmalloc(ipc->dev,
++ sizeof(struct mchp_ipc_status),
++ GFP_KERNEL);
+
+- if (!ipc->cluster_cfg[hartid].buf_base)
++ if (!ipc->cluster_cfg[cpuid].buf_base)
+ return -ENOMEM;
+
+- ipc->cluster_cfg[hartid].buf_base_addr = __pa(ipc->cluster_cfg[hartid].buf_base);
++ ipc->cluster_cfg[cpuid].buf_base_addr = __pa(ipc->cluster_cfg[cpuid].buf_base);
+
+ irq_found = true;
+ }
+--
+2.51.0
+
--- /dev/null
+From aad7142e4fa733221a7a6a777f3142eb71755beb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 10:33:59 +0000
+Subject: mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch
+ warnings
+
+From: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+
+[ Upstream commit bc4d17e495cd3b02bcb2e10f575763a5ff31f80b ]
+
+Fix uninitialized symbol 'hartid' warning in mchp_ipc_cluster_aggr_isr()
+by introducing a 'found' flag to track whether the IRQ matches any
+online hart. If no match is found, return IRQ_NONE.
+
+Also fix other smatch warnings by removing dead code in
+mchp_ipc_startup() and by returning -ENODEV in dev_err_probe() if the
+Microchip SBI extension is not found.
+
+Fixes below smatch warnings:
+drivers/mailbox/mailbox-mchp-ipc-sbi.c:187 mchp_ipc_cluster_aggr_isr() error: uninitialized symbol 'hartid'.
+drivers/mailbox/mailbox-mchp-ipc-sbi.c:324 mchp_ipc_startup() warn: ignoring unreachable code.
+drivers/mailbox/mailbox-mchp-ipc-sbi.c:422 mchp_ipc_probe() warn: passing zero to 'dev_err_probe'
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512171533.CDLdScMY-lkp@intel.com/
+Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mailbox-mchp-ipc-sbi.c | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+index d444491a584e8..b87bf2fb4b9b9 100644
+--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c
++++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+@@ -174,17 +174,21 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data)
+ struct mchp_ipc_msg ipc_msg;
+ struct mchp_ipc_status status_msg;
+ int ret;
+- unsigned long hartid;
+ u32 i, chan_index, chan_id;
++ bool found = false;
+
+ /* Find out the hart that originated the irq */
+ for_each_online_cpu(i) {
+- hartid = cpuid_to_hartid_map(i);
+- if (irq == ipc->cluster_cfg[i].irq)
++ if (irq == ipc->cluster_cfg[i].irq) {
++ found = true;
+ break;
++ }
+ }
+
+- status_msg.cluster = hartid;
++ if (unlikely(!found))
++ return IRQ_NONE;
++
++ status_msg.cluster = cpuid_to_hartid_map(i);
+ memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status));
+
+ ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr);
+@@ -321,13 +325,6 @@ static int mchp_ipc_startup(struct mbox_chan *chan)
+ goto fail_free_buf_msg_rx;
+ }
+
+- if (ret) {
+- dev_err(ipc->dev, "failed to register interrupt(s)\n");
+- goto fail_free_buf_msg_rx;
+- }
+-
+- return ret;
+-
+ fail_free_buf_msg_rx:
+ kfree(chan_info->msg_buf_rx);
+ fail_free_buf_msg_tx:
+@@ -419,7 +416,7 @@ static int mchp_ipc_probe(struct platform_device *pdev)
+
+ ret = sbi_probe_extension(SBI_EXT_MICROCHIP_TECHNOLOGY);
+ if (ret <= 0)
+- return dev_err_probe(dev, ret, "Microchip SBI extension not detected\n");
++ return dev_err_probe(dev, -ENODEV, "Microchip SBI extension not detected\n");
+
+ ipc = devm_kzalloc(dev, sizeof(*ipc), GFP_KERNEL);
+ if (!ipc)
+--
+2.51.0
+
--- /dev/null
+From 30747ba20a629590f0a9d0e0d571fb261e6c03ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 14:07:40 +0000
+Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ]
+
+The PCC code currently specifies IRQF_ONESHOT if the interrupt could
+potentially be shared but doesn't actually use request_threaded_irq() and
+the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is
+never relevant. Since commit aef30c8d569c ("genirq: Warn about using
+IRQF_ONESHOT without a threaded handler") specifying it has resulted in a
+WARN_ON(), fix this by removing IRQF_ONESHOT.
+
+Reported-by: Aishwarya TCV <Aishwarya.TCV@arm.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/pcc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
+index 0e0a66359d4c3..713022aed2e2f 100644
+--- a/drivers/mailbox/pcc.c
++++ b/drivers/mailbox/pcc.c
+@@ -459,7 +459,7 @@ static int pcc_startup(struct mbox_chan *chan)
+
+ if (pchan->plat_irq > 0) {
+ irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ?
+- IRQF_SHARED | IRQF_ONESHOT : 0;
++ IRQF_SHARED : 0;
+ rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq,
+ irqflags, MBOX_IRQ_NAME, chan);
+ if (unlikely(rc)) {
+--
+2.51.0
+
--- /dev/null
+From 7b8798168e478c4eec7597b207d233b7f7696a88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:36 +0100
+Subject: mailbox: sprd: clear delivery flag before handling TX done
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ]
+
+If there are any pending messages in the mailbox queue, they are sent
+as soon as a TX done event arrives from the driver. This may trigger a
+new delivery interrupt while the previous one is still being handled.
+If the delivery status is cleared after this, the interrupt is lost.
+To prevent this from happening, clear the delivery status immediately
+after checking it and before any new messages are sent.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index c1a5fe6cc8771..46d0c34177ab9 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -166,6 +166,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ return IRQ_NONE;
+ }
+
++ /* Clear FIFO delivery and overflow status first */
++ writel(fifo_sts &
++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
++ priv->inbox_base + SPRD_MBOX_FIFO_RST);
++
+ while (send_sts) {
+ id = __ffs(send_sts);
+ send_sts &= (send_sts - 1);
+@@ -181,11 +186,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ mbox_chan_txdone(chan, 0);
+ }
+
+- /* Clear FIFO delivery and overflow status */
+- writel(fifo_sts &
+- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
+- priv->inbox_base + SPRD_MBOX_FIFO_RST);
+-
+ /* Clear irq status */
+ writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS);
+
+--
+2.51.0
+
--- /dev/null
+From 0b69c6597148a0dcc1d1491a370734f92c92fc18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:38 +0100
+Subject: mailbox: sprd: mask interrupts that are not handled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ]
+
+To reduce the amount of spurious interrupts, disable the interrupts that
+are not handled in this driver.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index ee8539dfcef54..c1a5fe6cc8771 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -243,21 +243,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan)
+ /* Select outbox FIFO mode and reset the outbox FIFO status */
+ writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST);
+
+- /* Enable inbox FIFO overflow and delivery interrupt */
+- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ);
++ /* Enable inbox FIFO delivery interrupt */
++ val = SPRD_INBOX_FIFO_IRQ_MASK;
++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ;
+ writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable outbox FIFO not empty interrupt */
+- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ val = SPRD_OUTBOX_FIFO_IRQ_MASK;
+ val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable supplementary outbox as the fundamental one */
+ if (priv->supp_base) {
+ writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST);
+- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From d5248ddecd2dbde003a6e23ba510ecc5e3b29f9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 14:59:03 +0000
+Subject: md-cluster: fix NULL pointer dereference in process_metadata_update
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ]
+
+The function process_metadata_update() blindly dereferences the 'thread'
+pointer (acquired via rcu_dereference_protected) within the wait_event()
+macro.
+
+While the code comment states "daemon thread must exist", there is a valid
+race condition window during the MD array startup sequence (md_run):
+
+1. bitmap_load() is called, which invokes md_cluster_ops->join().
+2. join() starts the "cluster_recv" thread (recv_daemon).
+3. At this point, recv_daemon is active and processing messages.
+4. However, mddev->thread (the main MD thread) is not initialized until
+ later in md_run().
+
+If a METADATA_UPDATED message is received from a remote node during this
+specific window, process_metadata_update() will be called while
+mddev->thread is still NULL, leading to a kernel panic.
+
+To fix this, we must validate the 'thread' pointer. If it is NULL, we
+release the held lock (no_new_dev_lockres) and return early, safely
+ignoring the update request as the array is not yet fully ready to
+process it.
+
+Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-cluster.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index 11f1e91d387d8..896279988dfd5 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -549,8 +549,13 @@ static void process_metadata_update(struct mddev *mddev, struct cluster_msg *msg
+
+ dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_CR);
+
+- /* daemaon thread must exist */
+ thread = rcu_dereference_protected(mddev->thread, true);
++ if (!thread) {
++ pr_warn("md-cluster: Received metadata update but MD thread is not ready\n");
++ dlm_unlock_sync(cinfo->no_new_dev_lockres);
++ return;
++ }
++
+ wait_event(thread->wqueue,
+ (got_lock = mddev_trylock(mddev)) ||
+ test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state));
+--
+2.51.0
+
--- /dev/null
+From de310b6b850319ee12df6cd597ce7494d0312e51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 18:52:21 +0100
+Subject: md raid: fix hang when stopping arrays with metadata through dm-raid
+
+From: Heinz Mauelshagen <heinzm@redhat.com>
+
+[ Upstream commit cefcb9297fbdb6d94b61787b4f8d84f55b741470 ]
+
+When using device-mapper's dm-raid target, stopping a RAID array can cause
+the system to hang under specific conditions.
+
+This occurs when:
+
+- A dm-raid managed device tree is suspended from top to bottom
+ (the top-level RAID device is suspended first, followed by its
+ underlying metadata and data devices)
+
+- The top-level RAID device is then removed
+
+Removing the top-level device triggers a hang in the following sequence:
+the dm-raid destructor calls md_stop(), which tries to flush the
+write-intent bitmap by writing to the metadata sub-devices. However, these
+devices are already suspended, making them unable to complete the write-intent
+operations and causing an indefinite block.
+
+Fix:
+
+- Prevent bitmap flushing when md_stop() is called from dm-raid
+destructor context
+ and avoid a quiescing/unquescing cycle which could also cause I/O
+
+- Still allow write-intent bitmap flushing when called from dm-raid
+suspend context
+
+This ensures that RAID array teardown can complete successfully even when the
+underlying devices are in a suspended state.
+
+This second patch uses md_is_rdwr() to distinguish between suspend and
+destructor paths as elaborated on above.
+
+Link: https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 6d73f6e196a9f..ac71640ff3a81 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6848,13 +6848,15 @@ static void __md_stop_writes(struct mddev *mddev)
+ {
+ timer_delete_sync(&mddev->safemode_timer);
+
+- if (mddev->pers && mddev->pers->quiesce) {
+- mddev->pers->quiesce(mddev, 1);
+- mddev->pers->quiesce(mddev, 0);
+- }
++ if (md_is_rdwr(mddev) || !mddev_is_dm(mddev)) {
++ if (mddev->pers && mddev->pers->quiesce) {
++ mddev->pers->quiesce(mddev, 1);
++ mddev->pers->quiesce(mddev, 0);
++ }
+
+- if (md_bitmap_enabled(mddev, true))
+- mddev->bitmap_ops->flush(mddev);
++ if (md_bitmap_enabled(mddev, true))
++ mddev->bitmap_ops->flush(mddev);
++ }
+
+ if (md_is_rdwr(mddev) &&
+ ((!mddev->in_sync && !mddev_is_clustered(mddev)) ||
+--
+2.51.0
+
--- /dev/null
+From a123bb3f24f08f117891d328cfce6eab33edf179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 15:29:57 +0100
+Subject: media: adv7180: fix frame interval in progressive mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ]
+
+The ADV7280-M may internally convert interlaced video input to
+progressive video. If this mode is enabled, the ADV7280-M delivers
+progressive video frames at the field rate of 50 fields per second (PAL)
+or 60 fields per second (NTSC).
+
+Fix the reported frame interval if progressive video is enabled.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 378f4e6af12cb..5cbc973df684d 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -507,6 +507,13 @@ static int adv7180_get_frame_interval(struct v4l2_subdev *sd,
+ fi->interval.denominator = 25;
+ }
+
++ /*
++ * If the de-interlacer is active, the chip produces full video frames
++ * at the field rate.
++ */
++ if (state->field == V4L2_FIELD_NONE)
++ fi->interval.denominator *= 2;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6bd6e24e70f7011a6531965f60245b06928f31a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 11:02:22 +0800
+Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
+
+From: Ming Qian <ming.qian@oss.nxp.com>
+
+[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ]
+
+The V4L2_DEC_CMD_START command may be used to handle the dynamic source
+change, which will triggers an implicit decoder drain.
+The last_buffer_dequeued flag is set in the implicit decoder drain,
+so driver need to clear it to continue the following decoding flow.
+
+Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vdec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
+index c0d2aabb9e0e3..f25dbcebdccf6 100644
+--- a/drivers/media/platform/amphion/vdec.c
++++ b/drivers/media/platform/amphion/vdec.c
+@@ -724,6 +724,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd
+ switch (cmd->cmd) {
+ case V4L2_DEC_CMD_START:
+ vdec_cmd_start(inst);
++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx));
+ break;
+ case V4L2_DEC_CMD_STOP:
+ vdec_cmd_stop(inst);
+--
+2.51.0
+
--- /dev/null
+From 8a42ed8f11f4cda93219a1d73c8aadab6c7f8c25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 15:46:17 -0500
+Subject: media: chips-media: wave5: Fix conditional in start_streaming
+
+From: Brandon Brnich <b-brnich@ti.com>
+
+[ Upstream commit b4e26c6fc1b3c225caf80d4a95c6f9fcbe959e17 ]
+
+When STREAMON(CAP) is called after STREAMON(OUT), the driver was failing to
+switch states from VPU_INST_STATE_OPEN to VPU_INST_STATE_INIT_SEQ and
+VPU_INST_STATE_PIC_RUN because the capture queue streaming boolean had not
+yet been set to true. This led to a hang in the encoder since the state
+was stuck in VPU_INST_STATE_OPEN. During the second call to
+start_streaming, the sequence initialization and frame buffer allocation
+should occur.
+
+Signed-off-by: Brandon Brnich <b-brnich@ti.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+index 94fb5d7c87021..a11f0f7c7d7b0 100644
+--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+@@ -1367,7 +1367,8 @@ static int wave5_vpu_enc_start_streaming(struct vb2_queue *q, unsigned int count
+ if (ret)
+ goto return_buffers;
+ }
+- if (inst->state == VPU_INST_STATE_OPEN && m2m_ctx->cap_q_ctx.q.streaming) {
++ if (inst->state == VPU_INST_STATE_OPEN &&
++ (m2m_ctx->cap_q_ctx.q.streaming || q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) {
+ ret = initialize_sequence(inst);
+ if (ret) {
+ dev_warn(inst->dev->dev, "Sequence not found: %d\n", ret);
+--
+2.51.0
+
--- /dev/null
+From 63c76765ea3ce758d789e80fff73de7550bf276f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 15:46:18 -0500
+Subject: media: chips-media: wave5: Process ready frames when CMD_STOP sent to
+ Encoder
+
+From: Brandon Brnich <b-brnich@ti.com>
+
+[ Upstream commit 5da0380de41439ed64ed9a5218850db38544e315 ]
+
+CMD_STOP being sent to encoder before last job is executed by device_run
+can lead to an occasional dropped frame. Ensure that remaining ready
+buffers are drained by making a call to v4l2_m2m_try_schedule.
+
+Signed-off-by: Brandon Brnich <b-brnich@ti.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+index a11f0f7c7d7b0..a254830e4009e 100644
+--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+@@ -649,6 +649,8 @@ static int wave5_vpu_enc_encoder_cmd(struct file *file, void *fh, struct v4l2_en
+
+ m2m_ctx->last_src_buf = v4l2_m2m_last_src_buf(m2m_ctx);
+ m2m_ctx->is_draining = true;
++
++ v4l2_m2m_try_schedule(m2m_ctx);
+ break;
+ case V4L2_ENC_CMD_START:
+ break;
+--
+2.51.0
+
--- /dev/null
+From 35d0d89f50eaff295857a6beb9889a581c5c3fbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 15:46:47 +0800
+Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ]
+
+Add release_mem_region() if ioremap() fails to release the memory
+region obtained by cx25821_get_resources().
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index 6627fa9166d30..a7336be444748 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
+
+ if (!dev->lmmio) {
+ CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n");
++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0));
+ cx25821_iounmap(dev);
+ return -ENOMEM;
+ }
+--
+2.51.0
+
--- /dev/null
+From c782ab3761dc3c5efe554d4b7e191b6a82e1565a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 08:57:35 +0200
+Subject: media: dvb-core: dmxdevfilter must always flush bufs
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ]
+
+Currently the buffers are being filled until full, which works fine
+for the transport stream, but not when reading sections, those have
+to be returned to userspace immediately, otherwise dvbv5-scan will
+just wait forever.
+
+Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether
+the buffer must be flushed or wait until it is full.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dmxdev.c | 8 ++++----
+ drivers/media/dvb-core/dvb_vb2.c | 5 +++--
+ include/media/dvb_vb2.h | 6 ++++--
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index 8c6f5aafda1d6..17184b3674904 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -397,11 +397,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
+ if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) {
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, true);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, true);
+ } else {
+ ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer,
+ buffer1, buffer1_len);
+@@ -452,10 +452,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
+
+ if (dvb_vb2_is_streaming(ctx)) {
+ ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, false);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, false);
+ } else {
+ if (buffer->error) {
+ spin_unlock(&dmxdevfilter->dev->lock);
+diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c
+index 29edaaff7a5c9..7444bbc2f24d9 100644
+--- a/drivers/media/dvb-core/dvb_vb2.c
++++ b/drivers/media/dvb-core/dvb_vb2.c
+@@ -249,7 +249,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx)
+
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags)
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush)
+ {
+ unsigned long flags = 0;
+ void *vbuf = NULL;
+@@ -306,7 +307,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ }
+ }
+
+- if (ctx->nonblocking && ctx->buf) {
++ if (flush && ctx->buf) {
+ vb2_set_plane_payload(&ctx->buf->vb, 0, ll);
+ vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE);
+ list_del(&ctx->buf->list);
+diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h
+index 8cb88452cd6c2..0fbbfc65157e6 100644
+--- a/include/media/dvb_vb2.h
++++ b/include/media/dvb_vb2.h
+@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx)
+ return 0;
+ };
+ #define dvb_vb2_is_streaming(ctx) (0)
+-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0)
++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0)
+
+ static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx,
+ struct file *file,
+@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx);
+ * @buffer_flags:
+ * pointer to buffer flags as defined by &enum dmx_buffer_flags.
+ * can be NULL.
++ * @flush: flush the buffer, even if it isn't full.
+ */
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags);
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush);
+
+ /**
+ * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV
+--
+2.51.0
+
--- /dev/null
+From 23d3e743de88d2423169371ae62258773f2183ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 23:55:31 +0200
+Subject: media: ipu6: Always close firmware stream
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 2b08b7007e55bd1793a58478d3ecea4fd95849a5 ]
+
+Close the firmware stream even when disabling a stream on an upstream
+sub-device fails. This allows the firmware to release resources related to
+a stream that is stopped in any case.
+
+Suggested-by: Bingbu Cao <bingbu.cao@linux.intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
+Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
+Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+index 919b77107cef7..54d861aca0088 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+@@ -1036,11 +1036,10 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state,
+ sd->name, r_pad->index, stream_mask);
+ ret = v4l2_subdev_disable_streams(sd, r_pad->index,
+ stream_mask);
+- if (ret) {
++ if (ret)
+ dev_err(dev, "stream off %s failed with %d\n", sd->name,
+ ret);
+- return ret;
+- }
++
+ close_streaming_firmware(av);
+ } else {
+ ret = start_stream_firmware(av, bl);
+--
+2.51.0
+
--- /dev/null
+From 5c47c7edc336051849b852cd1dd0f01241d6dce4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 00:05:38 +0200
+Subject: media: ipu6: Close firmware streams on streaming enable failure
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 5925a92cc70d10c7d3124923c36da09b9c1a6eeb ]
+
+When enabling streaming fails, the stream is stopped in firmware but not
+closed. Do this to release resources on firmware side.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
+Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
+Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+index dec8f5ffcfa5f..919b77107cef7 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+@@ -1066,6 +1066,7 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state,
+
+ out_media_entity_stop_streaming_firmware:
+ stop_streaming_firmware(av);
++ close_streaming_firmware(av);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 5296f26282c936a88531b20bf3d4613ac2e9f950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 14:14:22 +0200
+Subject: media: ipu6: Ensure stream_mutex is acquired when dealing with node
+ list
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 779bdaad2abf718fb8116839e818e58852874b4d ]
+
+The ipu6 isys driver maintains the list of video buffer queues related to
+a stream (in ipu6 context streams on the same CSI-2 virtual channel) and
+this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs.
+Ensure the common mutex is acquired when accessing the linked list, i.e.
+the isys device context's stream_mutex.
+
+Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard()
+while at it as the error handling becomes more simple this way.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-queue.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
+index aa2cf7287477c..8f05987cdb4e7 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
+@@ -3,6 +3,7 @@
+ * Copyright (C) 2013--2024 Intel Corporation
+ */
+ #include <linux/atomic.h>
++#include <linux/cleanup.h>
+ #include <linux/bug.h>
+ #include <linux/device.h>
+ #include <linux/list.h>
+@@ -201,6 +202,8 @@ static int buffer_list_get(struct ipu6_isys_stream *stream,
+ unsigned long flags;
+ unsigned long buf_flag = IPU6_ISYS_BUFFER_LIST_FL_INCOMING;
+
++ lockdep_assert_held(&stream->mutex);
++
+ bl->nbufs = 0;
+ INIT_LIST_HEAD(&bl->head);
+
+@@ -294,9 +297,8 @@ static int ipu6_isys_stream_start(struct ipu6_isys_video *av,
+ struct ipu6_isys_buffer_list __bl;
+ int ret;
+
+- mutex_lock(&stream->isys->stream_mutex);
++ guard(mutex)(&stream->isys->stream_mutex);
+ ret = ipu6_isys_video_set_streaming(av, 1, bl);
+- mutex_unlock(&stream->isys->stream_mutex);
+ if (ret)
+ goto out_requeue;
+
+@@ -637,10 +639,10 @@ static void stop_streaming(struct vb2_queue *q)
+ mutex_lock(&av->isys->stream_mutex);
+ if (stream->nr_streaming == stream->nr_queues && stream->streaming)
+ ipu6_isys_video_set_streaming(av, 0, NULL);
++ list_del(&aq->node);
+ mutex_unlock(&av->isys->stream_mutex);
+
+ stream->nr_streaming--;
+- list_del(&aq->node);
+ stream->streaming = 0;
+ mutex_unlock(&stream->mutex);
+
+--
+2.51.0
+
--- /dev/null
+From 656948881a966637875510f1514d89817c58b114 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 14:16:16 -0500
+Subject: media: mediatek: vcodec: Don't try to decode 422/444 VP9
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 3e92d7e4935084ecdbdc88880cc4688618ae1557 ]
+
+This is not supported by the hardware and trying to decode
+these leads to LAT timeout errors.
+
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
+index d873159b9b306..9eef3ff2b1278 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
+@@ -502,6 +502,12 @@ static int mtk_vdec_s_ctrl(struct v4l2_ctrl *ctrl)
+ mtk_v4l2_vdec_err(ctx, "VP9: bit_depth:%d", frame->bit_depth);
+ return -EINVAL;
+ }
++
++ if (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
++ !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)) {
++ mtk_v4l2_vdec_err(ctx, "VP9: only 420 subsampling is supported");
++ return -EINVAL;
++ }
+ break;
+ case V4L2_CID_STATELESS_AV1_SEQUENCE:
+ seq = (struct v4l2_ctrl_av1_sequence *)hdr_ctrl->p_new.p;
+--
+2.51.0
+
--- /dev/null
+From 09f2132a5c4d29057e5147505062eaa1429200f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 18:03:03 +0100
+Subject: media: mt9m114: Avoid a reset low spike during probe()
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit 84359d0a5e3afce5e3e3b6562efadff690614d5b ]
+
+mt9m114_probe() requests the reset GPIO in output low state:
+
+ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+
+and then almost immediately afterwards calls mt9m114_power_on() which does:
+
+ gpiod_set_value(sensor->reset, 1);
+ fsleep(duration);
+ gpiod_set_value(sensor->reset, 0);
+
+which means that if the reset pin was high before this code runs that
+it will very briefly be driven low because of passing GPIOD_OUT_LOW when
+requesting the GPIO only to be driven high again possibly directly after
+that. Such a very brief driving low of the reset pin may put the chip in
+a confused state.
+
+Request the GPIO in high (reset the chip) state instead to avoid this,
+turning the initial gpiod_set_value() in mt9m114_power_on() into a no-op.
+and the fsleep() ensures that it will stay high long enough to properly
+reset the chip.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9m114.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c
+index 51ebbe7ae9969..554f25071cca6 100644
+--- a/drivers/media/i2c/mt9m114.c
++++ b/drivers/media/i2c/mt9m114.c
+@@ -2434,7 +2434,7 @@ static int mt9m114_probe(struct i2c_client *client)
+ goto error_ep_free;
+ }
+
+- sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
++ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(sensor->reset)) {
+ ret = PTR_ERR(sensor->reset);
+ dev_err_probe(dev, ret, "Failed to get reset GPIO\n");
+--
+2.51.0
+
--- /dev/null
+From d20fa90e6c0cd37763da0b0df60c2b7e80c2744f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 18:03:10 +0100
+Subject: media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit 437e1f6a960035166495a5117aacbc596115eeb6 ]
+
+With IPU# bridges, endpoints may only be created when the IPU bridge is
+initialized. This may happen after the sensor driver's first probe().
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9m114.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c
+index 554f25071cca6..b1325e2cd1321 100644
+--- a/drivers/media/i2c/mt9m114.c
++++ b/drivers/media/i2c/mt9m114.c
+@@ -2360,11 +2360,17 @@ static int mt9m114_parse_dt(struct mt9m114 *sensor)
+ struct fwnode_handle *ep;
+ int ret;
+
++ /*
++ * On ACPI systems the fwnode graph can be initialized by a bridge
++ * driver, which may not have probed yet. Wait for this.
++ *
++ * TODO: Return an error once bridge driver code will have moved
++ * to the ACPI core.
++ */
+ ep = fwnode_graph_get_next_endpoint(fwnode, NULL);
+- if (!ep) {
+- dev_err(&sensor->client->dev, "No endpoint found\n");
+- return -EINVAL;
+- }
++ if (!ep)
++ return dev_err_probe(&sensor->client->dev, -EPROBE_DEFER,
++ "waiting for fwnode graph endpoint\n");
+
+ sensor->bus_cfg.bus_type = V4L2_MBUS_UNKNOWN;
+ ret = v4l2_fwnode_endpoint_alloc_parse(ep, &sensor->bus_cfg);
+--
+2.51.0
+
--- /dev/null
+From 2e8eb9d7121a1d6387c296273f24f7cc8d212d3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 15:26:40 +0200
+Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ]
+
+The isp_video_mbus_to_pix/pix_to_mbus functions did not take
+the last empty entry { 0, } of the formats array into account.
+
+As a result, isp_video_mbus_to_pix would accept code 0 and
+isp_video_pix_to_mbus would select code 0 if no match was found.
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index 0e7f0bf2b3463..68e6a24be5614 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video,
+ pix->width = mbus->width;
+ pix->height = mbus->height;
+
+- for (i = 0; i < ARRAY_SIZE(formats); ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
+ if (formats[i].code == mbus->code)
+ break;
+ }
+
+- if (WARN_ON(i == ARRAY_SIZE(formats)))
++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1))
+ return 0;
+
+ min_bpl = pix->width * formats[i].bpp;
+@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix,
+ /* Skip the last format in the loop so that it will be selected if no
+ * match is found.
+ */
+- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) {
+ if (formats[i].pixelformat == pix->pixelformat)
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 514f220bdca767639295d5b410b617a59e202783 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 17:09:18 +0200
+Subject: media: omap3isp: isppreview: always clamp in preview_try_format()
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ]
+
+If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't
+clamped. Just always clamp.
+
+This fixes a v4l2-compliance error:
+
+ fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
+ fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
+test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c
+index e383a57654de8..5c492b31b5160 100644
+--- a/drivers/media/platform/ti/omap3isp/isppreview.c
++++ b/drivers/media/platform/ti/omap3isp/isppreview.c
+@@ -1742,22 +1742,17 @@ static void preview_try_format(struct isp_prev_device *prev,
+
+ switch (pad) {
+ case PREV_PAD_SINK:
+- /* When reading data from the CCDC, the input size has already
+- * been mangled by the CCDC output pad so it can be accepted
+- * as-is.
+- *
+- * When reading data from memory, clamp the requested width and
+- * height. The TRM doesn't specify a minimum input height, make
++ /*
++ * Clamp the requested width and height.
++ * The TRM doesn't specify a minimum input height, make
+ * sure we got enough lines to enable the noise filter and color
+ * filter array interpolation.
+ */
+- if (prev->input == PREVIEW_INPUT_MEMORY) {
+- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
+- preview_max_out_width(prev));
+- fmt->height = clamp_t(u32, fmt->height,
+- PREV_MIN_IN_HEIGHT,
+- PREV_MAX_IN_HEIGHT);
+- }
++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
++ preview_max_out_width(prev));
++ fmt->height = clamp_t(u32, fmt->height,
++ PREV_MIN_IN_HEIGHT,
++ PREV_MAX_IN_HEIGHT);
+
+ fmt->colorspace = V4L2_COLORSPACE_SRGB;
+
+--
+2.51.0
+
--- /dev/null
+From 4a815239fa9f96f8875538d3833b9f0fe047d6de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 09:21:53 +0200
+Subject: media: omap3isp: set initial format
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ]
+
+Initialize the v4l2_format to a default. Empty formats are
+not allowed in V4L2, so this fixes v4l2-compliance issues:
+
+ fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height
+test VIDIOC_G_FMT: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index 68e6a24be5614..eb33a776f27c9 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -1288,6 +1288,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = {
+ static int isp_video_open(struct file *file)
+ {
+ struct isp_video *video = video_drvdata(file);
++ struct v4l2_mbus_framefmt fmt;
+ struct isp_video_fh *handle;
+ struct vb2_queue *queue;
+ int ret = 0;
+@@ -1330,6 +1331,13 @@ static int isp_video_open(struct file *file)
+
+ memset(&handle->format, 0, sizeof(handle->format));
+ handle->format.type = video->type;
++ handle->format.fmt.pix.width = 720;
++ handle->format.fmt.pix.height = 480;
++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY;
++ handle->format.fmt.pix.field = V4L2_FIELD_NONE;
++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt);
++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix);
+ handle->timeperframe.denominator = 1;
+
+ handle->video = video;
+--
+2.51.0
+
--- /dev/null
+From 6404a67da6eac9828d341fb19457560143b3082e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 19:24:19 +0100
+Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex
+
+From: Szymon Wilczek <szymonwilczek@gmx.com>
+
+[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ]
+
+When pvr2_send_request_ex() submits a write URB successfully but fails to
+submit the read URB (e.g. returns -ENOMEM), it returns immediately without
+waiting for the write URB to complete. Since the driver reuses the same
+URB structure, a subsequent call to pvr2_send_request_ex() attempts to
+submit the still-active write URB, triggering a 'URB submitted while
+active' warning in usb_submit_urb().
+
+Fix this by ensuring the write URB is unlinked and waited upon if the read
+URB submission fails.
+
+Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
+Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com>
+Acked-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index b32bb906a9de2..5807734ae26c6 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -3709,6 +3709,11 @@ status);
+ "Failed to submit read-control URB status=%d",
+ status);
+ hdw->ctl_read_pend_flag = 0;
++ if (hdw->ctl_write_pend_flag) {
++ usb_unlink_urb(hdw->ctl_write_urb);
++ while (hdw->ctl_write_pend_flag)
++ wait_for_completion(&hdw->ctl_done);
++ }
+ goto done;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 5da48281e7172d7e53f0eac8e4941a33efe3ce99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Oct 2025 17:02:27 +0300
+Subject: media: qcom: camss: Do not enable cpas fast ahb clock for SM8550 VFE
+ lite
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit a89e490ba3551823511588b7b3828d67f8b82954 ]
+
+The clock is needed to stream images over a full VFE IP on SM8550 CAMSS,
+and it should not be enabled, when an image stream is routed over any of
+two lite VFE IPs on the SoC.
+
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
+index fcc2b2c3cba07..757c548af485a 100644
+--- a/drivers/media/platform/qcom/camss/camss.c
++++ b/drivers/media/platform/qcom/camss/camss.c
+@@ -2704,12 +2704,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = {
+ /* VFE3 lite */
+ {
+ .regulators = {},
+- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb",
++ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb",
+ "vfe_lite", "cpas_ife_lite", "camnoc_axi" },
+ .clock_rate = { { 0 },
+ { 80000000 },
+ { 300000000, 400000000 },
+- { 300000000, 400000000 },
+ { 400000000, 480000000 },
+ { 300000000, 400000000 },
+ { 300000000, 400000000 } },
+@@ -2726,12 +2725,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = {
+ /* VFE4 lite */
+ {
+ .regulators = {},
+- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb",
++ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb",
+ "vfe_lite", "cpas_ife_lite", "camnoc_axi" },
+ .clock_rate = { { 0 },
+ { 80000000 },
+ { 300000000, 400000000 },
+- { 300000000, 400000000 },
+ { 400000000, 480000000 },
+ { 300000000, 400000000 },
+ { 300000000, 400000000 } },
+--
+2.51.0
+
--- /dev/null
+From e9c20eeaebc6f76870a32317df0c4c92de4a0eae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 12:11:42 -0500
+Subject: media: rkisp1: Fix filter mode register configuration
+
+From: Rui Wang <rui.wang@ideasonboard.com>
+
+[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ]
+
+The rkisp1_flt_config() function performs an initial direct write to
+RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA
+bit, which clears the filter enable bit in the hardware.
+
+The subsequent read/modify/write sequence then reads back the register
+with the enable bit already cleared and cannot restore it, resulting in
+the filter being inadvertently disabled.
+
+Remove the redundant direct write. The read/modify/write sequence alone
+correctly preserves the existing enable bit state while updating the
+DNR mode and filter configuration bits.
+
+Signed-off-by: Rui Wang <rui.wang@ideasonboard.com>
+Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+index c9f88635224cc..6442436a5e428 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+@@ -411,12 +411,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params,
+ rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT,
+ arg->lum_weight);
+
+- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE,
+- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) |
+- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) |
+- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) |
+- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1));
+-
+ /* avoid to override the old enable value */
+ filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE);
+ filt_mode &= RKISP1_CIF_ISP_FLT_ENA;
+--
+2.51.0
+
--- /dev/null
+From d7a7686c062c78ce429e8888b174a4358f9b28d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:00:35 -0800
+Subject: media: solo6x10: Check for out of bounds chip_id
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ]
+
+Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
+(literal "1" is an "int") could end up being shifted beyond 32 bits,
+so instrumentation was added (and due to the double is_tw286x() call
+seen via inlining), Clang decides the second one must now be undefined
+behavior and elides the rest of the function[1]. This is a known problem
+with Clang (that is still being worked on), but we can avoid the entire
+problem by actually checking the existing max chip ID, and now there is
+no runtime instrumentation added at all since everything is known to be
+within bounds.
+
+Additionally use an unsigned value for the shift to remove the
+instrumentation even without the explicit bounds checking.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
+Suggested-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: fix checkpatch warning for is_tw286x]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+index 1b7c22a9bc94f..8f53946c67928 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c
++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = {
+ 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0,
+ };
+
+-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id)))
++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id))))
+
+ static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off,
+ u8 tw_off)
+@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ if (val > 255 || val < 0)
+ return -ERANGE;
+
+@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ switch (ctrl) {
+ case V4L2_CID_SHARPNESS:
+ /* Only 286x has sharpness */
+--
+2.51.0
+
--- /dev/null
+From db934604b090a8d4e28c8288b4b3991a7c987e2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 23:04:00 +0200
+Subject: media: uvcvideo: Create an ID namespace for streaming output
+ terminals
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 3d9f32e02c2ed85338be627de672e2b81b88a836 ]
+
+Some devices, such as the Grandstream GUV3100 and the LSK Meeting Eye
+for Business & Home, exhibit entity ID collisions between units and
+streaming output terminals.
+
+The UVC specification requires unit and terminal IDs to be unique, and
+uses the ID to reference entities:
+
+- In control requests, to identify the target entity
+- In the UVC units and terminals descriptors' bSourceID field, to
+ identify source entities
+- In the UVC input header descriptor's bTerminalLink, to identify the
+ terminal associated with a streaming interface
+
+Entity ID collisions break accessing controls and make the graph
+description in the UVC descriptors ambiguous. However, collisions where
+one of the entities is a streaming output terminal and the other entity
+is not a streaming terminal are less severe. Streaming output terminals
+have no controls, and, as they are the final entity in pipelines, they
+are never referenced in descriptors as source entities. They are
+referenced by ID only from innput header descriptors, which by
+definition only reference streaming terminals.
+
+For these reasons, we can work around the collision by giving streaming
+output terminals their own ID namespace. Do so by setting bit
+UVC_TERM_OUTPUT (15) in the uvc_entity.id field, which is normally never
+set as the ID is a 8-bit value.
+
+This ID change doesn't affect the entity name in the media controller
+graph as the name isn't constructed from the ID, so there should not be
+any impact on the uAPI.
+
+Although this change handles some ID collisions automagically, keep
+printing an error in uvc_alloc_new_entity() when a camera has invalid
+descriptors. Hopefully this message will help vendors fix their invalid
+descriptors.
+
+This new method of handling ID collisions includes a revert of commit
+758dbc756aad ("media: uvcvideo: Use heuristic to find stream entity")
+that attempted to fix the problem urgently due to regression reports.
+
+Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Lili Orosz <lily@floofy.city>
+Co-developed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patch.msgid.link/20251113210400.28618-1-laurent.pinchart@ideasonboard.com
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 54 ++++++++++++++++++------------
+ drivers/media/usb/uvc/uvcvideo.h | 3 +-
+ 2 files changed, 35 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index ee4f54d683496..aa3e8d295e0f5 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -165,28 +165,17 @@ static struct uvc_entity *uvc_entity_by_reference(struct uvc_device *dev,
+ return NULL;
+ }
+
+-static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id)
++static struct uvc_streaming *uvc_stream_for_terminal(struct uvc_device *dev,
++ struct uvc_entity *term)
+ {
+- struct uvc_streaming *stream, *last_stream;
+- unsigned int count = 0;
++ u16 id = UVC_HARDWARE_ENTITY_ID(term->id);
++ struct uvc_streaming *stream;
+
+ list_for_each_entry(stream, &dev->streams, list) {
+- count += 1;
+- last_stream = stream;
+ if (stream->header.bTerminalLink == id)
+ return stream;
+ }
+
+- /*
+- * If the streaming entity is referenced by an invalid ID, notify the
+- * user and use heuristics to guess the correct entity.
+- */
+- if (count == 1 && id == UVC_INVALID_ENTITY_ID) {
+- dev_warn(&dev->intf->dev,
+- "UVC non compliance: Invalid USB header. The streaming entity has an invalid ID, guessing the correct one.");
+- return last_stream;
+- }
+-
+ return NULL;
+ }
+
+@@ -823,10 +812,12 @@ static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type,
+ }
+
+ /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */
+- if (uvc_entity_by_id(dev, id)) {
+- dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id);
++ if (uvc_entity_by_id(dev, UVC_HARDWARE_ENTITY_ID(id)))
++ dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n",
++ UVC_HARDWARE_ENTITY_ID(id));
++
++ if (uvc_entity_by_id(dev, id))
+ id = UVC_INVALID_ENTITY_ID;
+- }
+
+ extra_size = roundup(extra_size, sizeof(*entity->pads));
+ if (num_pads)
+@@ -982,6 +973,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+ struct usb_host_interface *alts = dev->intf->cur_altsetting;
+ unsigned int i, n, p, len;
+ const char *type_name;
++ unsigned int id;
+ u16 type;
+
+ switch (buffer[2]) {
+@@ -1120,8 +1112,28 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+ return 0;
+ }
+
++ id = buffer[3];
++
++ /*
++ * Some devices, such as the Grandstream GUV3100, exhibit entity
++ * ID collisions between units and streaming output terminals.
++ * Move streaming output terminals to their own ID namespace by
++ * setting bit UVC_TERM_OUTPUT (15), above the ID's 8-bit value.
++ * The bit is ignored in uvc_stream_for_terminal() when looking
++ * up the streaming interface for the terminal.
++ *
++ * This hack is safe to enable unconditionally, as the ID is not
++ * used for any other purpose (streaming output terminals have
++ * no controls and are never referenced as sources in UVC
++ * descriptors). Other types output terminals can have controls,
++ * so limit usage of this separate namespace to streaming output
++ * terminals.
++ */
++ if (type & UVC_TT_STREAMING)
++ id |= UVC_TERM_OUTPUT;
++
+ term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
+- buffer[3], 1, 0);
++ id, 1, 0);
+ if (IS_ERR(term))
+ return PTR_ERR(term);
+
+@@ -2118,8 +2130,8 @@ static int uvc_register_terms(struct uvc_device *dev,
+ if (UVC_ENTITY_TYPE(term) != UVC_TT_STREAMING)
+ continue;
+
+- stream = uvc_stream_by_id(dev, term->id);
+- if (stream == NULL) {
++ stream = uvc_stream_for_terminal(dev, term);
++ if (!stream) {
+ dev_info(&dev->intf->dev,
+ "No streaming interface found for terminal %u.",
+ term->id);
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index ed7bad31f75ca..3f2e832025e71 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -41,7 +41,8 @@
+ #define UVC_EXT_GPIO_UNIT 0x7ffe
+ #define UVC_EXT_GPIO_UNIT_ID 0x100
+
+-#define UVC_INVALID_ENTITY_ID 0xffff
++#define UVC_HARDWARE_ENTITY_ID(id) ((id) & 0xff)
++#define UVC_INVALID_ENTITY_ID 0xffff
+
+ /* ------------------------------------------------------------------------
+ * Driver specific constants.
+--
+2.51.0
+
--- /dev/null
+From f0824ef46aed712a9565cce64f1f8a7d0d705bf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 13:48:40 +0200
+Subject: media: v4l2-async: Fix error handling on steps after finding a match
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 7345d6d356336c448d6b9230ed8704f39679fd12 ]
+
+Once an async connection is found to be matching with an fwnode, a
+sub-device may be registered (in case it wasn't already), its bound
+operation is called, ancillary links are created, the async connection
+is added to the sub-device's list of connections and removed from the
+global waiting connection list. Further on, the sub-device's possible own
+notifier is searched for possible additional matches.
+
+Fix these specific issues:
+
+- If v4l2_async_match_notify() failed before the sub-notifier handling,
+ the async connection was unbound and its entry removed from the
+ sub-device's async connection list. The latter part was also done in
+ v4l2_async_match_notify().
+
+- The async connection's sd field was only set after creating ancillary
+ links in v4l2_async_match_notify(). It was however dereferenced in
+ v4l2_async_unbind_subdev_one(), which was called on error path of
+ v4l2_async_match_notify() failure.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Tested-by: "Yew, Chang Ching" <chang.ching.yew@intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-async.c | 45 +++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
+index ee884a8221fbd..1c08bba9ecb91 100644
+--- a/drivers/media/v4l2-core/v4l2-async.c
++++ b/drivers/media/v4l2-core/v4l2-async.c
+@@ -343,7 +343,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ struct v4l2_subdev *sd,
+ struct v4l2_async_connection *asc)
+ {
+- struct v4l2_async_notifier *subdev_notifier;
+ bool registered = false;
+ int ret;
+
+@@ -389,6 +388,25 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ dev_dbg(notifier_dev(notifier), "v4l2-async: %s bound (ret %d)\n",
+ dev_name(sd->dev), ret);
+
++ return 0;
++
++err_call_unbind:
++ v4l2_async_nf_call_unbind(notifier, sd, asc);
++ list_del(&asc->asc_subdev_entry);
++
++err_unregister_subdev:
++ if (registered)
++ v4l2_device_unregister_subdev(sd);
++
++ return ret;
++}
++
++static int
++v4l2_async_nf_try_subdev_notifier(struct v4l2_async_notifier *notifier,
++ struct v4l2_subdev *sd)
++{
++ struct v4l2_async_notifier *subdev_notifier;
++
+ /*
+ * See if the sub-device has a notifier. If not, return here.
+ */
+@@ -404,16 +422,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ subdev_notifier->parent = notifier;
+
+ return v4l2_async_nf_try_all_subdevs(subdev_notifier);
+-
+-err_call_unbind:
+- v4l2_async_nf_call_unbind(notifier, sd, asc);
+- list_del(&asc->asc_subdev_entry);
+-
+-err_unregister_subdev:
+- if (registered)
+- v4l2_device_unregister_subdev(sd);
+-
+- return ret;
+ }
+
+ /* Test all async sub-devices in a notifier for a match. */
+@@ -445,6 +453,10 @@ v4l2_async_nf_try_all_subdevs(struct v4l2_async_notifier *notifier)
+ if (ret < 0)
+ return ret;
+
++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
++ if (ret < 0)
++ return ret;
++
+ /*
+ * v4l2_async_match_notify() may lead to registering a
+ * new notifier and thus changing the async subdevs
+@@ -829,7 +841,11 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module)
+ ret = v4l2_async_match_notify(notifier, v4l2_dev, sd,
+ asc);
+ if (ret)
+- goto err_unbind;
++ goto err_unlock;
++
++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
++ if (ret)
++ goto err_unbind_one;
+
+ ret = v4l2_async_nf_try_complete(notifier);
+ if (ret)
+@@ -853,9 +869,10 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module)
+ if (subdev_notifier)
+ v4l2_async_nf_unbind_all_subdevs(subdev_notifier);
+
+- if (asc)
+- v4l2_async_unbind_subdev_one(notifier, asc);
++err_unbind_one:
++ v4l2_async_unbind_subdev_one(notifier, asc);
+
++err_unlock:
+ mutex_unlock(&list_lock);
+
+ sd->owner = NULL;
+--
+2.51.0
+
--- /dev/null
+From 8c465adef131d359419791ee0a11f392b8a3608c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 19:21:50 +0200
+Subject: mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit cefd793fa17de708d043adab50e7f96f414b0f1d ]
+
+Add Intel Nova Lake-S LPSS PCI IDs.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20260113172151.48062-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 8d92c895d3aef..713a5bfb1a3c2 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -437,6 +437,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_spi_info },
+ { PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_spi_info },
+ { PCI_VDEVICE(INTEL, 0x5aee), (kernel_ulong_t)&bxt_uart_info },
++ /* NVL-S */
++ { PCI_VDEVICE(INTEL, 0x6e28), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x6e29), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x6e2a), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x6e2b), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x6e4c), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e4d), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e4e), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e4f), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e5c), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x6e5e), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x6e7a), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x6e7b), (kernel_ulong_t)&ehl_i2c_info },
+ /* ARL-H */
+ { PCI_VDEVICE(INTEL, 0x7725), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x7726), (kernel_ulong_t)&bxt_uart_info },
+--
+2.51.0
+
--- /dev/null
+From 775942b9ae815cec8e9b49ee2a9a9af253c95d7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 16:39:47 +0100
+Subject: minix: Add required sanity checking to minix_check_superblock()
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ]
+
+The fs/minix implementation of the minix filesystem does not currently
+support any other value for s_log_zone_size than 0. This is also the
+only value supported in util-linux; see mkfs.minix.c line 511. In
+addition, this patch adds some sanity checking for the other minix
+superblock fields, and moves the minix_blocks_needed() checks for the
+zmap and imap also to minix_check_super_block().
+
+This also closes a related syzbot bug report.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/inode.c | 50 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 29 insertions(+), 21 deletions(-)
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 51ea9bdc813f7..c8c6b2135abe7 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -170,10 +170,38 @@ static int minix_reconfigure(struct fs_context *fc)
+ static bool minix_check_superblock(struct super_block *sb)
+ {
+ struct minix_sb_info *sbi = minix_sb(sb);
++ unsigned long block;
+
+- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
++ if (sbi->s_log_zone_size != 0) {
++ printk("minix-fs error: zone size must equal block size. "
++ "s_log_zone_size > 0 is not supported.\n");
++ return false;
++ }
++
++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
++ sbi->s_firstdatazone >= sbi->s_nzones)
+ return false;
+
++ /* Apparently minix can create filesystems that allocate more blocks for
++ * the bitmaps than needed. We simply ignore that, but verify it didn't
++ * create one with not enough blocks and bail out if so.
++ */
++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize);
++ if (sbi->s_imap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "imap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
++ block = minix_blocks_needed(
++ (sbi->s_nzones - sbi->s_firstdatazone + 1),
++ sb->s_blocksize);
++ if (sbi->s_zmap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "zmap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
+ /*
+ * s_max_size must not exceed the block mapping limitation. This check
+ * is only needed for V1 filesystems, since V2/V3 support an extra level
+@@ -293,26 +321,6 @@ static int minix_fill_super(struct super_block *s, struct fs_context *fc)
+ minix_set_bit(0,sbi->s_imap[0]->b_data);
+ minix_set_bit(0,sbi->s_zmap[0]->b_data);
+
+- /* Apparently minix can create filesystems that allocate more blocks for
+- * the bitmaps than needed. We simply ignore that, but verify it didn't
+- * create one with not enough blocks and bail out if so.
+- */
+- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
+- if (sbi->s_imap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "imap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+- block = minix_blocks_needed(
+- (sbi->s_nzones - sbi->s_firstdatazone + 1),
+- s->s_blocksize);
+- if (sbi->s_zmap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "zmap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+ /* set up enough so that it can read an inode */
+ s->s_op = &minix_sops;
+ s->s_time_min = 0;
+--
+2.51.0
+
--- /dev/null
+From f1b3c859a7a52f47fb9c5ddbd1d3d67f48cef070 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 09:40:06 +0000
+Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ]
+
+The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which
+is a valid index - so add a check for this.
+
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mach-loongson64/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h
+index 3414a1fd17835..89bb4deab98a6 100644
+--- a/arch/mips/include/asm/mach-loongson64/topology.h
++++ b/arch/mips/include/asm/mach-loongson64/topology.h
+@@ -7,7 +7,7 @@
+ #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2)
+
+ extern cpumask_t __node_cpumask[];
+-#define cpumask_of_node(node) (&__node_cpumask[node])
++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node])
+
+ struct pci_bus;
+ extern int pcibus_to_node(struct pci_bus *);
+--
+2.51.0
+
--- /dev/null
+From 4f1c3cdf18ecf5fff223079889f5bc43eb7f13a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 14:36:37 +0800
+Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ]
+
+In the function bcm_vk_read(), the pointer entry is checked, indicating
+that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
+following code may cause null-pointer dereferences:
+
+ struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+ set_msg_id(&tmp_msg, entry->usr_msg_id);
+ tmp_msg.size = entry->to_h_blks - 1;
+
+To prevent these possible null-pointer dereferences, copy to_h_msg,
+usr_msg_id, and to_h_blks from iter into temporary variables, and return
+these temporary variables to the application instead of accessing them
+through a potentially NULL entry.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Reviewed-by: Scott Branden <scott.branden@broadcom.com>
+Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
+index 1f42d1d5a630a..665a3888708ac 100644
+--- a/drivers/misc/bcm-vk/bcm_vk_msg.c
++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
+@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ struct device *dev = &vk->pdev->dev;
+ struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan;
+ struct bcm_vk_wkent *entry = NULL, *iter;
++ struct vk_msg_blk tmp_msg;
++ u32 tmp_usr_msg_id;
++ u32 tmp_blks;
+ u32 q_num;
+ u32 rsp_length;
+
+@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ entry = iter;
+ } else {
+ /* buffer not big enough */
++ tmp_msg = iter->to_h_msg[0];
++ tmp_usr_msg_id = iter->usr_msg_id;
++ tmp_blks = iter->to_h_blks;
+ rc = -EMSGSIZE;
+ }
+ goto read_loop_exit;
+@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file,
+
+ bcm_vk_free_wkent(dev, entry);
+ } else if (rc == -EMSGSIZE) {
+- struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+-
+ /*
+ * in this case, return just the first block, so
+ * that app knows what size it is looking for.
+ */
+- set_msg_id(&tmp_msg, entry->usr_msg_id);
+- tmp_msg.size = entry->to_h_blks - 1;
++ set_msg_id(&tmp_msg, tmp_usr_msg_id);
++ tmp_msg.size = tmp_blks - 1;
+ if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) {
+ dev_err(dev, "Error return 1st block in -EMSGSIZE\n");
+ rc = -EFAULT;
+--
+2.51.0
+
--- /dev/null
+From be5a85e42826eaac9688967f00c7616c10d547dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 11:48:24 +0100
+Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
+
+From: Markus Perkins <markus@notsyncing.net>
+
+[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ]
+
+commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66
+compatible strings") added support for 93xx56 and 93xx66 eeproms, but
+didn't take into account that the write enable/disable + erase all
+commands are hardcoded for the 6-bit address of the 93xx46.
+
+This commit fixes the command word generation by increasing the number
+of shifts as the address field grows, keeping the command intact.
+
+Also, the check for 8-bit or 16-bit mode is no longer required as this
+is already taken into account in the edev->addrlen field.
+
+Signed-off-by: Markus Perkins <markus@notsyncing.net>
+Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index 9cae6f530679b..5230e910a1d11 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -45,6 +45,7 @@ struct eeprom_93xx46_platform_data {
+ #define OP_START 0x4
+ #define OP_WRITE (OP_START | 0x1)
+ #define OP_READ (OP_START | 0x2)
++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */
+ #define ADDR_EWDS 0x00
+ #define ADDR_ERAL 0x20
+ #define ADDR_EWEN 0x30
+@@ -191,10 +192,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1;
+- else
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS);
++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+@@ -328,10 +326,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= ADDR_ERAL << 1;
+- else
+- cmd_addr |= ADDR_ERAL;
++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+--
+2.51.0
+
--- /dev/null
+From 63f9a18e579ccc2307ea3a44785f5a1468627378 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Dec 2025 18:22:43 +0800
+Subject: misc: ti_fpc202: fix a potential memory leak in probe function
+
+From: Felix Gu <gu_0233@qq.com>
+
+[ Upstream commit dad9f13d967b4e53e8eaf5f9c690f8e778ad9802 ]
+
+Use for_each_child_of_node_scoped() to simplify the code and ensure the
+device node reference is automatically released when the loop scope
+ends.
+
+Signed-off-by: Felix Gu <gu_0233@qq.com>
+Reviewed-by: Romain Gantois <romain.gantois@bootlin.com>
+Link: https://patch.msgid.link/tencent_FA1AC670F5CF49873F88A44424F866994A08@qq.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/ti_fpc202.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c
+index 7964e46c74482..8eb2b5ac98506 100644
+--- a/drivers/misc/ti_fpc202.c
++++ b/drivers/misc/ti_fpc202.c
+@@ -309,7 +309,6 @@ static void fpc202_remove_port(struct fpc202_priv *priv, int port_id)
+ static int fpc202_probe(struct i2c_client *client)
+ {
+ struct device *dev = &client->dev;
+- struct device_node *i2c_handle;
+ struct fpc202_priv *priv;
+ int ret, port_id;
+
+@@ -357,7 +356,7 @@ static int fpc202_probe(struct i2c_client *client)
+
+ bitmap_zero(priv->probed_ports, FPC202_NUM_PORTS);
+
+- for_each_child_of_node(dev->of_node, i2c_handle) {
++ for_each_child_of_node_scoped(dev->of_node, i2c_handle) {
+ ret = of_property_read_u32(i2c_handle, "reg", &port_id);
+ if (ret) {
+ if (ret == -EINVAL)
+--
+2.51.0
+
--- /dev/null
+From efa587c899113f32f1e3521d1a3e83f3ee6db22d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jan 2026 22:02:36 -0800
+Subject: mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
+
+From: Matthew Schwartz <matthew.schwartz@linux.dev>
+
+[ Upstream commit aced969e9bf3701dc75cfca57c78c031b7875b9d ]
+
+The existing 1ms delay in sd_power_on is insufficient and causes resume
+errors around 4% of the time.
+
+Increasing the delay to 5ms resolves this issue after testing 300
+s2idle cycles.
+
+Fixes: 1f311c94aabd ("mmc: rtsx: add 74 Clocks in power on flow")
+Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
+Link: https://patch.msgid.link/20260105060236.400366-3-matthew.schwartz@linux.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/rtsx_pci_sdmmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
+index 4db3328f46dfb..b6cf1803c7d27 100644
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -937,7 +937,7 @@ static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power_mode)
+ if (err < 0)
+ return err;
+
+- mdelay(1);
++ mdelay(5);
+
+ err = rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From dfa6e81cfa004e34ffed62ae4b38b3a0661afd2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 13:13:30 +0100
+Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ]
+
+Building a size optimized ppc64 kernel (-Os), gcc emits more FP
+save/restore symbols, that the linker generates on demand into the
+.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c,
+too. They are needed for the amdgpu in-kernel floating point support.
+
+MODPOST Module.symvers
+ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many)
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 755b842f1f9b7..88ad227f87cd1 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -602,6 +602,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
+ /* Special register function linked on all modules during final link of .ko */
+ if (strstarts(symname, "_restgpr0_") ||
+ strstarts(symname, "_savegpr0_") ||
++ strstarts(symname, "_restgpr1_") ||
++ strstarts(symname, "_savegpr1_") ||
++ strstarts(symname, "_restfpr_") ||
++ strstarts(symname, "_savefpr_") ||
+ strstarts(symname, "_restvr_") ||
+ strstarts(symname, "_savevr_") ||
+ strcmp(symname, ".TOC.") == 0)
+--
+2.51.0
+
--- /dev/null
+From fe6229f704026dbd2f2528bfa17aadee42b7963c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 16:53:37 +0000
+Subject: most: core: fix resource leak in most_register_interface error paths
+
+From: Navaneeth K <knavaneeth786@gmail.com>
+
+[ Upstream commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 ]
+
+The function most_register_interface() did not correctly release resources
+if it failed early (before registering the device). In these cases, it
+returned an error code immediately, leaking the memory allocated for the
+interface.
+
+Fix this by initializing the device early via device_initialize() and
+calling put_device() on all error paths.
+
+The most_register_interface() is expected to call put_device() on
+error which frees the resources allocated in the caller. The
+put_device() either calls release_mdev() or dim2_release(),
+depending on the caller.
+
+Switch to using device_add() instead of device_register() to handle
+the split initialization.
+
+Acked-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://patch.msgid.link/20251127165337.19172-1-knavaneeth786@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/most/core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/most/core.c b/drivers/most/core.c
+index da319d108ea1d..6277e6702ca8c 100644
+--- a/drivers/most/core.c
++++ b/drivers/most/core.c
+@@ -1286,15 +1286,19 @@ int most_register_interface(struct most_interface *iface)
+ !iface->poison_channel || (iface->num_channels > MAX_CHANNELS))
+ return -EINVAL;
+
++ device_initialize(iface->dev);
++
+ id = ida_alloc(&mdev_id, GFP_KERNEL);
+ if (id < 0) {
+ dev_err(iface->dev, "Failed to allocate device ID\n");
++ put_device(iface->dev);
+ return id;
+ }
+
+ iface->p = kzalloc(sizeof(*iface->p), GFP_KERNEL);
+ if (!iface->p) {
+ ida_free(&mdev_id, id);
++ put_device(iface->dev);
+ return -ENOMEM;
+ }
+
+@@ -1304,7 +1308,7 @@ int most_register_interface(struct most_interface *iface)
+ iface->dev->bus = &mostbus;
+ iface->dev->groups = interface_attr_groups;
+ dev_set_drvdata(iface->dev, iface);
+- if (device_register(iface->dev)) {
++ if (device_add(iface->dev)) {
+ dev_err(iface->dev, "Failed to register interface device\n");
+ kfree(iface->p);
+ put_device(iface->dev);
+--
+2.51.0
+
--- /dev/null
+From 1ce78810666a03959aa072e31be5b86829a12bfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 12:41:31 +0100
+Subject: mshv: clear eventfd counter on irqfd shutdown
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Carlos López <clopez@suse.de>
+
+[ Upstream commit 2b4246153e2184e3a3b4edc8cc35337d7a2455a6 ]
+
+While unhooking from the irqfd waitqueue, clear the internal eventfd
+counter by using eventfd_ctx_remove_wait_queue() instead of
+remove_wait_queue(), preventing potential spurious interrupts. This
+removes the need to store a pointer into the workqueue, as the eventfd
+already keeps track of it.
+
+This mimicks what other similar subsystems do on their equivalent paths
+with their irqfds (KVM, Xen, ACRN support, etc).
+
+Signed-off-by: Carlos López <clopez@suse.de>
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/mshv_eventfd.c | 5 ++---
+ drivers/hv/mshv_eventfd.h | 1 -
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hv/mshv_eventfd.c b/drivers/hv/mshv_eventfd.c
+index 6d176ed8ae516..188923fce40b4 100644
+--- a/drivers/hv/mshv_eventfd.c
++++ b/drivers/hv/mshv_eventfd.c
+@@ -248,12 +248,13 @@ static void mshv_irqfd_shutdown(struct work_struct *work)
+ {
+ struct mshv_irqfd *irqfd =
+ container_of(work, struct mshv_irqfd, irqfd_shutdown);
++ u64 cnt;
+
+ /*
+ * Synchronize with the wait-queue and unhook ourselves to prevent
+ * further events.
+ */
+- remove_wait_queue(irqfd->irqfd_wqh, &irqfd->irqfd_wait);
++ eventfd_ctx_remove_wait_queue(irqfd->irqfd_eventfd_ctx, &irqfd->irqfd_wait, &cnt);
+
+ if (irqfd->irqfd_resampler) {
+ mshv_irqfd_resampler_shutdown(irqfd);
+@@ -372,8 +373,6 @@ static void mshv_irqfd_queue_proc(struct file *file, wait_queue_head_t *wqh,
+ struct mshv_irqfd *irqfd =
+ container_of(polltbl, struct mshv_irqfd, irqfd_polltbl);
+
+- irqfd->irqfd_wqh = wqh;
+-
+ /*
+ * TODO: Ensure there isn't already an exclusive, priority waiter, e.g.
+ * that the irqfd isn't already bound to another partition. Only the
+diff --git a/drivers/hv/mshv_eventfd.h b/drivers/hv/mshv_eventfd.h
+index 332e7670a3442..464c6b81ab336 100644
+--- a/drivers/hv/mshv_eventfd.h
++++ b/drivers/hv/mshv_eventfd.h
+@@ -32,7 +32,6 @@ struct mshv_irqfd {
+ struct mshv_lapic_irq irqfd_lapic_irq;
+ struct hlist_node irqfd_hnode;
+ poll_table irqfd_polltbl;
+- wait_queue_head_t *irqfd_wqh;
+ wait_queue_entry_t irqfd_wait;
+ struct work_struct irqfd_shutdown;
+ struct mshv_irqfd_resampler *irqfd_resampler;
+--
+2.51.0
+
--- /dev/null
+From 4af39bad445fdda040c23b8c7780a4bb70045acb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:11:40 -0800
+Subject: mshv: Ignore second stats page map result failure
+
+From: Purna Pavan Chandra Aekkaladevi <paekkaladevi@linux.microsoft.com>
+
+[ Upstream commit 7538b80e5a4b473b73428d13b3a47ceaad9a8a7c ]
+
+Older versions of the hypervisor do not have a concept of separate SELF
+and PARENT stats areas. In this case, mapping the HV_STATS_AREA_SELF page
+is sufficient - it's the only page and it contains all available stats.
+
+Mapping HV_STATS_AREA_PARENT returns HV_STATUS_INVALID_PARAMETER which
+currently causes module init to fail on older hypevisor versions.
+
+Detect this case and gracefully fall back to populating
+stats_pages[HV_STATS_AREA_PARENT] with the already-mapped SELF page.
+
+Add comments to clarify the behavior, including a clarification of why
+this isn't needed for hv_call_map_stats_page2() which always supports
+PARENT and SELF areas.
+
+Signed-off-by: Purna Pavan Chandra Aekkaladevi <paekkaladevi@linux.microsoft.com>
+Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+Reviewed-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
+Acked-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/mshv_root_hv_call.c | 52 +++++++++++++++++++++++++++++++---
+ drivers/hv/mshv_root_main.c | 3 ++
+ 2 files changed, 51 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hv/mshv_root_hv_call.c b/drivers/hv/mshv_root_hv_call.c
+index 598eaff4ff299..1f93b94d7580c 100644
+--- a/drivers/hv/mshv_root_hv_call.c
++++ b/drivers/hv/mshv_root_hv_call.c
+@@ -813,6 +813,13 @@ hv_call_notify_port_ring_empty(u32 sint_index)
+ return hv_result_to_errno(status);
+ }
+
++/*
++ * Equivalent of hv_call_map_stats_page() for cases when the caller provides
++ * the map location.
++ *
++ * NOTE: This is a newer hypercall that always supports SELF and PARENT stats
++ * areas, unlike hv_call_map_stats_page().
++ */
+ static int hv_call_map_stats_page2(enum hv_stats_object_type type,
+ const union hv_stats_object_identity *identity,
+ u64 map_location)
+@@ -855,6 +862,34 @@ static int hv_call_map_stats_page2(enum hv_stats_object_type type,
+ return ret;
+ }
+
++static int
++hv_stats_get_area_type(enum hv_stats_object_type type,
++ const union hv_stats_object_identity *identity)
++{
++ switch (type) {
++ case HV_STATS_OBJECT_HYPERVISOR:
++ return identity->hv.stats_area_type;
++ case HV_STATS_OBJECT_LOGICAL_PROCESSOR:
++ return identity->lp.stats_area_type;
++ case HV_STATS_OBJECT_PARTITION:
++ return identity->partition.stats_area_type;
++ case HV_STATS_OBJECT_VP:
++ return identity->vp.stats_area_type;
++ }
++
++ return -EINVAL;
++}
++
++/*
++ * Map a stats page, where the page location is provided by the hypervisor.
++ *
++ * NOTE: The concept of separate SELF and PARENT stats areas does not exist on
++ * older hypervisor versions. All the available stats information can be found
++ * on the SELF page. When attempting to map the PARENT area on a hypervisor
++ * that doesn't support it, return "success" but with a NULL address. The
++ * caller should check for this case and instead fallback to the SELF area
++ * alone.
++ */
+ static int hv_call_map_stats_page(enum hv_stats_object_type type,
+ const union hv_stats_object_identity *identity,
+ void **addr)
+@@ -863,7 +898,7 @@ static int hv_call_map_stats_page(enum hv_stats_object_type type,
+ struct hv_input_map_stats_page *input;
+ struct hv_output_map_stats_page *output;
+ u64 status, pfn;
+- int ret = 0;
++ int hv_status, ret = 0;
+
+ do {
+ local_irq_save(flags);
+@@ -878,11 +913,20 @@ static int hv_call_map_stats_page(enum hv_stats_object_type type,
+ pfn = output->map_location;
+
+ local_irq_restore(flags);
+- if (hv_result(status) != HV_STATUS_INSUFFICIENT_MEMORY) {
+- ret = hv_result_to_errno(status);
++
++ hv_status = hv_result(status);
++ if (hv_status != HV_STATUS_INSUFFICIENT_MEMORY) {
+ if (hv_result_success(status))
+ break;
+- return ret;
++
++ if (hv_stats_get_area_type(type, identity) == HV_STATS_AREA_PARENT &&
++ hv_status == HV_STATUS_INVALID_PARAMETER) {
++ *addr = NULL;
++ return 0;
++ }
++
++ hv_status_debug(status, "\n");
++ return hv_result_to_errno(status);
+ }
+
+ ret = hv_call_deposit_pages(NUMA_NO_NODE,
+diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
+index 681b58154d5ea..d3e8a66443ad6 100644
+--- a/drivers/hv/mshv_root_main.c
++++ b/drivers/hv/mshv_root_main.c
+@@ -993,6 +993,9 @@ static int mshv_vp_stats_map(u64 partition_id, u32 vp_index,
+ if (err)
+ goto unmap_self;
+
++ if (!stats_pages[HV_STATS_AREA_PARENT])
++ stats_pages[HV_STATS_AREA_PARENT] = stats_pages[HV_STATS_AREA_SELF];
++
+ return 0;
+
+ unmap_self:
+--
+2.51.0
+
--- /dev/null
+From 46ccb91803cd693dc1475b14a391f9b286fdb650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 17:28:09 +0100
+Subject: myri10ge: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ]
+
+While compile testing on less common architectures, I noticed that gcc-10 on
+s390 finds a bug that all other configurations seem to miss:
+
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized]
+ 391 | buf->data0 = htonl(data->data0);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+ | ^~~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized]
+ 393 | buf->data2 = htonl(data->data2);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+
+It would be nice to understand how to make other compilers catch this as
+well, but for the moment I'll just shut up the warning by fixing the
+undefined behavior in this driver.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index 7be30a8df2685..2f0cdbd4e2ac9 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
+
+ /* probe for IPv6 TSO support */
+ mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE,
+ &cmd, 0);
+ if (status == 0) {
+@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp,
+ | (addr[2] << 8) | addr[3]);
+
+ cmd.data1 = ((addr[4] << 8) | (addr[5]));
++ cmd.data2 = 0;
+
+ status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0);
+ return status;
+@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause)
+ int status, ctl;
+
+ ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, 0);
+
+ if (status) {
+@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic)
+ int status, ctl;
+
+ ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC;
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic);
+ if (status)
+ netdev_err(mgp->dev, "Failed to set promisc mode\n");
+@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss)
+ /* get ring sizes */
+ slice = ss - mgp->ss;
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
+ tx_ring_size = cmd.data0;
+ cmd.data0 = slice;
+@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice)
+ status = 0;
+ if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) {
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET,
+ &cmd, 0);
+ ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *)
+ (mgp->sram + cmd.data0);
+ }
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET,
+ &cmd, 0);
+ ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *)
+@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev)
+ if (mgp->num_slices > 1) {
+ cmd.data0 = mgp->num_slices;
+ cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE;
++ cmd.data2 = 0;
+ if (mgp->dev->real_num_tx_queues > 1)
+ cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES,
+@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev)
+
+ /* now give firmware buffers sizes, and MTU */
+ cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0);
+ cmd.data0 = mgp->small_bytes;
+ status |=
+@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev)
+ static int myri10ge_close(struct net_device *dev)
+ {
+ struct myri10ge_priv *mgp = netdev_priv(dev);
+- struct myri10ge_cmd cmd;
+ int status, old_down_cnt;
+ int i;
+
+@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev)
+
+ netif_tx_stop_all_queues(dev);
+ if (mgp->rebooted == 0) {
++ struct myri10ge_cmd cmd;
++
+ old_down_cnt = mgp->down_cnt;
+ mb();
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status =
+ myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0);
+ if (status)
+@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev)
+
+ /* Disable multicast filtering */
+
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1);
+ if (err != 0) {
+ netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n",
+--
+2.51.0
+
--- /dev/null
+From 6126cf78f7a23d3228a2332b9979e1ad750f117b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:47:55 +0800
+Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits
+
+From: Jijie Shao <shaojijie@huawei.com>
+
+[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ]
+
+Currently, HCLGE_FD_AD_QID has only 10 bits and supports a
+maximum of 1023 queues. However, there are actually scenarios
+where the queue_id exceeds 1023.
+
+This patch adds an additional bit to HCLGE_FD_AD_QID to ensure
+that queue_id greater than 1023 are supported.
+
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++--
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 416e02e7b995f..bc333d8710ac1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd {
+
+ #define HCLGE_FD_AD_DROP_B 0
+ #define HCLGE_FD_AD_DIRECT_QID_B 1
+-#define HCLGE_FD_AD_QID_S 2
+-#define HCLGE_FD_AD_QID_M GENMASK(11, 2)
++#define HCLGE_FD_AD_QID_L_S 2
++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2)
+ #define HCLGE_FD_AD_USE_COUNTER_B 12
+ #define HCLGE_FD_AD_COUNTER_NUM_S 13
+ #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)
+@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd {
+ #define HCLGE_FD_AD_TC_OVRD_B 16
+ #define HCLGE_FD_AD_TC_SIZE_S 17
+ #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17)
++#define HCLGE_FD_AD_QID_H_B 21
+
+ struct hclge_fd_ad_config_cmd {
+ u8 stage;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index b8e2aa19f9e61..a90f1a91f9973 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5679,11 +5679,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc,
+ hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M,
+ HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size);
+ }
++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B,
++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0);
+ ad_data <<= 32;
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B,
+ action->forward_to_direct_queue);
+- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S,
++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S,
+ action->queue_id);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter);
+ hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M,
+--
+2.51.0
+
--- /dev/null
+From 1354595f3470cdc86ee9dae1ae43a7e65823f760 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:57:20 -0700
+Subject: net/rds: Clear reconnect pending bit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ]
+
+When canceling the reconnect worker, care must be taken to reset the
+reconnect-pending bit. If the reconnect worker has not yet been
+scheduled before it is canceled, the reconnect-pending bit will stay
+on forever.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index ad8027e6f54ef..dbfea6fa11260 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -429,6 +429,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ * to the conn hash, so we never trigger a reconnect on this
+ * conn - the reconnect is always triggered by the active peer. */
+ cancel_delayed_work_sync(&cp->cp_conn_w);
++
++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags);
+ rcu_read_lock();
+ if (!hlist_unhashed(&conn->c_hash_node)) {
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From f05f6f34f746136faf2d3c8a688db936fa18796f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 22:52:12 -0700
+Subject: net/rds: No shortcut out of RDS_CONN_ERROR
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ]
+
+RDS connections carry a state "rds_conn_path::cp_state"
+and transitions from one state to another and are conditional
+upon an expected state: "rds_conn_path_transition."
+
+There is one exception to this conditionality, which is
+"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"
+regardless of what state the condition is currently in.
+
+But as soon as a connection enters state "RDS_CONN_ERROR",
+the connection handling code expects it to go through the
+shutdown-path.
+
+The RDS/TCP multipath changes added a shortcut out of
+"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"
+via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").
+
+A subsequent "rds_tcp_reset_callbacks" can then transition
+the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.
+
+That'll trip up "rds_conn_init_shutdown", which was
+never adjusted to handle "RDS_CONN_RESETTING" and subsequently
+drops the connection with the dreaded "DR_INV_CONN_STATE",
+which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever.
+
+So we do two things here:
+
+a) Don't shortcut "RDS_CONN_ERROR", but take the longer
+ path through the shutdown code.
+
+b) Add "RDS_CONN_RESETTING" to the expected states in
+ "rds_conn_init_shutdown" so that we won't error out
+ and get stuck, if we ever hit weird state transitions
+ like this again."
+
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ net/rds/tcp_listen.c | 5 -----
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 68bc88cce84ec..ad8027e6f54ef 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -382,6 +382,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ if (!rds_conn_path_transition(cp, RDS_CONN_UP,
+ RDS_CONN_DISCONNECTING) &&
+ !rds_conn_path_transition(cp, RDS_CONN_ERROR,
++ RDS_CONN_DISCONNECTING) &&
++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING,
+ RDS_CONN_DISCONNECTING)) {
+ rds_conn_path_error(cp,
+ "shutdown called in state %d\n",
+diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
+index 820d3e20de195..27b6107ddc28d 100644
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -59,9 +59,6 @@ void rds_tcp_keepalive(struct socket *sock)
+ * socket and force a reconneect from smaller -> larger ip addr. The reason
+ * we special case cp_index 0 is to allow the rds probe ping itself to itself
+ * get through efficiently.
+- * Since reconnects are only initiated from the node with the numerically
+- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side
+- * by moving them to CONNECTING in this function.
+ */
+ static
+ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+@@ -86,8 +83,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+ struct rds_conn_path *cp = &conn->c_path[i];
+
+ if (rds_conn_path_transition(cp, RDS_CONN_DOWN,
+- RDS_CONN_CONNECTING) ||
+- rds_conn_path_transition(cp, RDS_CONN_ERROR,
+ RDS_CONN_CONNECTING)) {
+ return cp->cp_transport_data;
+ }
+--
+2.51.0
+
--- /dev/null
+From 23bd4c7b9466ed40b0578d497f3e4670f956a727 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 18:00:44 +0100
+Subject: net: sfp: add quirk for Lantech 8330-265D
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 86a8e8e0ddbc3d14c799536eb888180b84d002f3 ]
+
+Similar to Lantech 8330-262D-E, the Lantech 8330-265D also reports
+2500MBd instead of 3125MBd.
+
+Also, all 8330-265D report normal RX_LOS in EEPROM, but some signal
+inverted RX_LOS. We therefore need to ignore RX_LOS on these modules.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Link: https://patch.msgid.link/20260128170044.15576-1-kabel@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/sfp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 3e023723887c4..43aefdd8b70f7 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -532,9 +532,13 @@ static const struct sfp_quirk sfp_quirks[] = {
+ SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex,
+ sfp_fixup_ignore_tx_fault),
+
+- // Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report
+- // 2500MBd NRZ in their EEPROM
++ // Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but
++ // incorrectly report 2500MBd NRZ in their EEPROM.
++ // Some 8330-265D modules have inverted LOS, while all of them report
++ // normal LOS in EEPROM. Therefore we need to ignore LOS entirely.
+ SFP_QUIRK_S("Lantech", "8330-262D-E", sfp_quirk_2500basex),
++ SFP_QUIRK("Lantech", "8330-265D", sfp_quirk_2500basex,
++ sfp_fixup_ignore_los),
+
+ SFP_QUIRK_S("UBNT", "UF-INSTANT", sfp_quirk_ubnt_uf_instant),
+
+--
+2.51.0
+
--- /dev/null
+From 4cae521df6e04f0eca5ac73bff880022d27fde76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 09:59:49 +0800
+Subject: net: usb: r8152: fix transmit queue timeout
+
+From: Mingj Ye <insyelu@gmail.com>
+
+[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ]
+
+When the TX queue length reaches the threshold, the netdev watchdog
+immediately detects a TX queue timeout.
+
+This patch updates the trans_start timestamp of the transmit queue
+on every asynchronous USB URB submission along the transmit path,
+ensuring that the network watchdog accurately reflects ongoing
+transmission activity.
+
+Signed-off-by: Mingj Ye <insyelu@gmail.com>
+Reviewed-by: Hayes Wang <hayeswang@realtek.com>
+Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 2f3baa5f6e9c9..6b107cf5f37bd 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -2449,6 +2449,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
+ ret = usb_submit_urb(agg->urb, GFP_ATOMIC);
+ if (ret < 0)
+ usb_autopm_put_interface_async(tp->intf);
++ else
++ netif_trans_update(tp->netdev);
+
+ out_tx_fill:
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 52c6717ca6c13e991c1dc633958db5a33ed4ab0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:39:09 -0800
+Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter
+
+From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+
+[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ]
+
+Several registers referenced in this driver's source code do not
+actually exist (they are not writable and read as zero in my testing).
+They exist in this driver because it originated as a copy of the dm9601
+driver. Notably, these include the multicast filter registers - this
+causes the driver to not support multicast packets correctly. Remove
+the multicast filter code and register definitions. Instead, set the
+chip to receive all multicast filter packets when any multicast
+addresses are in the list.
+
+Reviewed-by: Simon Horman <horms@kernel.org> (from v1)
+Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/Kconfig | 1 -
+ drivers/net/usb/sr9700.c | 25 ++++---------------------
+ drivers/net/usb/sr9700.h | 7 +------
+ 3 files changed, 5 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index 856e648d804e0..da0f6a138f4fc 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -319,7 +319,6 @@ config USB_NET_DM9601
+ config USB_NET_SR9700
+ tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
+ depends on USB_USBNET
+- select CRC32
+ help
+ This option adds support for CoreChip-sz SR9700 based USB 1.1
+ 10/100 Ethernet adapters.
+diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
+index 820c4c5069792..a5d364fbc3639 100644
+--- a/drivers/net/usb/sr9700.c
++++ b/drivers/net/usb/sr9700.c
+@@ -18,7 +18,6 @@
+ #include <linux/ethtool.h>
+ #include <linux/mii.h>
+ #include <linux/usb.h>
+-#include <linux/crc32.h>
+ #include <linux/usb/usbnet.h>
+
+ #include "sr9700.h"
+@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = {
+ static void sr9700_set_multicast(struct net_device *netdev)
+ {
+ struct usbnet *dev = netdev_priv(netdev);
+- /* We use the 20 byte dev->data for our 8 byte filter buffer
+- * to avoid allocating memory that is tricky to free later
+- */
+- u8 *hashes = (u8 *)&dev->data;
+ /* rx_ctl setting : enable, disable_long, disable_crc */
+ u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG;
+
+- memset(hashes, 0x00, SR_MCAST_SIZE);
+- /* broadcast address */
+- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG;
+- if (netdev->flags & IFF_PROMISC) {
++ if (netdev->flags & IFF_PROMISC)
+ rx_ctl |= RCR_PRMSC;
+- } else if (netdev->flags & IFF_ALLMULTI ||
+- netdev_mc_count(netdev) > SR_MCAST_MAX) {
+- rx_ctl |= RCR_RUNT;
+- } else if (!netdev_mc_empty(netdev)) {
+- struct netdev_hw_addr *ha;
+-
+- netdev_for_each_mc_addr(ha, netdev) {
+- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26;
+- hashes[crc >> 3] |= 1 << (crc & 0x7);
+- }
+- }
++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev))
++ /* The chip has no multicast filter */
++ rx_ctl |= RCR_ALL;
+
+- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes);
+ sr_write_reg_async(dev, SR_RCR, rx_ctl);
+ }
+
+diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
+index ea2b4de621c86..c479908f7d823 100644
+--- a/drivers/net/usb/sr9700.h
++++ b/drivers/net/usb/sr9700.h
+@@ -104,9 +104,7 @@
+ #define WCR_LINKEN (1 << 5)
+ /* Physical Address Reg */
+ #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */
+-/* Multicast Address Reg */
+-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */
+-/* 0x1e unused */
++/* 0x16 --> 0x1E unused */
+ /* Phy Reset Reg */
+ #define SR_PRR 0x1F
+ #define PRR_PHY_RST (1 << 0)
+@@ -161,9 +159,6 @@
+ /* parameters */
+ #define SR_SHARE_TIMEOUT 1000
+ #define SR_EEPROM_LEN 256
+-#define SR_MCAST_SIZE 8
+-#define SR_MCAST_ADDR_FLAG 0x80
+-#define SR_MCAST_MAX 64
+ #define SR_TX_OVERHEAD 2 /* 2bytes header */
+ #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */
+
+--
+2.51.0
+
--- /dev/null
+From ef6e58b59374835e87f92b3d8f5595281ca54b0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 10:26:46 +0800
+Subject: net: wwan: mhi: Add network support for Foxconn T99W760
+
+From: Slark Xiao <slark_xiao@163.com>
+
+[ Upstream commit 915a5f60ad947e8dd515d2cc77a96a14dffb3f15 ]
+
+T99W760 is designed based on Qualcomm SDX35 chip. It use similar
+architecture with SDX72/SDX75 chip. So we need to assign initial
+link id for this device to make sure network available.
+
+Signed-off-by: Slark Xiao <slark_xiao@163.com>
+Link: https://patch.msgid.link/20260105022646.10630-1-slark_xiao@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/mhi_wwan_mbim.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
+index f8bc9a39bfa30..1d7e3ad900c12 100644
+--- a/drivers/net/wwan/mhi_wwan_mbim.c
++++ b/drivers/net/wwan/mhi_wwan_mbim.c
+@@ -98,7 +98,8 @@ static struct mhi_mbim_link *mhi_mbim_get_link_rcu(struct mhi_mbim_context *mbim
+ static int mhi_mbim_get_link_mux_id(struct mhi_controller *cntrl)
+ {
+ if (strcmp(cntrl->name, "foxconn-dw5934e") == 0 ||
+- strcmp(cntrl->name, "foxconn-t99w640") == 0)
++ strcmp(cntrl->name, "foxconn-t99w640") == 0 ||
++ strcmp(cntrl->name, "foxconn-t99w760") == 0)
+ return WDS_BIND_MUX_DATA_PORT_MUX_ID;
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From dd94ce2a5f1929c15740a6e39d6c57204a6f7c4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Dec 2025 20:53:51 +0900
+Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler
+
+From: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+
+[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ]
+
+The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
+ ("netfilter: conntrack: introduce clash resolution on insertion race"),
+sets allow_clash=true in the UDP/UDPLITE protocol handler
+but does not set it in the generic protocol handler.
+
+As a result, packets composed of connectionless protocols at each layer,
+such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
+
+To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.
+
+Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_generic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
+index e831637bc8ca8..cb260eb3d012c 100644
+--- a/net/netfilter/nf_conntrack_proto_generic.c
++++ b/net/netfilter/nf_conntrack_proto_generic.c
+@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net)
+ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
+ {
+ .l4proto = 255,
++ .allow_clash = true,
+ #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ .ctnl_timeout = {
+ .nlattr_to_obj = generic_timeout_nlattr_to_obj,
+--
+2.51.0
+
--- /dev/null
+From 619f2f0817c4bae11727fdcc08fe766c1a2aa50d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 12:30:42 +0100
+Subject: netfilter: xt_tcpmss: check remaining length before reading optlen
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ]
+
+Quoting reporter:
+ In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
+ op[i+1] directly without validating the remaining option length.
+
+ If the last byte of the option field is not EOL/NOP (0/1), the code attempts
+ to index op[i+1]. In the case where i + 1 == optlen, this causes an
+ out-of-bounds read, accessing memory past the optlen boundary
+ (either reading beyond the stack buffer _opt or the
+ following payload).
+
+Reported-by: sungzii <sungzii@pm.me>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_tcpmss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
+index 37704ab017992..0d32d4841cb32 100644
+--- a/net/netfilter/xt_tcpmss.c
++++ b/net/netfilter/xt_tcpmss.c
+@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ return (mssval >= info->mss_min &&
+ mssval <= info->mss_max) ^ info->invert;
+ }
+- if (op[i] < 2)
++ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i+1] ? : 1;
+--
+2.51.0
+
--- /dev/null
+From 87065ca63c7c9f198e50bd0c888a8ed73c8ef4a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jan 2026 14:03:04 +0530
+Subject: netfs: when subreq is marked for retry, do not check if it faced an
+ error
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+[ Upstream commit 82e8885bd7633a36ee9050e6d7f348a4155eed5f ]
+
+The *_subreq_terminated functions today only process the NEED_RETRY
+flag when the subreq was successful or failed with EAGAIN error.
+However, there could be other retriable errors for network filesystems.
+
+Avoid this by processing the NEED_RETRY irrespective of the error
+code faced by the subreq. If it was specifically marked for retry,
+the error code must not matter.
+
+Acked-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/read_collect.c | 10 ++++++++++
+ fs/netfs/read_retry.c | 4 ++--
+ fs/netfs/write_collect.c | 8 ++++----
+ fs/netfs/write_issue.c | 1 +
+ 4 files changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c
+index 7a0ffa675fb17..137f0e28a44c5 100644
+--- a/fs/netfs/read_collect.c
++++ b/fs/netfs/read_collect.c
+@@ -546,6 +546,15 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq)
+ }
+ }
+
++ /* If need retry is set, error should not matter unless we hit too many
++ * retries. Pause the generation of new subreqs
++ */
++ if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
++ trace_netfs_rreq(rreq, netfs_rreq_trace_set_pause);
++ set_bit(NETFS_RREQ_PAUSE, &rreq->flags);
++ goto skip_error_checks;
++ }
++
+ if (unlikely(subreq->error < 0)) {
+ trace_netfs_failure(rreq, subreq, subreq->error, netfs_fail_read);
+ if (subreq->source == NETFS_READ_FROM_CACHE) {
+@@ -559,6 +568,7 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq)
+ set_bit(NETFS_RREQ_PAUSE, &rreq->flags);
+ }
+
++skip_error_checks:
+ trace_netfs_sreq(subreq, netfs_sreq_trace_terminated);
+ netfs_subreq_clear_in_progress(subreq);
+ netfs_put_subrequest(subreq, netfs_sreq_trace_put_terminated);
+diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c
+index b99e84a8170af..7793ba5e3e8fc 100644
+--- a/fs/netfs/read_retry.c
++++ b/fs/netfs/read_retry.c
+@@ -12,6 +12,7 @@
+ static void netfs_reissue_read(struct netfs_io_request *rreq,
+ struct netfs_io_subrequest *subreq)
+ {
++ subreq->error = 0;
+ __clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
+ __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
+ netfs_stat(&netfs_n_rh_retry_read_subreq);
+@@ -242,8 +243,7 @@ static void netfs_retry_read_subrequests(struct netfs_io_request *rreq)
+ subreq = list_next_entry(subreq, rreq_link);
+ abandon:
+ list_for_each_entry_from(subreq, &stream->subrequests, rreq_link) {
+- if (!subreq->error &&
+- !test_bit(NETFS_SREQ_FAILED, &subreq->flags) &&
++ if (!test_bit(NETFS_SREQ_FAILED, &subreq->flags) &&
+ !test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags))
+ continue;
+ subreq->error = -ENOMEM;
+diff --git a/fs/netfs/write_collect.c b/fs/netfs/write_collect.c
+index cbf3d9194c7bf..61eab34ea67ef 100644
+--- a/fs/netfs/write_collect.c
++++ b/fs/netfs/write_collect.c
+@@ -492,11 +492,11 @@ void netfs_write_subrequest_terminated(void *_op, ssize_t transferred_or_error)
+
+ if (IS_ERR_VALUE(transferred_or_error)) {
+ subreq->error = transferred_or_error;
+- if (subreq->error == -EAGAIN)
+- set_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags);
+- else
++ /* if need retry is set, error should not matter */
++ if (!test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
+ set_bit(NETFS_SREQ_FAILED, &subreq->flags);
+- trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write);
++ trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write);
++ }
+
+ switch (subreq->source) {
+ case NETFS_WRITE_TO_CACHE:
+diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
+index dd8743bc8d7fe..34894da5a23ec 100644
+--- a/fs/netfs/write_issue.c
++++ b/fs/netfs/write_issue.c
+@@ -250,6 +250,7 @@ void netfs_reissue_write(struct netfs_io_stream *stream,
+ iov_iter_truncate(&subreq->io_iter, size);
+
+ subreq->retry_count++;
++ subreq->error = 0;
+ __clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
+ __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
+ netfs_stat(&netfs_n_wh_retry_write_subreq);
+--
+2.51.0
+
--- /dev/null
+From 1fef83601b91bf03d249befc323a42a340cb55c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 19:11:39 +0800
+Subject: nfc: nxp-nci: remove interrupt trigger type
+
+From: Carl Lee <carl.lee@amd.com>
+
+[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ]
+
+For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and
+active high, not edge-triggered.
+
+Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail
+to trigger correctly.
+
+Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured
+via Device Tree.
+
+Signed-off-by: Carl Lee <carl.lee@amd.com>
+Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index 049662ffdf972..6a5ce8ff91f0b 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -305,7 +305,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client)
+
+ r = request_threaded_irq(client->irq, NULL,
+ nxp_nci_i2c_irq_thread_fn,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_ONESHOT,
+ NXP_NCI_I2C_DRIVER_NAME, phy);
+ if (r < 0)
+ nfc_err(&client->dev, "Unable to register IRQ handler\n");
+--
+2.51.0
+
--- /dev/null
+From 6c12a3d41754fc22d85c667c6cf8d92abdd65e4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:18 -0800
+Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]
+
+Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
+This patch protects against invalid index out of bounds access to mw_sizes
+When invalid access print message to user that configuration is not valid.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index f851397b65d6e..f15ebab138144 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev)
+ for (i = 0; i < sndev->nr_lut_mw; i++) {
+ int idx = sndev->nr_direct_mw + i;
+
++ if (idx >= MAX_MWS) {
++ dev_err(&sndev->stdev->dev,
++ "Total number of MW cannot be bigger than %d", MAX_MWS);
++ break;
++ }
++
+ sndev->self_shared->mw_sizes[idx] = LUT_SIZE;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 5b9c172ba51c67eae8d2753a264b9b6bdadf9d81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:17 -0800
+Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]
+
+Number of MW LUTs depends on NTB configuration and can be set to zero,
+in such scenario rounddown_pow_of_two will cause undefined behaviour and
+should not be performed.
+This patch ensures that rounddown_pow_of_two is called on valid value.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index f15ebab138144..0536521fa6ccc 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+ sndev->mmio_self_ctrl);
+
+ sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries);
+- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
++ if (sndev->nr_lut_mw)
++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n",
+ sndev->nr_direct_mw, sndev->nr_lut_mw);
+@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+
+ sndev->peer_nr_lut_mw =
+ ioread16(&sndev->mmio_peer_ctrl->lut_table_entries);
+- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
++ if (sndev->peer_nr_lut_mw)
++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n",
+ sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw);
+--
+2.51.0
+
--- /dev/null
+From d9b896abe07e51cbb2767e746b2825152c689336 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:15:04 -0500
+Subject: ntfs: ->d_compare() must not block
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit ca2a04e84af79596e5cd9cfe697d5122ec39c8ce ]
+
+... so don't use __getname() there. Switch it (and ntfs_d_hash(), while
+we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash()
+almost certainly can do with smaller allocations, but let ntfs folks
+deal with that - keep the allocation size as-is for now.
+
+Stop abusing names_cachep in ntfs, period - various uses of that thing
+in there have nothing to do with pathnames; just use k[mz]alloc() and
+be done with that. For now let's keep sizes as-in, but AFAICS none of
+the users actually want PATH_MAX.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/dir.c | 5 ++---
+ fs/ntfs3/fsntfs.c | 4 ++--
+ fs/ntfs3/inode.c | 13 ++++++-------
+ fs/ntfs3/namei.c | 17 ++++++++---------
+ fs/ntfs3/xattr.c | 5 ++---
+ 5 files changed, 20 insertions(+), 24 deletions(-)
+
+diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
+index b98e95d6b4d99..cf038d713f507 100644
+--- a/fs/ntfs3/dir.c
++++ b/fs/ntfs3/dir.c
+@@ -423,8 +423,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
+ if (!dir_emit_dots(file, ctx))
+ return 0;
+
+- /* Allocate PATH_MAX bytes. */
+- name = __getname();
++ name = kmalloc(PATH_MAX, GFP_KERNEL);
+ if (!name)
+ return -ENOMEM;
+
+@@ -502,7 +501,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
+
+ out:
+
+- __putname(name);
++ kfree(name);
+ put_indx_node(node);
+
+ if (err == 1) {
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index 5f138f7158357..bd67ba7b50153 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -2627,7 +2627,7 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len)
+ u32 uni_bytes;
+ struct ntfs_inode *ni = sbi->volume.ni;
+ /* Allocate PATH_MAX bytes. */
+- struct cpu_str *uni = __getname();
++ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL);
+
+ if (!uni)
+ return -ENOMEM;
+@@ -2671,6 +2671,6 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len)
+ err = _ni_write_inode(&ni->vfs_inode, 0);
+
+ out:
+- __putname(uni);
++ kfree(uni);
+ return err;
+ }
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index ec8e954f4426c..bf6ef525d9562 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -1280,7 +1280,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,
+ fa |= FILE_ATTRIBUTE_READONLY;
+
+ /* Allocate PATH_MAX bytes. */
+- new_de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
++ new_de = kzalloc(PATH_MAX, GFP_KERNEL);
+ if (!new_de) {
+ err = -ENOMEM;
+ goto out1;
+@@ -1701,7 +1701,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,
+ ntfs_mark_rec_free(sbi, ino, false);
+
+ out2:
+- __putname(new_de);
++ kfree(new_de);
+ kfree(rp);
+
+ out1:
+@@ -1722,7 +1722,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry)
+ struct NTFS_DE *de;
+
+ /* Allocate PATH_MAX bytes. */
+- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
++ de = kzalloc(PATH_MAX, GFP_KERNEL);
+ if (!de)
+ return -ENOMEM;
+
+@@ -1736,7 +1736,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry)
+
+ err = ni_add_name(ntfs_i(d_inode(dentry->d_parent)), ni, de);
+ out:
+- __putname(de);
++ kfree(de);
+ return err;
+ }
+
+@@ -1759,8 +1759,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry)
+ if (ntfs_is_meta_file(sbi, ni->mi.rno))
+ return -EINVAL;
+
+- /* Allocate PATH_MAX bytes. */
+- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
++ de = kzalloc(PATH_MAX, GFP_KERNEL);
+ if (!de)
+ return -ENOMEM;
+
+@@ -1796,7 +1795,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry)
+
+ out:
+ ni_unlock(ni);
+- __putname(de);
++ kfree(de);
+ return err;
+ }
+
+diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
+index 3b24ca02de614..b2af8f695e60f 100644
+--- a/fs/ntfs3/namei.c
++++ b/fs/ntfs3/namei.c
+@@ -68,7 +68,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
+ u32 flags)
+ {
+ struct ntfs_inode *ni = ntfs_i(dir);
+- struct cpu_str *uni = __getname();
++ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL);
+ struct inode *inode;
+ int err;
+
+@@ -85,7 +85,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
+ inode = dir_search_u(dir, uni, NULL);
+ ni_unlock(ni);
+ }
+- __putname(uni);
++ kfree(uni);
+ }
+
+ /*
+@@ -303,8 +303,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,
+ return err;
+ }
+
+- /* Allocate PATH_MAX bytes. */
+- de = __getname();
++ de = kmalloc(PATH_MAX, GFP_KERNEL);
+ if (!de)
+ return -ENOMEM;
+
+@@ -349,7 +348,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,
+ ni_unlock(ni);
+ ni_unlock(dir_ni);
+ out:
+- __putname(de);
++ kfree(de);
+ return err;
+ }
+
+@@ -407,7 +406,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)
+ /*
+ * Try slow way with current upcase table
+ */
+- uni = kmem_cache_alloc(names_cachep, GFP_NOWAIT);
++ uni = kmalloc(PATH_MAX, GFP_NOWAIT);
+ if (!uni)
+ return -ENOMEM;
+
+@@ -429,7 +428,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)
+ err = 0;
+
+ out:
+- kmem_cache_free(names_cachep, uni);
++ kfree(uni);
+ return err;
+ }
+
+@@ -468,7 +467,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1,
+ * Try slow way with current upcase table
+ */
+ sbi = dentry->d_sb->s_fs_info;
+- uni1 = __getname();
++ uni1 = kmalloc(PATH_MAX, GFP_NOWAIT);
+ if (!uni1)
+ return -ENOMEM;
+
+@@ -498,7 +497,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1,
+ ret = !ntfs_cmp_names_cpu(uni1, uni2, sbi->upcase, false) ? 0 : 1;
+
+ out:
+- __putname(uni1);
++ kfree(uni1);
+ return ret;
+ }
+
+diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
+index c93df55e98d07..f3bb2c41c000f 100644
+--- a/fs/ntfs3/xattr.c
++++ b/fs/ntfs3/xattr.c
+@@ -556,8 +556,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+ if (unlikely(is_bad_ni(ni)))
+ return ERR_PTR(-EINVAL);
+
+- /* Allocate PATH_MAX bytes. */
+- buf = __getname();
++ buf = kmalloc(PATH_MAX, GFP_KERNEL);
+ if (!buf)
+ return ERR_PTR(-ENOMEM);
+
+@@ -588,7 +587,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+ if (!IS_ERR(acl))
+ set_cached_acl(inode, type, acl);
+
+- __putname(buf);
++ kfree(buf);
+
+ return acl;
+ }
+--
+2.51.0
+
--- /dev/null
+From ef5dae37b29b663e8c3b61577a85da17f9cd25ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 15:43:07 +0100
+Subject: ntfs3: fix circular locking dependency in run_unpack_ex
+
+From: Szymon Wilczek <swilczek.lx@gmail.com>
+
+[ Upstream commit 08ce2fee1b869ecbfbd94e0eb2630e52203a2e03 ]
+
+Syzbot reported a circular locking dependency between wnd->rw_lock
+(sbi->used.bitmap) and ni->file.run_lock.
+
+The deadlock scenario:
+1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock.
+2. run_unpack_ex() takes wnd->rw_lock then tries to acquire
+ ni->file.run_lock inside ntfs_refresh_zone().
+
+This creates an AB-BA deadlock.
+
+Fix this by using down_read_trylock() instead of down_read() when
+acquiring run_lock in run_unpack_ex(). If the lock is contended,
+skip ntfs_refresh_zone() - the MFT zone will be refreshed on the
+next MFT operation. This breaks the circular dependency since we
+never block waiting for run_lock while holding wnd->rw_lock.
+
+Reported-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com
+Tested-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=d27edf9f96ae85939222
+Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/run.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
+index 395b204925258..dc59cad4fa376 100644
+--- a/fs/ntfs3/run.c
++++ b/fs/ntfs3/run.c
+@@ -1131,11 +1131,14 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+ struct rw_semaphore *lock =
+ is_mounted(sbi) ? &sbi->mft.ni->file.run_lock :
+ NULL;
+- if (lock)
+- down_read(lock);
+- ntfs_refresh_zone(sbi);
+- if (lock)
+- up_read(lock);
++ if (lock) {
++ if (down_read_trylock(lock)) {
++ ntfs_refresh_zone(sbi);
++ up_read(lock);
++ }
++ } else {
++ ntfs_refresh_zone(sbi);
++ }
+ }
+ up_write(&wnd->rw_lock);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 7e63cc26eff2595fa3dbeaef80755b2e07093cd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Feb 2026 21:43:36 +0100
+Subject: objtool/rust: add one more `noreturn` Rust function
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+[ Upstream commit c431b00ca6afc5da3133636ecc34ee7edd38d6cc ]
+
+`objtool` with Rust 1.84.0 reports:
+
+ rust/kernel.o: error: objtool: _RNvXNtNtCsaRPFapPOzLs_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix14from_str_radix()
+ falls through to next function _RNvXNtNtCsaRPFapPOzLs_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix16from_u64_negated()
+
+This is very similar to commit c18f35e49049 ("objtool/rust: add one more
+`noreturn` Rust function"), which added `from_ascii_radix_panic` for Rust
+1.86.0, except that Rust 1.84.0 ends up needing `from_str_radix_panic`.
+
+Thus add it to the list to fix the warning.
+
+Cc: FUJITA Tomonori <fujita.tomonori@gmail.com>
+Fixes: 51d9ee90ea90 ("rust: str: add radix prefixed integer parsing functions")
+Reported-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://rust-for-linux.zulipchat.com/#narrow/channel/291565/topic/x/with/572427627
+Tested-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260206204336.38462-1-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 3fd98c5b6e1a8..37ec0d757e9b1 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -197,7 +197,8 @@ static bool is_rust_noreturn(const struct symbol *func)
+ * as well as changes to the source code itself between versions (since
+ * these come from the Rust standard library).
+ */
+- return str_ends_with(func->name, "_4core3num22from_ascii_radix_panic") ||
++ return str_ends_with(func->name, "_4core3num20from_str_radix_panic") ||
++ str_ends_with(func->name, "_4core3num22from_ascii_radix_panic") ||
+ str_ends_with(func->name, "_4core5sliceSp15copy_from_slice17len_mismatch_fail") ||
+ str_ends_with(func->name, "_4core6option13expect_failed") ||
+ str_ends_with(func->name, "_4core6option13unwrap_failed") ||
+--
+2.51.0
+
--- /dev/null
+From 23389bbae8eaa07413f14bde6004ec3d2a7b001c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 18:21:47 +0530
+Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ]
+
+NIX SQ manager sticky mode is known to cause stalls when multiple SQs
+share an SMQ and transmit concurrently. Additionally, PSE may deadlock
+on transitions between sticky and non-sticky transmissions. There is
+also a credit drop issue observed when certain condition clocks are
+gated.
+
+work around these hardware errata by:
+- Disabling SQM sticky operation:
+ - Clear TM6 (bit 15)
+ - Clear TM11 (bit 14)
+- Disabling sticky → non-sticky transition path that can deadlock PSE:
+ - Clear TM5 (bit 23)
+- Preventing credit drops by keeping the control-flow clock enabled:
+ - Set TM9 (bit 21)
+
+These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this
+configuration the SQM/PSE maintain forward progress under load without
+credit loss, at the cost of disabling sticky optimizations.
+
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index 2f485a930edd1..49f7ff5eddfc8 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -4938,12 +4938,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw)
+ /* Set chan/link to backpressure TL3 instead of TL2 */
+ rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
+
+- /* Disable SQ manager's sticky mode operation (set TM6 = 0)
++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0)
+ * This sticky mode is known to cause SQ stalls when multiple
+- * SQs are mapped to same SMQ and transmitting pkts at a time.
++ * SQs are mapped to same SMQ and transmitting pkts simultaneously.
++ * NIX PSE may deadlock when there are any sticky to non-sticky
++ * transmission. Hence disable it (TM5 = 0).
+ */
+ cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
+- cfg &= ~BIT_ULL(15);
++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23));
++ /* NIX may drop credits when condition clocks are turned off.
++ * Hence enable control flow clk (set TM9 = 1).
++ */
++ cfg |= BIT_ULL(21);
+ rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
+
+ ltdefs = rvu->kpu.lt_def;
+--
+2.51.0
+
--- /dev/null
+From b43afaf07c4924bb4dc235af14b6345c55e9f794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 12:07:23 -0500
+Subject: openrisc: define arch-specific version of nop()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ]
+
+When compiling a driver written for MIPS on OpenRISC that uses the nop()
+function, it fails due to the following error:
+
+ drivers/watchdog/pic32-wdt.c: Assembler messages:
+ drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop'
+
+The driver currently uses the generic version of nop() from
+include/asm-generic/barrier.h:
+
+ #ifndef nop
+ #define nop() asm volatile ("nop")
+ #endif
+
+Let's fix this on OpenRISC by defining an architecture-specific version
+of nop().
+
+This was tested by performing an allmodconfig openrisc cross compile on
+an aarch64 host.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/barrier.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+index 7538294721bed..8e592c9909023 100644
+--- a/arch/openrisc/include/asm/barrier.h
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -4,6 +4,8 @@
+
+ #define mb() asm volatile ("l.msync" ::: "memory")
+
++#define nop() asm volatile ("l.nop")
++
+ #include <asm-generic/barrier.h>
+
+ #endif /* __ASM_BARRIER_H */
+--
+2.51.0
+
--- /dev/null
+From e04002c04ac9b2b20a2823cf77cb2232c6733adb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 17:58:55 +0100
+Subject: parisc: Prevent interrupts during reboot
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/process.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index e64ab5d2a40d6..703644e5bfc4a 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -85,6 +85,9 @@ void machine_restart(char *cmd)
+ #endif
+ /* set up a new led state on systems shipped with a LED State panel */
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN);
++
++ /* prevent interrupts during reboot */
++ set_eiem(0);
+
+ /* "Normal" system reset */
+ pdc_do_reset();
+--
+2.51.0
+
--- /dev/null
+From 56583181fd8c959eaeb1c55b8aea3fe6a57c5184 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:53:32 +0530
+Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
+
+From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+
+[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ]
+
+The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability,
+but they do provide ACS-like features to disable peer transactions and
+validate bus numbers in requests.
+
+Add an ACS quirk for Hamoa & Glymur.
+
+Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 538ad85cf7c30..4463a2da0441f 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5117,6 +5117,10 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
+ /* QCOM SA8775P root port */
+ { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },
++ /* QCOM Hamoa root port */
++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs },
++ /* QCOM Glymur root port */
++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs },
+ /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */
+ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs },
+ /* Intel PCH root ports */
+--
+2.51.0
+
--- /dev/null
+From 3516980a9e7c7fe0c60d06378b8b2cdf9f643d32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 21:35:04 +0200
+Subject: PCI: Add Intel Nova Lake audio Device ID
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit b190870e0e0cfb375c0d4da02761c32083f3644d ]
+
+Add Nova Lake (NVL) audio Device ID
+
+The ID will be used by HDA legacy, SOF audio stack and the driver
+to determine which audio stack should be used (intel-dsp-config).
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260120193507.14019-2-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pci_ids.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index a9a089566b7cb..f2849ff1830b1 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -3143,6 +3143,7 @@
+ #define PCI_DEVICE_ID_INTEL_HDA_CML_S 0xa3f0
+ #define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828
+ #define PCI_DEVICE_ID_INTEL_S21152BB 0xb152
++#define PCI_DEVICE_ID_INTEL_HDA_NVL 0xd328
+ #define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7
+ #define PCI_DEVICE_ID_INTEL_HDA_PTL_H 0xe328
+ #define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428
+--
+2.51.0
+
--- /dev/null
+From a4c680648284cde5141458fd5eced3882244f6e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 10:25:51 +0100
+Subject: PCI/AER: Clear stale errors on reporting agents upon probe
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ]
+
+Correctable and Uncorrectable Error Status Registers on reporting agents
+are cleared upon PCI device enumeration in pci_aer_init() to flush past
+events. They're cleared again when an error is handled by the AER driver.
+
+If an agent reports a new error after pci_aer_init() and before the AER
+driver has probed on the corresponding Root Port or Root Complex Event
+Collector, that error is not handled by the AER driver: It clears the
+Root Error Status Register on probe, but neglects to re-clear the
+Correctable and Uncorrectable Error Status Registers on reporting agents.
+
+The error will eventually be reported when another error occurs. Which
+is irritating because to an end user it appears as if the earlier error
+has just happened.
+
+Amend the AER driver to clear stale errors on reporting agents upon probe.
+
+Skip reporting agents which have not invoked pci_aer_init() yet to avoid
+using an uninitialized pdev->aer_cap. They're recognizable by the error
+bits in the Device Control register still being clear.
+
+Reporting agents may execute pci_aer_init() after the AER driver has
+probed, particularly when devices are hotplugged or removed/rescanned via
+sysfs. For this reason, it continues to be necessary that pci_aer_init()
+clears Correctable and Uncorrectable Error Status Registers.
+
+Reported-by: Lucas Van <lucas.van@intel.com> # off-list
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Lucas Van <lucas.van@intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 9472d86cef552..73cb6d587202c 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -1605,6 +1605,20 @@ static void aer_disable_irq(struct pci_dev *pdev)
+ pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_COMMAND, reg32);
+ }
+
++static int clear_status_iter(struct pci_dev *dev, void *data)
++{
++ u16 devctl;
++
++ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */
++ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl);
++ if (!(devctl & PCI_EXP_AER_FLAGS))
++ return 0;
++
++ pci_aer_clear_status(dev);
++ pcie_clear_device_status(dev);
++ return 0;
++}
++
+ /**
+ * aer_enable_rootport - enable Root Port's interrupts when receiving messages
+ * @rpc: pointer to a Root Port data structure
+@@ -1626,9 +1640,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc)
+ pcie_capability_clear_word(pdev, PCI_EXP_RTCTL,
+ SYSTEM_ERROR_INTR_ON_MESG_MASK);
+
+- /* Clear error status */
++ /* Clear error status of this Root Port or RCEC */
+ pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32);
++
++ /* Clear error status of agents reporting to this Root Port or RCEC */
++ if (reg32 & AER_ERR_STATUS_MASK) {
++ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC)
++ pcie_walk_rcec(pdev, clear_status_iter, NULL);
++ else if (pdev->subordinate)
++ pci_walk_bus(pdev->subordinate, clear_status_iter,
++ NULL);
++ }
++
+ pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32);
+ pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32);
+ pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32);
+--
+2.51.0
+
--- /dev/null
+From 9a1e23ff807fb273d01ffe1ca45d04b63b419242 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 15:15:12 +0200
+Subject: PCI/bwctrl: Disable BW controller on Intel P45 using a quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 46a9f70e93ef73860d1dbbec75ef840031f8f30a ]
+
+The commit 665745f27487 ("PCI/bwctrl: Re-add BW notification portdrv as
+PCIe BW controller") was found to lead to a boot hang on a Intel P45
+system. Testing without setting Link Bandwidth Management Interrupt Enable
+(LBMIE) and Link Autonomous Bandwidth Interrupt Enable (LABIE) (PCIe r7.0,
+sec 7.5.3.7) in bwctrl allowed system to come up.
+
+P45 is a very old chipset and supports only up to gen2 PCIe, so not having
+bwctrl does not seem a huge deficiency.
+
+Add no_bw_notif in struct pci_dev and quirk Intel P45 Root Port with it.
+
+Reported-by: Adam Stylinski <kungfujesus06@gmail.com>
+Link: https://lore.kernel.org/linux-pci/aUCt1tHhm_-XIVvi@eggsbenedict/
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Adam Stylinski <kungfujesus06@gmail.com>
+Link: https://patch.msgid.link/20260116131513.2359-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/bwctrl.c | 3 +++
+ drivers/pci/quirks.c | 10 ++++++++++
+ include/linux/pci.h | 1 +
+ 3 files changed, 14 insertions(+)
+
+diff --git a/drivers/pci/pcie/bwctrl.c b/drivers/pci/pcie/bwctrl.c
+index 36f939f23d34e..4ae92c9f912a8 100644
+--- a/drivers/pci/pcie/bwctrl.c
++++ b/drivers/pci/pcie/bwctrl.c
+@@ -250,6 +250,9 @@ static int pcie_bwnotif_probe(struct pcie_device *srv)
+ struct pci_dev *port = srv->port;
+ int ret;
+
++ if (port->no_bw_notif)
++ return -ENODEV;
++
+ /* Can happen if we run out of bus numbers during enumeration. */
+ if (!port->subordinate)
+ return -ENODEV;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 90676cb2fd10b..fd86f72f54aef 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1359,6 +1359,16 @@ static void quirk_transparent_bridge(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82380FB, quirk_transparent_bridge);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TOSHIBA, 0x605, quirk_transparent_bridge);
+
++/*
++ * Enabling Link Bandwidth Management Interrupts (BW notifications) can cause
++ * boot hangs on P45.
++ */
++static void quirk_p45_bw_notifications(struct pci_dev *dev)
++{
++ dev->no_bw_notif = 1;
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e21, quirk_p45_bw_notifications);
++
+ /*
+ * Common misconfiguration of the MediaGX/Geode PCI master that will reduce
+ * PCI bandwidth from 70MB/s to 25MB/s. See the GXM/GXLV/GX1 datasheets
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index b5cc0c2b99065..e958ff7443356 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -406,6 +406,7 @@ struct pci_dev {
+ user sysfs */
+ unsigned int clear_retrain_link:1; /* Need to clear Retrain Link
+ bit manually */
++ unsigned int no_bw_notif:1; /* BW notifications may cause issues */
+ unsigned int d3hot_delay; /* D3hot->D0 transition time in ms */
+ unsigned int d3cold_delay; /* D3cold->D0 transition time in ms */
+
+--
+2.51.0
+
--- /dev/null
+From 61f0f893efb9f787b1662424a5ee3497c2bc6354 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 14:37:56 -0800
+Subject: PCI: cadence: Avoid signed 64-bit truncation and invalid sort
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 0297dce758a021ccf2c0f4e164d5403ef722961c ]
+
+The cdns_pcie_host_dma_ranges_cmp() element comparison function used by
+list_sort() is of type list_cmp_func_t, so it returns a 32-bit int.
+
+cdns_pcie_host_dma_ranges_cmp() computes a resource_size_t difference that
+may be a 64-bit value, and truncating that difference to a 32-bit return
+value may change the sign and result in an invalid sort order.
+
+Avoid the truncation and invalid sort order by returning -1, 0, or 1.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20251209223756.2321578-1-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../controller/cadence/pcie-cadence-host-common.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host-common.c b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
+index 15415d7f35ee9..2b0211870f02a 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
+@@ -173,11 +173,21 @@ int cdns_pcie_host_dma_ranges_cmp(void *priv, const struct list_head *a,
+ const struct list_head *b)
+ {
+ struct resource_entry *entry1, *entry2;
++ u64 size1, size2;
+
+ entry1 = container_of(a, struct resource_entry, node);
+ entry2 = container_of(b, struct resource_entry, node);
+
+- return resource_size(entry2->res) - resource_size(entry1->res);
++ size1 = resource_size(entry1->res);
++ size2 = resource_size(entry2->res);
++
++ if (size1 > size2)
++ return -1;
++
++ if (size1 < size2)
++ return 1;
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(cdns_pcie_host_dma_ranges_cmp);
+
+--
+2.51.0
+
--- /dev/null
+From c5207ac23dc3ca17e96a130866f8016efad0608f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 18:01:01 +0800
+Subject: PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+[ Upstream commit b5d712e5b87fc56ff838684afb1bae359eb8069f ]
+
+Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR
+memories and they cause below resource allocation issue during probe.
+
+ pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port
+ pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff]
+ pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff]
+ pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref]
+ ...
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
+ pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing
+ pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
+
+Since there is no use of the Root Port BAR memories, disable both of them.
+
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+[mani: reworded the description and comment]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-dw-rockchip.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+index bf8ec3ca6f689..a3daac74d3f18 100644
+--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c
++++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+@@ -80,6 +80,8 @@
+ #define PCIE_LINKUP_MASK GENMASK(17, 16)
+ #define PCIE_LTSSM_STATUS_MASK GENMASK(5, 0)
+
++#define PCIE_TYPE0_HDR_DBI2_OFFSET 0x100000
++
+ struct rockchip_pcie {
+ struct dw_pcie pci;
+ void __iomem *apb_base;
+@@ -292,6 +294,8 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
+ if (irq < 0)
+ return irq;
+
++ pci->dbi_base2 = pci->dbi_base + PCIE_TYPE0_HDR_DBI2_OFFSET;
++
+ ret = rockchip_pcie_init_irq_domain(rockchip);
+ if (ret < 0)
+ dev_err(dev, "failed to init irq domain\n");
+@@ -302,6 +306,10 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
+ rockchip_pcie_configure_l1ss(pci);
+ rockchip_pcie_enable_l0s(pci);
+
++ /* Disable Root Ports BAR0 and BAR1 as they report bogus size */
++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_0, 0x0);
++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_1, 0x0);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 609fe173198919bf11fbf1652e49d31e63b60052 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 17:34:52 +0530
+Subject: PCI: dwc: Skip PME_Turn_Off broadcast and L2/L3 transition during
+ suspend if link is not up
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+[ Upstream commit cfd2fdfd0a8da2e5bbfdc4009b9c4b8bf164c937 ]
+
+During system suspend, if the PCIe link is not up, then there is no need
+to broadcast PME_Turn_Off message and wait for L2/L3 transition. So skip
+them.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Tested-by: Vincent Guittot <vincent.guittot@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Link: https://patch.msgid.link/20251218-pci-dwc-suspend-rework-v2-1-5a7778c6094a@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware-host.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index 372207c33a857..250725ced9026 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -1158,8 +1158,11 @@ static int dw_pcie_pme_turn_off(struct dw_pcie *pci)
+ int dw_pcie_suspend_noirq(struct dw_pcie *pci)
+ {
+ u8 offset = dw_pcie_find_capability(pci, PCI_CAP_ID_EXP);
++ int ret = 0;
+ u32 val;
+- int ret;
++
++ if (!dw_pcie_link_up(pci))
++ goto stop_link;
+
+ /*
+ * If L1SS is supported, then do not put the link into L2 as some
+@@ -1194,6 +1197,7 @@ int dw_pcie_suspend_noirq(struct dw_pcie *pci)
+ */
+ udelay(1);
+
++stop_link:
+ dw_pcie_stop_link(pci);
+ if (pci->pp.ops->deinit)
+ pci->pp.ops->deinit(&pci->pp);
+--
+2.51.0
+
--- /dev/null
+From 2d4e7a16269704f1c309fa7f00dbfb54463430dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 21:04:47 +0530
+Subject: PCI: Enable ACS after configuring IOMMU for OF platforms
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ]
+
+Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets
+'pci_acs_enable' to request that ACS be enabled for any devices enumerated
+in the future.
+
+OF platforms called pci_enable_acs() for the first device before
+of_iommu_configure() called pci_request_acs(), so ACS was never enabled for
+that device (typically a Root Port).
+
+Call pci_enable_acs() later, from pci_dma_configure(), after
+of_dma_configure() has had a chance to call pci_request_acs().
+
+Here's the call path, showing the move of pci_enable_acs() from
+pci_acs_init() to pci_dma_configure(), where it always happens after
+pci_request_acs():
+
+ pci_device_add
+ pci_init_capabilities
+ pci_acs_init
+ - pci_enable_acs
+ - if (pci_acs_enable) <-- previous test
+ - ...
+ device_add
+ bus_notify(BUS_NOTIFY_ADD_DEVICE)
+ iommu_bus_notifier
+ iommu_probe_device
+ iommu_init_device
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ of_dma_configure
+ of_iommu_configure
+ pci_request_acs
+ pci_acs_enable = 1 <-- set
+ + pci_enable_acs
+ + if (pci_acs_enable) <-- new test
+ + ...
+ bus_probe_device
+ device_initial_probe
+ ...
+ really_probe
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ ...
+ pci_enable_acs
+
+Note that we will now call pci_enable_acs() twice for every device, first
+from the iommu_probe_device() path and again from the really_probe() path.
+Presumably that's not an issue since we also call dev->bus->dma_configure()
+twice.
+
+For the ACPI platforms, pci_request_acs() is called during ACPI
+initialization time itself, independent of the IOMMU framework.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 8 ++++++++
+ drivers/pci/pci.c | 10 +---------
+ drivers/pci/pci.h | 1 +
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 7c2d9d5962586..301a9418e38e0 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1650,6 +1650,14 @@ static int pci_dma_configure(struct device *dev)
+ ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
+ }
+
++ /*
++ * Attempt to enable ACS regardless of capability because some Root
++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
++ * the standard ACS capability but still support ACS via those
++ * quirks.
++ */
++ pci_enable_acs(to_pci_dev(dev));
++
+ pci_put_host_bridge_device(bridge);
+
+ /* @drv may not be valid when we're called from the IOMMU layer */
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 41596bc72f1dc..f21f6933c9b63 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1015,7 +1015,7 @@ static void pci_std_enable_acs(struct pci_dev *dev, struct pci_acs *caps)
+ * pci_enable_acs - enable ACS if hardware support it
+ * @dev: the PCI device
+ */
+-static void pci_enable_acs(struct pci_dev *dev)
++void pci_enable_acs(struct pci_dev *dev)
+ {
+ struct pci_acs caps;
+ bool enable_acs = false;
+@@ -3651,14 +3651,6 @@ bool pci_acs_path_enabled(struct pci_dev *start,
+ void pci_acs_init(struct pci_dev *dev)
+ {
+ dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
+-
+- /*
+- * Attempt to enable ACS regardless of capability because some Root
+- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+- * the standard ACS capability but still support ACS via those
+- * quirks.
+- */
+- pci_enable_acs(dev);
+ }
+
+ /**
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 36f32b8af6ab3..ecc67fbb159c4 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -957,6 +957,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
+ }
+
+ void pci_acs_init(struct pci_dev *dev);
++void pci_enable_acs(struct pci_dev *dev);
+ #ifdef CONFIG_PCI_QUIRKS
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);
+--
+2.51.0
+
--- /dev/null
+From afbb00505470ad24d1ca7cda5638532ccb6a4f85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 08:59:51 -0800
+Subject: PCI: Fix pci_slot_lock () device locking
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ]
+
+Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to
+prevent warnings like:
+
+ pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0
+
+Take and release the lock for the bridge providing the slot for the
+lock/trylock and unlock routines.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index a05978f5cf2c7..41596bc72f1dc 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5293,10 +5293,9 @@ static int pci_bus_trylock(struct pci_bus *bus)
+ /* Do any devices on or below this slot prevent a bus reset? */
+ static bool pci_slot_resettable(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+- if (slot->bus->self &&
+- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
+ return false;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+@@ -5313,7 +5312,10 @@ static bool pci_slot_resettable(struct pci_slot *slot)
+ /* Lock devices from the top of the tree down */
+ static void pci_slot_lock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge)
++ pci_dev_lock(bridge);
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5328,7 +5330,7 @@ static void pci_slot_lock(struct pci_slot *slot)
+ /* Unlock devices from the bottom of the tree up */
+ static void pci_slot_unlock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5338,12 +5340,18 @@ static void pci_slot_unlock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ }
+
+ /* Return 1 on successful lock, 0 on contention */
+ static int pci_slot_trylock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge && !pci_dev_trylock(bridge))
++ return 0;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5368,6 +5376,9 @@ static int pci_slot_trylock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 130156807cf0e39cc0d3627b211dff4c4943f3e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 11:04:27 +0800
+Subject: PCI: imx6: Add CLKREQ# override to enable REFCLK for i.MX95 PCIe
+
+From: Richard Zhu <hongxing.zhu@nxp.com>
+
+[ Upstream commit 27a064aba2da6bc58fc36a6b8e889187ae3bf89d ]
+
+The CLKREQ# is an open drain, active low signal that is driven low by
+the card to request reference clock. It's an optional signal added in
+PCIe CEM r4.0, sec 2. Thus, this signal wouldn't be driven low if it's
+not exposed on the slot.
+
+On the i.MX95 EVK board, REFCLK to the host and endpoint is gated by this
+CLKREQ# signal. So if the CLKREQ# signal is not driven by the endpoint, it
+will gate the REFCLK to host too, leading to operational failure.
+
+Hence, enable the REFCLK on this SoC by enabling the CLKREQ# override using
+imx95_pcie_clkreq_override() helper during probe. This override should only
+be cleared when the CLKREQ# signal is exposed on the slot.
+
+Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
+[mani: reworded description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20251015030428.2980427-11-hongxing.zhu@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index f28e335bbbfaf..dd69af0f195ff 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -52,6 +52,8 @@
+ #define IMX95_PCIE_REF_CLKEN BIT(23)
+ #define IMX95_PCIE_PHY_CR_PARA_SEL BIT(9)
+ #define IMX95_PCIE_SS_RW_REG_1 0xf4
++#define IMX95_PCIE_CLKREQ_OVERRIDE_EN BIT(8)
++#define IMX95_PCIE_CLKREQ_OVERRIDE_VAL BIT(9)
+ #define IMX95_PCIE_SYS_AUX_PWR_DET BIT(31)
+
+ #define IMX95_PE0_GEN_CTRL_1 0x1050
+@@ -706,6 +708,22 @@ static int imx7d_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable)
+ return 0;
+ }
+
++static void imx95_pcie_clkreq_override(struct imx_pcie *imx_pcie, bool enable)
++{
++ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1,
++ IMX95_PCIE_CLKREQ_OVERRIDE_EN,
++ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_EN : 0);
++ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1,
++ IMX95_PCIE_CLKREQ_OVERRIDE_VAL,
++ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_VAL : 0);
++}
++
++static int imx95_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable)
++{
++ imx95_pcie_clkreq_override(imx_pcie, enable);
++ return 0;
++}
++
+ static int imx_pcie_clk_enable(struct imx_pcie *imx_pcie)
+ {
+ struct dw_pcie *pci = imx_pcie->pci;
+@@ -1916,6 +1934,7 @@ static const struct imx_pcie_drvdata drvdata[] = {
+ .core_reset = imx95_pcie_core_reset,
+ .init_phy = imx95_pcie_init_phy,
+ .wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock,
++ .enable_ref_clk = imx95_pcie_enable_ref_clk,
+ },
+ [IMX8MQ_EP] = {
+ .variant = IMX8MQ_EP,
+@@ -1972,6 +1991,7 @@ static const struct imx_pcie_drvdata drvdata[] = {
+ .core_reset = imx95_pcie_core_reset,
+ .wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock,
+ .epc_features = &imx95_pcie_epc_features,
++ .enable_ref_clk = imx95_pcie_enable_ref_clk,
+ .mode = DW_PCIE_EP_TYPE,
+ },
+ };
+--
+2.51.0
+
--- /dev/null
+From 13d167fa59dcdf9e99c52b7b2d790ff21725eedd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 17:02:08 -0700
+Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset
+
+From: Alex Williamson <alex.williamson@nvidia.com>
+
+[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ]
+
+User forums report issues when assigning ASM1164 SATA controllers to VMs,
+especially in configurations with multiple controllers. Logs show the
+device fails to retrain after bus reset. Reports suggest this is an issue
+across multiple platforms. The device indicates support for PM reset,
+therefore the device still has a viable function level reset mechanism.
+The reporting user confirms the device is well behaved in this use case
+with bus reset disabled.
+
+Reported-by: Patrick Bianchi <patrick.w.bianchi@gmail.com>
+Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
+Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6df78efd7f6dc..538ad85cf7c30 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3791,6 +3791,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset);
+ */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
+
++/*
++ * Reports from users making use of PCI device assignment with ASM1164
++ * controllers indicate an issue with bus reset where the device fails to
++ * retrain. The issue appears more common in configurations with multiple
++ * controllers. The device does indicate PM reset support (NoSoftRst-),
++ * therefore this still leaves a viable reset method.
++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset);
++
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
+ /*
+--
+2.51.0
+
--- /dev/null
+From a330d687a15239cd7d77dd873f22364898385d83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 16:44:06 +0800
+Subject: PCI: Mark Nvidia GB10 to avoid bus reset
+
+From: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+
+[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ]
+
+After asserting Secondary Bus Reset to downstream devices via a GB10 Root
+Port, the link may not retrain correctly, e.g., the link may retrain with a
+lower lane count or config accesses to downstream devices may fail.
+
+Prevent use of Secondary Bus Reset for devices below GB10.
+
+Signed-off-by: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+[bhelgaas: drop pci_ids.h update (only used once), update commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 4463a2da0441f..90676cb2fd10b 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3748,6 +3748,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+ }
+
++/*
++ * After asserting Secondary Bus Reset to downstream devices via a GB10
++ * Root Port, the link may not retrain correctly.
++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset);
++
+ /*
+ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
+ * prevented for those affected devices.
+--
+2.51.0
+
--- /dev/null
+From eaa13026354cc29fed668d53cb3a05431145994e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 22:44:52 +0800
+Subject: PCI/MSI: Unmap MSI-X region on error
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ]
+
+msix_capability_init() fails to unmap the MSI-X region if
+msix_setup_interrupts() fails.
+
+Add the missing iounmap() for that error path.
+
+[ tglx: Massaged change log ]
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi/msi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
+index 34d664139f48f..e010ecd9f90dd 100644
+--- a/drivers/pci/msi/msi.c
++++ b/drivers/pci/msi/msi.c
+@@ -737,7 +737,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+
+ ret = msix_setup_interrupts(dev, entries, nvec, affd);
+ if (ret)
+- goto out_disable;
++ goto out_unmap;
+
+ /* Disable INTX */
+ pci_intx_for_msi(dev, 0);
+@@ -758,6 +758,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ pcibios_free_irq(dev);
+ return 0;
+
++out_unmap:
++ iounmap(dev->msix_base);
+ out_disable:
+ dev->msix_enabled = 0;
+ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
+--
+2.51.0
+
--- /dev/null
+From 132846ea1a417dffff8307e6ccc7c575ea234364 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:35:06 -0800
+Subject: perf annotate: Fix args leak of map_symbol
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 00419892bac28bf148450d762bbff990a6bd5494 ]
+
+map_symbol__exit() needs calling on an annotate_args.ms, however, rather
+than introduce proper reference count handling to symbol__annotate()
+just switch to passing the map_symbol pointer parameter around, making
+the puts the caller's responsibility.
+
+Fix a number of cases to ensure the map in a map_symbol has a
+reference count increment and add the then necessary map_symbol_exits.
+
+Fixes: 56e144fe98260a0f ("perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Dr. David Alan Gilbert <linux@treblig.org>
+Cc: Guo Ren <guoren@kernel.org>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Julia Lawall <Julia.Lawall@inria.fr>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-csky@vger.kernel.org
+Cc: linux-riscv@lists.infradead.org
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Paul Walmsley <pjw@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sergei Trofimovich <slyich@gmail.com>
+Cc: Shimin Guo <shimin.guo@skydio.com>
+Cc: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Tianyou Li <tianyou.li@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Zecheng Li <zecheng@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arch/loongarch/annotate/instructions.c | 14 ++++----
+ tools/perf/arch/s390/annotate/instructions.c | 11 +++---
+ tools/perf/util/annotate.c | 2 +-
+ tools/perf/util/capstone.c | 14 ++++----
+ tools/perf/util/disasm.c | 36 ++++++++++---------
+ tools/perf/util/disasm.h | 2 +-
+ tools/perf/util/llvm.c | 6 ++--
+ 7 files changed, 47 insertions(+), 38 deletions(-)
+
+diff --git a/tools/perf/arch/loongarch/annotate/instructions.c b/tools/perf/arch/loongarch/annotate/instructions.c
+index 70262d5f14442..1c3abb43c8d72 100644
+--- a/tools/perf/arch/loongarch/annotate/instructions.c
++++ b/tools/perf/arch/loongarch/annotate/instructions.c
+@@ -10,9 +10,7 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st
+ {
+ char *c, *endptr, *tok, *name;
+ struct map *map = ms->map;
+- struct addr_map_symbol target = {
+- .ms = { .map = map, },
+- };
++ struct addr_map_symbol target;
+
+ c = strchr(ops->raw, '#');
+ if (c++ == NULL)
+@@ -38,12 +36,16 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st
+ if (ops->target.name == NULL)
+ return -1;
+
+- target.addr = map__objdump_2mem(map, ops->target.addr);
++ target = (struct addr_map_symbol) {
++ .ms = { .map = map__get(map), },
++ .addr = map__objdump_2mem(map, ops->target.addr),
++ };
+
+ if (maps__find_ams(ms->maps, &target) == 0 &&
+ map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
+ ops->target.sym = target.ms.sym;
+
++ addr_map_symbol__exit(&target);
+ return 0;
+ }
+
+@@ -58,7 +60,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st
+ struct map *map = ms->map;
+ struct symbol *sym = ms->sym;
+ struct addr_map_symbol target = {
+- .ms = { .map = map, },
++ .ms = { .map = map__get(map), },
+ };
+ const char *c = strchr(ops->raw, '#');
+ u64 start, end;
+@@ -90,7 +92,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st
+ } else {
+ ops->target.offset_avail = false;
+ }
+-
++ addr_map_symbol__exit(&target);
+ return 0;
+ }
+
+diff --git a/tools/perf/arch/s390/annotate/instructions.c b/tools/perf/arch/s390/annotate/instructions.c
+index c61193f1e0964..626e6d2cbc81a 100644
+--- a/tools/perf/arch/s390/annotate/instructions.c
++++ b/tools/perf/arch/s390/annotate/instructions.c
+@@ -6,9 +6,7 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops,
+ {
+ char *endptr, *tok, *name;
+ struct map *map = ms->map;
+- struct addr_map_symbol target = {
+- .ms = { .map = map, },
+- };
++ struct addr_map_symbol target;
+
+ tok = strchr(ops->raw, ',');
+ if (!tok)
+@@ -36,12 +34,17 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops,
+
+ if (ops->target.name == NULL)
+ return -1;
+- target.addr = map__objdump_2mem(map, ops->target.addr);
++
++ target = (struct addr_map_symbol) {
++ .ms = { .map = map__get(map), },
++ .addr = map__objdump_2mem(map, ops->target.addr),
++ };
+
+ if (maps__find_ams(ms->maps, &target) == 0 &&
+ map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
+ ops->target.sym = target.ms.sym;
+
++ addr_map_symbol__exit(&target);
+ return 0;
+ }
+
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index cc7764455faf6..791d60f97c23e 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -1031,7 +1031,7 @@ int symbol__annotate(struct map_symbol *ms, struct evsel *evsel,
+ return 0;
+
+ args.arch = arch;
+- args.ms = *ms;
++ args.ms = ms;
+
+ if (notes->src == NULL) {
+ notes->src = annotated_source__new();
+diff --git a/tools/perf/util/capstone.c b/tools/perf/util/capstone.c
+index be5fd44b1f9dc..2c7feab61b7bf 100644
+--- a/tools/perf/util/capstone.c
++++ b/tools/perf/util/capstone.c
+@@ -143,7 +143,7 @@ static void print_capstone_detail(cs_insn *insn, char *buf, size_t len,
+ struct annotate_args *args, u64 addr)
+ {
+ int i;
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct symbol *sym;
+
+ /* TODO: support more architectures */
+@@ -222,7 +222,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused,
+ {
+ #ifdef HAVE_LIBCAPSTONE_SUPPORT
+ struct annotation *notes = symbol__annotation(sym);
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ u64 start = map__rip_2objdump(map, sym->start);
+ u64 offset;
+@@ -256,7 +256,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused,
+ args->line = disasm_buf;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ if (dl == NULL)
+@@ -268,7 +268,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused,
+ !strcmp(args->options->disassembler_style, "att"))
+ disassembler_style = true;
+
+- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0)
++ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0)
+ goto err;
+
+ needs_cs_close = true;
+@@ -345,7 +345,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused,
+ {
+ #ifdef HAVE_LIBCAPSTONE_SUPPORT
+ struct annotation *notes = symbol__annotation(sym);
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ struct nscookie nsc;
+ u64 start = map__rip_2objdump(map, sym->start);
+@@ -382,7 +382,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused,
+ !strcmp(args->options->disassembler_style, "att"))
+ disassembler_style = true;
+
+- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0)
++ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0)
+ goto err;
+
+ needs_cs_close = true;
+@@ -408,7 +408,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused,
+ args->line = disasm_buf;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ if (dl == NULL)
+diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
+index 50b9433f3f8e6..924429142631a 100644
+--- a/tools/perf/util/disasm.c
++++ b/tools/perf/util/disasm.c
+@@ -269,9 +269,7 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ {
+ char *endptr, *tok, *name;
+ struct map *map = ms->map;
+- struct addr_map_symbol target = {
+- .ms = { .map = map, },
+- };
++ struct addr_map_symbol target;
+
+ ops->target.addr = strtoull(ops->raw, &endptr, 16);
+
+@@ -296,12 +294,16 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ if (ops->target.name == NULL)
+ return -1;
+ find_target:
+- target.addr = map__objdump_2mem(map, ops->target.addr);
++ target = (struct addr_map_symbol) {
++ .ms = { .map = map__get(map), },
++ .addr = map__objdump_2mem(map, ops->target.addr),
++ };
+
+ if (maps__find_ams(ms->maps, &target) == 0 &&
+ map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
+ ops->target.sym = target.ms.sym;
+
++ addr_map_symbol__exit(&target);
+ return 0;
+
+ indirect_call:
+@@ -366,7 +368,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ struct map *map = ms->map;
+ struct symbol *sym = ms->sym;
+ struct addr_map_symbol target = {
+- .ms = { .map = map, },
++ .ms = { .map = map__get(map), },
+ };
+ const char *c = strchr(ops->raw, ',');
+ u64 start, end;
+@@ -440,7 +442,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ } else {
+ ops->target.offset_avail = false;
+ }
+-
++ addr_map_symbol__exit(&target);
+ return 0;
+ }
+
+@@ -1046,7 +1048,7 @@ static size_t disasm_line_size(int nr)
+ struct disasm_line *disasm_line__new(struct annotate_args *args)
+ {
+ struct disasm_line *dl = NULL;
+- struct annotation *notes = symbol__annotation(args->ms.sym);
++ struct annotation *notes = symbol__annotation(args->ms->sym);
+ int nr = notes->src->nr_events;
+
+ dl = zalloc(disasm_line_size(nr));
+@@ -1064,7 +1066,7 @@ struct disasm_line *disasm_line__new(struct annotate_args *args)
+ } else if (disasm_line__parse(dl->al.line, &dl->ins.name, &dl->ops.raw) < 0)
+ goto out_free_line;
+
+- disasm_line__init_ins(dl, args->arch, &args->ms);
++ disasm_line__init_ins(dl, args->arch, args->ms);
+ }
+
+ return dl;
+@@ -1119,7 +1121,7 @@ static int symbol__parse_objdump_line(struct symbol *sym,
+ struct annotate_args *args,
+ char *parsed_line, int *line_nr, char **fileloc)
+ {
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct annotation *notes = symbol__annotation(sym);
+ struct disasm_line *dl;
+ char *tmp;
+@@ -1151,7 +1153,7 @@ static int symbol__parse_objdump_line(struct symbol *sym,
+ args->line = parsed_line;
+ args->line_nr = *line_nr;
+ args->fileloc = *fileloc;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ (*line_nr)++;
+@@ -1169,12 +1171,14 @@ static int symbol__parse_objdump_line(struct symbol *sym,
+ if (dl->ins.ops && ins__is_call(&dl->ins) && !dl->ops.target.sym) {
+ struct addr_map_symbol target = {
+ .addr = dl->ops.target.addr,
+- .ms = { .map = map, },
++ .ms = { .map = map__get(map), },
+ };
+
+- if (!maps__find_ams(args->ms.maps, &target) &&
++ if (!maps__find_ams(args->ms->maps, &target) &&
+ target.ms.sym->start == target.al_addr)
+ dl->ops.target.sym = target.ms.sym;
++
++ addr_map_symbol__exit(&target);
+ }
+
+ annotation_line__add(&dl->al, ¬es->src->source);
+@@ -1338,7 +1342,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym,
+ struct annotate_args *args)
+ {
+ struct annotation *notes = symbol__annotation(sym);
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ u64 start = map__rip_2objdump(map, sym->start);
+ u64 end = map__rip_2objdump(map, sym->end);
+@@ -1375,7 +1379,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym,
+ args->line = disasm_buf;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ if (dl == NULL)
+@@ -1501,7 +1505,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym,
+ struct annotate_args *args)
+ {
+ struct annotation_options *opts = &annotate_opts;
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ char *command;
+ FILE *file;
+@@ -1644,7 +1648,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym,
+ int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
+ {
+ struct annotation_options *options = args->options;
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ char symfs_filename[PATH_MAX];
+ bool delete_extract = false;
+diff --git a/tools/perf/util/disasm.h b/tools/perf/util/disasm.h
+index d2cb555e4a3be..a3ea9d6762816 100644
+--- a/tools/perf/util/disasm.h
++++ b/tools/perf/util/disasm.h
+@@ -97,7 +97,7 @@ struct ins_ops {
+
+ struct annotate_args {
+ struct arch *arch;
+- struct map_symbol ms;
++ struct map_symbol *ms;
+ struct annotation_options *options;
+ s64 offset;
+ char *line;
+diff --git a/tools/perf/util/llvm.c b/tools/perf/util/llvm.c
+index 2ebf1f5f65bf7..4ada9a10bd93f 100644
+--- a/tools/perf/util/llvm.c
++++ b/tools/perf/util/llvm.c
+@@ -118,7 +118,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym,
+ {
+ #ifdef HAVE_LIBLLVM_SUPPORT
+ struct annotation *notes = symbol__annotation(sym);
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct dso *dso = map__dso(map);
+ u64 start = map__rip_2objdump(map, sym->start);
+ /* Malloc-ed buffer containing instructions read from disk. */
+@@ -184,7 +184,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym,
+ args->line = disasm_buf;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ dl = disasm_line__new(args);
+ if (dl == NULL)
+@@ -242,7 +242,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym,
+ &line_storage_len);
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+
+ llvm_addr2line(filename, pc, &args->fileloc,
+ (unsigned int *)&args->line_nr, false, NULL);
+--
+2.51.0
+
--- /dev/null
+From 12b505efd1e0f76149a1be9198ae4036b53e7658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 17:25:00 -0300
+Subject: perf annotate: Fix BUILD_NONDISTRO=1 missing args->ms conversions to
+ pointer
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit dda5f926a1006c735b00ed5c27291fce64236656 ]
+
+Fix a few missing conversions to pointer in the usage of 'struct
+annotate_args' 'ms' member in symbol__disassemble_bpf_libbfd().
+
+Fixes: 00419892bac28bf1 ("perf annotate: Fix args leak of map_symbol")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/libbfd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/libbfd.c b/tools/perf/util/libbfd.c
+index 79f4528234a9d..63ea3fb53e77d 100644
+--- a/tools/perf/util/libbfd.c
++++ b/tools/perf/util/libbfd.c
+@@ -501,7 +501,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused,
+ struct bpf_prog_info_node *info_node;
+ int len = sym->end - sym->start;
+ disassembler_ftype disassemble;
+- struct map *map = args->ms.map;
++ struct map *map = args->ms->map;
+ struct perf_bpil *info_linear;
+ struct disassemble_info info;
+ struct dso *dso = map__dso(map);
+@@ -612,7 +612,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused,
+ args->line = strdup(srcline);
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+ dl = disasm_line__new(args);
+ if (dl) {
+ annotation_line__add(&dl->al,
+@@ -624,7 +624,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused,
+ args->line = buf + prev_buf_size;
+ args->line_nr = 0;
+ args->fileloc = NULL;
+- args->ms.sym = sym;
++ args->ms->sym = sym;
+ dl = disasm_line__new(args);
+ if (dl)
+ annotation_line__add(&dl->al, ¬es->src->source);
+--
+2.51.0
+
--- /dev/null
+From df698c1c2e545c21e554cb13c23d4eab63ac4bb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 22:47:04 +0530
+Subject: perf annotate: Fix memcpy size in arch__grow_instructions()
+
+From: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+
+[ Upstream commit f0d98c78f8bf73ce2a9b7793f66cda240fa9ab10 ]
+
+The memcpy() in arch__grow_instructions() is copying the wrong number of
+bytes when growing from a non-allocated table.
+
+It should copy arch->nr_instructions * sizeof(struct ins) bytes, not
+just arch->nr_instructions bytes.
+
+This bug causes data corruption as only a partial copy of the
+instruction table is made, leading to garbage data in most entries and
+potential crashes
+
+Fixes: 2a1ff812c40be982 ("perf annotate: Introduce alternative method of keeping instructions table")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/disasm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
+index 924429142631a..88706b98b9064 100644
+--- a/tools/perf/util/disasm.c
++++ b/tools/perf/util/disasm.c
+@@ -81,7 +81,7 @@ static int arch__grow_instructions(struct arch *arch)
+ if (new_instructions == NULL)
+ return -1;
+
+- memcpy(new_instructions, arch->instructions, arch->nr_instructions);
++ memcpy(new_instructions, arch->instructions, arch->nr_instructions * sizeof(struct ins));
+ goto out_update_instructions;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4f658e21137806cc2d9189e58f9ddf598cc4dc7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 16:39:54 +0000
+Subject: perf/arm-cmn: Support CMN-600AE
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ]
+
+The functional safety features of CMN-600AE have little to no impact on
+the PMU relative to the base CMN-600 design, so for simplicity we can
+reasonably just treat it as the same thing. The only obvious difference
+is that the revision numbers aren't aligned, so we may hide some aliases
+for events which do actually exist, but those can still be specified via
+the underlying "type,eventid" format so it's not too big a deal.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Tested-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 23245352a3fc0..651edd73bfcb1 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -210,6 +210,7 @@ enum cmn_model {
+ enum cmn_part {
+ PART_CMN600 = 0x434,
+ PART_CMN650 = 0x436,
++ PART_CMN600AE = 0x438,
+ PART_CMN700 = 0x43c,
+ PART_CI700 = 0x43a,
+ PART_CMN_S3 = 0x43e,
+@@ -2266,6 +2267,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01);
+ part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg);
+ part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8;
++ /* 600AE is close enough that it's not really worth more complexity */
++ if (part == PART_CMN600AE)
++ part = PART_CMN600;
+ if (cmn->part && cmn->part != part)
+ dev_warn(cmn->dev,
+ "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n",
+--
+2.51.0
+
--- /dev/null
+From 143a491a318355fce8f2c3979e585cfca8fa3e37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:29:10 +0100
+Subject: perf build: Raise minimum shellcheck version to 0.7.2
+
+From: Nicolas Schier <n.schier@avm.de>
+
+[ Upstream commit 383f8e26e2c483e25453f8c3d0839877708ac701 ]
+
+Raise the minimum shellcheck version for perf builds to 0.7.2, so that
+systems with shellcheck versions below 0.7.2 will automatically skip the
+shell script checking, even if NO_SHELLCHECK is unset.
+
+Since commit 241f21be7d0fdf3c ("perf test perftool_testsuite: Use
+absolute paths"), shellcheck versions before 0.7.2 break the perf build
+with several SC1090 [2] warnings due to its too strict dynamic source
+handling [1], e.g.:
+
+ In tests/shell/base_probe/test_line_semantics.sh line 20:
+ . "$DIR_PATH/../common/init.sh"
+ ^---------------------------^ SC1090: Can't follow non-constant source. Use a directive to specify location.
+
+Fixes: 241f21be7d0fdf3c ("perf test perftool_testsuite: Use absolute paths")
+Signed-off-by: Nicolas Schier <n.schier@avm.de>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jakub Brnak <jbrnak@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Nicolas Schier <nsc@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Philipp Hahn <p.hahn@avm.de>
+Cc: Veronika Molnarova <vmolnaro@redhat.com>
+Link: https://github.com/koalaman/shellcheck/issues/1998 # [1]
+Link: https://www.shellcheck.net/wiki/SC1090
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Makefile.perf | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
+index b3f481a626afa..e6895626c1872 100644
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -251,11 +251,12 @@ else
+ endif
+
+ # shellcheck is using in tools/perf/tests/Build with option -a/--check-sourced (
+-# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0). So make the
+-# minimal shellcheck version as v0.6.0.
++# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0) as well as
++# dynamic source inclusions (properly handled since v0.7.2).
++# So make the minimal shellcheck version as v0.7.2.
+ ifneq ($(SHELLCHECK),)
+ ifeq ($(shell expr $(shell $(SHELLCHECK) --version | grep version: | \
+- sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 060), 1)
++ sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 072), 1)
+ SHELLCHECK :=
+ else
+ SHELLCHECK := $(SHELLCHECK) -s bash -a -S warning
+--
+2.51.0
+
--- /dev/null
+From e706d634cd51d5e8ce2d44368f5b352de826c9db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 15:35:39 -0800
+Subject: perf build: Remove NO_LIBCAP that controls nothing
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 169343cc8ff2bd59758760d867bd26adae866a2b ]
+
+Using libcap was removed in commit e25ebda78e230283 ("perf cap: Tidy up
+and improve capability testing") and improve capability testing"),
+however, some build documentation and a use of the NO_LIBCAP=1 were
+lingering.
+
+Remove these left over bits.
+
+Fixes: e25ebda78e230283 ("perf cap: Tidy up and improve capability testing")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Makefile.perf | 2 --
+ tools/perf/tests/make | 2 +-
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
+index e6895626c1872..fbeb5c81c8072 100644
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -86,8 +86,6 @@ include ../scripts/utilities.mak
+ #
+ # Define NO_LIBBPF if you do not want BPF support
+ #
+-# Define NO_LIBCAP if you do not want process capabilities considered by perf
+-#
+ # Define NO_SDT if you do not want to define SDT event in perf tools,
+ # note that it doesn't disable SDT scanning support.
+ #
+diff --git a/tools/perf/tests/make b/tools/perf/tests/make
+index 6641701e48285..c721cd1bcaa9a 100644
+--- a/tools/perf/tests/make
++++ b/tools/perf/tests/make
+@@ -122,7 +122,7 @@ make_minimal += NO_DEMANGLE=1 NO_LIBELF=1 NO_BACKTRACE=1
+ make_minimal += NO_LIBNUMA=1 NO_LIBBIONIC=1 NO_LIBDW=1
+ make_minimal += NO_LIBDW_DWARF_UNWIND=1 NO_LIBBPF=1
+ make_minimal += NO_SDT=1 NO_JVMTI=1 NO_LIBZSTD=1
+-make_minimal += NO_LIBCAP=1 NO_CAPSTONE=1
++make_minimal += NO_CAPSTONE=1
+
+ # $(run) contains all available tests
+ run := make_pure
+--
+2.51.0
+
--- /dev/null
+From 2dcfde82523c770ce07c52d3a163334f9b8bb4e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:36 -0800
+Subject: perf callchain: Fix srcline printing with inlines
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ]
+
+sample__fprintf_callchain() was using map__fprintf_srcline() which won't
+report inline line numbers.
+
+Fix by using the srcline from the callchain and falling back to the map
+variant.
+
+Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel_fprintf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
+index 10f1a03c28601..5521d00bff2c0 100644
+--- a/tools/perf/util/evsel_fprintf.c
++++ b/tools/perf/util/evsel_fprintf.c
+@@ -185,8 +185,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
+ if (print_dso && (!sym || !sym->inlined))
+ printed += map__fprintf_dsoname_dsoff(map, print_dsoff, addr, fp);
+
+- if (print_srcline)
+- printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ if (print_srcline) {
++ if (node->srcline)
++ printed += fprintf(fp, "\n %s", node->srcline);
++ else
++ printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ }
+
+ if (sym && sym->inlined)
+ printed += fprintf(fp, " (inlined)");
+--
+2.51.0
+
--- /dev/null
+From 3276e1c102bd7c99b43e65048963d5f7279aaee3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 08:51:57 -0800
+Subject: perf/core: Fix slow perf_event_task_exit() with LBR callstacks
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 4960626f956d63dce57f099016c2ecbe637a8229 ]
+
+I got a report that a task is stuck in perf_event_exit_task() waiting
+for global_ctx_data_rwsem. On large systems with lots threads, it'd
+have performance issues when it grabs the lock to iterate all threads
+in the system to allocate the context data.
+
+And it'd block task exit path which is problematic especially under
+memory pressure.
+
+ perf_event_open
+ perf_event_alloc
+ attach_perf_ctx_data
+ attach_global_ctx_data
+ percpu_down_write (global_ctx_data_rwsem)
+ for_each_process_thread
+ alloc_task_ctx_data
+ do_exit
+ perf_event_exit_task
+ percpu_down_read (global_ctx_data_rwsem)
+
+It should not hold the global_ctx_data_rwsem on the exit path. Let's
+skip allocation for exiting tasks and free the data carefully.
+
+Reported-by: Rosalie Fang <rosaliefang@google.com>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://patch.msgid.link/20260112165157.1919624-1-namhyung@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 8cca800946248..69c56cad88a89 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5280,9 +5280,20 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache,
+ return -ENOMEM;
+
+ for (;;) {
+- if (try_cmpxchg((struct perf_ctx_data **)&task->perf_ctx_data, &old, cd)) {
++ if (try_cmpxchg(&task->perf_ctx_data, &old, cd)) {
+ if (old)
+ perf_free_ctx_data_rcu(old);
++ /*
++ * Above try_cmpxchg() pairs with try_cmpxchg() from
++ * detach_task_ctx_data() such that
++ * if we race with perf_event_exit_task(), we must
++ * observe PF_EXITING.
++ */
++ if (task->flags & PF_EXITING) {
++ /* detach_task_ctx_data() may free it already */
++ if (try_cmpxchg(&task->perf_ctx_data, &cd, NULL))
++ perf_free_ctx_data_rcu(cd);
++ }
+ return 0;
+ }
+
+@@ -5328,6 +5339,8 @@ attach_global_ctx_data(struct kmem_cache *ctx_cache)
+ /* Allocate everything */
+ scoped_guard (rcu) {
+ for_each_process_thread(g, p) {
++ if (p->flags & PF_EXITING)
++ continue;
+ cd = rcu_dereference(p->perf_ctx_data);
+ if (cd && !cd->global) {
+ cd->global = 1;
+@@ -14294,8 +14307,11 @@ void perf_event_exit_task(struct task_struct *task)
+
+ /*
+ * Detach the perf_ctx_data for the system-wide event.
++ *
++ * Done without holding global_ctx_data_rwsem; typically
++ * attach_global_ctx_data() will skip over this task, but otherwise
++ * attach_task_ctx_data() will observe PF_EXITING.
+ */
+- guard(percpu_read)(&global_ctx_data_rwsem);
+ detach_task_ctx_data(task);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6af646327c4cc1259ca7fade9c8569db19b779d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 10:18:35 +0000
+Subject: perf cs-etm: Fix decoding for sparse CPU maps
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit a70493e2bb0878885aa7a8178162550270693eb1 ]
+
+The ETM decoder incorrectly assumed that auxtrace queue indices were
+equivalent to CPU number. This assumption is used for inserting records
+into the queue, and for fetching queues when given a CPU number. This
+assumption held when Perf always opened a dummy event on every CPU, even
+if the user provided a subset of CPUs on the commandline, resulting in
+the indices aligning.
+
+For example:
+
+ # event : name = cs_etm//u, , id = { 2451, 2452 }, type = 11 (cs_etm), size = 136, config = 0x4010, { sample_period, samp>
+ # event : name = dummy:u, , id = { 2453, 2454, 2455, 2456 }, type = 1 (PERF_TYPE_SOFTWARE), size = 136, config = 0x9 (PER>
+
+ 0 0 0x200 [0xd0]: PERF_RECORD_ID_INDEX nr: 6
+ ... id: 2451 idx: 2 cpu: 2 tid: -1
+ ... id: 2452 idx: 3 cpu: 3 tid: -1
+ ... id: 2453 idx: 0 cpu: 0 tid: -1
+ ... id: 2454 idx: 1 cpu: 1 tid: -1
+ ... id: 2455 idx: 2 cpu: 2 tid: -1
+ ... id: 2456 idx: 3 cpu: 3 tid: -1
+
+Since commit 811082e4b668 ("perf parse-events: Support user CPUs mixed
+with threads/processes") the dummy event no longer behaves in this way,
+making the ETM event indices start from 0 on the first CPU recorded
+regardless of its ID:
+
+ # event : name = cs_etm//u, , id = { 771, 772 }, type = 11 (cs_etm), size = 144, config = 0x4010, { sample_period, sample>
+ # event : name = dummy:u, , id = { 773, 774 }, type = 1 (PERF_TYPE_SOFTWARE), size = 144, config = 0x9 (PERF_COUNT_SW_DUM>
+
+ 0 0 0x200 [0x90]: PERF_RECORD_ID_INDEX nr: 4
+ ... id: 771 idx: 0 cpu: 2 tid: -1
+ ... id: 772 idx: 1 cpu: 3 tid: -1
+ ... id: 773 idx: 0 cpu: 2 tid: -1
+ ... id: 774 idx: 1 cpu: 3 tid: -1
+
+This causes the following segfault when decoding:
+
+ $ perf record -e cs_etm//u -C 2,3 -- true
+ $ perf report
+
+ perf: Segmentation fault
+ -------- backtrace --------
+ #0 0xaaaabf9fd020 in ui__signal_backtrace setup.c:110
+ #1 0xffffab5c7930 in __kernel_rt_sigreturn [vdso][930]
+ #2 0xaaaabfb68d30 in cs_etm_decoder__reset cs-etm-decoder.c:85
+ #3 0xaaaabfb65930 in cs_etm__get_data_block cs-etm.c:2032
+ #4 0xaaaabfb666fc in cs_etm__run_per_cpu_timeless_decoder cs-etm.c:2551
+ #5 0xaaaabfb6692c in (cs_etm__process_timeless_queues cs-etm.c:2612
+ #6 0xaaaabfb63390 in cs_etm__flush_events cs-etm.c:921
+ #7 0xaaaabfb324c0 in auxtrace__flush_events auxtrace.c:2915
+ #8 0xaaaabfaac378 in __perf_session__process_events session.c:2285
+ #9 0xaaaabfaacc9c in perf_session__process_events session.c:2442
+ #10 0xaaaabf8d3d90 in __cmd_report builtin-report.c:1085
+ #11 0xaaaabf8d6944 in cmd_report builtin-report.c:1866
+ #12 0xaaaabf95ebfc in run_builtin perf.c:351
+ #13 0xaaaabf95eeb0 in handle_internal_command perf.c:404
+ #14 0xaaaabf95f068 in run_argv perf.c:451
+ #15 0xaaaabf95f390 in main perf.c:558
+ #16 0xffffaab97400 in __libc_start_call_main libc_start_call_main.h:74
+ #17 0xffffaab974d8 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
+ #18 0xaaaabf8aa8f0 in _start perf[7a8f0]
+
+Fix it by inserting into the queues based on CPU number, rather than
+using the index.
+
+Fixes: 811082e4b668db96 ("perf parse-events: Support user CPUs mixed with threads/processes")
+Signed-off-by: James Clark <james.clark@linaro.org>
+Tested-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: coresight@lists.linaro.org
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/cs-etm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index 25d56e0f1c078..12b55c2bc2ca4 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -3086,7 +3086,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o
+
+ if (aux_offset >= auxtrace_event->offset &&
+ aux_offset + aux_size <= auxtrace_event->offset + auxtrace_event->size) {
+- struct cs_etm_queue *etmq = etm->queues.queue_array[auxtrace_event->idx].priv;
++ struct cs_etm_queue *etmq = cs_etm__get_queue(etm, auxtrace_event->cpu);
+
+ /*
+ * If this AUX event was inside this buffer somewhere, create a new auxtrace event
+@@ -3095,6 +3095,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o
+ auxtrace_fragment.auxtrace = *auxtrace_event;
+ auxtrace_fragment.auxtrace.size = aux_size;
+ auxtrace_fragment.auxtrace.offset = aux_offset;
++ auxtrace_fragment.auxtrace.idx = etmq->queue_nr;
+ file_offset += aux_offset - auxtrace_event->offset + auxtrace_event->header.size;
+
+ pr_debug3("CS ETM: Queue buffer size: %#"PRI_lx64" offset: %#"PRI_lx64
+--
+2.51.0
+
--- /dev/null
+From 75bf71f3e402613d12bd7332c83a1e538e3f3c75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:34 +0100
+Subject: perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+
+The intention here was probably not allowing forced-threading.
+
+Replace IRQF_ONESHOT with IRQF_NO_THREAD.
+
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/cxl_pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c
+index d094030220bf2..68a54d97d2a8a 100644
+--- a/drivers/perf/cxl_pmu.c
++++ b/drivers/perf/cxl_pmu.c
+@@ -877,7 +877,7 @@ static int cxl_pmu_probe(struct device *dev)
+ if (!irq_name)
+ return -ENOMEM;
+
+- rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_ONESHOT,
++ rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD,
+ irq_name, info);
+ if (rc)
+ return rc;
+--
+2.51.0
+
--- /dev/null
+From cfb8a2938a2a1130ad82a2f1b36cd8e598d834b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 16:19:40 +0000
+Subject: perf jevents: Handle deleted JSONS in out of source builds
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit 297c9d96e3085116c5cde18170dba716a1f2591e ]
+
+Make the source folders a dependency for the generated folder root so
+that whenever a file is deleted from the source it will force a new
+fresh copy of all the JSON files and avoid stale deleted files.
+
+JSON_DIRS_OUTPUT_ROOT needs to be a dependency of LEGACY_CACHE_JSON so
+that the root folder doesn't get cleaned after the legacy JSON is
+generated. But this is a no-op with in-source builds as
+JSON_DIRS_OUTPUT_ROOT is unset.
+
+JSON_DIRS is added as a dependency of PMU_EVENTS_C which also forces a
+re-build for in source builds when JSON files are deleted. This could
+have also resulted in stale builds, but never a broken one.
+
+Closes: https://lore.kernel.org/linux-next/aW5XSAo88_LBPSYI@sirena.org.uk/
+Fixes: 4bb55de4ff03db3e ("perf jevents: Support copying the source json files to OUTPUT")
+Reported-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/Build | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build
+index a46ab7b612dfc..4f9ef624ba70d 100644
+--- a/tools/perf/pmu-events/Build
++++ b/tools/perf/pmu-events/Build
+@@ -1,5 +1,6 @@
+ pmu-events-y += pmu-events.o
+ JSON = $(shell find pmu-events/arch -name '*.json' -o -name '*.csv')
++JSON_DIRS = $(shell find pmu-events/arch -type d)
+ JDIR_TEST = pmu-events/arch/test
+ JSON_TEST = $(shell [ -d $(JDIR_TEST) ] && \
+ find $(JDIR_TEST) -name '*.json')
+@@ -31,16 +32,23 @@ $(PMU_EVENTS_C): $(EMPTY_PMU_EVENTS_C)
+ else
+ # Copy checked-in json to OUTPUT for generation if it's an out of source build
+ ifneq ($(OUTPUT),)
+-$(OUTPUT)pmu-events/arch/%: pmu-events/arch/%
++# Remove all output directories when any source directory timestamp changes
++# so there are no stale deleted files
++JSON_DIRS_ROOT = $(OUTPUT)pmu-events/arch/
++$(JSON_DIRS_ROOT): $(JSON_DIRS)
++ $(Q)$(call echo-cmd,gen)rm -rf $@
++ $(Q)mkdir -p $@
++
++$(OUTPUT)pmu-events/arch/%: pmu-events/arch/% $(JSON_DIRS_ROOT)
+ $(call rule_mkdir)
+ $(Q)$(call echo-cmd,gen)cp $< $@
+ endif
+
+-$(LEGACY_CACHE_JSON): $(LEGACY_CACHE_PY)
++$(LEGACY_CACHE_JSON): $(LEGACY_CACHE_PY) $(JSON_DIRS_ROOT)
+ $(call rule_mkdir)
+ $(Q)$(call echo-cmd,gen)$(PYTHON) $(LEGACY_CACHE_PY) > $@
+
+-GEN_JSON = $(patsubst %,$(OUTPUT)%,$(JSON)) $(LEGACY_CACHE_JSON)
++GEN_JSON = $(patsubst %,$(OUTPUT)%,$(JSON)) $(LEGACY_CACHE_JSON) $(JSON_DIRS)
+
+ $(METRIC_TEST_LOG): $(METRIC_TEST_PY) $(METRIC_PY)
+ $(call rule_mkdir)
+--
+2.51.0
+
--- /dev/null
+From dc96337f8b798e00352fe2e475f834e1ba0d8d40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:35:07 -0800
+Subject: perf maps: Fix reference count leak in maps__find_ams()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 6fdd2676db55b503c52dd3f1359b5c57f774ab75 ]
+
+ams and so ams->ms.map is an in argument, however, it is also
+overwritten. As a map is reference counted, ensure a map__put() is done
+before overwriting it.
+
+Fixes: 42fd623b58dbcc48 ("perf maps: Get map before returning in maps__find")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Dr. David Alan Gilbert <linux@treblig.org>
+Cc: Guo Ren <guoren@kernel.org>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Julia Lawall <Julia.Lawall@inria.fr>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Paul Walmsley <pjw@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sergei Trofimovich <slyich@gmail.com>
+Cc: Shimin Guo <shimin.guo@skydio.com>
+Cc: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Tianyou Li <tianyou.li@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Zecheng Li <zecheng@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/maps.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c
+index c321d4f4d8466..8885c95f02b3e 100644
+--- a/tools/perf/util/maps.c
++++ b/tools/perf/util/maps.c
+@@ -676,6 +676,7 @@ int maps__find_ams(struct maps *maps, struct addr_map_symbol *ams)
+ if (ams->addr < map__start(ams->ms.map) || ams->addr >= map__end(ams->ms.map)) {
+ if (maps == NULL)
+ return -1;
++ map__put(ams->ms.map);
+ ams->ms.map = maps__find(maps, ams->addr);
+ if (ams->ms.map == NULL)
+ return -1;
+--
+2.51.0
+
--- /dev/null
+From e2f41bc6103d7251f2e540e17bf279873232cb7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 10:36:03 -0800
+Subject: perf metricgroup: Don't early exit if no CPUID table exists
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit cee275edcdb1acfdc8270f80e96f30750b633220 ]
+
+The failure to find a table of metrics with a CPUID shouldn't early
+exit as the metric code will now also consider the default table.
+
+When searching for a metric or metric group,
+pmu_metrics_table__for_each_metric() considers all tables and so the
+caller doesn't need to switch the table to do this.
+
+Fixes: c7adeb0974f18da4 ("perf jevents: Add set of common metrics based on default ones")
+Reviewed-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/metricgroup.c | 18 +++++-------------
+ 1 file changed, 5 insertions(+), 13 deletions(-)
+
+diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c
+index 25c75fdbfc525..a21f2d4969c5c 100644
+--- a/tools/perf/util/metricgroup.c
++++ b/tools/perf/util/metricgroup.c
+@@ -1563,8 +1563,6 @@ int metricgroup__parse_groups(struct evlist *perf_evlist,
+ {
+ const struct pmu_metrics_table *table = pmu_metrics_table__find();
+
+- if (!table)
+- return -EINVAL;
+ if (hardware_aware_grouping)
+ pr_debug("Use hardware aware grouping instead of traditional metric grouping method\n");
+
+@@ -1602,22 +1600,16 @@ static int metricgroup__has_metric_or_groups_callback(const struct pmu_metric *p
+
+ bool metricgroup__has_metric_or_groups(const char *pmu, const char *metric_or_groups)
+ {
+- const struct pmu_metrics_table *tables[2] = {
+- pmu_metrics_table__find(),
+- pmu_metrics_table__default(),
+- };
++ const struct pmu_metrics_table *table = pmu_metrics_table__find();
+ struct metricgroup__has_metric_data data = {
+ .pmu = pmu,
+ .metric_or_groups = metric_or_groups,
+ };
+
+- for (size_t i = 0; i < ARRAY_SIZE(tables); i++) {
+- if (pmu_metrics_table__for_each_metric(tables[i],
+- metricgroup__has_metric_or_groups_callback,
+- &data))
+- return true;
+- }
+- return false;
++ return pmu_metrics_table__for_each_metric(table,
++ metricgroup__has_metric_or_groups_callback,
++ &data)
++ ? true : false;
+ }
+
+ static int metricgroup__topdown_max_level_callback(const struct pmu_metric *pm,
+--
+2.51.0
+
--- /dev/null
+From 028488b5c72f6dbdd17811d0c13e020a478dcba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 15:06:22 -0800
+Subject: perf stat: Ensure metrics are displayed even with failed events
+
+From: Chun-Tse Shao <ctshao@google.com>
+
+[ Upstream commit bb5a920b9099127915706fdd23eb540c9a69c338 ]
+
+Currently, `perf stat` skips or hides metrics when the underlying
+hardware events cannot be counted (e.g., due to insufficient permissions
+or unsupported events).
+
+In `--metric-only` mode, this often results in missing columns or blank
+spaces, making the output difficult to parse.
+
+Modify the logic to ensure metrics are consistently displayed by
+propagating NAN (Not a Number) through the expression evaluator.
+Specifically:
+
+1. Update `prepare_metric()` in stat-shadow.c to treat uncounted events
+ (where `run == 0`) as NAN. This leverages the existing math in expr.y
+ to propagate NAN through metric expressions.
+
+2. Remove the early return in the display logic's `printout()` function
+ that was previously skipping metrics in `--metric-only` mode for
+ failed events.
+l
+3. Simplify `perf_stat__skip_metric_event()` to no longer depend on
+ event runtime.
+
+Tested:
+
+1. `perf all metrics test` did not crash while paranoid is 2.
+
+2. Multiple combinations with `CPUs_utilized` while paranoid is 2.
+
+ $ ./perf stat -M CPUs_utilized -a -- sleep 1
+
+ Performance counter stats for 'system wide':
+
+ <not supported> msec cpu-clock:u # nan CPUs CPUs_utilized
+ 1,006,356,120 duration_time
+
+ 1.004375550 seconds time elapsed
+
+ $ ./perf stat -M CPUs_utilized -a -j -- sleep 1
+ {"counter-value" : "<not supported>", "unit" : "msec", "event" : "cpu-clock:u", "event-runtime" : 0, "pcnt-running" : 100.00, "metric-value" : "nan", "metric-unit" : "CPUs CPUs_utilized"}
+ {"counter-value" : "1006642462.000000", "unit" : "", "event" : "duration_time", "event-runtime" : 1, "pcnt-running" : 100.00}
+
+ $ ./perf stat -M CPUs_utilized -a --metric-only -- sleep 1
+
+ Performance counter stats for 'system wide':
+
+ CPUs CPUs_utilized
+ nan
+
+ 1.004424652 seconds time elapsed
+
+ $ ./perf stat -M CPUs_utilized -a --metric-only -j -- sleep 1
+ {"CPUs CPUs_utilized" : "none"}
+
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Chun-Tse Shao <ctshao@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: 63b320aaac08 ("perf stat-shadow: In prepare_metric fix guard on reading NULL perf_stat_evsel")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/stat-display.c | 59 +++++++++++++++-------------------
+ tools/perf/util/stat-shadow.c | 8 ++---
+ tools/perf/util/stat.h | 2 +-
+ 3 files changed, 29 insertions(+), 40 deletions(-)
+
+diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c
+index 6d02f84c5691a..f4bd579908b43 100644
+--- a/tools/perf/util/stat-display.c
++++ b/tools/perf/util/stat-display.c
+@@ -820,12 +820,6 @@ static void printout(struct perf_stat_config *config, struct outstate *os,
+ }
+
+ if (run == 0 || ena == 0 || counter->counts->scaled == -1) {
+- if (config->metric_only) {
+- pm(config, os, METRIC_THRESHOLD_UNKNOWN, /*format=*/NULL,
+- /*unit=*/NULL, /*val=*/0);
+- return;
+- }
+-
+ ok = false;
+
+ if (counter->supported) {
+@@ -848,33 +842,32 @@ static void printout(struct perf_stat_config *config, struct outstate *os,
+ print_running(config, os, run, ena, /*before_metric=*/true);
+ }
+
+- if (ok) {
+- if (!config->metric_only && counter->default_metricgroup && !counter->default_show_events) {
+- void *from = NULL;
+-
+- aggr_printout(config, os, os->evsel, os->id, os->aggr_nr);
+- /* Print out all the metricgroup with the same metric event. */
+- do {
+- int num = 0;
+-
+- /* Print out the new line for the next new metricgroup. */
+- if (from) {
+- if (config->json_output)
+- new_line_json(config, (void *)os);
+- else
+- __new_line_std_csv(config, os);
+- }
+-
+- print_noise(config, os, counter, noise, /*before_metric=*/true);
+- print_running(config, os, run, ena, /*before_metric=*/true);
+- from = perf_stat__print_shadow_stats_metricgroup(config, counter, aggr_idx,
+- &num, from, &out);
+- } while (from != NULL);
+- } else {
+- perf_stat__print_shadow_stats(config, counter, aggr_idx, &out);
+- }
++ if (!config->metric_only && counter->default_metricgroup &&
++ !counter->default_show_events) {
++ void *from = NULL;
++
++ aggr_printout(config, os, os->evsel, os->id, os->aggr_nr);
++ /* Print out all the metricgroup with the same metric event. */
++ do {
++ int num = 0;
++
++ /* Print out the new line for the next new metricgroup. */
++ if (from) {
++ if (config->json_output)
++ new_line_json(config, (void *)os);
++ else
++ __new_line_std_csv(config, os);
++ }
++
++ print_noise(config, os, counter, noise,
++ /*before_metric=*/true);
++ print_running(config, os, run, ena,
++ /*before_metric=*/true);
++ from = perf_stat__print_shadow_stats_metricgroup(
++ config, counter, aggr_idx, &num, from, &out);
++ } while (from != NULL);
+ } else {
+- pm(config, os, METRIC_THRESHOLD_UNKNOWN, /*format=*/NULL, /*unit=*/NULL, /*val=*/0);
++ perf_stat__print_shadow_stats(config, counter, aggr_idx, &out);
+ }
+
+ if (!config->metric_only) {
+@@ -987,7 +980,7 @@ static void print_counter_aggrdata(struct perf_stat_config *config,
+ ena = aggr->counts.ena;
+ run = aggr->counts.run;
+
+- if (perf_stat__skip_metric_event(counter, ena, run))
++ if (perf_stat__skip_metric_event(counter))
+ return;
+
+ if (val == 0 && should_skip_zero_counter(config, counter, &id))
+diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
+index 9c83f7d96caa4..5d8d09e0e6ae5 100644
+--- a/tools/perf/util/stat-shadow.c
++++ b/tools/perf/util/stat-shadow.c
+@@ -83,7 +83,7 @@ static int prepare_metric(struct perf_stat_config *config,
+ }
+ /* Time events are always on CPU0, the first aggregation index. */
+ aggr = &ps->aggr[is_tool_time ? tool_aggr_idx : aggr_idx];
+- if (!aggr || !metric_events[i]->supported) {
++ if (!aggr || !metric_events[i]->supported || aggr->counts.run == 0) {
+ /*
+ * Not supported events will have a count of 0, which
+ * can be confusing in a metric. Explicitly set the
+@@ -335,14 +335,10 @@ void perf_stat__print_shadow_stats(struct perf_stat_config *config,
+ * perf_stat__skip_metric_event - Skip the evsel in the Default metricgroup,
+ * if it's not running or not the metric event.
+ */
+-bool perf_stat__skip_metric_event(struct evsel *evsel,
+- u64 ena, u64 run)
++bool perf_stat__skip_metric_event(struct evsel *evsel)
+ {
+ if (!evsel->default_metricgroup)
+ return false;
+
+- if (!ena || !run)
+- return true;
+-
+ return !metricgroup__lookup(&evsel->evlist->metric_events, evsel, false);
+ }
+diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h
+index f986911c9296e..4bced233d2fc0 100644
+--- a/tools/perf/util/stat.h
++++ b/tools/perf/util/stat.h
+@@ -163,7 +163,7 @@ void perf_stat__print_shadow_stats(struct perf_stat_config *config,
+ struct evsel *evsel,
+ int aggr_idx,
+ struct perf_stat_output_ctx *out);
+-bool perf_stat__skip_metric_event(struct evsel *evsel, u64 ena, u64 run);
++bool perf_stat__skip_metric_event(struct evsel *evsel);
+ void *perf_stat__print_shadow_stats_metricgroup(struct perf_stat_config *config,
+ struct evsel *evsel,
+ int aggr_idx,
+--
+2.51.0
+
--- /dev/null
+From df6e72a0d57ce044eaf015d0415d02d622a22934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 22:03:55 -0800
+Subject: perf stat-shadow: In prepare_metric fix guard on reading NULL
+ perf_stat_evsel
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 63b320aaac08ba267268ec21a195ce3c82dcb8ab ]
+
+The aggr value is setup to always be non-null creating a redundant
+guard for reading from it. Switch to using the perf_stat_evsel (ps)
+and narrow the scope of aggr so that it is known valid when used.
+
+Fixes: 3d65f6445fd93e3e ("perf stat-shadow: Read tool events directly")
+Reported-by: Andres Freund <andres@anarazel.de>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Cc: Dr. David Alan Gilbert <linux@treblig.org>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/stat-shadow.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
+index 5d8d09e0e6ae5..59d2cd4f2188d 100644
+--- a/tools/perf/util/stat-shadow.c
++++ b/tools/perf/util/stat-shadow.c
+@@ -57,7 +57,6 @@ static int prepare_metric(struct perf_stat_config *config,
+ bool is_tool_time =
+ tool_pmu__is_time_event(config, metric_events[i], &tool_aggr_idx);
+ struct perf_stat_evsel *ps = metric_events[i]->stats;
+- struct perf_stat_aggr *aggr;
+ char *n;
+ double val;
+
+@@ -82,8 +81,7 @@ static int prepare_metric(struct perf_stat_config *config,
+ }
+ }
+ /* Time events are always on CPU0, the first aggregation index. */
+- aggr = &ps->aggr[is_tool_time ? tool_aggr_idx : aggr_idx];
+- if (!aggr || !metric_events[i]->supported || aggr->counts.run == 0) {
++ if (!ps || !metric_events[i]->supported) {
+ /*
+ * Not supported events will have a count of 0, which
+ * can be confusing in a metric. Explicitly set the
+@@ -93,11 +91,21 @@ static int prepare_metric(struct perf_stat_config *config,
+ val = NAN;
+ source_count = 0;
+ } else {
+- val = aggr->counts.val;
+- if (is_tool_time)
+- val *= 1e-9; /* Convert time event nanoseconds to seconds. */
+- if (!source_count)
+- source_count = evsel__source_count(metric_events[i]);
++ struct perf_stat_aggr *aggr =
++ &ps->aggr[is_tool_time ? tool_aggr_idx : aggr_idx];
++
++ if (aggr->counts.run == 0) {
++ val = NAN;
++ source_count = 0;
++ } else {
++ val = aggr->counts.val;
++ if (is_tool_time) {
++ /* Convert time event nanoseconds to seconds. */
++ val *= 1e-9;
++ }
++ if (!source_count)
++ source_count = evsel__source_count(metric_events[i]);
++ }
+ }
+ n = strdup(evsel__metric_id(metric_events[i]));
+ if (!n)
+--
+2.51.0
+
--- /dev/null
+From 218ccaafbaca60e6fbce9403bdd40cbe3c5f92ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 21:28:27 -0800
+Subject: perf symbol-elf: Fix leak of ELF files with GNU debugdata
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 92d65d9c31621befe0a5f7c0bd43bd217613c6b6 ]
+
+The processing of DSO_BINARY_TYPE__GNU_DEBUGDATA in symsrc__init happens
+with an open ELF file but the error path only closes the associate fd.
+
+Fix the goto so that the ELF file is also ended and memory released.
+
+Fixes: b10f74308e130527 ("perf symbol: Support .gnu_debugdata for symbols")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Dmitriy Vyukov <dvyukov@google.com>
+Cc: Dr. David Alan Gilbert <linux@treblig.org>
+Cc: Guo Ren <guoren@kernel.org>
+Cc: Haibo Xu <haibo1.xu@intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: Mark Wielaard <mark@klomp.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Paul Walmsley <pjw@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sergei Trofimovich <slyich@gmail.com>
+Cc: Shimin Guo <shimin.guo@skydio.com>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol-elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index d1dcafa4b3b80..439f252937b89 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1173,7 +1173,7 @@ int symsrc__init(struct symsrc *ss, struct dso *dso, const char *name,
+ Elf *embedded = read_gnu_debugdata(dso, elf, name, &new_fd);
+
+ if (!embedded)
+- goto out_close;
++ goto out_elf_end;
+
+ elf_end(elf);
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From a465f48a0d67673269acf86c5de4c6f9be825425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 08:17:52 +0100
+Subject: perf test: Fix test case perf evlist tests for s390x
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit b04d2b9199129f4f0c992a518c0fb78c2efc1064 ]
+
+Perf test case 78: perf evlist tests fails on s390.
+
+The failure is causes by grouping events cycles and instructions because
+sampling does only support event cycles. Change the group to software
+events to fix this.
+
+Output before:
+ # ./perf test 78
+ 78: perf evlist tests : FAILED!
+ #
+
+Output after:
+ # ./perf test 78
+ 78: perf evlist tests : Ok
+ #
+
+Fixes: db452961de939225 ("perf tests evlist: Add basic evlist test")
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/evlist.sh | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/tests/shell/evlist.sh b/tools/perf/tests/shell/evlist.sh
+index 140f099e75c1e..5632be3917109 100755
+--- a/tools/perf/tests/shell/evlist.sh
++++ b/tools/perf/tests/shell/evlist.sh
+@@ -38,13 +38,14 @@ test_evlist_simple() {
+
+ test_evlist_group() {
+ echo "Group evlist test"
+- if ! perf record -e "{cycles,instructions}" -o "${perfdata}" true 2> /dev/null
++ if ! perf record -e "{cpu-clock,task-clock}" -o "${perfdata}" \
++ -- perf test -w noploop 2> /dev/null
+ then
+ echo "Group evlist [Skipped event group recording failed]"
+ return
+ fi
+
+- if ! perf evlist -i "${perfdata}" -g | grep -q "{.*cycles.*,.*instructions.*}"
++ if ! perf evlist -i "${perfdata}" -g | grep -q "{.*cpu-clock.*,.*task-clock.*}"
+ then
+ echo "Group evlist [Failed to list event group]"
+ err=1
+--
+2.51.0
+
--- /dev/null
+From 7c60b8f049a38b7dcd0b0eb479dba8ee96091bb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 16:32:56 +0100
+Subject: perf test: Fix test case perftool-testsuite_report for s390
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 3d012b8614ee020666f3dd15af9f65dc487e3f5f ]
+
+Test case perftool-testsuite_report fails on s390 for some time
+now.
+
+Root cause is a time out which is too tight for large s390 machines.
+The time out value addr2line_timeout_ms is per default set to 1 second.
+
+This is the maximum time the function read_addr2line_record() waits for
+a reply from the forked off tool addr2line, which is started as a child
+in interactive mode.
+
+It reads stdin (an address in hexadecimal) and replies on stdout with
+function name, file name and line number. This might take more than one
+second.
+
+However one second is not always enough and the reply from addr2line
+tool is not received. Function read_addr2line_record() fails and emits
+a warning, which is not expected by the test case. It fails.
+
+Output before:
+
+ # perf test -F 133
+ -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file
+ ==================
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.087 MB \
+ /tmp/perftool-testsuite_report.FHz/perf_report/perf.data.1 \
+ (207 samples) ]
+ ==================
+ -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file
+ ## [ PASS ] ## perf_report :: setup SUMMARY
+ -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped
+ Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/
+ 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/
+ vmlinux: could not read first record"
+ Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/
+ 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/
+ vmlinux: could not read first record"
+ -- [ FAIL ] -- perf_report :: test_basic :: basic execution
+ (output regexp parsing)
+ ....
+ 133: perftool-testsuite_report : FAILED!
+
+Output after:
+
+ # ./perf test -F 133
+ -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file
+ ==================
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.087 MB \
+ /tmp/perftool-testsuite_report.Mlp/perf_report/perf.data.1
+ (188 samples) ]
+ ==================
+ -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file
+ ## [ PASS ] ## perf_report :: setup SUMMARY
+ -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped
+ -- [ PASS ] -- perf_report :: test_basic :: basic execution
+ -- [ PASS ] -- perf_report :: test_basic :: number of samples
+ -- [ PASS ] -- perf_report :: test_basic :: header
+ -- [ PASS ] -- perf_report :: test_basic :: header timestamp
+ -- [ PASS ] -- perf_report :: test_basic :: show CPU utilization
+ -- [ PASS ] -- perf_report :: test_basic :: pid
+ -- [ PASS ] -- perf_report :: test_basic :: non-existing symbol
+ -- [ PASS ] -- perf_report :: test_basic :: symbol filter
+ -- [ PASS ] -- perf_report :: test_basic :: latency header
+ -- [ PASS ] -- perf_report :: test_basic :: default report for latency profile
+ -- [ PASS ] -- perf_report :: test_basic :: latency report for latency profile
+ -- [ PASS ] -- perf_report :: test_basic :: parallelism histogram
+ ## [ PASS ] ## perf_report :: test_basic SUMMARY
+ 133: perftool-testsuite_report : Ok
+ #
+
+Fixes: 257046a36750a6db ("perf srcline: Fallback between addr2line implementations")
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: linux-s390@vger.kernel.org
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/addr2line.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/addr2line.c b/tools/perf/util/addr2line.c
+index f2d94a3272d71..a8b39f4f202b6 100644
+--- a/tools/perf/util/addr2line.c
++++ b/tools/perf/util/addr2line.c
+@@ -18,8 +18,8 @@
+
+ #define MAX_INLINE_NEST 1024
+
+-/* If addr2line doesn't return data for 1 second then timeout. */
+-int addr2line_timeout_ms = 1 * 1000;
++/* If addr2line doesn't return data for 5 seconds then timeout. */
++int addr2line_timeout_ms = 5 * 1000;
+
+ static int filename_split(char *filename, unsigned int *line_nr)
+ {
+--
+2.51.0
+
--- /dev/null
+From 32b4b04f1396b0b1dc019032f79b651e3356726b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 11:18:23 +0100
+Subject: perf test: Fix test perf evlist for z/VM s390x
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 008603bda19b29687edce533e4c09acff68c1077 ]
+
+Perf test case 'perf evlist tests' fails on z/VM machines on s390.
+
+The failure is causes by event cycles. This event is not available
+on virtualized machines like z/VM on s390.
+
+Change to software event cpu-clock to fix this.
+
+ Output before:
+ # ./perf test 78
+ 79: perf evlist tests : FAILED!
+ #
+
+ Output after:
+ # ./perf test 78
+ 79: perf evlist tests : Ok
+ #
+
+Fixes: b04d2b9199129f4f ("perf test: Fix test case perf evlist tests for s390x")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Tested-by: Jan Polensky <japo@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/evlist.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/tests/shell/evlist.sh b/tools/perf/tests/shell/evlist.sh
+index 5632be3917109..8a22f4171c07c 100755
+--- a/tools/perf/tests/shell/evlist.sh
++++ b/tools/perf/tests/shell/evlist.sh
+@@ -21,13 +21,13 @@ trap trap_cleanup EXIT TERM INT
+
+ test_evlist_simple() {
+ echo "Simple evlist test"
+- if ! perf record -e cycles -o "${perfdata}" true 2> /dev/null
++ if ! perf record -e cpu-clock -o "${perfdata}" true 2> /dev/null
+ then
+ echo "Simple evlist [Failed record]"
+ err=1
+ return
+ fi
+- if ! perf evlist -i "${perfdata}" | grep -q "cycles"
++ if ! perf evlist -i "${perfdata}" | grep -q "cpu-clock"
+ then
+ echo "Simple evlist [Failed to list event]"
+ err=1
+--
+2.51.0
+
--- /dev/null
+From 1a7dec8ea4cd5ef10b8f06df19c90e03b8207f84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 14:32:16 +0100
+Subject: perf test stat tests: Fix for virtualized machines
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit e272628902c1c96731e2d9f62a7fc77767686eb0 ]
+
+On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for
+z/VM systems. The root cause is this statement:
+
+ $(perf stat -a -- sleep 0.1 2>&1 |\
+ grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* -c)
+
+The 'perf stat' output on a s390 z/VM system is
+
+ # perf stat -a -- sleep 0.1 2>&1
+ Performance counter stats for 'system wide':
+
+ 56 context-switches # 46.3 cs/sec cs_per_second
+ 1,210.41 msec cpu-clock # 11.9 CPUs CPUs_utilized
+ 12 cpu-migrations # 9.9 migrations/sec ...
+ 81 page-faults # 66.9 faults/sec ...
+
+ 0.100891009 seconds time elapsed
+
+The grep command does not match any single line and exits with error
+code 1.
+
+As the bash script is executed with 'set -e', it aborts with the first
+error code being non-zero.
+
+Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'.
+
+Output before:
+
+ # perf test 102
+ 102: perf stat tests : FAILED!
+ #
+
+Output after:
+
+ # perf test 102
+ 102: perf stat tests : Ok
+ #
+
+Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: linux-s390@vger.kernel.org
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index 0b2f0f88ca166..792a0b79f6b86 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -233,7 +233,7 @@ test_hybrid() {
+ fi
+
+ # Run default Perf stat
+- cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c)
++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " | wc -l)
+
+ # The expectation is that default output will have a cycles events on each
+ # hybrid PMU. In situations with no cycles PMU events, like virtualized, this
+--
+2.51.0
+
--- /dev/null
+From 129f90c53abba37523fdc6a88f615859000594fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 11:01:41 -0800
+Subject: perf tests kallsyms: Fix missed map__put()
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit a58807adbed5f532efb231e5490767f284f237c0 ]
+
+Issue was caught by leak sanitizer and the test robot.
+
+Fixes: 34e271ae55382fbd ("perf test: Add kallsyms split test")
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Closes: https://lore.kernel.org/oe-lkp/202512101502.f3819cd3-lkp@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/kallsyms-split.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/perf/tests/kallsyms-split.c b/tools/perf/tests/kallsyms-split.c
+index bbbc66957e5d0..117ed3b70f630 100644
+--- a/tools/perf/tests/kallsyms-split.c
++++ b/tools/perf/tests/kallsyms-split.c
+@@ -148,6 +148,7 @@ static int test__kallsyms_split(struct test_suite *test __maybe_unused,
+ ret = TEST_OK;
+
+ out:
++ map__put(map);
+ remove_proc_dir(0);
+ machine__exit(&m);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From e27c8fe84849ed4e0c9959551c0947324098d2f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 09:53:37 -0800
+Subject: perf tests sched: Avoid error in cleanup on loaded machines
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit c5e47e4d00fbc15f2390bb6ed8d9c21836363291 ]
+
+The stop_noploops function will kill the noploop processes that are
+running for 10 seconds.
+
+On a loaded machine they may have already terminated meaning the kill
+will return an error of no such process.
+
+This doesn't matter and so ignore the error to avoid the test
+terminating in the cleanup.
+
+Fixes: 0e22c5ca44e68798 ("perf test: Add sched latency and script shell tests")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/sched.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/shell/sched.sh b/tools/perf/tests/shell/sched.sh
+index b9b81eaf856e6..b9637069adb1f 100755
+--- a/tools/perf/tests/shell/sched.sh
++++ b/tools/perf/tests/shell/sched.sh
+@@ -53,7 +53,7 @@ start_noploops() {
+ }
+
+ cleanup_noploops() {
+- kill "$PID1" "$PID2"
++ kill "$PID1" "$PID2" || true
+ }
+
+ test_sched_record() {
+--
+2.51.0
+
--- /dev/null
+From 0dac4e3a03c3fea5c7813adf45d156ff89907ab0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 15:37:57 -0800
+Subject: perf tools: Get debug info of DSO properly
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 069e603d8248dac98b1ef2909e2f1c4169b9da11 ]
+
+The dso__debuginfo() just used the path name to open the file but it may
+be outdated. It should check build-ID and use the file in the build-ID
+cache if available rather than just using the path name.
+
+Let's factor out dso__get_filename() to avoid code duplicate.
+
+Fixes: 53a61a6ca279165d ("perf annotate: Add dso__debuginfo() helper")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dso.c | 63 ++++++++++++++++++++++++++++++++-----------
+ tools/perf/util/dso.h | 11 ++------
+ 2 files changed, 50 insertions(+), 24 deletions(-)
+
+diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
+index 344e689567ee1..dc202d4943721 100644
+--- a/tools/perf/util/dso.c
++++ b/tools/perf/util/dso.c
+@@ -111,7 +111,7 @@ bool dso__is_object_file(const struct dso *dso)
+
+ int dso__read_binary_type_filename(const struct dso *dso,
+ enum dso_binary_type type,
+- char *root_dir, char *filename, size_t size)
++ const char *root_dir, char *filename, size_t size)
+ {
+ char build_id_hex[SBUILD_ID_SIZE];
+ int ret = 0;
+@@ -563,20 +563,15 @@ char *dso__filename_with_chroot(const struct dso *dso, const char *filename)
+ return filename_with_chroot(nsinfo__pid(dso__nsinfo_const(dso)), filename);
+ }
+
+-static int __open_dso(struct dso *dso, struct machine *machine)
+- EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock)
++static char *dso__get_filename(struct dso *dso, const char *root_dir,
++ bool *decomp)
+ {
+- int fd = -EINVAL;
+- char *root_dir = (char *)"";
+ char *name = malloc(PATH_MAX);
+- bool decomp = false;
+
+- if (!name)
+- return -ENOMEM;
++ *decomp = false;
+
+- mutex_lock(dso__lock(dso));
+- if (machine)
+- root_dir = machine->root_dir;
++ if (name == NULL)
++ return NULL;
+
+ if (dso__read_binary_type_filename(dso, dso__binary_type(dso),
+ root_dir, name, PATH_MAX))
+@@ -601,20 +596,38 @@ static int __open_dso(struct dso *dso, struct machine *machine)
+ size_t len = sizeof(newpath);
+
+ if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) {
+- fd = -(*dso__load_errno(dso));
++ errno = *dso__load_errno(dso);
+ goto out;
+ }
+
+- decomp = true;
++ *decomp = true;
+ strcpy(name, newpath);
+ }
++ return name;
++
++out:
++ free(name);
++ return NULL;
++}
+
+- fd = do_open(name);
++static int __open_dso(struct dso *dso, struct machine *machine)
++ EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock)
++{
++ int fd = -EINVAL;
++ char *name;
++ bool decomp = false;
++
++ mutex_lock(dso__lock(dso));
++
++ name = dso__get_filename(dso, machine ? machine->root_dir : "", &decomp);
++ if (name)
++ fd = do_open(name);
++ else
++ fd = -errno;
+
+ if (decomp)
+ unlink(name);
+
+-out:
+ mutex_unlock(dso__lock(dso));
+ free(name);
+ return fd;
+@@ -1910,3 +1923,23 @@ const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename,
+ return __dso__read_symbol(dso, symfs_filename, start, len,
+ out_buf, out_buf_len, is_64bit);
+ }
++
++struct debuginfo *dso__debuginfo(struct dso *dso)
++{
++ char *name;
++ bool decomp = false;
++ struct debuginfo *dinfo = NULL;
++
++ mutex_lock(dso__lock(dso));
++
++ name = dso__get_filename(dso, "", &decomp);
++ if (name)
++ dinfo = debuginfo__new(name);
++
++ if (decomp)
++ unlink(name);
++
++ mutex_unlock(dso__lock(dso));
++ free(name);
++ return dinfo;
++}
+diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
+index f8ccb9816b89c..54e470dd07305 100644
+--- a/tools/perf/util/dso.h
++++ b/tools/perf/util/dso.h
+@@ -766,7 +766,7 @@ int dso__kernel_module_get_build_id(struct dso *dso, const char *root_dir);
+
+ char dso__symtab_origin(const struct dso *dso);
+ int dso__read_binary_type_filename(const struct dso *dso, enum dso_binary_type type,
+- char *root_dir, char *filename, size_t size);
++ const char *root_dir, char *filename, size_t size);
+ bool is_kernel_module(const char *pathname, int cpumode);
+ bool dso__needs_decompress(struct dso *dso);
+ int dso__decompress_kmodule_fd(struct dso *dso, const char *name);
+@@ -915,14 +915,7 @@ u64 dso__findnew_global_type(struct dso *dso, u64 addr, u64 offset);
+ bool perf_pid_map_tid(const char *dso_name, int *tid);
+ bool is_perf_pid_map_name(const char *dso_name);
+
+-/*
+- * In the future, we may get debuginfo using build-ID (w/o path).
+- * Add this helper is for the smooth conversion.
+- */
+-static inline struct debuginfo *dso__debuginfo(struct dso *dso)
+-{
+- return debuginfo__new(dso__long_name(dso));
+-}
++struct debuginfo *dso__debuginfo(struct dso *dso);
+
+ const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename,
+ const struct map *map, const struct symbol *sym,
+--
+2.51.0
+
--- /dev/null
+From ad15c71ae1ae56d3db2faa7eef73356c36d8ac61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:32 -0800
+Subject: perf unwind-libdw: Fix invalid reference counts
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f815fc0c66e777c727689666cfb46b8d461c2f99 ]
+
+The addition of addr_location__exit() causes use-after put on the maps
+and map references in the unwind info. Add the gets and then add the
+map_symbol__exit() calls.
+
+Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/unwind-libdw.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index ae70fb56a0572..3ff427a49e4c5 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -136,8 +136,8 @@ static int entry(u64 ip, struct unwind_info *ui)
+ }
+
+ e->ip = ip;
+- e->ms.maps = al.maps;
+- e->ms.map = al.map;
++ e->ms.maps = maps__get(al.maps);
++ e->ms.map = map__get(al.map);
+ e->ms.sym = al.sym;
+
+ pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n",
+@@ -325,6 +325,9 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
+ if (err)
+ pr_debug("unwind: failed with '%s'\n", dwfl_errmsg(-1));
+
++ for (i = 0; i < ui->idx; i++)
++ map_symbol__exit(&ui->entries[i].ms);
++
+ dwfl_end(ui->dwfl);
+ free(ui);
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From ff22ab916f45ef50ca7d9c47a5c4f334a866db76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:39:46 +0530
+Subject: perf vendor events amd: Fix Zen 5 MAB allocation events
+
+From: Sandipan Das <sandipan.das@amd.com>
+
+[ Upstream commit 76b2cf07a6d2a836108f9c2486d76599f7adf6e8 ]
+
+The unit masks for PMCx041 vary across different generations of Zen
+processors.
+
+Fix the Zen 5 events based on PMCx041 as they incorrectly use the same
+unit masks as that of Zen 4.
+
+Fixes: 45c072f2537ab07b ("perf vendor events amd: Add Zen 5 core events")
+Reported-by: Suyash Mahar <smahar@meta.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ananth Narayan <ananth.narayan@amd.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: Sandipan Das <sandipan.das@amd.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/arch/x86/amdzen5/load-store.json | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
+index ff6627a778057..06bbaea159259 100644
+--- a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
++++ b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
+@@ -70,19 +70,19 @@
+ "EventName": "ls_mab_alloc.load_store_allocations",
+ "EventCode": "0x41",
+ "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for load-store allocations.",
+- "UMask": "0x3f"
++ "UMask": "0x07"
+ },
+ {
+ "EventName": "ls_mab_alloc.hardware_prefetcher_allocations",
+ "EventCode": "0x41",
+ "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for hardware prefetcher allocations.",
+- "UMask": "0x40"
++ "UMask": "0x08"
+ },
+ {
+ "EventName": "ls_mab_alloc.all_allocations",
+ "EventCode": "0x41",
+ "BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for all types of allocations.",
+- "UMask": "0x7f"
++ "UMask": "0x0f"
+ },
+ {
+ "EventName": "ls_dmnd_fills_from_sys.local_l2",
+--
+2.51.0
+
--- /dev/null
+From 7a01b6bbb6c40743c698f9cd7ee019d08f89223d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 08:48:46 +0100
+Subject: perf/x86/cstate: Add Airmont NP
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 3006911f284d769b0f66c12b39da130325ef1440 ]
+
+From the perspective of Intel cstate residency counters, the Airmont NP
+(aka Lightning Mountain) is identical to the Airmont.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Link: https://patch.msgid.link/20251124074846.9653-4-ms@dev.tdt.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/cstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index fa67fda6e45b4..c1e318bdaa397 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -599,6 +599,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
+ X86_MATCH_VFM(INTEL_ATOM_SILVERMONT, &slm_cstates),
+ X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_D, &slm_cstates),
+ X86_MATCH_VFM(INTEL_ATOM_AIRMONT, &slm_cstates),
++ X86_MATCH_VFM(INTEL_ATOM_AIRMONT_NP, &slm_cstates),
+
+ X86_MATCH_VFM(INTEL_BROADWELL, &snb_cstates),
+ X86_MATCH_VFM(INTEL_BROADWELL_D, &snb_cstates),
+--
+2.51.0
+
--- /dev/null
+From 8fbac886cb98e39c698fc9775c36c45acb888ffa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 08:48:45 +0100
+Subject: perf/x86/intel: Add Airmont NP
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit a08340fd291671c54d379d285b2325490ce90ddd ]
+
+The Intel / MaxLinear Airmont NP (aka Lightning Mountain) supports the
+same architectual and non-architecural events as Airmont.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Link: https://patch.msgid.link/20251124074846.9653-3-ms@dev.tdt.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index bdf3f0d0fe216..d85df652334fb 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -7405,6 +7405,7 @@ __init int intel_pmu_init(void)
+ case INTEL_ATOM_SILVERMONT_D:
+ case INTEL_ATOM_SILVERMONT_MID:
+ case INTEL_ATOM_AIRMONT:
++ case INTEL_ATOM_AIRMONT_NP:
+ case INTEL_ATOM_SILVERMONT_MID2:
+ memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+--
+2.51.0
+
--- /dev/null
+From 7e4c8729f22ac0fc9bd6da0610085e26541ecb18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 08:48:44 +0100
+Subject: perf/x86/msr: Add Airmont NP
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 63dbadcafc1f4d1da796a8e2c0aea1e561f79ece ]
+
+Like Airmont, the Airmont NP (aka Intel / MaxLinear Lightning Mountain)
+supports SMI_COUNT MSR.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Link: https://patch.msgid.link/20251124074846.9653-2-ms@dev.tdt.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/msr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c
+index 7f5007a4752a1..8052596b85036 100644
+--- a/arch/x86/events/msr.c
++++ b/arch/x86/events/msr.c
+@@ -78,6 +78,7 @@ static bool test_intel(int idx, void *data)
+ case INTEL_ATOM_SILVERMONT:
+ case INTEL_ATOM_SILVERMONT_D:
+ case INTEL_ATOM_AIRMONT:
++ case INTEL_ATOM_AIRMONT_NP:
+
+ case INTEL_ATOM_GOLDMONT:
+ case INTEL_ATOM_GOLDMONT_D:
+--
+2.51.0
+
--- /dev/null
+From e4dddbba6657655341933c44ed2e0b85ebbc94e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 15:24:25 +0100
+Subject: phy: cadence-torrent: restore parent clock for refclk during resume
+
+From: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+
+[ Upstream commit 434e1a0ee145d0389b192252be4c993f86cf1134 ]
+
+While suspend and resume, parent clock config for refclk was getting lost.
+So save and restore it in suspend and resume operations.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+Link: https://patch.msgid.link/20251216-phy-cadence-torrent-resume-restore-refclk-parent-v3-1-8a7ed84b47e3@bootlin.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/phy-cadence-torrent.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c
+index 37fa4bad6bd72..877f22177c699 100644
+--- a/drivers/phy/cadence/phy-cadence-torrent.c
++++ b/drivers/phy/cadence/phy-cadence-torrent.c
+@@ -397,6 +397,7 @@ struct cdns_torrent_refclk_driver {
+ struct clk_hw hw;
+ struct regmap_field *cmn_fields[REFCLK_OUT_NUM_CMN_CONFIG];
+ struct clk_init_data clk_data;
++ u8 parent_index;
+ };
+
+ #define to_cdns_torrent_refclk_driver(_hw) \
+@@ -3326,11 +3327,29 @@ static const struct cdns_torrent_vals sgmii_qsgmii_xcvr_diag_ln_vals = {
+ .num_regs = ARRAY_SIZE(sgmii_qsgmii_xcvr_diag_ln_regs),
+ };
+
++static void cdns_torrent_refclk_driver_suspend(struct cdns_torrent_phy *cdns_phy)
++{
++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER];
++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw);
++
++ refclk_driver->parent_index = cdns_torrent_refclk_driver_get_parent(hw);
++}
++
++static int cdns_torrent_refclk_driver_resume(struct cdns_torrent_phy *cdns_phy)
++{
++ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER];
++ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw);
++
++ return cdns_torrent_refclk_driver_set_parent(hw, refclk_driver->parent_index);
++}
++
+ static int cdns_torrent_phy_suspend_noirq(struct device *dev)
+ {
+ struct cdns_torrent_phy *cdns_phy = dev_get_drvdata(dev);
+ int i;
+
++ cdns_torrent_refclk_driver_suspend(cdns_phy);
++
+ reset_control_assert(cdns_phy->phy_rst);
+ reset_control_assert(cdns_phy->apb_rst);
+ for (i = 0; i < cdns_phy->nsubnodes; i++)
+@@ -3352,6 +3371,10 @@ static int cdns_torrent_phy_resume_noirq(struct device *dev)
+ int node = cdns_phy->nsubnodes;
+ int ret, i;
+
++ ret = cdns_torrent_refclk_driver_resume(cdns_phy);
++ if (ret)
++ return ret;
++
+ ret = cdns_torrent_clk(cdns_phy);
+ if (ret)
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From ab1ed626d1cfbfc50d590a01833e85121f3a1e2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 19:17:12 +0800
+Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ]
+
+Disabling PHYs in runtime usually causes the client with external abort
+exception or similar issue due to lack of API to notify clients about PHY
+removal. This patch removes the possibility to unbind i.MX PHY drivers in
+runtime.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+index 91b3e62743d3a..b30d01f345d20 100644
+--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+@@ -730,6 +730,7 @@ static struct platform_driver imx8mq_usb_phy_driver = {
+ .driver = {
+ .name = "imx8mq-usb-phy",
+ .of_match_table = imx8mq_usb_phy_of_match,
++ .suppress_bind_attrs = true,
+ }
+ };
+ module_platform_driver(imx8mq_usb_phy_driver);
+--
+2.51.0
+
--- /dev/null
+From a5f60a728a27f2e16334167b0f21bdf56c29efb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 15:06:43 +0000
+Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts
+
+From: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+
+[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ]
+
+The problem with the current implementation is that it does not consider
+that the USB controller can have multiple PHY handles with different
+arguments count, as for example we have in our cn9131 based platform:
+"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;".
+
+In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells)
+leads to not proper phy detection, taking the "marvell,cp110-utmi-phy"
+dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0
+(#phy-cells = <0>) and safely look for that phy.
+
+Signed-off-by: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+index 59903f86b13f5..dd3e515a8e865 100644
+--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+@@ -338,7 +338,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
+- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1);
++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0);
+ if ((port->dr_mode != USB_DR_MODE_HOST) &&
+ (port->dr_mode != USB_DR_MODE_PERIPHERAL)) {
+ dev_err(&pdev->dev,
+--
+2.51.0
+
--- /dev/null
+From 85d421d568c82246110870adbe98f3149e5ef928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 15:26:20 +0100
+Subject: phy: ti: phy-j721e-wiz: restore mux selection during resume
+
+From: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+
+[ Upstream commit 53f6240e88c9e8715e09fc19942f13450db4cb33 ]
+
+While suspend and resume mux selection was getting lost. So save and
+restore these values in suspend and resume operations.
+
+Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
+Link: https://patch.msgid.link/20251216-phy-ti-phy-j721e-wiz-resume-restore-mux-sel-v1-1-771d564db966@bootlin.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-j721e-wiz.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c
+index a8b440c6c46bb..ba31b0a1f7f79 100644
+--- a/drivers/phy/ti/phy-j721e-wiz.c
++++ b/drivers/phy/ti/phy-j721e-wiz.c
+@@ -393,6 +393,7 @@ struct wiz {
+ struct clk *output_clks[WIZ_MAX_OUTPUT_CLOCKS];
+ struct clk_onecell_data clk_data;
+ const struct wiz_data *data;
++ int mux_sel_status[WIZ_MUX_NUM_CLOCKS];
+ };
+
+ static int wiz_reset(struct wiz *wiz)
+@@ -1654,11 +1655,25 @@ static void wiz_remove(struct platform_device *pdev)
+ pm_runtime_disable(dev);
+ }
+
++static int wiz_suspend_noirq(struct device *dev)
++{
++ struct wiz *wiz = dev_get_drvdata(dev);
++ int i;
++
++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++)
++ regmap_field_read(wiz->mux_sel_field[i], &wiz->mux_sel_status[i]);
++
++ return 0;
++}
++
+ static int wiz_resume_noirq(struct device *dev)
+ {
+ struct device_node *node = dev->of_node;
+ struct wiz *wiz = dev_get_drvdata(dev);
+- int ret;
++ int ret, i;
++
++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++)
++ regmap_field_write(wiz->mux_sel_field[i], wiz->mux_sel_status[i]);
+
+ /* Enable supplemental Control override if available */
+ if (wiz->sup_legacy_clk_override)
+@@ -1680,7 +1695,7 @@ static int wiz_resume_noirq(struct device *dev)
+ return ret;
+ }
+
+-static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, NULL, wiz_resume_noirq);
++static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, wiz_suspend_noirq, wiz_resume_noirq);
+
+ static struct platform_driver wiz_driver = {
+ .probe = wiz_probe,
+--
+2.51.0
+
--- /dev/null
+From d6b05baf8603e27f5a6bb3f524304bf46d75c1a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 18:02:17 +0800
+Subject: pinctrl: mediatek: make devm allocations safer and clearer in
+ mtk_eint_do_init()
+
+From: Liang Jie <liangjie@lixiang.com>
+
+[ Upstream commit 255b721c96046d4c57fa2268e4c72607868ce91f ]
+
+mtk_eint_do_init() allocates several pointer arrays which are then
+populated in a per-instance loop and freed on error. The arrays are
+currently allocated with devm_kmalloc(), so their entries are left
+uninitialised until the per-instance allocations succeed.
+
+On a failure in the middle of the loop, the error path iterates over
+the full nbase range and calls devm_kfree() on each element. For
+indices which were never initialised, the corresponding array entries
+contain stack garbage. If any of those happen to be non-zero,
+devm_kfree() will pass them to devres_destroy(), which will WARN
+because there is no matching devm_kmalloc() resource for such bogus
+pointers.
+
+Improve the robustness and readability by:
+
+ - Using devm_kcalloc() for the pointer arrays so that all entries
+ start as NULL, ensuring that only genuinely initialised elements
+ may be freed and preventing spurious WARN_ON()s in the error path.
+ - Switching the allocations to sizeof(*ptr) / sizeof(**ptr) forms,
+ avoiding hard-coded element types and making the code more resilient
+ to future type changes.
+ - Dropping the redundant NULL checks before devm_kfree(), as
+ devm_kfree() safely handles NULL pointers.
+
+The functional behaviour in the successful initialisation path remains
+unchanged, while the error handling becomes simpler and less
+error-prone.
+
+Reviewed-by: fanggeng <fanggeng@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Signed-off-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/mtk-eint.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
+index c8c5097c11c4d..2a3c04eedc5f3 100644
+--- a/drivers/pinctrl/mediatek/mtk-eint.c
++++ b/drivers/pinctrl/mediatek/mtk-eint.c
+@@ -544,24 +544,32 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin)
+ }
+ }
+
+- eint->pin_list = devm_kmalloc(eint->dev, eint->nbase * sizeof(u16 *), GFP_KERNEL);
++ eint->pin_list = devm_kcalloc(eint->dev, eint->nbase,
++ sizeof(*eint->pin_list), GFP_KERNEL);
+ if (!eint->pin_list)
+ goto err_pin_list;
+
+- eint->wake_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL);
++ eint->wake_mask = devm_kcalloc(eint->dev, eint->nbase,
++ sizeof(*eint->wake_mask), GFP_KERNEL);
+ if (!eint->wake_mask)
+ goto err_wake_mask;
+
+- eint->cur_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL);
++ eint->cur_mask = devm_kcalloc(eint->dev, eint->nbase,
++ sizeof(*eint->cur_mask), GFP_KERNEL);
+ if (!eint->cur_mask)
+ goto err_cur_mask;
+
+ for (i = 0; i < eint->nbase; i++) {
+- eint->pin_list[i] = devm_kzalloc(eint->dev, eint->base_pin_num[i] * sizeof(u16),
++ eint->pin_list[i] = devm_kzalloc(eint->dev,
++ eint->base_pin_num[i] * sizeof(**eint->pin_list),
+ GFP_KERNEL);
+ port = DIV_ROUND_UP(eint->base_pin_num[i], 32);
+- eint->wake_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL);
+- eint->cur_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL);
++ eint->wake_mask[i] = devm_kzalloc(eint->dev,
++ port * sizeof(**eint->wake_mask),
++ GFP_KERNEL);
++ eint->cur_mask[i] = devm_kzalloc(eint->dev,
++ port * sizeof(**eint->cur_mask),
++ GFP_KERNEL);
+ if (!eint->pin_list[i] || !eint->wake_mask[i] || !eint->cur_mask[i])
+ goto err_eint;
+ }
+@@ -597,12 +605,9 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin)
+
+ err_eint:
+ for (i = 0; i < eint->nbase; i++) {
+- if (eint->cur_mask[i])
+- devm_kfree(eint->dev, eint->cur_mask[i]);
+- if (eint->wake_mask[i])
+- devm_kfree(eint->dev, eint->wake_mask[i]);
+- if (eint->pin_list[i])
+- devm_kfree(eint->dev, eint->pin_list[i]);
++ devm_kfree(eint->dev, eint->cur_mask[i]);
++ devm_kfree(eint->dev, eint->wake_mask[i]);
++ devm_kfree(eint->dev, eint->pin_list[i]);
+ }
+ devm_kfree(eint->dev, eint->cur_mask);
+ err_cur_mask:
+--
+2.51.0
+
--- /dev/null
+From fed781a232d26d21793bc31ed3026dc32eebfbb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 17:02:28 +0200
+Subject: pinctrl: renesas: rzt2h: Allow .get_direction() for IRQ function
+ GPIOs
+
+From: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
+
+[ Upstream commit 49b039a61a314c18074c15a7047705399e1240e6 ]
+
+Setting up an IRQ would normally be done in the .activate() and
+.deactivate() ops of the IRQ domain, but for hierarchical IRQ domains
+the .activate() and .deactivate() ops are overridden in the
+gpiochip_hierarchy_setup_domain_ops() function.
+
+As such, activating and deactivating need to be done in the .translate()
+and .free() ops of the IRQ domain.
+
+For RZ/T2H and RZ/N2H, interrupts go through the pin controller, into
+the ICU, which level-translates them and forwards them to the GIC.
+
+To use a GPIO as an interrupt it needs to be put into peripheral
+function mode 0, which will connect it to the IRQ lines of the ICU.
+
+The IRQ chip .child_to_parent_hwirq() callback is called as part of the
+IRQ fwspec parsing logic (as part of irq_create_of_mapping()) which
+happens before the IRQ is requested (as part of gpiochip_lock_as_irq()).
+
+gpiochip_lock_as_irq() calls gpiod_get_direction() if the
+.get_direction() callback is provided to ensure that the GPIO line is
+set up as input.
+
+In our case, IRQ function is separate from GPIO, and both cannot be true
+at the same time.
+
+Return GPIO_LINE_DIRECTION_IN even if pin is in IRQ function to allow
+this setup to work.
+
+Hold the spinlock to ensure atomicity between reading the PMC register
+(which determines whether the pin is in GPIO mode or not) and reading
+the function of the pin when it is not in GPIO mode.
+
+Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20251205150234.2958140-3-cosmin-gabriel.tanislav.xa@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzt2h.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzt2h.c b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
+index 4826ff91cd906..40df706210119 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzt2h.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
+@@ -51,6 +51,7 @@
+
+ #define PFC_MASK GENMASK_ULL(5, 0)
+ #define PFC_PIN_MASK(pin) (PFC_MASK << ((pin) * 8))
++#define PFC_FUNC_INTERRUPT 0
+
+ /*
+ * Use 16 lower bits [15:0] for pin identifier
+@@ -486,6 +487,7 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+ struct rzt2h_pinctrl *pctrl = gpiochip_get_data(chip);
+ u8 port = RZT2H_PIN_ID_TO_PORT(offset);
+ u8 bit = RZT2H_PIN_ID_TO_PIN(offset);
++ u64 reg64;
+ u16 reg;
+ int ret;
+
+@@ -493,8 +495,25 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+ if (ret)
+ return ret;
+
+- if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit))
++ guard(spinlock_irqsave)(&pctrl->lock);
++
++ if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit)) {
++ /*
++ * When a GPIO is being requested as an IRQ, the pinctrl
++ * framework expects to be able to read the GPIO's direction.
++ * IRQ function is separate from GPIO, and enabling it takes the
++ * pin out of GPIO mode.
++ * At this point, .child_to_parent_hwirq() has already been
++ * called to enable the IRQ function.
++ * Default to input direction for IRQ function.
++ */
++ reg64 = rzt2h_pinctrl_readq(pctrl, port, PFC(port));
++ reg64 = (reg64 >> (bit * 8)) & PFC_MASK;
++ if (reg64 == PFC_FUNC_INTERRUPT)
++ return GPIO_LINE_DIRECTION_IN;
++
+ return -EINVAL;
++ }
+
+ reg = rzt2h_pinctrl_readw(pctrl, port, PM(port));
+ reg = (reg >> (bit * 2)) & PM_MASK;
+--
+2.51.0
+
--- /dev/null
+From 402c9547ab5e01374c6be1ed4251f8d6e8adaa3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 18:26:51 +0000
+Subject: power: sequencing: fix missing state_lock in pwrseq_power_on() error
+ path
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e1dccb485c2876ac1318f36ccc0155416c633a48 ]
+
+pwrseq_power_on() calls pwrseq_unit_disable() when the
+post_enable callback fails. However, this call is outside the
+scoped_guard(mutex, &pwrseq->state_lock) block that ends.
+
+pwrseq_unit_disable() has lockdep_assert_held(&pwrseq->state_lock),
+which will fail when called from this error path.
+
+Add the scoped_guard block to cover the post_enable callback and its
+error handling to ensure the lock is held when pwrseq_unit_disable() is
+called.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Link: https://patch.msgid.link/20260130182651.1576579-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/sequencing/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/sequencing/core.c b/drivers/power/sequencing/core.c
+index 190564e559885..1fcf0af7cc0bb 100644
+--- a/drivers/power/sequencing/core.c
++++ b/drivers/power/sequencing/core.c
+@@ -914,8 +914,10 @@ int pwrseq_power_on(struct pwrseq_desc *desc)
+ if (target->post_enable) {
+ ret = target->post_enable(pwrseq);
+ if (ret) {
+- pwrseq_unit_disable(pwrseq, unit);
+- desc->powered_on = false;
++ scoped_guard(mutex, &pwrseq->state_lock) {
++ pwrseq_unit_disable(pwrseq, unit);
++ desc->powered_on = false;
++ }
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 402cfb6a46ff1184b28a8b167748f3780a77ff7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 21:01:52 -0500
+Subject: powercap: intel_rapl: Add PL4 support for Ice Lake
+
+From: Daniel Tang <danielzgtg.opensource@gmail.com>
+
+[ Upstream commit 54b3cd55a515c7c0fcfa0c1f0b10d62c11d64bcc ]
+
+Microsoft Surface Pro 7 firmware throttles the processor upon
+boot/resume. Userspace needs to be able to restore the correct value.
+
+Link: https://github.com/linux-surface/linux-surface/issues/706
+Signed-off-by: Daniel Tang <danielzgtg.opensource@gmail.com>
+Link: https://patch.msgid.link/6088605.ChMirdbgyp@daniel-desktop3
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/powercap/intel_rapl_msr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c
+index 152893dca5653..3d5e7f56d68a1 100644
+--- a/drivers/powercap/intel_rapl_msr.c
++++ b/drivers/powercap/intel_rapl_msr.c
+@@ -160,6 +160,7 @@ static int rapl_msr_write_raw(int cpu, struct reg_action *ra)
+
+ /* List of verified CPUs. */
+ static const struct x86_cpu_id pl4_support_ids[] = {
++ X86_MATCH_VFM(INTEL_ICELAKE_L, NULL),
+ X86_MATCH_VFM(INTEL_TIGERLAKE_L, NULL),
+ X86_MATCH_VFM(INTEL_ALDERLAKE, NULL),
+ X86_MATCH_VFM(INTEL_ALDERLAKE_L, NULL),
+--
+2.51.0
+
--- /dev/null
+From 0dba926e2baacebe053994ad7ab0797debc259e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 10:03:58 +0800
+Subject: pstore: ram_core: fix incorrect success return when vmap() fails
+
+From: Ruipeng Qi <ruipengqi3@gmail.com>
+
+[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ]
+
+In persistent_ram_vmap(), vmap() may return NULL on failure.
+
+If offset is non-zero, adding offset_in_page(start) causes the function
+to return a non-NULL pointer even though the mapping failed.
+persistent_ram_buffer_map() therefore incorrectly returns success.
+
+Subsequent access to prz->buffer may dereference an invalid address
+and cause crashes.
+
+Add proper NULL checking for vmap() failures.
+
+Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
+Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index c9eaacdec37e4..7b6d6378a3b87 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot);
+ kfree(pages);
+
++ /*
++ * vmap() may fail and return NULL. Do not add the offset in this
++ * case, otherwise a NULL mapping would appear successful.
++ */
++ if (!vaddr)
++ return NULL;
++
+ /*
+ * Since vmap() uses page granularity, we must add the offset
+ * into the page here, to get the byte granularity address
+--
+2.51.0
+
--- /dev/null
+From 02ceeede1c7a35ec3d908bf9c13ceb27979c16e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 17:36:04 +0000
+Subject: ptp: ptp_vmclock: add 'VMCLOCK' to ACPI device match
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+[ Upstream commit ed4d23ed469ca14d47670c0384f6ae6c4ff060a5 ]
+
+As we finalised the spec, we spotted that vmgenid actually says that the
+_HID is supposed to be hypervisor-specific. Although in the 13 years
+since the original vmgenid doc was published, nobody seems to have cared
+about using _HID to distinguish between implementations on different
+hypervisors, and we only ever use the _CID.
+
+For consistency, match the _CID of "VMCLOCK" too.
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Babis Chalios <bchalios@amazon.es>
+Tested-by: Takahiro Itazuri <itazur@amazon.com>
+Link: https://patch.msgid.link/20260130173704.12575-6-itazur@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_vmclock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ptp/ptp_vmclock.c b/drivers/ptp/ptp_vmclock.c
+index b3a83b03d9c14..cbbfc494680c7 100644
+--- a/drivers/ptp/ptp_vmclock.c
++++ b/drivers/ptp/ptp_vmclock.c
+@@ -591,6 +591,7 @@ static int vmclock_probe(struct platform_device *pdev)
+
+ static const struct acpi_device_id vmclock_acpi_ids[] = {
+ { "AMZNC10C", 0 },
++ { "VMCLOCK", 0 },
+ {}
+ };
+ MODULE_DEVICE_TABLE(acpi, vmclock_acpi_ids);
+--
+2.51.0
+
--- /dev/null
+From fc63a78f88b4fe80625a9f65360dc8a7b65d6e56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:15:16 +0100
+Subject: RDMA/rtrs-clt: For conn rejection use actual err number
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ]
+
+When the connection establishment request is rejected from the server
+side, then the actual error number sent back should be used.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com
+Reviewed-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 2b397a544cb93..8fa1d72bd20a4 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1923,7 +1923,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ struct rtrs_path *s = con->c.path;
+ const struct rtrs_msg_conn_rsp *msg;
+ const char *rej_msg;
+- int status, errno;
++ int status, errno = -ECONNRESET;
+ u8 data_len;
+
+ status = ev->status;
+@@ -1945,7 +1945,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ status, rej_msg);
+ }
+
+- return -ECONNRESET;
++ return errno;
+ }
+
+ void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait)
+--
+2.51.0
+
--- /dev/null
+From 842c1b0b35466deb9325fbd95305d1db1b5bb4aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 21:37:14 -0600
+Subject: regulator: core: Remove regulator supply_name length limit
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit e243cdd87b911ce9968b62e4ab2b680dfadc4341 ]
+
+When creating the regulator object, associated with a consumer device,
+the supply_name is string formatted into a statically sized buffer on
+the stack, then strdup()'ed onto the heap.
+
+Not only is the dance on the stack unnecessary, but when the device's
+name is long we might not fit the constructed supply_name in the fixed
+64 byte buffer on the stack.
+
+One such case can be seen on the Qualcomm Rb3Gen2 board, where we find a
+PCIe controller, with a PCIe switch, with a USB controller, with a USB
+hub, consuming a regulator. In this example the dev->kobj.name itself is
+62 characters long.
+
+Drop the temporary buffer on the stack and kasprintf() the string
+directly on the heap, both to simplify the code, and to remove the
+length limitation.
+
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260211-regulator-supply-name-length-v1-1-3875541c1576@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 8ee33b777f6ce..838bbdcdede9a 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1949,8 +1949,6 @@ static const struct file_operations constraint_flags_fops = {
+ #endif
+ };
+
+-#define REG_STR_SIZE 64
+-
+ static void link_and_create_debugfs(struct regulator *regulator, struct regulator_dev *rdev,
+ struct device *dev)
+ {
+@@ -1998,15 +1996,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ lockdep_assert_held_once(&rdev->mutex.base);
+
+ if (dev) {
+- char buf[REG_STR_SIZE];
+- int size;
+-
+- size = snprintf(buf, REG_STR_SIZE, "%s-%s",
+- dev->kobj.name, supply_name);
+- if (size >= REG_STR_SIZE)
+- return NULL;
+-
+- supply_name = kstrdup(buf, GFP_KERNEL);
++ supply_name = kasprintf(GFP_KERNEL, "%s-%s", dev->kobj.name, supply_name);
+ if (supply_name == NULL)
+ return NULL;
+ } else {
+--
+2.51.0
+
--- /dev/null
+From b9329f55820e1848be9f45e18dcba7fe7c0d0ef8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 14:28:23 +0200
+Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox
+ TX channel is uninitialized
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ]
+
+Firmwares that do not use mailbox communication (e.g., the hello_world
+sample) leave priv->tx_ch as NULL. The current suspend logic
+unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without
+an initialized TX channel.
+
+Detect the no_mailboxes case early and skip sending the suspend
+message. Instead, proceed directly to the runtime PM suspend path,
+which is the correct behavior for firmwares that cannot respond to
+mailbox requests.
+
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c
+index 5a9a8fa031f6d..9e4f50e0e822d 100644
+--- a/drivers/remoteproc/imx_dsp_rproc.c
++++ b/drivers/remoteproc/imx_dsp_rproc.c
+@@ -1260,6 +1260,15 @@ static int imx_dsp_suspend(struct device *dev)
+ if (rproc->state != RPROC_RUNNING)
+ goto out;
+
++ /*
++ * No channel available for sending messages;
++ * indicates no mailboxes present, so trigger PM runtime suspend
++ */
++ if (!priv->tx_ch) {
++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n");
++ goto out;
++ }
++
+ reinit_completion(&priv->pm_comp);
+
+ /* Tell DSP that suspend is happening */
+--
+2.51.0
+
--- /dev/null
+From e318d7fcf37cb1abbb7121c798d560722e25692b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 11:07:55 +0000
+Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock`
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ]
+
+A potential circular locking dependency (ABBA deadlock) exists between
+`ec_dev->lock` and the clock framework's `prepare_lock`.
+
+The first order (A -> B) occurs when scp_ipi_send() is called while
+`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()):
+1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send().
+2. scp_ipi_send() calls clk_prepare_enable(), which acquires
+ `prepare_lock`.
+See #0 in the following example calling trace.
+(Lock Order: `ec_dev->lock` -> `prepare_lock`)
+
+The reverse order (B -> A) is more complex and has been observed
+(learned) by lockdep. It involves the clock prepare operation
+triggering power domain changes, which then propagates through sysfs
+and power supply uevents, eventually calling back into the ChromeOS EC
+driver and attempting to acquire `ec_dev->lock`:
+1. Something calls clk_prepare(), which acquires `prepare_lock`. It
+ then triggers genpd operations like genpd_runtime_resume(), which
+ takes `&genpd->mlock`.
+2. Power domain changes can trigger regulator changes; regulator
+ changes can then trigger device link changes; device link changes
+ can then trigger sysfs changes. Eventually, power_supply_uevent()
+ is called.
+3. This leads to calls like cros_usbpd_charger_get_prop(), which calls
+ cros_ec_cmd_xfer_status(), which then attempts to acquire
+ `ec_dev->lock`.
+See #1 ~ #6 in the following example calling trace.
+(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`)
+
+Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the
+remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock`
+is only acquired in prepare()/unprepare() callbacks. Since
+`ec_dev->lock` is not involved in the callbacks, the dependency loop is
+broken.
+
+This means the clock is always "prepared" when the SCP is running. The
+prolonged "prepared time" for the clock should be acceptable as SCP is
+designed to be a very power efficient processor. The power consumption
+impact can be negligible.
+
+A simplified calling trace reported by lockdep:
+> -> #6 (&ec_dev->lock)
+> cros_ec_cmd_xfer
+> cros_ec_cmd_xfer_status
+> cros_usbpd_charger_get_port_status
+> cros_usbpd_charger_get_prop
+> power_supply_get_property
+> power_supply_show_property
+> power_supply_uevent
+> dev_uevent
+> uevent_show
+> dev_attr_show
+> sysfs_kf_seq_show
+> kernfs_seq_show
+> -> #5 (kn->active#2)
+> kernfs_drain
+> __kernfs_remove
+> kernfs_remove_by_name_ns
+> sysfs_remove_file_ns
+> device_del
+> __device_link_del
+> device_links_driver_bound
+> -> #4 (device_links_lock)
+> device_link_remove
+> _regulator_put
+> regulator_put
+> -> #3 (regulator_list_mutex)
+> regulator_lock_dependent
+> regulator_disable
+> scpsys_power_off
+> _genpd_power_off
+> genpd_power_off
+> -> #2 (&genpd->mlock/1)
+> genpd_add_subdomain
+> pm_genpd_add_subdomain
+> scpsys_add_subdomain
+> scpsys_probe
+> -> #1 (&genpd->mlock)
+> genpd_runtime_resume
+> __rpm_callback
+> rpm_callback
+> rpm_resume
+> __pm_runtime_resume
+> clk_core_prepare
+> clk_prepare
+> -> #0 (prepare_lock)
+> clk_prepare
+> scp_ipi_send
+> scp_send_ipi
+> mtk_rpmsg_send
+> rpmsg_send
+> cros_ec_pkt_xfer_rpmsg
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++---------
+ drivers/remoteproc/mtk_scp_ipi.c | 4 ++--
+ 2 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
+index db8fd045468d9..98d00bd5200cc 100644
+--- a/drivers/remoteproc/mtk_scp.c
++++ b/drivers/remoteproc/mtk_scp.c
+@@ -283,7 +283,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+ struct mtk_scp *scp = priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return IRQ_NONE;
+@@ -291,7 +291,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+
+ scp->data->scp_irq_handler(scp);
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return IRQ_HANDLED;
+ }
+@@ -665,7 +665,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -680,7 +680,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+
+ ret = scp_elf_load_segments(rproc, fw);
+ leave:
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+@@ -691,14 +691,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+ }
+
+ ret = scp_ipi_init(scp, fw);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -709,7 +709,7 @@ static int scp_start(struct rproc *rproc)
+ struct scp_run *run = &scp->run;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -734,14 +734,14 @@ static int scp_start(struct rproc *rproc)
+ goto stop;
+ }
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver);
+
+ return 0;
+
+ stop:
+ scp->data->scp_reset_assert(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -909,7 +909,7 @@ static int scp_stop(struct rproc *rproc)
+ struct mtk_scp *scp = rproc->priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return ret;
+@@ -917,12 +917,29 @@ static int scp_stop(struct rproc *rproc)
+
+ scp->data->scp_reset_assert(scp);
+ scp->data->scp_stop(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return 0;
+ }
+
++static int scp_prepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ return clk_prepare(scp->clk);
++}
++
++static int scp_unprepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ clk_unprepare(scp->clk);
++ return 0;
++}
++
+ static const struct rproc_ops scp_ops = {
++ .prepare = scp_prepare,
++ .unprepare = scp_unprepare,
+ .start = scp_start,
+ .stop = scp_stop,
+ .load = scp_load,
+diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c
+index c068227e251e7..7a37e273b3af8 100644
+--- a/drivers/remoteproc/mtk_scp_ipi.c
++++ b/drivers/remoteproc/mtk_scp_ipi.c
+@@ -171,7 +171,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+ WARN_ON(len > scp_sizes->ipi_share_buffer_size) || WARN_ON(!buf))
+ return -EINVAL;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clock\n");
+ return ret;
+@@ -211,7 +211,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+
+ unlock_mutex:
+ mutex_unlock(&scp->send_lock);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From c72b1adb6d430fc4668c1a9ec226fc073c02f9d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 09:53:54 +0200
+Subject: Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
+
+From: Tomas Melin <tomas.melin@vaisala.com>
+
+[ Upstream commit c197179990124f991fca220d97fac56779a02c6d ]
+
+This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.
+
+OP-TEE logic in U-Boot automatically injects a reserved-memory
+node along with optee firmware node to kernel device tree.
+The injection logic is dependent on that there is no manually
+defined optee node. Having the node in zynqmp.dtsi effectively
+breaks OP-TEE's insertion of the reserved-memory node, causing
+memory access violations during runtime.
+
+Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/20251125-revert-zynqmp-optee-v1-1-d2ce4c0fcaf6@vaisala.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index 938b014ca9231..b55c6b2e8e0e1 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -192,11 +192,6 @@ psci {
+ };
+
+ firmware {
+- optee: optee {
+- compatible = "linaro,optee-tz";
+- method = "smc";
+- };
+-
+ zynqmp_firmware: zynqmp-firmware {
+ compatible = "xlnx,zynqmp-firmware";
+ #power-domain-cells = <1>;
+--
+2.51.0
+
--- /dev/null
+From 81b41e23476256375cee6c20177bc3552c8c6401 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 17:16:51 +0100
+Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask"
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ]
+
+This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed.
+
+Almost every register in this chip can be customized via OTP
+memory. Somehow the value for R19, which decide if the flag is set
+on read or write operation, seems to have been overwritten for the chip
+the original patch were written for.
+
+Revert the change to follow the default behavior.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9052-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c
+index 80fc5c0cac2fb..be5f2b34e18ae 100644
+--- a/drivers/mfd/da9052-spi.c
++++ b/drivers/mfd/da9052-spi.c
+@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)
+ spi_set_drvdata(spi, da9052);
+
+ config = da9052_regmap_config;
+- config.write_flag_mask = 1;
++ config.read_flag_mask = 1;
+ config.reg_bits = 7;
+ config.pad_bits = 1;
+ config.val_bits = 8;
+--
+2.51.0
+
--- /dev/null
+From 8b6d627e79dd1986f65f08d9e727f4e2056bb01d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 15:49:31 +0100
+Subject: Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit ff112f1ecd10b72004eac05bae395e1c65f0c63c ]
+
+This reverts commit aced969e9bf3701dc75cfca57c78c031b7875b9d.
+
+It was determined that this was not the correct "fix", so should be
+reverted.
+
+Fixes: aced969e9bf3 ("mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms")
+Cc: Matthew Schwartz <matthew.schwartz@linux.dev>
+Cc: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/rtsx_pci_sdmmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
+index b6cf1803c7d27..4db3328f46dfb 100644
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -937,7 +937,7 @@ static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power_mode)
+ if (err < 0)
+ return err;
+
+- mdelay(5);
++ mdelay(1);
+
+ err = rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From 8d93f012ec4095384fe6364cda0e35da5edd1d11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 21:09:56 -0700
+Subject: riscv: vector: init vector context with proper vlenb
+
+From: Sergey Matyukevich <geomatsi@gmail.com>
+
+[ Upstream commit ef3ff40346db8476a9ef7269fc9d1837e7243c40 ]
+
+The vstate in thread_struct is zeroed when the vector context is
+initialized. That includes read-only register vlenb, which holds
+the vector register length in bytes. Zeroed state persists until
+mstatus.VS becomes 'dirty' and a context switch saves the actual
+hardware values.
+
+This can expose the zero vlenb value to the user-space in early
+debug scenarios, e.g. when ptrace attaches to a traced process
+early, before any vector instruction except the first one was
+executed.
+
+Fix this by specifying proper vlenb on vector context init.
+
+Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
+Reviewed-by: Andy Chiu <andybnac@gmail.com>
+Tested-by: Andy Chiu <andybnac@gmail.com>
+Link: https://patch.msgid.link/20251214163537.1054292-3-geomatsi@gmail.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/vector.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/vector.c b/arch/riscv/kernel/vector.c
+index 3ed071dab9d83..b112166d51e9f 100644
+--- a/arch/riscv/kernel/vector.c
++++ b/arch/riscv/kernel/vector.c
+@@ -111,8 +111,8 @@ bool insn_is_vector(u32 insn_buf)
+ return false;
+ }
+
+-static int riscv_v_thread_zalloc(struct kmem_cache *cache,
+- struct __riscv_v_ext_state *ctx)
++static int riscv_v_thread_ctx_alloc(struct kmem_cache *cache,
++ struct __riscv_v_ext_state *ctx)
+ {
+ void *datap;
+
+@@ -122,13 +122,15 @@ static int riscv_v_thread_zalloc(struct kmem_cache *cache,
+
+ ctx->datap = datap;
+ memset(ctx, 0, offsetof(struct __riscv_v_ext_state, datap));
++ ctx->vlenb = riscv_v_vsize / 32;
++
+ return 0;
+ }
+
+ void riscv_v_thread_alloc(struct task_struct *tsk)
+ {
+ #ifdef CONFIG_RISCV_ISA_V_PREEMPTIVE
+- riscv_v_thread_zalloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate);
++ riscv_v_thread_ctx_alloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate);
+ #endif
+ }
+
+@@ -214,12 +216,14 @@ bool riscv_v_first_use_handler(struct pt_regs *regs)
+ * context where VS has been off. So, try to allocate the user's V
+ * context and resume execution.
+ */
+- if (riscv_v_thread_zalloc(riscv_v_user_cachep, ¤t->thread.vstate)) {
++ if (riscv_v_thread_ctx_alloc(riscv_v_user_cachep, ¤t->thread.vstate)) {
+ force_sig(SIGBUS);
+ return true;
+ }
++
+ riscv_v_vstate_on(regs);
+ riscv_v_vstate_set_restore(current, regs);
++
+ return true;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c75b30c0f180ba848f837d15c448ee92537381c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 13:47:33 +0100
+Subject: rnbd-srv: Zero the rsp buffer before using it
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ]
+
+Before using the data buffer to send back the response message, zero it
+completely. This prevents any stray bytes to be picked up by the client
+side when there the message is exchanged between different protocol
+versions.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-srv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
+index 9b3fdc202e152..7eeb321d61402 100644
+--- a/drivers/block/rnbd/rnbd-srv.c
++++ b/drivers/block/rnbd/rnbd-srv.c
+@@ -551,6 +551,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp,
+ {
+ struct block_device *bdev = file_bdev(sess_dev->bdev_file);
+
++ memset(rsp, 0, sizeof(*rsp));
++
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP);
+ rsp->device_id = cpu_to_le32(sess_dev->device_id);
+ rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev));
+@@ -657,6 +659,7 @@ static void process_msg_sess_info(struct rnbd_srv_session *srv_sess,
+
+ trace_process_msg_sess_info(srv_sess, sess_info_msg);
+
++ memset(rsp, 0, sizeof(*rsp));
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP);
+ rsp->ver = srv_sess->ver;
+ }
+--
+2.51.0
+
--- /dev/null
+From f224affb2ff087479f741d14267a361819dd4309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 17:35:19 +0000
+Subject: rtc: interface: Alarm race handling should not discard preceding
+ error
+
+From: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+
+[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ]
+
+Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting
+alarm") should not discard any errors from the preceding validations.
+
+Prior to that commit, if the alarm feature was disabled, or the
+set_alarm failed, a meaningful error code would be returned to the
+caller for further action.
+
+After, more often than not, the __rtc_read_time will cause a success
+return code instead, misleading the caller.
+
+An example of this is when timer_enqueue is called for a rtc-abx080x
+device. Since that driver does not clear the alarm feature bit, but
+instead relies on the set_alarm operation to return invalid, the discard
+of the return code causes very different behaviour; i.e.
+ hwclock: select() to /dev/rtc0 to wait for clock tick timed out
+
+Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm")
+Signed-off-by: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+Reviewed-by: Esben Haabendal <esben@geanix.com>
+Tested-by: Nick Bowler <nbowler@draconx.ca>
+Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index b8b298efd9a9c..1906f4884a834 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ * are in, we can return -ETIME to signal that the timer has already
+ * expired, which is true in both cases.
+ */
+- if ((scheduled - now) <= 1) {
++ if (!err && (scheduled - now) <= 1) {
+ err = __rtc_read_time(rtc, &tm);
+ if (err)
+ return err;
+--
+2.51.0
+
--- /dev/null
+From 070e7df22eeb8706a92b90d287dc0202f223fa23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 20:54:32 -0800
+Subject: rtc: max31335: use correct CONFIG symbol in IS_REACHABLE()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d5aca9a17f6de884febc56018f92d743b8ea1298 ]
+
+IS_REACHABLE() is meant to be used with full symbol names from a kernel
+.config file, not the shortened symbols used in Kconfig files, so
+change HWMON to CONFIG_HWMON in 3 places.
+
+Fixes: dedaf03b99d6 ("rtc: max31335: add driver support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20260108045432.2705691-1-rdunlap@infradead.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-max31335.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/rtc/rtc-max31335.c b/drivers/rtc/rtc-max31335.c
+index 23b7bf16b4cd5..952b455071d68 100644
+--- a/drivers/rtc/rtc-max31335.c
++++ b/drivers/rtc/rtc-max31335.c
+@@ -591,7 +591,7 @@ static struct nvmem_config max31335_nvmem_cfg = {
+ .size = MAX31335_RAM_SIZE,
+ };
+
+-#if IS_REACHABLE(HWMON)
++#if IS_REACHABLE(CONFIG_HWMON)
+ static int max31335_read_temp(struct device *dev, enum hwmon_sensor_types type,
+ u32 attr, int channel, long *val)
+ {
+@@ -672,7 +672,7 @@ static int max31335_clkout_register(struct device *dev)
+ static int max31335_probe(struct i2c_client *client)
+ {
+ struct max31335_data *max31335;
+-#if IS_REACHABLE(HWMON)
++#if IS_REACHABLE(CONFIG_HWMON)
+ struct device *hwmon;
+ #endif
+ const struct chip_desc *match;
+@@ -727,7 +727,7 @@ static int max31335_probe(struct i2c_client *client)
+ return dev_err_probe(&client->dev, ret,
+ "cannot register rtc nvmem\n");
+
+-#if IS_REACHABLE(HWMON)
++#if IS_REACHABLE(CONFIG_HWMON)
+ if (max31335->chip->temp_reg) {
+ hwmon = devm_hwmon_device_register_with_info(&client->dev, client->name, max31335,
+ &max31335_chip_info, NULL);
+--
+2.51.0
+
--- /dev/null
+From ac4d032431444a424fa3c4854bfaf0aa4054b1d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Dec 2025 03:56:48 +0000
+Subject: rtc: nvvrs: Add ARCH_TEGRA to the NV VRS RTC driver
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit f9ecfd9bfedba9fd9d4b015b33b847571f7fdd42 ]
+
+The NV VRS RTC driver currently is only supported on the
+Tegra platform so add a dep for ARCH_TEGRA and compile test
+so it doesn't show up universally across all arches/platforms.
+
+Fixes: 9d6d6b06933c8 ("rtc: nvvrs: add NVIDIA VRS RTC device driver")
+Cc: Shubhi Garg <shgarg@nvidia.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://patch.msgid.link/20251222035651.433603-1-pbrobinson@gmail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index 50dc779f7f983..50ba48609d74e 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -418,6 +418,7 @@ config RTC_DRV_SPACEMIT_P1
+
+ config RTC_DRV_NVIDIA_VRS10
+ tristate "NVIDIA VRS10 RTC device"
++ depends on ARCH_TEGRA || COMPILE_TEST
+ help
+ If you say yes here you will get support for the battery backed RTC device
+ of NVIDIA VRS (Voltage Regulator Specification). The RTC is connected via
+--
+2.51.0
+
--- /dev/null
+From 7853e63d3d17fb45a41f57abdeb7619aab03908d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:53:45 +0000
+Subject: rtc: zynqmp: correct frequency value
+
+From: Tomas Melin <tomas.melin@vaisala.com>
+
+[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ]
+
+Fix calibration value in case a clock reference is provided.
+The actual calibration value written into register is
+frequency - 1.
+
+Reviewed-by: Harini T <harini.t@amd.com>
+Tested-by: Harini T <harini.t@amd.com>
+Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-zynqmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c
+index 3baa2b481d9f2..856bc1678e7d3 100644
+--- a/drivers/rtc/rtc-zynqmp.c
++++ b/drivers/rtc/rtc-zynqmp.c
+@@ -345,7 +345,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev)
+ &xrtcdev->freq);
+ if (ret)
+ xrtcdev->freq = RTC_CALIB_DEF;
++ } else {
++ xrtcdev->freq--;
+ }
++
+ ret = readl(xrtcdev->reg_base + RTC_CALIB_RD);
+ if (!ret)
+ writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR));
+--
+2.51.0
+
--- /dev/null
+From fe7b1d2c559bed8405eb28f6bed565abae11ec45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 08:49:48 -0300
+Subject: rtla: Fix NULL pointer dereference in actions_parse
+
+From: Wander Lairson Costa <wander@redhat.com>
+
+[ Upstream commit a0890f9dbd24b302d327fe7dad9b9c5be0e278aa ]
+
+The actions_parse() function uses strtok() to tokenize the trigger
+string, but does not check if the returned token is NULL before
+passing it to strcmp(). If the trigger parameter is an empty string
+or contains only delimiter characters, strtok() returns NULL, causing
+strcmp() to dereference a NULL pointer and crash the program.
+
+This issue can be triggered by malformed user input or edge cases in
+trigger string parsing. Add a NULL check immediately after the strtok()
+call to validate that a token was successfully extracted before using
+it. If no token is found, the function now returns -1 to indicate a
+parsing error.
+
+Signed-off-by: Wander Lairson Costa <wander@redhat.com>
+Link: https://lore.kernel.org/r/20260106133655.249887-13-wander@redhat.com
+Signed-off-by: Tomas Glozar <tglozar@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/actions.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/tracing/rtla/src/actions.c b/tools/tracing/rtla/src/actions.c
+index 8945aee58d511..15986505b4376 100644
+--- a/tools/tracing/rtla/src/actions.c
++++ b/tools/tracing/rtla/src/actions.c
+@@ -141,6 +141,8 @@ actions_parse(struct actions *self, const char *trigger, const char *tracefn)
+
+ strcpy(trigger_c, trigger);
+ token = strtok(trigger_c, ",");
++ if (!token)
++ return -1;
+
+ if (strcmp(token, "trace") == 0)
+ type = ACTION_TRACE_OUTPUT;
+--
+2.51.0
+
--- /dev/null
+From 59e860d296ae98af1d318627acea5ef602139886 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 11:11:39 +0900
+Subject: rust: cpufreq: always inline functions using build_assert with
+ arguments
+
+From: Alexandre Courbot <acourbot@nvidia.com>
+
+[ Upstream commit 8c8b12a55614ea05953e8d695e700e6e1322a05d ]
+
+`build_assert` relies on the compiler to optimize out its error path.
+Functions using it with its arguments must thus always be inlined,
+otherwise the error path of `build_assert` might not be optimized out,
+triggering a build error.
+
+Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/cpufreq.rs | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/rust/kernel/cpufreq.rs b/rust/kernel/cpufreq.rs
+index f968fbd228905..0879a79485f8e 100644
+--- a/rust/kernel/cpufreq.rs
++++ b/rust/kernel/cpufreq.rs
+@@ -1015,6 +1015,8 @@ impl<T: Driver> Registration<T> {
+ ..pin_init::zeroed()
+ };
+
++ // Always inline to optimize out error path of `build_assert`.
++ #[inline(always)]
+ const fn copy_name(name: &'static CStr) -> [c_char; CPUFREQ_NAME_LEN] {
+ let src = name.to_bytes_with_nul();
+ let mut dst = [0; CPUFREQ_NAME_LEN];
+--
+2.51.0
+
--- /dev/null
+From def1fca04336ff8863b0ecd6dba1ddcc875f8f19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 16:43:58 +0100
+Subject: s390/boot: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit 5ba35a6c13fff0929c34aba6b7602dacbe68686c ]
+
+Add -Wno-default-const-init-unsafe to boot KBUILD_CFLAGS, similar to
+scripts/Makefile.extrawarn, since clang generates warnings for the dummy
+variable in typecheck():
+
+ CC arch/s390/boot/version.o
+ arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
+ 221 | return psw_bits(regs->psw).pstate;
+ | ^
+ arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
+ 98 | typecheck(psw_t, __psw); \
+ | ^
+ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
+ 11 | typeof(x) __dummy2; \
+ | ^
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile
+index 490167faba7a4..a1e719a79d38c 100644
+--- a/arch/s390/boot/Makefile
++++ b/arch/s390/boot/Makefile
+@@ -21,6 +21,7 @@ KBUILD_AFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_AFLAGS_DECOMPRESSOR))
+ KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_CFLAGS_DECOMPRESSOR))
+ KBUILD_AFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS
+ KBUILD_CFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS
++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
+
+ CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char
+
+--
+2.51.0
+
--- /dev/null
+From 071cc638bc9b0bf029b58c30cb41865e86faf7a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 10:14:12 +0100
+Subject: s390/perf: Disable register readout on sampling events
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ]
+
+Running commands
+ # ./perf record -IR0,R1 -a sleep 1
+extracts and displays register value of general purpose register r1 and r0.
+However the value displayed of any register is random and does not
+reflect the register value recorded at the time of the sample interrupt.
+
+The sampling device driver on s390 creates a very large buffer
+for the hardware to store the samples. Only when that large buffer
+gets full an interrupt is generated and many hundreds of sample
+entries are processed and copied to the kernel ring buffer and
+eventually get copied to the perf tool. It is during the copy
+to the kernel ring buffer that each sample is processed (on s390)
+and at that time the register values are extracted.
+This is not the original goal, the register values should be read
+when the samples are created not when the samples are copied to the
+kernel ring buffer.
+
+Prevent this event from being installed in the first place and
+return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 459af23a47a5e..e8bd19ac82c7d 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -841,7 +841,7 @@ static bool is_callchain_event(struct perf_event *event)
+ u64 sample_type = event->attr.sample_type;
+
+ return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER |
+- PERF_SAMPLE_STACK_USER);
++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER);
+ }
+
+ static int cpumsf_pmu_event_init(struct perf_event *event)
+--
+2.51.0
+
--- /dev/null
+From 47a172fbd0119e2ad0b168826916db44614c2921 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 16:47:07 +0100
+Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ]
+
+Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
+to scripts/Makefile.extrawarn, since clang generates warnings for the
+dummy variable in typecheck():
+
+ CC arch/s390/purgatory/purgatory.o
+ arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
+ 221 | return psw_bits(regs->psw).pstate;
+ | ^
+ arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
+ 98 | typecheck(psw_t, __psw); \
+ | ^
+ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
+ 11 | typeof(x) __dummy2; \
+ | ^
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/purgatory/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
+index 0c196a5b194af..61d240a37633d 100644
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -23,6 +23,7 @@ KBUILD_CFLAGS += -D__DISABLE_EXPORTS
+ KBUILD_CFLAGS += $(CLANG_FLAGS)
+ KBUILD_CFLAGS += $(if $(CONFIG_CC_IS_CLANG),-Wno-microsoft-anon-tag)
+ KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
+ KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS))
+ KBUILD_AFLAGS += -D__DISABLE_EXPORTS
+
+--
+2.51.0
+
--- /dev/null
+From 0b5ee2711b66e0261b8dc4574d4f0bc2eecf045a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jan 2026 10:59:00 +0100
+Subject: sched/debug: Fix updating of ppos on server write ops
+
+From: Joel Fernandes <joelagnelf@nvidia.com>
+
+[ Upstream commit 6080fb211672aec6ce8f2f5a2e0b4eae736f2027 ]
+
+Updating "ppos" on error conditions does not make much sense. The pattern
+is to return the error code directly without modifying the position, or
+modify the position on success and return the number of bytes written.
+
+Since on success, the return value of apply is 0, there is no point in
+modifying ppos either. Fix it by removing all this and just returning
+error code or number of bytes written on success.
+
+Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Juri Lelli <juri.lelli@redhat.com>
+Reviewed-by: Andrea Righi <arighi@nvidia.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Tested-by: Christian Loehle <christian.loehle@arm.com>
+Link: https://patch.msgid.link/20260126100050.3854740-3-arighi@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 41caa22e0680a..93f009e1076d8 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -345,8 +345,8 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
+ long cpu = (long) ((struct seq_file *) filp->private_data)->private;
+ struct rq *rq = cpu_rq(cpu);
+ u64 runtime, period;
++ int retval = 0;
+ size_t err;
+- int retval;
+ u64 value;
+
+ err = kstrtoull_from_user(ubuf, cnt, 10, &value);
+@@ -380,8 +380,6 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
+ dl_server_stop(&rq->fair_server);
+
+ retval = dl_server_apply_params(&rq->fair_server, runtime, period, 0);
+- if (retval)
+- cnt = retval;
+
+ if (!runtime)
+ printk_deferred("Fair server disabled in CPU %d, system may crash due to starvation.\n",
+@@ -389,6 +387,9 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
+
+ if (rq->cfs.h_nr_queued)
+ dl_server_start(&rq->fair_server);
++
++ if (retval < 0)
++ return retval;
+ }
+
+ *ppos += cnt;
+--
+2.51.0
+
--- /dev/null
+From e283128c6704ff57cce8ea0170afab059661ed5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:33:15 +0100
+Subject: scsi: buslogic: Reduce stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ]
+
+Some randconfig builds run into excessive stack usage with gcc-14 or
+higher, which use __attribute__((cold)) where earlier versions did not do
+that:
+
+drivers/scsi/BusLogic.c: In function 'blogic_init':
+drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
+
+The problem is that a lot of code gets inlined into blogic_init() here. Two
+functions stick out, but they are a bit different:
+
+ - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel
+ stack, which is a problem in combination with other functions that also
+ do. Marking this one as noinline means that the stack slots get get
+ reused between function calls
+
+ - blogic_reportconfig() has a few large variables, but whenever it is not
+ inlined into its caller, the compiler is actually smart enough to reuse
+ stack slots for these automatically, so marking it as noinline saves
+ most of the stack space by itself.
+
+The combination of both of these should avoid the problem entirely.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/BusLogic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index a86d780d1ba40..026c3e617cb1c 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -920,7 +920,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter)
+ a particular probe order.
+ */
+
+-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter)
++static noinline_for_stack void __init
++blogic_init_probeinfo_list(struct blogic_adapter *adapter)
+ {
+ /*
+ If a PCI BIOS is present, interrogate it for MultiMaster and
+@@ -1690,7 +1691,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter)
+ blogic_reportconfig reports the configuration of Host Adapter.
+ */
+
+-static bool __init blogic_reportconfig(struct blogic_adapter *adapter)
++static noinline_for_stack bool __init
++blogic_reportconfig(struct blogic_adapter *adapter)
+ {
+ unsigned short alltgt_mask = (1 << adapter->maxdev) - 1;
+ unsigned short sync_ok, fast_ok;
+--
+2.51.0
+
--- /dev/null
+From 7230109f06e4617ee741acdc88c73821c8bffc96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 11:45:26 +0900
+Subject: scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace
+ event
+
+From: Keita Morisaki <keita.morisaki@tier4.jp>
+
+[ Upstream commit 9672ed3de7d772ceddd713c769c05e832fc69bae ]
+
+The ufs_mtk_clk_scale() trace event currently stores the address of the
+name string directly via __field(const char *, name). This pointer may
+become invalid after the module is unloaded, causing page faults when the
+trace buffer is subsequently accessed.
+
+This can occur because the MediaTek UFS driver can be configured as a
+loadable module (tristate in Kconfig), meaning the name string passed to
+the trace event may reside in module memory that becomes invalid after
+module unload.
+
+Fix this by using __string() and __assign_str() to copy the string contents
+into the ring buffer instead of storing the pointer. This ensures the trace
+data remains valid regardless of module state.
+
+This change increases the memory usage for each ftrace entry by a few bytes
+(clock names are typically 7-15 characters like "ufs_sel" or
+"ufs_sel_max_src") compared to storing an 8-byte pointer.
+
+Note that this change does not affect anything unless all of the following
+conditions are met:
+
+ - CONFIG_SCSI_UFS_MEDIATEK is enabled
+
+ - ftrace tracing is enabled
+
+ - The ufs_mtk_clk_scale event is enabled in ftrace
+
+Signed-off-by: Keita Morisaki <keita.morisaki@tier4.jp>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://patch.msgid.link/20260202024526.122515-1-keita.morisaki@tier4.jp
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek-trace.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek-trace.h b/drivers/ufs/host/ufs-mediatek-trace.h
+index b5f2ec3140748..0df8ac843379a 100644
+--- a/drivers/ufs/host/ufs-mediatek-trace.h
++++ b/drivers/ufs/host/ufs-mediatek-trace.h
+@@ -33,19 +33,19 @@ TRACE_EVENT(ufs_mtk_clk_scale,
+ TP_ARGS(name, scale_up, clk_rate),
+
+ TP_STRUCT__entry(
+- __field(const char*, name)
++ __string(name, name)
+ __field(bool, scale_up)
+ __field(unsigned long, clk_rate)
+ ),
+
+ TP_fast_assign(
+- __entry->name = name;
++ __assign_str(name);
+ __entry->scale_up = scale_up;
+ __entry->clk_rate = clk_rate;
+ ),
+
+ TP_printk("ufs: clk (%s) scaled %s @ %lu",
+- __entry->name,
++ __get_str(name),
+ __entry->scale_up ? "up" : "down",
+ __entry->clk_rate)
+ );
+--
+2.51.0
+
--- /dev/null
+From d3c2c6c6ef0b105461435c91949ac2af5257b897 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:28 +0530
+Subject: serial: 8250: 8250_omap.c: Add support for handling UART error
+ conditions
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit 623b07b370e9963122d167e04fdc1dc713ebfbaf ]
+
+The DMA IRQ handler does not accounts for the overrun(OE) or any other
+errors being reported by the IP before triggering a DMA transaction which
+leads to the interrupts not being handled resulting into an IRQ storm.
+
+The way to handle OE is to:
+1. Reset the RX FIFO.
+2. Read the UART_RESUME register, which clears the internal flag
+
+Earlier, the driver issued DMA transations even in case of OE which shouldn't
+be done according to the OE handling mechanism mentioned above, as we are
+resetting the FIFO's, refer section: "12.1.6.4.8.1.3.6 Overrun During
+Receive" [0].
+
+[0] https://www.ti.com/lit/pdf/spruiu1
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-2-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 9e49ef48b851b..e26bae0a6488f 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -100,6 +100,9 @@
+ #define OMAP_UART_REV_52 0x0502
+ #define OMAP_UART_REV_63 0x0603
+
++/* Resume register */
++#define UART_OMAP_RESUME 0x0B
++
+ /* Interrupt Enable Register 2 */
+ #define UART_OMAP_IER2 0x1B
+ #define UART_OMAP_IER2_RHR_IT_DIS BIT(2)
+@@ -119,7 +122,6 @@
+ /* Timeout low and High */
+ #define UART_OMAP_TO_L 0x26
+ #define UART_OMAP_TO_H 0x27
+-
+ struct omap8250_priv {
+ void __iomem *membase;
+ int line;
+@@ -1256,6 +1258,20 @@ static u16 omap_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, u16 status
+ return status;
+ }
+
++static void am654_8250_handle_uart_errors(struct uart_8250_port *up, u8 iir, u16 status)
++{
++ if (status & UART_LSR_OE) {
++ serial8250_clear_and_reinit_fifos(up);
++ serial_in(up, UART_LSR);
++ serial_in(up, UART_OMAP_RESUME);
++ } else {
++ if (status & (UART_LSR_FE | UART_LSR_PE | UART_LSR_BI))
++ serial_in(up, UART_RX);
++ if (iir & UART_IIR_XOFF)
++ serial_in(up, UART_IIR);
++ }
++}
++
+ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
+ u16 status)
+ {
+@@ -1266,7 +1282,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
+ * Queue a new transfer if FIFO has data.
+ */
+ if ((status & (UART_LSR_DR | UART_LSR_BI)) &&
+- (up->ier & UART_IER_RDI)) {
++ (up->ier & UART_IER_RDI) && !(status & UART_LSR_OE)) {
++ am654_8250_handle_uart_errors(up, iir, status);
+ omap_8250_rx_dma(up);
+ serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE);
+ } else if ((iir & 0x3f) == UART_IIR_RX_TIMEOUT) {
+@@ -1282,6 +1299,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
+ serial_out(up, UART_OMAP_EFR2, 0x0);
+ up->ier |= UART_IER_RLSI | UART_IER_RDI;
+ serial_out(up, UART_IER, up->ier);
++ } else {
++ am654_8250_handle_uart_errors(up, iir, status);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b1244a418c3a9833fd1935ec2971986839ab096c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:29 +0530
+Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
+ termination is done
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ]
+
+Clear rx_running flag only after DMA teardown polling completes. In the
+previous implementation the flag was being cleared while hardware teardown
+was still in progress, creating a mismatch between software state
+(flag = 0, "ready") and hardware state (still terminating).
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index e26bae0a6488f..272bc07c9a6b5 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -931,7 +931,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+
+ cookie = dma->rx_cookie;
+- dma->rx_running = 0;
+
+ /* Re-enable RX FIFO interrupt now that transfer is complete */
+ if (priv->habit & UART_HAS_RHR_IT_DIS) {
+@@ -965,6 +964,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+ ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+
++ dma->rx_running = 0;
+ p->port.icount.rx += ret;
+ p->port.icount.buf_overrun += count - ret;
+ out:
+--
+2.51.0
+
--- /dev/null
+From e46cdfd33d6039350d5a671bd6838f66cd352d72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 17:54:25 +0300
+Subject: serial: 8250_dw: handle clock enable errors in runtime_resume
+
+From: Artem Shimko <a.shimko.dev@gmail.com>
+
+[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ]
+
+Add error checking for clk_prepare_enable() calls in
+dw8250_runtime_resume(). Currently if either clock fails to enable,
+the function returns success while leaving clocks in inconsistent state.
+
+This change implements comprehensive error handling by checking the return
+values of both clk_prepare_enable() calls. If the second clock enable
+operation fails after the first clock has already been successfully
+enabled, the code now properly cleans up by disabling and unpreparing
+the first clock before returning. The error code is then propagated to
+the caller, ensuring that clock enable failures are properly reported
+rather than being silently ignored.
+
+Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
+Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index 27af83f0ff463..0f8207652efe6 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -741,11 +741,18 @@ static int dw8250_runtime_suspend(struct device *dev)
+
+ static int dw8250_runtime_resume(struct device *dev)
+ {
++ int ret;
+ struct dw8250_data *data = dev_get_drvdata(dev);
+
+- clk_prepare_enable(data->pclk);
++ ret = clk_prepare_enable(data->pclk);
++ if (ret)
++ return ret;
+
+- clk_prepare_enable(data->clk);
++ ret = clk_prepare_enable(data->clk);
++ if (ret) {
++ clk_disable_unprepare(data->pclk);
++ return ret;
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 38643096cc25acdd85c0ac01d9ff4b812d8ab0f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Nov 2025 16:42:59 +0000
+Subject: serial: rsci: Add set_rtrg() callback
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit b346e5d7dbf6696176417923c49838a1beb1d785 ]
+
+The rtrg variable is populated in sci_init_single() for RZ/T2H. Add
+set_rtrg() callback for setting the rtrg value.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Link: https://patch.msgid.link/20251129164325.209213-4-biju.das.jz@bp.renesas.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/rsci.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/tty/serial/rsci.c b/drivers/tty/serial/rsci.c
+index b3c48dc1e07db..0533a4bb1d03c 100644
+--- a/drivers/tty/serial/rsci.c
++++ b/drivers/tty/serial/rsci.c
+@@ -151,6 +151,22 @@ static void rsci_start_rx(struct uart_port *port)
+ rsci_serial_out(port, CCR0, ctrl);
+ }
+
++static int rsci_scif_set_rtrg(struct uart_port *port, int rx_trig)
++{
++ u32 fcr = rsci_serial_in(port, FCR);
++
++ if (rx_trig >= port->fifosize)
++ rx_trig = port->fifosize - 1;
++ else if (rx_trig < 1)
++ rx_trig = 0;
++
++ fcr &= ~FCR_RTRG4_0;
++ fcr |= field_prep(FCR_RTRG4_0, rx_trig);
++ rsci_serial_out(port, FCR, fcr);
++
++ return rx_trig;
++}
++
+ static void rsci_set_termios(struct uart_port *port, struct ktermios *termios,
+ const struct ktermios *old)
+ {
+@@ -454,6 +470,7 @@ static const struct sci_port_ops rsci_port_ops = {
+ .poll_put_char = rsci_poll_put_char,
+ .prepare_console_write = rsci_prepare_console_write,
+ .suspend_regs_size = rsci_suspend_regs_size,
++ .set_rtrg = rsci_scif_set_rtrg,
+ .shutdown_complete = rsci_shutdown_complete,
+ };
+
+--
+2.51.0
+
rust_binder-fix-build-failure-if-config_compat.patch
+mmc-rtsx_pci_sdmmc-increase-power-on-settling-delay-.patch
+revert-mmc-rtsx_pci_sdmmc-increase-power-on-settling.patch
+perf-test-fix-test-case-perf-evlist-tests-for-s390x.patch
+perf-test-stat-tests-fix-for-virtualized-machines.patch
+perf-build-raise-minimum-shellcheck-version-to-0.7.2.patch
+perf-unwind-libdw-fix-invalid-reference-counts.patch
+perf-callchain-fix-srcline-printing-with-inlines.patch
+libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch
+rtc-nvvrs-add-arch_tegra-to-the-nv-vrs-rtc-driver.patch
+rtc-max31335-use-correct-config-symbol-in-is_reachab.patch
+perf-symbol-elf-fix-leak-of-elf-files-with-gnu-debug.patch
+perf-tools-get-debug-info-of-dso-properly.patch
+perf-tests-kallsyms-fix-missed-map__put.patch
+perf-cs-etm-fix-decoding-for-sparse-cpu-maps.patch
+perf-annotate-fix-args-leak-of-map_symbol.patch
+perf-maps-fix-reference-count-leak-in-maps__find_ams.patch
+perf-tests-sched-avoid-error-in-cleanup-on-loaded-ma.patch
+perf-annotate-fix-memcpy-size-in-arch__grow_instruct.patch
+tools-headers-go-back-to-include-asm-generic-unistd..patch
+perf-annotate-fix-build_nondistro-1-missing-args-ms-.patch
+perf-test-fix-test-perf-evlist-for-z-vm-s390x.patch
+perf-vendor-events-amd-fix-zen-5-mab-allocation-even.patch
+perf-jevents-handle-deleted-jsons-in-out-of-source-b.patch
+perf-build-remove-no_libcap-that-controls-nothing.patch
+libperf-build-always-place-libperf-includes-first.patch
+perf-metricgroup-don-t-early-exit-if-no-cpuid-table-.patch
+perf-test-fix-test-case-perftool-testsuite_report-fo.patch
+objtool-rust-add-one-more-noreturn-rust-function.patch
+perf-stat-ensure-metrics-are-displayed-even-with-fai.patch
+perf-stat-shadow-in-prepare_metric-fix-guard-on-read.patch
+io_uring-add-ioring_op_uring_cmd128-to-opcode-checks.patch
+rtc-interface-alarm-race-handling-should-not-discard.patch
+statmount-permission-check-should-return-eperm.patch
+hfsplus-fix-volume-corruption-issue-for-generic-480.patch
+audit-add-fchmodat2-to-change-attributes-class.patch
+hfsplus-fix-volume-corruption-issue-for-generic-498.patch
+fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch
+kselftest-kublk-include-message-in-_static_assert-fo.patch
+hfs-replace-bug_on-with-error-handling-for-cnid-coun.patch
+audit-add-missing-syscalls-to-read-class.patch
+hfsplus-pretend-special-inodes-as-regular-files.patch
+i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch
+i3c-mipi-i3c-hci-stop-reading-extended-capabilities-.patch
+i3c-mipi-i3c-hci-reset-ring_operation1-fields-during.patch
+dlm-fix-recovery-pending-middle-conversion.patch
+minix-add-required-sanity-checking-to-minix_check_su.patch
+dlm-validate-length-in-dlm_search_rsb_tree.patch
+btrfs-don-t-bug-on-unexpected-delayed-ref-type-in-ru.patch
+btrfs-fallback-to-buffered-io-if-the-data-profile-ha.patch
+btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch
+netfs-when-subreq-is-marked-for-retry-do-not-check-i.patch
+smb-client-add-proper-locking-around-ses-iface_last_.patch
+gfs2-fiemap-page-fault-fix.patch
+smb-client-prevent-races-in-query_interfaces.patch
+tools-cpupower-fix-inverted-aperf-capability-check.patch
+s390-boot-add-wno-default-const-init-unsafe-to-kbuil.patch
+tools-power-cpupower-reset-errno-before-strtoull.patch
+s390-purgatory-add-wno-default-const-init-unsafe-to-.patch
+perf-arm-cmn-support-cmn-600ae.patch
+arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch
+rnbd-srv-zero-the-rsp-buffer-before-using-it.patch
+x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch
+ntfs-d_compare-must-not-block.patch
+efi-cper-don-t-dump-the-entire-memory-region.patch
+apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch
+apei-ghes-arm-processor-error-don-t-go-past-allocate.patch
+efi-cper-don-t-go-past-the-arm-processor-cper-record.patch
+acpi-processor-fix-null-pointer-dereference-in-acpi_.patch
+acpi-resource-add-jwipc-jvc9100-to-irq1_level_low_sk.patch
+acpica-abort-aml-bytecode-execution-when-executing-a.patch
+powercap-intel_rapl-add-pl4-support-for-ice-lake.patch
+io_uring-timeout-annotate-data-race-in-io_flush_time.patch
+alpha-fix-user-space-corruption-during-memory-compac.patch
+md-cluster-fix-null-pointer-dereference-in-process_m.patch
+md-raid-fix-hang-when-stopping-arrays-with-metadata-.patch
+rust-cpufreq-always-inline-functions-using-build_ass.patch
+cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch
+s390-perf-disable-register-readout-on-sampling-event.patch
+arm64-mte-set-tcma1-whenever-mte-is-present-in-the-k.patch
+perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch
+acpi-x86-s2idle-invoke-microsoft-_dsm-function-9-tur.patch
+acpi-scan-use-async-schedule-function-in-acpi_scan_c.patch
+acpi-battery-fix-incorrect-charging-status-when-curr.patch
+xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch
+blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch
+blk-mq-sched-unify-elevators-checking-for-async-requ.patch
+block-decouple-secure-erase-size-limit-from-discard-.patch
+sparc-synchronize-user-stack-on-fork-and-clone.patch
+sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch
+bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch
+irqchip-riscv-imsic-add-a-cpu-pm-notifier-to-restore.patch
+perf-x86-msr-add-airmont-np.patch
+perf-x86-cstate-add-airmont-np.patch
+perf-x86-intel-add-airmont-np.patch
+gendwarfksyms-fix-build-on-32-bit-hosts.patch
+bpf-crypto-use-the-correct-destructor-kfunc-type.patch
+bpf-net_sched-use-the-correct-destructor-kfunc-type.patch
+bpf-recognize-special-arithmetic-shift-in-the-verifi.patch
+genirq-cpuhotplug-notify-about-affinity-changes-brea.patch
+bpf-properly-mark-live-registers-for-indirect-jumps.patch
+perf-core-fix-slow-perf_event_task_exit-with-lbr-cal.patch
+arm64-ftrace-bpf-fix-partial-regs-after-bpf_prog_run.patch
+clocksource-drivers-sh_tmu-always-leave-device-runni.patch
+clocksource-drivers-timer-integrator-ap-add-missing-.patch
+pci-msi-unmap-msi-x-region-on-error.patch
+bpftool-fix-dependencies-for-static-build.patch
+crypto-hisilicon-qm-move-the-barrier-before-writing-.patch
+mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch
+char-tpm-cr50-remove-irqf_oneshot.patch
+sched-debug-fix-updating-of-ppos-on-server-write-ops.patch
+pstore-ram_core-fix-incorrect-success-return-when-vm.patch
+firmware-arm_ffa-unmap-rx-tx-buffers-on-init-failure.patch
+revert-arm64-zynqmp-add-an-op-tee-node-to-the-device.patch
+edac-igen6-add-more-intel-panther-lake-h-socs-suppor.patch
+edac-igen6-add-two-intel-amston-lake-socs-support.patch
+arm64-tegra-smaug-add-usb-role-switch-support.patch
+soc-imx8m-fix-error-handling-for-clk_prepare_enable.patch
+soc-tegra-pmc-fix-unsafe-generic_handle_irq-call.patch
+x86-sev-use-kfree_sensitive-when-freeing-a-snp-messa.patch
+parisc-prevent-interrupts-during-reboot.patch
+drm-xe-ggtt-use-scope-based-runtime-pm.patch
+drm-xe-covert-return-of-ebusy-to-enomem-in-vm-bind-i.patch
+drm-xe-vm-skip-ufence-association-for-cpu-address-mi.patch
+drm-panthor-always-wait-after-sending-a-command-to-a.patch
+drm-xe-xe3_lpg-apply-wa_16028005424.patch
+drm-panel-edp-add-csw-mne007qb3-1.patch
+gpu-panel-edp-add-auo-panel-entry-for-b140han06.4.patch
+accel-amdxdna-fix-tail-pointer-polling-in-mailbox_ge.patch
+drm-amdgpu-fix-null-pointer-issue-buffer-funcs.patch
+drm-amdgpu-fix-the-calculation-of-ras-bad-page-numbe.patch
+drm-amdgpu-ras-move-ras-data-alloc-before-bad-page-c.patch
+drm-amd-display-correct-dsc-padding-accounting.patch
+drm-amd-display-fix-wrong-x_pos-and-y_pos-for-cursor.patch
+drm-amd-display-correct-fixed_vs-link-rate-toggle-co.patch
+drm-amd-display-guard-fams2-configuration-updates.patch
+drm-panel-edp-add-auo-b140qax01.h-panel.patch
+drm-amdkfd-handle-gpu-reset-and-drain-retry-fault-ra.patch
+spi-geni-qcom-initialize-mode-related-registers-to-0.patch
+spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch
+spi-cadence-quadspi-parse-dt-for-flashes-with-the-re.patch
+drm-amd-display-fix-dp-no-audio-issue.patch
+drm-amd-display-add-usb-c-dp-alt-mode-lane-limitatio.patch
+drm-amd-display-don-t-disable-dpcd-mst_en-if-sink-co.patch
+asoc-sof-ipc4-support-for-sending-payload-along-with.patch
+media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch
+gpio-pca953x-add-support-for-tcal6408-tcal6416.patch
+spi-stm32-fix-overrun-issue-at-8bpw.patch
+drm-ast-swap-framebuffer-writes-on-big-endian-machin.patch
+alsa-hda-realtek-enable-mute-led-for-lenovo-platform.patch
+drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch
+media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch
+media-omap3isp-isppreview-always-clamp-in-preview_tr.patch
+media-omap3isp-set-initial-format.patch
+media-chips-media-wave5-fix-conditional-in-start_str.patch
+media-chips-media-wave5-process-ready-frames-when-cm.patch
+drm-panel-edp-add-boe-nv140wum-t08-panel.patch
+media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch
+drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch
+drm-amd-display-fix-mismatched-unlock-for-dmub-hw-lo.patch
+drm-amd-display-fix-dsc-edp-issue.patch
+drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch
+drm-amd-display-add-signal-type-check-for-dcn401-get.patch
+drm-amdgpu-refactor-amdgpu_gem_va_ioctl-for-handling.patch
+hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch
+hid-pidff-do-not-set-out-of-range-trigger-button.patch
+hid-multitouch-add-quirks-for-lenovo-yoga-book-9i.patch
+drm-amdgpu-skip-loading-sdma_rs64-in-vf.patch
+drm-amd-display-only-power-down-dig-on-phy-endpoints.patch
+drm-amd-display-adjust-phy-fsm-transition-to-tx_en-t.patch
+drm-xe-only-toggle-scheduling-in-tdr-if-guc-is-runni.patch
+asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch
+asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch
+spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch
+cgroup-cpuset-don-t-fail-cpuset.cpus-change-in-v2.patch
+media-amphion-clear-last_buffer_dequeued-flag-for-de.patch
+drm-panel-fix-a-possible-null-pointer-dereference-in.patch
+media-adv7180-fix-frame-interval-in-progressive-mode.patch
+media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch
+media-solo6x10-check-for-out-of-bounds-chip_id.patch
+media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch
+media-qcom-camss-do-not-enable-cpas-fast-ahb-clock-f.patch
+media-v4l2-async-fix-error-handling-on-steps-after-f.patch
+media-mt9m114-avoid-a-reset-low-spike-during-probe.patch
+media-mt9m114-return-eprobe_defer-if-no-endpoint-is-.patch
+media-ipu6-ensure-stream_mutex-is-acquired-when-deal.patch
+media-ipu6-close-firmware-streams-on-streaming-enabl.patch
+media-ipu6-always-close-firmware-stream.patch
+alsa-hda-realtek-add-hp-victus-16-e0xxx-mute-led-qui.patch
+alsa-usb-audio-presonus-s18xx-uses-little-endian.patch
+drm-amdkfd-relax-size-checking-during-queue-buffer-g.patch
+drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch
+drm-account-property-blob-allocations-to-memcg.patch
+drm-renesas-rz-du-mipi_dsi-fix-kernel-panic-when-reb.patch
+hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch
+virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch
+asoc-soc-acpi-intel-arl-match-change-rt722-amp-endpo.patch
+asoc-soc-acpi-intel-ptl-match-use-aggregated-endpoin.patch
+asoc-sdw_utils-remove-dai-registered-check.patch
+drm-atmel-hlcdc-destroy-properly-the-plane-state-in-.patch
+pci-add-intel-nova-lake-audio-device-id.patch
+alsa-hda-controllers-intel-add-support-for-nova-lake.patch
+drm-amd-display-disable-fec-when-powering-down-encod.patch
+drm-amd-display-ensure-link-output-is-disabled-in-ba.patch
+drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch
+drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch
+drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch
+drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch
+media-rkisp1-fix-filter-mode-register-configuration.patch
+drm-amd-display-revert-init-dispclk-from-bootup-cloc.patch-24199
+drm-amdgpu-mark-invalid-records-with-u64_max.patch
+hid-multitouch-add-egalaxtouch-exc3188-support.patch
+media-uvcvideo-create-an-id-namespace-for-streaming-.patch
+hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch
+alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch
+alsa-hda-realtek-fix-lg-gram-style-14-speakers.patch
+gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch
+asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch
+spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch
+drm-amd-display-fix-gfx12-family-constant-checks.patch
+drm-amd-display-avoid-dig-reg-access-timeout-on-usb4.patch
+spi-cadence-qspi-fix-probe-error-path-and-remove.patch
+drm-amdgpu-validate-user-queue-size-constraints.patch
+spi-cadence-qspi-try-hard-to-disable-the-clocks.patch
+drm-amd-pm-fix-null-pointer-dereference-issue.patch
+asoc-codecs-max98390-check-return-value-of-devm_gpio.patch
+hwmon-asus-ec-sensors-add-pro-ws-trx50-sage-wifi-a.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7080.patch
+hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch
+hwmon-nct6683-add-customer-id-for-asrock-z590-taichi.patch
+hwmon-emc2305-fix-a-resource-leak-in-emc2305_of_pars.patch
+hwmon-f71882fg-add-f81968-support.patch
+hwmon-nct7363-fix-a-resource-leak-in-nct7363_present.patch
+hid-logitech-hidpp-add-support-for-logitech-k980.patch
+asoc-es8328-add-error-unwind-in-resume.patch
+alsa-hda-realtek-add-quirk-for-minisforum-v3-se.patch
+modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch
+asoc-qcom-q6asm-drop-dsp-responses-for-closed-data-s.patch
+power-sequencing-fix-missing-state_lock-in-pwrseq_po.patch
+asoc-sof-intel-hda-fix-null-pointer-dereference.patch
+spi-geni-qcom-fix-abort-sequence-execution-for-seria.patch
+asoc-fsl-imx-rpmsg-use-snd_soc_find_dai_with_mutex-i.patch
+alsa-hda-realtek-enable-mute-leds-on-hp-envy-x360-15.patch
+alsa-mixer-oss-add-card-disconnect-checkpoints.patch
+alsa-ctxfi-add-quirk-for-se-300pcie-variant-160b-010.patch
+alsa-usb-audio-add-dsd-support-for-ibasso-dc04u.patch
+alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch
+jfs-add-missing-set_freezable-for-freezable-kthread.patch
+jfs-nlink-overflow-in-jfs_rename.patch
+pci-dwc-skip-pme_turn_off-broadcast-and-l2-l3-transi.patch
+wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch
+wifi-rtw89-8852au-add-support-for-tp-tx30u-plus.patch
+wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch
+wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch
+wifi-rtw89-8922a-set-random-mac-if-efuse-contains-ze.patch
+wifi-rtw89-ser-enable-error-imr-after-recovering-fro.patch
+wifi-rtw89-setting-tbtt-agg-number-when-mac-port-ini.patch
+wifi-rtw89-mcc-reset-probe-counter-when-receiving-be.patch
+wifi-rtw88-use-devm_kmemdup-in-rtw_set_supported_ban.patch
+wifi-rtw88-fix-inadvertent-sharing-of-struct-ieee802.patch
+pci-cadence-avoid-signed-64-bit-truncation-and-inval.patch
+wifi-rtw89-regd-6-ghz-power-type-marks-default-when-.patch
+dm-replace-eexist-with-ebusy.patch
+dm-remove-fake-timeout-to-avoid-leak-request.patch
+iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch
+net-wwan-mhi-add-network-support-for-foxconn-t99w760.patch
+wifi-rtw89-fix-potential-zero-beacon-interval-in-bea.patch
+rtla-fix-null-pointer-dereference-in-actions_parse.patch
+wifi-libertas-fix-warning-in-usb_tx_block.patch
+iommu-amd-move-wait_on_sem-out-of-spinlock.patch
+wifi-rtw89-add-support-for-msi-ax1800-nano-guax18n.patch
+wifi-rtw89-add-support-for-d-link-vr-air-bridge-dwa-.patch
+wifi-rtw89-pci-validate-sequence-number-of-tx-releas.patch
+wifi-rtw89-mac-correct-page-number-for-csi-response.patch
+wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch
+pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch
+wifi-rtw89-disable-eht-protocol-by-chip-capabilities.patch
+wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch
+wifi-ath11k-fix-failure-to-connect-to-a-6-ghz-ap.patch
+wifi-ath12k-fix-preferred-hardware-mode-calculation.patch
+wifi-ath12k-fix-mac-phy-capability-parsing.patch
+wifi-cfg80211-allow-only-one-nan-interface-also-in-m.patch
+ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch
+ipv6-annotate-data-races-over-sysctl.flowlabel_refle.patch
+ipv6-annotate-data-races-in-net-ipv6-route.c.patch
+ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch
+ext4-mark-group-add-fast-commit-ineligible.patch
+ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch
+ext4-mark-group-extend-fast-commit-ineligible.patch
+ext4-use-reserved-metadata-blocks-when-splitting-ext.patch
+netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch
+netfilter-xt_tcpmss-check-remaining-length-before-re.patch
+openrisc-define-arch-specific-version-of-nop.patch
+net-usb-r8152-fix-transmit-queue-timeout.patch
+pci-imx6-add-clkreq-override-to-enable-refclk-for-i..patch
+wifi-iwlwifi-mld-handle-rate-selection-for-nan-inter.patch
+wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch
+wifi-iwlwifi-fix-22000-series-smem-parsing.patch
+wifi-iwlwifi-mld-fix-chandef-start-calculation.patch
+wifi-iwlwifi-mld-fix-primary-link-selection-logic.patch
+driver-core-faux-stop-using-static-struct-device.patch
+wifi-rtw89-add-default-id-28de-2432-for-rtl8832cu.patch
+wifi-rtw89-fix-unable-to-receive-probe-responses-und.patch
+wifi-rtw89-8922a-add-digital-compensation-for-2ghz.patch
+net-rds-no-shortcut-out-of-rds_conn_error.patch
+ext4-propagate-flags-to-convert_initialized_extent.patch
+gro-change-the-bug_on-in-gro_pull_from_frag0.patch
+ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch
+net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch
+wifi-cfg80211-treat-deprecated-indoor_sp_ap_old-cont.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch
+wifi-rtw89-pci-validate-release-report-content-befor.patch
+ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch
+bluetooth-btusb-add-support-for-mediatek7920-0489-e1.patch
+bluetooth-hci_qca-fix-ssr-subsystem-restart-fail-whe.patch
+bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch
+bluetooth-btusb-add-usb-id-0489-e112-for-realtek-885.patch
+bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch
+bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch
+bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch
+octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch
+net-sfp-add-quirk-for-lantech-8330-265d.patch
+wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch
+wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch
+bnxt_en-allow-ntuple-filters-for-drops.patch
+ptp-ptp_vmclock-add-vmclock-to-acpi-device-match.patch
+net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch
+vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch
+net-rds-clear-reconnect-pending-bit.patch
+pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch
+pci-aer-clear-stale-errors-on-reporting-agents-upon-.patch
+pci-fix-pci_slot_lock-device-locking.patch
+pci-enable-acs-after-configuring-iommu-for-of-platfo.patch
+pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch
+pci-mark-nvidia-gb10-to-avoid-bus-reset.patch
+pci-bwctrl-disable-bw-controller-on-intel-p45-using-.patch
+myri10ge-avoid-uninitialized-variable-use.patch
+nfc-nxp-nci-remove-interrupt-trigger-type.patch
+hisi_acc_vfio_pci-resolve-duplicate-migration-states.patch
+rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch
+hisi_acc_vfio_pci-fix-the-queue-parameter-anomaly-is.patch
+um-preserve-errno-within-signal-handler.patch
+ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch
+hisi_acc_vfio_pci-update-status-after-ras-error.patch
+scsi-buslogic-reduce-stack-usage.patch
+vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch
+scsi-ufs-mediatek-fix-page-faults-in-ufs_mtk_clk_sca.patch
+riscv-vector-init-vector-context-with-proper-vlenb.patch
+tracing-fix-false-sharing-in-hwlat-get_sample.patch
+remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch
+mailbox-mchp-ipc-sbi-fix-out-of-bounds-access-in-mch.patch
+mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch
+mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch
+mailbox-mchp-ipc-sbi-fix-uninitialized-symbol-and-ot.patch
+mailbox-sprd-mask-interrupts-that-are-not-handled.patch
+remoteproc-mediatek-break-lock-dependency-to-prepare.patch
+mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch
+clk-amlogic-remove-potentially-unsafe-flags-from-s4-.patch
+clk-renesas-rzg2l-deassert-reset-on-assert-timeout.patch
+clk-microchip-core-correct-return-value-on-_get_pare.patch
+hid-i2c-hid-add-focaltech-ft8112.patch
+m68k-nommu-fix-memmove-with-differently-aligned-src-.patch
+9p-xen-protect-xen_9pfs_front_free-against-concurren.patch
+dmaengine-stm32-dma3-use-module_platform_driver.patch
+soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch
+soundwire-intel_auxdevice-add-cs42l45-codec-to-wake_.patch
+staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch
+serial-8250_dw-handle-clock-enable-errors-in-runtime.patch
+usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch
+tty-vt-keyboard-split-apart-vt_do_diacrit.patch
+serial-rsci-add-set_rtrg-callback.patch
+fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch
+most-core-fix-resource-leak-in-most_register_interfa.patch
+dmaengine-sun6i-choose-appropriate-burst-length-unde.patch
+dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch
+phy-ti-phy-j721e-wiz-restore-mux-selection-during-re.patch
+phy-cadence-torrent-restore-parent-clock-for-refclk-.patch
+misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch
+pinctrl-mediatek-make-devm-allocations-safer-and-cle.patch
+misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch
+misc-ti_fpc202-fix-a-potential-memory-leak-in-probe-.patch
+pinctrl-renesas-rzt2h-allow-.get_direction-for-irq-f.patch
+iio-bmi270_i2c-add-module_device_table-for-bmi260-27.patch
+usb-gadget-f_fs-fix-dma-buf-out-queues.patch
+usb-gadget-f_fs-fix-ioctl-error-handling.patch
+usb-chipidea-udc-fix-dma-and-sg-cleanup-in-_ep_nuke.patch
+staging-rtl8723bs-fix-memory-leak-on-failure-path.patch
+serial-8250-8250_omap.c-add-support-for-handling-uar.patch
+serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch
+fix-it87_wdt-early-reboot-by-reporting-running-timer.patch
+binder-don-t-use-pk-through-printk.patch
+watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch
+watchdog-rzv2h_wdt-discard-pm_runtime_put-return-val.patch
+phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch
+phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch
+revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch
+mfd-intel-lpss-add-intel-nova-lake-s-pci-ids.patch
+iio-use-irqf_no_thread.patch
+iio-magnetometer-remove-irqf_oneshot.patch
+mips-loongson-make-cpumask_of_node-robust-against-nu.patch
+block-fix-partial-iova-mapping-cleanup-in-blk_rq_dma.patch
+fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch
+fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch
+fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch
+fs-ntfs3-handle-attr_set_size-errors-when-truncating.patch
+fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch
+ntfs3-fix-circular-locking-dependency-in-run_unpack_.patch
+fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch
+ceph-supply-snapshot-context-in-ceph_uninline_data.patch
+libceph-define-and-enforce-ceph_max_key_len.patch
+thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch
+acpi-x86-force-enabling-of-pwm2-on-the-yogabook-yb1-.patch
+include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch
+arm-9467-1-mm-don-t-use-pk-through-printk.patch
+drm-amd-display-fix-writeback-on-dcn-3.2.patch
+drm-amdgpu-skip-vcn-poison-irq-release-on-vf.patch
+mshv-ignore-second-stats-page-map-result-failure.patch
+x86-hyperv-move-hv-crash-init-after-hypercall-pg-set.patch
+mshv-clear-eventfd-counter-on-irqfd-shutdown.patch
+asoc-rt721-sdca-fix-issue-of-fail-to-detect-omtp-jac.patch
+regulator-core-remove-regulator-supply_name-length-l.patch
+alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch
+drm-amd-display-fix-system-resume-lag-issue.patch
+drm-amd-display-avoid-updating-surface-with-the-same.patch
+drm-amdgpu-return-when-ras-table-checksum-is-error.patch
+drm-amdgpu-adjust-usleep_range-in-fence-wait.patch
+alsa-hda-realtek-fix-headset-mic-on-asus-zenbook-14-.patch
+alsa-usb-audio-update-the-number-of-packets-properly.patch
+drm-amd-display-set-enable_legacy_fast_update-to-fal.patch
+drm-amdgpu-add-hainan-clock-adjustment.patch
+drm-amd-display-bypass-post-csc-for-additional-color.patch
+spi-spidev-fix-lock-inversion-between-spi_lock-and-b.patch
+drm-radeon-add-hainan-clock-adjustment.patch
+alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch
+btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch
+btrfs-do-not-assert-when-the-fs-flips-ro-inside-btrf.patch
+asoc-amd-amd_sdw-add-machine-driver-quirk-for-lenovo.patch
+alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch
+arm64-hugetlbpage-avoid-unused-but-set-parameter-war.patch
+drm-amd-display-remove-conditional-for-shaper-3dlut-.patch
+drm-amdgpu-avoid-sdma-ring-reset-in-sriov.patch
+rtc-zynqmp-correct-frequency-value.patch
+ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch
+ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch
+iommu-amd-serialize-sequence-allocation-under-concur.patch
--- /dev/null
+From 0beb88bacdde1ac864085ab1e1f1cab9ba5755fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 14:54:45 -0300
+Subject: smb: client: add proper locking around ses->iface_last_update
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ]
+
+There is a missing ses->iface_lock in cifs_setup_session,
+around ses->iface_last_update.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/connect.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
+index ce620503e9f70..60c76375f0f50 100644
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -4270,7 +4270,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
+ ses->ses_status = SES_IN_SETUP;
+
+ /* force iface_list refresh */
++ spin_lock(&ses->iface_lock);
+ ses->iface_last_update = 0;
++ spin_unlock(&ses->iface_lock);
+ }
+ spin_unlock(&ses->ses_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 9da455bf644070ac52ad8d9caec648f6ec106b8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 14:54:44 -0300
+Subject: smb: client: prevent races in ->query_interfaces()
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ]
+
+It was possible for two query interface works to be concurrently trying
+to update the interfaces.
+
+Prevent this by checking and updating iface_last_update under
+iface_lock.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index c1aaf77e187b6..edfd6a4e87e8b 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -637,13 +637,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ p = buf;
+
+ spin_lock(&ses->iface_lock);
+- /* do not query too frequently, this time with lock held */
+- if (ses->iface_last_update &&
+- time_before(jiffies, ses->iface_last_update +
+- (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
+- spin_unlock(&ses->iface_lock);
+- return 0;
+- }
+
+ /*
+ * Go through iface_list and mark them as inactive
+@@ -666,7 +659,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ "Empty network interface list returned by server %s\n",
+ ses->server->hostname);
+ rc = -EOPNOTSUPP;
+- ses->iface_last_update = jiffies;
+ goto out;
+ }
+
+@@ -795,8 +787,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ + sizeof(p->Next) && p->Next))
+ cifs_dbg(VFS, "%s: incomplete interface info\n", __func__);
+
+- ses->iface_last_update = jiffies;
+-
+ out:
+ /*
+ * Go through the list again and put the inactive entries
+@@ -825,10 +815,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_
+ struct TCP_Server_Info *pserver;
+
+ /* do not query too frequently */
++ spin_lock(&ses->iface_lock);
+ if (ses->iface_last_update &&
+ time_before(jiffies, ses->iface_last_update +
+- (SMB_INTERFACE_POLL_INTERVAL * HZ)))
++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
++ spin_unlock(&ses->iface_lock);
+ return 0;
++ }
++
++ ses->iface_last_update = jiffies;
++
++ spin_unlock(&ses->iface_lock);
+
+ rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
+ FSCTL_QUERY_NETWORK_INTERFACE_INFO,
+--
+2.51.0
+
--- /dev/null
+From 4a8c5cb3c9416ab49f0d478d767d75e60f8367cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 06:12:41 +0800
+Subject: soc: imx8m: Fix error handling for clk_prepare_enable()
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit f6ef3d9ff81240e9bcc030f2da132eb0f8a761d7 ]
+
+imx8m_soc_prepare() directly returns the result of clk_prepare_enable(),
+which skips proper cleanup if the clock enable fails. Check the return
+value of clk_prepare_enable() and release resources if failure.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/r/202601111406.ZVV3YaiU-lkp@intel.com/
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/soc-imx8m.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c
+index 04a1b60f2f2b5..8e2322999f099 100644
+--- a/drivers/soc/imx/soc-imx8m.c
++++ b/drivers/soc/imx/soc-imx8m.c
+@@ -148,7 +148,11 @@ static int imx8m_soc_prepare(struct platform_device *pdev, const char *ocotp_com
+ goto err_clk;
+ }
+
+- return clk_prepare_enable(drvdata->clk);
++ ret = clk_prepare_enable(drvdata->clk);
++ if (ret)
++ goto err_clk;
++
++ return 0;
+
+ err_clk:
+ iounmap(drvdata->ocotp_base);
+--
+2.51.0
+
--- /dev/null
+From 5ff5259b5af89149afbf24735d5444546c731cd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 05:01:03 +0000
+Subject: soc/tegra: pmc: Fix unsafe generic_handle_irq() call
+
+From: Prathamesh Shete <pshete@nvidia.com>
+
+[ Upstream commit e6d96073af681780820c94079b978474a8a44413 ]
+
+Currently, when resuming from system suspend on Tegra platforms,
+the following warning is observed:
+
+WARNING: CPU: 0 PID: 14459 at kernel/irq/irqdesc.c:666
+Call trace:
+ handle_irq_desc+0x20/0x58 (P)
+ tegra186_pmc_wake_syscore_resume+0xe4/0x15c
+ syscore_resume+0x3c/0xb8
+ suspend_devices_and_enter+0x510/0x540
+ pm_suspend+0x16c/0x1d8
+
+The warning occurs because generic_handle_irq() is being called from
+a non-interrupt context which is considered as unsafe.
+
+Fix this warning by deferring generic_handle_irq() call to an IRQ work
+which gets executed in hard IRQ context where generic_handle_irq()
+can be called safely.
+
+When PREEMPT_RT kernels are used, regular IRQ work (initialized with
+init_irq_work) is deferred to run in per-CPU kthreads in preemptible
+context rather than hard IRQ context. Hence, use the IRQ_WORK_INIT_HARD
+variant so that with PREEMPT_RT kernels, the IRQ work is processed in
+hardirq context instead of being deferred to a thread which is required
+for calling generic_handle_irq().
+
+On non-PREEMPT_RT kernels, both init_irq_work() and IRQ_WORK_INIT_HARD()
+execute in IRQ context, so this change has no functional impact for
+standard kernel configurations.
+
+Signed-off-by: Petlozu Pravareshwar <petlozup@nvidia.com>
+Signed-off-by: Prathamesh Shete <pshete@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+[treding@nvidia.com: miscellaneous cleanups]
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/pmc.c | 104 ++++++++++++++++++++++++++++------------
+ 1 file changed, 74 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index f3760a3b3026d..407fa840814c3 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -28,6 +28,7 @@
+ #include <linux/iopoll.h>
+ #include <linux/irqdomain.h>
+ #include <linux/irq.h>
++#include <linux/irq_work.h>
+ #include <linux/kernel.h>
+ #include <linux/of_address.h>
+ #include <linux/of_clk.h>
+@@ -468,6 +469,10 @@ struct tegra_pmc {
+ unsigned long *wake_sw_status_map;
+ unsigned long *wake_cntrl_level_map;
+ struct syscore syscore;
++
++ /* Pending wake IRQ processing */
++ struct irq_work wake_work;
++ u32 *wake_status;
+ };
+
+ static struct tegra_pmc *pmc = &(struct tegra_pmc) {
+@@ -1905,6 +1910,50 @@ static int tegra_pmc_parse_dt(struct tegra_pmc *pmc, struct device_node *np)
+ return 0;
+ }
+
++/* translate sc7 wake sources back into IRQs to catch edge triggered wakeups */
++static void tegra186_pmc_wake_handler(struct irq_work *work)
++{
++ struct tegra_pmc *pmc = container_of(work, struct tegra_pmc, wake_work);
++ unsigned int i, wake;
++
++ for (i = 0; i < pmc->soc->max_wake_vectors; i++) {
++ unsigned long status = pmc->wake_status[i];
++
++ for_each_set_bit(wake, &status, 32) {
++ irq_hw_number_t hwirq = wake + (i * 32);
++ struct irq_desc *desc;
++ unsigned int irq;
++
++ irq = irq_find_mapping(pmc->domain, hwirq);
++ if (!irq) {
++ dev_warn(pmc->dev,
++ "No IRQ found for WAKE#%lu!\n",
++ hwirq);
++ continue;
++ }
++
++ dev_dbg(pmc->dev,
++ "Resume caused by WAKE#%lu mapped to IRQ#%u\n",
++ hwirq, irq);
++
++ desc = irq_to_desc(irq);
++ if (!desc) {
++ dev_warn(pmc->dev,
++ "No descriptor found for IRQ#%u\n",
++ irq);
++ continue;
++ }
++
++ if (!desc->action || !desc->action->name)
++ continue;
++
++ generic_handle_irq(irq);
++ }
++
++ pmc->wake_status[i] = 0;
++ }
++}
++
+ static int tegra_pmc_init(struct tegra_pmc *pmc)
+ {
+ if (pmc->soc->max_wake_events > 0) {
+@@ -1923,6 +1972,18 @@ static int tegra_pmc_init(struct tegra_pmc *pmc)
+ pmc->wake_cntrl_level_map = bitmap_zalloc(pmc->soc->max_wake_events, GFP_KERNEL);
+ if (!pmc->wake_cntrl_level_map)
+ return -ENOMEM;
++
++ pmc->wake_status = kcalloc(pmc->soc->max_wake_vectors, sizeof(u32), GFP_KERNEL);
++ if (!pmc->wake_status)
++ return -ENOMEM;
++
++ /*
++ * Initialize IRQ work for processing wake IRQs. Must use
++ * HARD_IRQ variant to run in hard IRQ context on PREEMPT_RT
++ * because we call generic_handle_irq() which requires hard
++ * IRQ context.
++ */
++ pmc->wake_work = IRQ_WORK_INIT_HARD(tegra186_pmc_wake_handler);
+ }
+
+ if (pmc->soc->init)
+@@ -3129,47 +3190,30 @@ static void wke_clear_wake_status(struct tegra_pmc *pmc)
+ }
+ }
+
+-/* translate sc7 wake sources back into IRQs to catch edge triggered wakeups */
+-static void tegra186_pmc_process_wake_events(struct tegra_pmc *pmc, unsigned int index,
+- unsigned long status)
+-{
+- unsigned int wake;
+-
+- dev_dbg(pmc->dev, "Wake[%d:%d] status=%#lx\n", (index * 32) + 31, index * 32, status);
+-
+- for_each_set_bit(wake, &status, 32) {
+- irq_hw_number_t hwirq = wake + 32 * index;
+- struct irq_desc *desc;
+- unsigned int irq;
+-
+- irq = irq_find_mapping(pmc->domain, hwirq);
+-
+- desc = irq_to_desc(irq);
+- if (!desc || !desc->action || !desc->action->name) {
+- dev_dbg(pmc->dev, "Resume caused by WAKE%ld, IRQ %d\n", hwirq, irq);
+- continue;
+- }
+-
+- dev_dbg(pmc->dev, "Resume caused by WAKE%ld, %s\n", hwirq, desc->action->name);
+- generic_handle_irq(irq);
+- }
+-}
+-
+ static void tegra186_pmc_wake_syscore_resume(void *data)
+ {
+- u32 status, mask;
+ unsigned int i;
++ u32 mask;
+
+ for (i = 0; i < pmc->soc->max_wake_vectors; i++) {
+ mask = readl(pmc->wake + WAKE_AOWAKE_TIER2_ROUTING(i));
+- status = readl(pmc->wake + WAKE_AOWAKE_STATUS_R(i)) & mask;
+-
+- tegra186_pmc_process_wake_events(pmc, i, status);
++ pmc->wake_status[i] = readl(pmc->wake + WAKE_AOWAKE_STATUS_R(i)) & mask;
+ }
++
++ /* Schedule IRQ work to process wake IRQs (if any) */
++ irq_work_queue(&pmc->wake_work);
+ }
+
+ static int tegra186_pmc_wake_syscore_suspend(void *data)
+ {
++ unsigned int i;
++
++ /* Check if there are unhandled wake IRQs */
++ for (i = 0; i < pmc->soc->max_wake_vectors; i++)
++ if (pmc->wake_status[i])
++ dev_warn(pmc->dev,
++ "Unhandled wake IRQs pending vector[%u]: 0x%x\n",
++ i, pmc->wake_status[i]);
+ wke_read_sw_wake_status(pmc);
+
+ /* flip the wakeup trigger for dual-edge triggered pads
+--
+2.51.0
+
--- /dev/null
+From da53429d1ae6b27eb2c2e12ebb2864c3e6683fb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:09:47 +0200
+Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of
+ NUC15)
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ]
+
+Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and
+LAPBC710.
+
+Link: https://github.com/thesofproject/linux/issues/5529
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/dmi-quirks.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
+index 91ab97a456fa9..5854218e1a274 100644
+--- a/drivers/soundwire/dmi-quirks.c
++++ b/drivers/soundwire/dmi-quirks.c
+@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
+ },
+ .driver_data = (void *)intel_tgl_bios,
+ },
++ {
++ /*
++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County'
++ * LAPBC510 and LAPBC710)
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"),
++ },
++ .driver_data = (void *)intel_tgl_bios,
++ },
+ {
+ /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From acb0044662d8ec21331d9b60121f4a2b2e50d3c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:17:29 +0000
+Subject: soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
+
+From: Maciej Strozek <mstrozek@opensource.cirrus.com>
+
+[ Upstream commit f87e5575a6bd1925cd55f500b61b661724372e5f ]
+
+Add cs42l45 to the wake_capable_list because it can generate jack events
+whilst the bus is stopped.
+
+Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20251215151729.3911077-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/intel_auxdevice.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soundwire/intel_auxdevice.c b/drivers/soundwire/intel_auxdevice.c
+index 6df2601fff909..8752b0e3ce74c 100644
+--- a/drivers/soundwire/intel_auxdevice.c
++++ b/drivers/soundwire/intel_auxdevice.c
+@@ -52,6 +52,7 @@ struct wake_capable_part {
+
+ static struct wake_capable_part wake_capable_list[] = {
+ {0x01fa, 0x4243},
++ {0x01fa, 0x4245},
+ {0x025d, 0x5682},
+ {0x025d, 0x700},
+ {0x025d, 0x711},
+--
+2.51.0
+
--- /dev/null
+From 371e4efc27bd82024b639cdafbaf8dcbe995ccc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 13:40:29 +0000
+Subject: sparc: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ]
+
+Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros").
+
+glibc-2.42 drops the legacy termio struct, but the ioctls.h header still
+defines some TC* constants in terms of termio (via sizeof). Hardcode the
+values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h
+index 7fd2f5873c9e7..a8bbdf9877a41 100644
+--- a/arch/sparc/include/uapi/asm/ioctls.h
++++ b/arch/sparc/include/uapi/asm/ioctls.h
+@@ -5,10 +5,10 @@
+ #include <asm/ioctl.h>
+
+ /* Big T */
+-#define TCGETA _IOR('T', 1, struct termio)
+-#define TCSETA _IOW('T', 2, struct termio)
+-#define TCSETAW _IOW('T', 3, struct termio)
+-#define TCSETAF _IOW('T', 4, struct termio)
++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */
++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */
++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */
++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */
+ #define TCSBRK _IO('T', 5)
+ #define TCXONC _IO('T', 6)
+ #define TCFLSH _IO('T', 7)
+--
+2.51.0
+
--- /dev/null
+From 016a5109f8ebbc4068b24f9f8abe863ec1b50a39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:47:52 +0100
+Subject: sparc: Synchronize user stack on fork and clone
+
+From: Andreas Larsson <andreas@gaisler.com>
+
+[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ]
+
+Flush all uncommitted user windows before calling the generic syscall
+handlers for clone, fork, and vfork.
+
+Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the
+arch-specific syscall wrappers for these syscalls will attempt to flush
+all windows (including user windows).
+
+In the window overflow trap handlers on both SPARC{32|64},
+if the window can't be stored (i.e due to MMU related faults) the routine
+backups the user window and increments a thread counter (wsaved).
+
+By adding a synchronization point after the flush attempt, when fault
+handling is enabled, any uncommitted user windows will be flushed.
+
+Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394
+Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++--------------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
+index 0442ab00518d3..7d69877511fac 100644
+--- a/arch/sparc/kernel/process.c
++++ b/arch/sparc/kernel/process.c
+@@ -17,14 +17,18 @@
+
+ asmlinkage long sparc_fork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+ struct kernel_clone_args args = {
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs)
+
+ asmlinkage long sparc_vfork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+-
+ struct kernel_clone_args args = {
+ .flags = CLONE_VFORK | CLONE_VM,
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs)
+
+ asmlinkage long sparc_clone(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
+- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ unsigned long orig_i1;
++ unsigned int flags;
+ long ret;
++ struct kernel_clone_args args = {0};
+
+- struct kernel_clone_args args = {
+- .flags = (flags & ~CSIGNAL),
+- .exit_signal = (flags & CSIGNAL),
+- .tls = regs->u_regs[UREG_I3],
+- };
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ args.flags = (flags & ~CSIGNAL);
++ args.exit_signal = (flags & CSIGNAL);
++ args.tls = regs->u_regs[UREG_I3];
+
+ #ifdef CONFIG_COMPAT
+ if (test_thread_flag(TIF_32BIT)) {
+--
+2.51.0
+
--- /dev/null
+From 9c9f87fcc213582fa95c9736ff289196c46dc848 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 16:13:33 +0100
+Subject: spi: cadence-qspi: Fix probe error path and remove
+
+From: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>
+
+[ Upstream commit f18c8cfa4f1af2cf7d68d86989a7d6109acfa1bb ]
+
+The probe has been modified by many different users, it is hard to track
+history, but for sure its current state is partially broken. One easy
+rule to follow is to drop/free/release the resources in the opposite
+order they have been queried.
+
+Fix the labels, the order for freeing the resources, and add the
+missing DMA channel step. Replicate these changes in the remove path as
+well.
+
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>
+Tested-by: Santhosh Kumar K <s-k6@ti.com>
+Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-8-f9c21419a3e6@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 44 ++++++++++++++++++-------------
+ 1 file changed, 25 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index b1cf182d65665..ab74808debe98 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -1891,7 +1891,7 @@ static int cqspi_probe(struct platform_device *pdev)
+ ret = clk_prepare_enable(cqspi->clk);
+ if (ret) {
+ dev_err(dev, "Cannot enable QSPI clock.\n");
+- goto probe_clk_failed;
++ goto disable_rpm;
+ }
+
+ /* Obtain QSPI reset control */
+@@ -1899,14 +1899,14 @@ static int cqspi_probe(struct platform_device *pdev)
+ if (IS_ERR(rstc)) {
+ ret = PTR_ERR(rstc);
+ dev_err(dev, "Cannot get QSPI reset.\n");
+- goto probe_reset_failed;
++ goto disable_clk;
+ }
+
+ rstc_ocp = devm_reset_control_get_optional_exclusive(dev, "qspi-ocp");
+ if (IS_ERR(rstc_ocp)) {
+ ret = PTR_ERR(rstc_ocp);
+ dev_err(dev, "Cannot get QSPI OCP reset.\n");
+- goto probe_reset_failed;
++ goto disable_clk;
+ }
+
+ if (of_device_is_compatible(pdev->dev.of_node, "starfive,jh7110-qspi")) {
+@@ -1914,7 +1914,7 @@ static int cqspi_probe(struct platform_device *pdev)
+ if (IS_ERR(rstc_ref)) {
+ ret = PTR_ERR(rstc_ref);
+ dev_err(dev, "Cannot get QSPI REF reset.\n");
+- goto probe_reset_failed;
++ goto disable_clk;
+ }
+ reset_control_assert(rstc_ref);
+ reset_control_deassert(rstc_ref);
+@@ -1956,7 +1956,7 @@ static int cqspi_probe(struct platform_device *pdev)
+ if (ddata->jh7110_clk_init) {
+ ret = cqspi_jh7110_clk_init(pdev, cqspi);
+ if (ret)
+- goto probe_reset_failed;
++ goto disable_clk;
+ }
+ if (ddata->quirks & CQSPI_DISABLE_STIG_MODE)
+ cqspi->disable_stig_mode = true;
+@@ -1964,7 +1964,7 @@ static int cqspi_probe(struct platform_device *pdev)
+ if (ddata->quirks & CQSPI_DMA_SET_MASK) {
+ ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
+ if (ret)
+- goto probe_reset_failed;
++ goto disable_clks;
+ }
+ }
+
+@@ -1975,7 +1975,7 @@ static int cqspi_probe(struct platform_device *pdev)
+ pdev->name, cqspi);
+ if (ret) {
+ dev_err(dev, "Cannot request IRQ.\n");
+- goto probe_reset_failed;
++ goto disable_clks;
+ }
+
+ cqspi_wait_idle(cqspi);
+@@ -2002,31 +2002,36 @@ static int cqspi_probe(struct platform_device *pdev)
+ ret = cqspi_request_mmap_dma(cqspi);
+ if (ret == -EPROBE_DEFER) {
+ dev_err_probe(&pdev->dev, ret, "Failed to request mmap DMA\n");
+- goto probe_setup_failed;
++ goto disable_controller;
+ }
+ }
+
+ ret = spi_register_controller(host);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to register SPI ctlr %d\n", ret);
+- goto probe_setup_failed;
++ goto release_dma_chan;
+ }
+
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
+ pm_runtime_put_autosuspend(dev);
+
+ return 0;
+-probe_setup_failed:
+- if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
+- pm_runtime_disable(dev);
++
++release_dma_chan:
++ if (cqspi->rx_chan)
++ dma_release_channel(cqspi->rx_chan);
++disable_controller:
+ cqspi_controller_enable(cqspi, 0);
+-probe_reset_failed:
++disable_clks:
+ if (cqspi->is_jh7110)
+ cqspi_jh7110_disable_clk(pdev, cqspi);
+-
++disable_clk:
+ if (pm_runtime_get_sync(&pdev->dev) >= 0)
+ clk_disable_unprepare(cqspi->clk);
+-probe_clk_failed:
++disable_rpm:
++ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
++ pm_runtime_disable(dev);
++
+ return ret;
+ }
+
+@@ -2044,18 +2049,19 @@ static void cqspi_remove(struct platform_device *pdev)
+ cqspi_wait_idle(cqspi);
+
+ spi_unregister_controller(cqspi->host);
+- cqspi_controller_enable(cqspi, 0);
+
+ if (cqspi->rx_chan)
+ dma_release_channel(cqspi->rx_chan);
+
+- if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
+- if (pm_runtime_get_sync(&pdev->dev) >= 0)
+- clk_disable(cqspi->clk);
++ cqspi_controller_enable(cqspi, 0);
+
+ if (cqspi->is_jh7110)
+ cqspi_jh7110_disable_clk(pdev, cqspi);
+
++ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
++ if (pm_runtime_get_sync(&pdev->dev) >= 0)
++ clk_disable(cqspi->clk);
++
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
+ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+--
+2.51.0
+
--- /dev/null
+From edd58cb8fb0caa6476c8d899e4b3a8124a1e7f8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 16:13:34 +0100
+Subject: spi: cadence-qspi: Try hard to disable the clocks
+
+From: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>
+
+[ Upstream commit 612227b392eed94a3398dc03334a84a699a82276 ]
+
+In the remove path, we should try hard to perform all steps as we simply
+cannot fail.
+
+The "no runtime PM" quirk must only alter the state of the RPM core, but
+the clocks should still be disabled if that is possible. Move the
+disable call outside of the RPM quirk.
+
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>
+Tested-by: Santhosh Kumar K <s-k6@ti.com>
+Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-9-f9c21419a3e6@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index ab74808debe98..51ed666a0fdd1 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -2040,6 +2040,7 @@ static void cqspi_remove(struct platform_device *pdev)
+ const struct cqspi_driver_platdata *ddata;
+ struct cqspi_st *cqspi = platform_get_drvdata(pdev);
+ struct device *dev = &pdev->dev;
++ int ret = 0;
+
+ ddata = of_device_get_match_data(dev);
+
+@@ -2059,8 +2060,10 @@ static void cqspi_remove(struct platform_device *pdev)
+ cqspi_jh7110_disable_clk(pdev, cqspi);
+
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
+- if (pm_runtime_get_sync(&pdev->dev) >= 0)
+- clk_disable(cqspi->clk);
++ ret = pm_runtime_get_sync(&pdev->dev);
++
++ if (ret >= 0)
++ clk_disable(cqspi->clk);
+
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
+ pm_runtime_put_sync(&pdev->dev);
+--
+2.51.0
+
--- /dev/null
+From 528544710c6a40b40e5063195ec3f119bf63e714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 19:13:35 +0000
+Subject: spi: cadence-quadspi: Parse DT for flashes with the rest of the DT
+ parsing
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 9f0736a4e136a6eb61e0cf530ddc18ab6d816ba3 ]
+
+The recent refactoring of where runtime PM is enabled done in commit
+f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to
+avoid imbalance") made the fact that when we do a pm_runtime_disable()
+in the error paths of probe() we can trigger a runtime disable which in
+turn results in duplicate clock disables. This is particularly likely
+to happen when there is missing or broken DT description for the flashes
+attached to the controller.
+
+Early on in the probe function we do a pm_runtime_get_noresume() since
+the probe function leaves the device in a powered up state but in the
+error path we can't assume that PM is enabled so we also manually
+disable everything, including clocks. This means that when runtime PM is
+active both it and the probe function release the same reference to the
+main clock for the IP, triggering warnings from the clock subsystem:
+
+[ 8.693719] clk:75:7 already disabled
+[ 8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb
+...
+[ 8.694261] clk_core_disable+0xa0/0xb4 (P)
+[ 8.694272] clk_disable+0x38/0x60
+[ 8.694283] cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi]
+[ 8.694309] platform_probe+0x5c/0xa4
+
+Dealing with this issue properly is complicated by the fact that we
+don't know if runtime PM is active so can't tell if it will disable the
+clocks or not. We can, however, sidestep the issue for the flash
+descriptions by moving their parsing to when we parse the controller
+properties which also save us doing a bunch of setup which can never be
+used so let's do that.
+
+Reported-by: Francesco Dolcini <francesco@dolcini.it>
+Closes: https://lore.kernel.org/r/20251201072844.GA6785@francesco-nb
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://patch.msgid.link/20251204-spi-cadence-qspi-runtime-pm-imbalance-v2-1-10af9115d531@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index b9a560c75c5cd..b1cf182d65665 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -1844,6 +1844,12 @@ static int cqspi_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
++ ret = cqspi_setup_flash(cqspi);
++ if (ret) {
++ dev_err(dev, "failed to setup flash parameters %d\n", ret);
++ return ret;
++ }
++
+ /* Obtain QSPI clock. */
+ cqspi->clk = devm_clk_get(dev, NULL);
+ if (IS_ERR(cqspi->clk)) {
+@@ -1987,12 +1993,6 @@ static int cqspi_probe(struct platform_device *pdev)
+ pm_runtime_get_noresume(dev);
+ }
+
+- ret = cqspi_setup_flash(cqspi);
+- if (ret) {
+- dev_err(dev, "failed to setup flash parameters %d\n", ret);
+- goto probe_setup_failed;
+- }
+-
+ host->num_chipselect = cqspi->num_chipselect;
+
+ if (ddata && (ddata->quirks & CQSPI_SUPPORT_DEVICE_RESET))
+--
+2.51.0
+
--- /dev/null
+From e8df146df00f852048cd68aa73cc37609ce82205 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 21:58:52 +0530
+Subject: spi: geni-qcom: Fix abort sequence execution for serial engine errors
+
+From: Praveen Talari <praveen.talari@oss.qualcomm.com>
+
+[ Upstream commit 96e041647bb0f9d92f95df1d69cb7442d7408b79 ]
+
+The driver currently skips the abort sequence for target mode when serial
+engine errors occur. This leads to improper error recovery as the serial
+engine may remain in an undefined state without proper cleanup, potentially
+causing subsequent operations to fail or behave unpredictably.
+
+Fix this by ensuring the abort sequence and DMA reset always execute during
+error recovery, as both are required for proper serial engine error
+handling.
+
+Co-developed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260204162854.1206323-3-praveen.talari@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 24 ++++++++++--------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 5ab20d7955121..acfcf870efd84 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -160,24 +160,20 @@ static void handle_se_timeout(struct spi_controller *spi,
+ xfer = mas->cur_xfer;
+ mas->cur_xfer = NULL;
+
+- if (spi->target) {
+- /*
+- * skip CMD Cancel sequnece since spi target
+- * doesn`t support CMD Cancel sequnece
+- */
++ /* The controller doesn't support the Cancel commnand in target mode */
++ if (!spi->target) {
++ reinit_completion(&mas->cancel_done);
++ geni_se_cancel_m_cmd(se);
++
+ spin_unlock_irq(&mas->lock);
+- goto reset_if_dma;
+- }
+
+- reinit_completion(&mas->cancel_done);
+- geni_se_cancel_m_cmd(se);
+- spin_unlock_irq(&mas->lock);
++ time_left = wait_for_completion_timeout(&mas->cancel_done, HZ);
++ if (time_left)
++ goto reset_if_dma;
+
+- time_left = wait_for_completion_timeout(&mas->cancel_done, HZ);
+- if (time_left)
+- goto reset_if_dma;
++ spin_lock_irq(&mas->lock);
++ }
+
+- spin_lock_irq(&mas->lock);
+ reinit_completion(&mas->abort_done);
+ geni_se_abort_m_cmd(se);
+ spin_unlock_irq(&mas->lock);
+--
+2.51.0
+
--- /dev/null
+From 996200a0ec3631766878c5a2b938deaef29cb7b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:01 -0500
+Subject: spi-geni-qcom: initialize mode related registers to 0
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ]
+
+setup_fifo_params assumes these will be zero, it won't write these
+registers if the initial mode is zero.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index a0d8d3425c6c6..9e9953469b3a0 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -724,6 +724,12 @@ static int spi_geni_init(struct spi_geni_master *mas)
+ case 0:
+ mas->cur_xfer_mode = GENI_SE_FIFO;
+ geni_se_select_mode(se, GENI_SE_FIFO);
++ /* setup_fifo_params assumes that these registers start with a zero value */
++ writel(0, se->base + SE_SPI_LOOPBACK);
++ writel(0, se->base + SE_SPI_DEMUX_SEL);
++ writel(0, se->base + SE_SPI_CPHA);
++ writel(0, se->base + SE_SPI_CPOL);
++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV);
+ ret = 0;
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 45416c9b11ccd343ba8bb351ad22d4781c972330 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:00 -0500
+Subject: spi-geni-qcom: use xfer->bits_per_word for can_dma()
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit fb2bbe3838728f572485706677590e4fc41eec5c ]
+
+mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word
+when can_dma() is called. Use the right value instead.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 9e9953469b3a0..5ab20d7955121 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -548,10 +548,10 @@ static u32 get_xfer_len_in_words(struct spi_transfer *xfer,
+ {
+ u32 len;
+
+- if (!(mas->cur_bits_per_word % MIN_WORD_LEN))
+- len = xfer->len * BITS_PER_BYTE / mas->cur_bits_per_word;
++ if (!(xfer->bits_per_word % MIN_WORD_LEN))
++ len = xfer->len * BITS_PER_BYTE / xfer->bits_per_word;
+ else
+- len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1);
++ len = xfer->len / (xfer->bits_per_word / BITS_PER_BYTE + 1);
+ len &= TRANS_LEN_MSK;
+
+ return len;
+@@ -571,7 +571,7 @@ static bool geni_can_dma(struct spi_controller *ctlr,
+ return true;
+
+ len = get_xfer_len_in_words(xfer, mas);
+- fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / mas->cur_bits_per_word;
++ fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / xfer->bits_per_word;
+
+ if (len > fifo_size)
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 076afaf190926056d6ba03d6a607cfdc2656d8b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 18:18:01 +0100
+Subject: spi: spi-mem: Limit octal DTR constraints to octal DTR situations
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9 ]
+
+In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is
+considered requiring a duplicated command opcode. This is wrong as this
+constraint only applies to octal DTR operations (8D-8D-8D).
+
+Narrow the application of this constraint to the concerned bus
+interface.
+
+Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2,
+4} would benefit from this check either as there is only in octal DTR
+mode that a single clock edge would be enough to transmit the full
+opcode.
+
+Make sure the constraint of expecting two bytes for the command is
+applied to the relevant bus interface.
+
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index c8b2add2640e5..6c7921469b90b 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -178,8 +178,19 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,
+ if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16))
+ return false;
+
+- if (op->cmd.nbytes != 2)
+- return false;
++ /* Extra 8D-8D-8D limitations */
++ if (op->cmd.dtr && op->cmd.buswidth == 8) {
++ if (op->cmd.nbytes != 2)
++ return false;
++
++ if ((op->addr.nbytes % 2) ||
++ (op->dummy.nbytes % 2) ||
++ (op->data.nbytes % 2)) {
++ dev_err(&ctlr->dev,
++ "Even byte numbers not allowed in octal DTR operations\n");
++ return false;
++ }
++ }
+ } else {
+ if (op->cmd.nbytes != 1)
+ return false;
+--
+2.51.0
+
--- /dev/null
+From 895188452336c38759dfc7e2649801d79bb4a048 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 20:30:04 +0800
+Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
+
+From: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+
+[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ]
+
+spi_mem_dirmap_create() may reconfigure controller-wide settings,
+which can interfere with concurrent transfers to other devices
+sharing the same SPI controller but using different chip selects.
+
+Wrap the ->dirmap_create() callback with spi_mem_access_start() and
+spi_mem_access_end() to serialize access and prevent cross-CS
+interference during dirmap creation.
+
+This patch has been verified on a setup where a SPI TPM is connected
+to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1
+of the same controller. Without this patch, spi_mem_dirmap_create()
+for the SPI NOR flash interferes with ongoing SPI TPM data transfers,
+resulting in failure to create the TPM device. This was tested on an
+ASPEED AST2700 EVB.
+
+Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 6c7921469b90b..965673bac98b9 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -719,9 +719,18 @@ spi_mem_dirmap_create(struct spi_mem *mem,
+
+ desc->mem = mem;
+ desc->info = *info;
+- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create)
++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) {
++ ret = spi_mem_access_start(mem);
++ if (ret) {
++ kfree(desc);
++ return ERR_PTR(ret);
++ }
++
+ ret = ctlr->mem_ops->dirmap_create(desc);
+
++ spi_mem_access_end(mem);
++ }
++
+ if (ret) {
+ desc->nodirmap = true;
+ if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
+--
+2.51.0
+
--- /dev/null
+From f956100ff9602ce204484ebed59acff55b002426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 08:26:16 +0100
+Subject: spi: spidev: fix lock inversion between spi_lock and buf_lock
+
+From: Fabian Godehardt <fg@emlix.com>
+
+[ Upstream commit 40534d19ed2afb880ecf202dab26a8e7a5808d16 ]
+
+The spidev driver previously used two mutexes, spi_lock and buf_lock,
+but acquired them in different orders depending on the code path:
+
+ write()/read(): buf_lock -> spi_lock
+ ioctl(): spi_lock -> buf_lock
+
+This AB-BA locking pattern triggers lockdep warnings and can
+cause real deadlocks:
+
+ WARNING: possible circular locking dependency detected
+ spidev_ioctl() -> mutex_lock(&spidev->buf_lock)
+ spidev_sync_write() -> mutex_lock(&spidev->spi_lock)
+ *** DEADLOCK ***
+
+The issue is reproducible with a simple userspace program that
+performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from
+separate threads on the same spidev file descriptor.
+
+Fix this by simplifying the locking model and removing the lock
+inversion entirely. spidev_sync() no longer performs any locking,
+and all callers serialize access using spi_lock.
+
+buf_lock is removed since its functionality is fully covered by
+spi_lock, eliminating the possibility of lock ordering issues.
+
+This removes the lock inversion and prevents deadlocks without
+changing userspace ABI or behaviour.
+
+Signed-off-by: Fabian Godehardt <fg@emlix.com>
+Link: https://patch.msgid.link/20260211072616.489522-1-fg@emlix.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spidev.c | 63 ++++++++++++++++----------------------------
+ 1 file changed, 22 insertions(+), 41 deletions(-)
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 9a0160f6dc3dc..f28528ed1c24e 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -74,7 +74,6 @@ struct spidev_data {
+ struct list_head device_entry;
+
+ /* TX/RX buffers are NULL unless this device is open (users > 0) */
+- struct mutex buf_lock;
+ unsigned users;
+ u8 *tx_buffer;
+ u8 *rx_buffer;
+@@ -102,24 +101,6 @@ spidev_sync_unlocked(struct spi_device *spi, struct spi_message *message)
+ return status;
+ }
+
+-static ssize_t
+-spidev_sync(struct spidev_data *spidev, struct spi_message *message)
+-{
+- ssize_t status;
+- struct spi_device *spi;
+-
+- mutex_lock(&spidev->spi_lock);
+- spi = spidev->spi;
+-
+- if (spi == NULL)
+- status = -ESHUTDOWN;
+- else
+- status = spidev_sync_unlocked(spi, message);
+-
+- mutex_unlock(&spidev->spi_lock);
+- return status;
+-}
+-
+ static inline ssize_t
+ spidev_sync_write(struct spidev_data *spidev, size_t len)
+ {
+@@ -132,7 +113,8 @@ spidev_sync_write(struct spidev_data *spidev, size_t len)
+
+ spi_message_init(&m);
+ spi_message_add_tail(&t, &m);
+- return spidev_sync(spidev, &m);
++
++ return spidev_sync_unlocked(spidev->spi, &m);
+ }
+
+ static inline ssize_t
+@@ -147,7 +129,8 @@ spidev_sync_read(struct spidev_data *spidev, size_t len)
+
+ spi_message_init(&m);
+ spi_message_add_tail(&t, &m);
+- return spidev_sync(spidev, &m);
++
++ return spidev_sync_unlocked(spidev->spi, &m);
+ }
+
+ /*-------------------------------------------------------------------------*/
+@@ -157,7 +140,7 @@ static ssize_t
+ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
+ {
+ struct spidev_data *spidev;
+- ssize_t status;
++ ssize_t status = -ESHUTDOWN;
+
+ /* chipselect only toggles at start or end of operation */
+ if (count > bufsiz)
+@@ -165,7 +148,11 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
+
+ spidev = filp->private_data;
+
+- mutex_lock(&spidev->buf_lock);
++ mutex_lock(&spidev->spi_lock);
++
++ if (spidev->spi == NULL)
++ goto err_spi_removed;
++
+ status = spidev_sync_read(spidev, count);
+ if (status > 0) {
+ unsigned long missing;
+@@ -176,7 +163,9 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
+ else
+ status = status - missing;
+ }
+- mutex_unlock(&spidev->buf_lock);
++
++err_spi_removed:
++ mutex_unlock(&spidev->spi_lock);
+
+ return status;
+ }
+@@ -187,7 +176,7 @@ spidev_write(struct file *filp, const char __user *buf,
+ size_t count, loff_t *f_pos)
+ {
+ struct spidev_data *spidev;
+- ssize_t status;
++ ssize_t status = -ESHUTDOWN;
+ unsigned long missing;
+
+ /* chipselect only toggles at start or end of operation */
+@@ -196,13 +185,19 @@ spidev_write(struct file *filp, const char __user *buf,
+
+ spidev = filp->private_data;
+
+- mutex_lock(&spidev->buf_lock);
++ mutex_lock(&spidev->spi_lock);
++
++ if (spidev->spi == NULL)
++ goto err_spi_removed;
++
+ missing = copy_from_user(spidev->tx_buffer, buf, count);
+ if (missing == 0)
+ status = spidev_sync_write(spidev, count);
+ else
+ status = -EFAULT;
+- mutex_unlock(&spidev->buf_lock);
++
++err_spi_removed:
++ mutex_unlock(&spidev->spi_lock);
+
+ return status;
+ }
+@@ -379,14 +374,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+
+ ctlr = spi->controller;
+
+- /* use the buffer lock here for triple duty:
+- * - prevent I/O (from us) so calling spi_setup() is safe;
+- * - prevent concurrent SPI_IOC_WR_* from morphing
+- * data fields while SPI_IOC_RD_* reads them;
+- * - SPI_IOC_MESSAGE needs the buffer locked "normally".
+- */
+- mutex_lock(&spidev->buf_lock);
+-
+ switch (cmd) {
+ /* read requests */
+ case SPI_IOC_RD_MODE:
+@@ -510,7 +497,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ break;
+ }
+
+- mutex_unlock(&spidev->buf_lock);
+ spi_dev_put(spi);
+ mutex_unlock(&spidev->spi_lock);
+ return retval;
+@@ -541,9 +527,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
+ return -ESHUTDOWN;
+ }
+
+- /* SPI_IOC_MESSAGE needs the buffer locked "normally" */
+- mutex_lock(&spidev->buf_lock);
+-
+ /* Check message and copy into scratch area */
+ ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc);
+ if (IS_ERR(ioc)) {
+@@ -564,7 +547,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
+ kfree(ioc);
+
+ done:
+- mutex_unlock(&spidev->buf_lock);
+ spi_dev_put(spi);
+ mutex_unlock(&spidev->spi_lock);
+ return retval;
+@@ -802,7 +784,6 @@ static int spidev_probe(struct spi_device *spi)
+ /* Initialize the driver data */
+ spidev->spi = spi;
+ mutex_init(&spidev->spi_lock);
+- mutex_init(&spidev->buf_lock);
+
+ INIT_LIST_HEAD(&spidev->device_entry);
+
+--
+2.51.0
+
--- /dev/null
+From 742618093b1c99bcb62ca781a841a8c5d6bf4f62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 11:48:28 +0100
+Subject: spi: stm32: fix Overrun issue at < 8bpw
+
+From: Deepak Kumar <deepak.kumar01@st.com>
+
+[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ]
+
+When SPI communication is suspended by hardware automatically, it could
+happen that few bits of next frame are already clocked out due to
+internal synchronization delay.
+
+To achieve a safe suspension, we need to ensure that each word must be
+at least 8 SPI clock cycles long. That's why, if bpw is less than 8
+bits, we need to use midi to reach 8 SPI clock cycles at least.
+
+This will ensure that each word achieve safe suspension and prevent
+overrun condition.
+
+Signed-off-by: Deepak Kumar <deepak.kumar01@st.com>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 2c804c1aef989..80986bd251d29 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1906,11 +1906,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, struct spi_transfer
+ cfg2_clrb |= STM32H7_SPI_CFG2_MIDI;
+ if ((len > 1) && (spi->cur_midi > 0)) {
+ u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed);
+- u32 midi = min_t(u32,
+- DIV_ROUND_UP(spi->cur_midi, sck_period_ns),
+- FIELD_GET(STM32H7_SPI_CFG2_MIDI,
+- STM32H7_SPI_CFG2_MIDI));
++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns);
+
++ if ((spi->cur_bpw + midi) < 8)
++ midi = 8 - spi->cur_bpw;
++
++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI));
+
+ dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n",
+ sck_period_ns, midi, midi * sck_period_ns);
+--
+2.51.0
+
--- /dev/null
+From 4b4577ee1e6b6ccf0ae5706453a411d2aed04771 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:47:12 +0530
+Subject: staging: rtl8723bs: fix memory leak on failure path
+
+From: Diksha Kumari <dikshakdevgan@gmail.com>
+
+[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ]
+
+cfg80211_inform_bss_frame() may return NULL on failure. In that case,
+the allocated buffer 'buf' is not freed and the function returns early,
+leading to potential memory leak.
+Fix this by ensuring that 'buf' is freed on both success and failure paths.
+
+Signed-off-by: Diksha Kumari <dikshakdevgan@gmail.com>
+Reviewed-by: Mukesh Kumar Chaurasiya <mkchauras@linux.ibm.com>
+Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+index 60edeae1cffe7..476ab055e53e5 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -315,9 +315,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl
+ len, notify_signal, GFP_ATOMIC);
+
+ if (unlikely(!bss))
+- goto exit;
++ goto free_buf;
+
+ cfg80211_put_bss(wiphy, bss);
++free_buf:
+ kfree(buf);
+
+ exit:
+--
+2.51.0
+
--- /dev/null
+From 2cf2f6df9a01a50df6f5de21635b109b31a3d7d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:27:28 +0800
+Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq()
+ failure
+
+From: Liang Jie <liangjie@lixiang.com>
+
+[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ]
+
+The return value of sdio_alloc_irq() was not stored in status.
+If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds,
+status remains _SUCCESS and the error path skips resource cleanup,
+while rtw_drv_init() still returns success.
+
+Store the return value of sdio_alloc_irq() in status and reuse the
+existing error handling which relies on status.
+
+Reviewed-by: fanggeng <fanggeng@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+index 1d0239eef114b..dc787954126fd 100644
+--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+@@ -377,7 +377,8 @@ static int rtw_drv_init(
+ if (status != _SUCCESS)
+ goto free_if1;
+
+- if (sdio_alloc_irq(dvobj) != _SUCCESS)
++ status = sdio_alloc_irq(dvobj);
++ if (status != _SUCCESS)
+ goto free_if1;
+
+ status = _SUCCESS;
+--
+2.51.0
+
--- /dev/null
+From f30b4cbfb94e82c2ad9335bd366e1a6656fd0b1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Nov 2025 14:41:20 +0530
+Subject: statmount: permission check should return EPERM
+
+From: Bhavik Sachdev <b.sachdev1904@gmail.com>
+
+[ Upstream commit fccbe38a5d06dbe44bcd89196fe1d2c2272a1f4a ]
+
+Currently, statmount() returns ENOENT when caller is not CAP_SYS_ADMIN
+in the user namespace owner of target mount namespace. This should be
+EPERM instead.
+
+Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
+Signed-off-by: Bhavik Sachdev <b.sachdev1904@gmail.com>
+Link: https://patch.msgid.link/20251129091455.757724-2-b.sachdev1904@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index c58674a20cad5..f6879f282daec 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -5780,7 +5780,7 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,
+
+ if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) &&
+ !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
+- return -ENOENT;
++ return -EPERM;
+
+ ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT);
+ if (!ks)
+--
+2.51.0
+
--- /dev/null
+From 5fe5dfc744c4981dac07c37c0388bc38d11f24d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 08:23:15 +0000
+Subject: thermal: int340x: Fix sysfs group leak on DLVR registration failure
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ]
+
+When DLVR sysfs group creation fails in proc_thermal_rfim_add(),
+the function returns immediately without cleaning up the FIVR group
+that may have been created earlier.
+
+Add proper error unwinding to remove the FIVR group before returning
+failure.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../thermal/intel/int340x_thermal/processor_thermal_rfim.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+index 589a3a71f0c4c..ba88d878c998d 100644
+--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+@@ -466,8 +466,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc
+ break;
+ }
+ ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group);
+- if (ret)
++ if (ret) {
++ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR)
++ sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group);
+ return ret;
++ }
+ }
+
+ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) {
+--
+2.51.0
+
--- /dev/null
+From d173aee241b3eabe19104ca44b6788177aebfadf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Nov 2025 14:46:13 +0530
+Subject: tools/cpupower: Fix inverted APERF capability check
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 24858a84163c8d04827166b3bcaed80612bb62fc ]
+
+The capability check was inverted, causing the function to return
+error when APERF support is available and proceed when it is not.
+
+Negate the condition to return error only when APERF capability
+is absent.
+
+Link: https://lore.kernel.org/r/20251126091613.567480-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/utils/cpufreq-info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c
+index 7d3732f5f2f6f..5fe01e516817e 100644
+--- a/tools/power/cpupower/utils/cpufreq-info.c
++++ b/tools/power/cpupower/utils/cpufreq-info.c
+@@ -270,7 +270,7 @@ static int get_freq_hardware(unsigned int cpu, unsigned int human)
+ {
+ unsigned long freq;
+
+- if (cpupower_cpu_info.caps & CPUPOWER_CAP_APERF)
++ if (!(cpupower_cpu_info.caps & CPUPOWER_CAP_APERF))
+ return -EINVAL;
+
+ freq = cpufreq_get_freq_hardware(cpu);
+--
+2.51.0
+
--- /dev/null
+From e9d143f7b30681841774ce0ace453d2d2bc688bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 09:43:24 +0000
+Subject: tools headers: Go back to include asm-generic/unistd.h for arm64
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 096b86ce08332fbcb0ec6ff6714c44899ec03970 ]
+
+The header unistd.h is included under Arm64's uAPI folder (see
+tools/arch/arm64/include/uapi/asm/), but it does not include its
+dependent header unistd_64.h.
+
+The intention is for unistd_64.h to be generated dynamically using
+scripts/Makefile.asm-headers.
+
+However, this dynamic approach causes problems because the header is not
+available early enough, even though it is widely included throughout
+tools.
+
+Using the perf build as an example:
+
+ 1) Feature detection: Perf first runs feature tests.
+
+ The BPF feature program test-bpf.c includes unistd.h. Since
+ unistd_64.h has not been generated yet, the program fails to build,
+ and the BPF feature ends up being disabled.
+
+ 2) libperf build:
+
+ The libperf Makefile later generates unistd_64.h on the fly, so
+ libperf itself builds successfully.
+
+ 3) Final perf build:
+
+ Although the perf binary can build successfully using the generated
+ header, we never get a chance to build BPF skeleton programs,
+ because BPF support was already disabled earlier.
+
+Restore to include asm-generic/unistd.h for fixing the issue. This
+aligns with most architectures (x86 is a special case that keeps
+unistd_32.h/unistd_64.h for its particular syscall numbers) and ensures
+the header is available from the start.
+
+Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/arch/arm64/include/uapi/asm/unistd.h | 24 +++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/tools/arch/arm64/include/uapi/asm/unistd.h b/tools/arch/arm64/include/uapi/asm/unistd.h
+index df36f23876e86..9306726337fe0 100644
+--- a/tools/arch/arm64/include/uapi/asm/unistd.h
++++ b/tools/arch/arm64/include/uapi/asm/unistd.h
+@@ -1,2 +1,24 @@
+ /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+-#include <asm/unistd_64.h>
++/*
++ * Copyright (C) 2012 ARM Ltd.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program. If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#define __ARCH_WANT_RENAMEAT
++#define __ARCH_WANT_NEW_STAT
++#define __ARCH_WANT_SET_GET_RLIMIT
++#define __ARCH_WANT_TIME32_SYSCALLS
++#define __ARCH_WANT_MEMFD_SECRET
++
++#include <asm-generic/unistd.h>
+--
+2.51.0
+
--- /dev/null
+From 6cda2be8c213c1773030a8c8e37a06ab0b86613f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:47:45 +0530
+Subject: tools/power cpupower: Reset errno before strtoull()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ]
+
+cpuidle_state_get_one_value() never cleared errno before calling
+strtoull(), so a prior ERANGE caused every cpuidle counter read to
+return zero. Reset errno to 0 before the conversion so each sysfs read
+is evaluated independently.
+
+Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index f2c1139adf716..bd857ee7541a7 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -150,6 +150,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu,
+ if (len == 0)
+ return 0;
+
++ errno = 0;
+ value = strtoull(linebuf, &endp, 0);
+
+ if (endp == linebuf || errno == ERANGE)
+--
+2.51.0
+
--- /dev/null
+From 363b25f746026f8ae7aae915f535bb113870fad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 23:48:10 -0800
+Subject: tracing: Fix false sharing in hwlat get_sample()
+
+From: Colin Lord <clord@mykolab.com>
+
+[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ]
+
+The get_sample() function in the hwlat tracer assumes the caller holds
+hwlat_data.lock, but this is not actually happening. The result is
+unprotected data access to hwlat_data, and in per-cpu mode can result in
+false sharing which may show up as false positive latency events.
+
+The specific case of false sharing observed was primarily between
+hwlat_data.sample_width and hwlat_data.count. These are separated by
+just 8B and are therefore likely to share a cache line. When one thread
+modifies count, the cache line is in a modified state so when other
+threads read sample_width in the main latency detection loop, they fetch
+the modified cache line. On some systems, the fetch itself may be slow
+enough to count as a latency event, which could set up a self
+reinforcing cycle of latency events as each event increments count which
+then causes more latency events, continuing the cycle.
+
+The other result of the unprotected data access is that hwlat_data.count
+can end up with duplicate or missed values, which was observed on some
+systems in testing.
+
+Convert hwlat_data.count to atomic64_t so it can be safely modified
+without locking, and prevent false sharing by pulling sample_width into
+a local variable.
+
+One system this was tested on was a dual socket server with 32 CPUs on
+each numa node. With settings of 1us threshold, 1000us width, and
+2000us window, this change reduced the number of latency events from
+500 per second down to approximately 1 event per minute. Some machines
+tested did not exhibit measurable latency from the false sharing.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com
+Signed-off-by: Colin Lord <clord@mykolab.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_hwlat.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
+index 2f7b94e98317c..3fe274b84f1c2 100644
+--- a/kernel/trace/trace_hwlat.c
++++ b/kernel/trace/trace_hwlat.c
+@@ -102,9 +102,9 @@ struct hwlat_sample {
+ /* keep the global state somewhere. */
+ static struct hwlat_data {
+
+- struct mutex lock; /* protect changes */
++ struct mutex lock; /* protect changes */
+
+- u64 count; /* total since reset */
++ atomic64_t count; /* total since reset */
+
+ u64 sample_window; /* total sampling window (on+off) */
+ u64 sample_width; /* active sampling portion of window */
+@@ -193,8 +193,7 @@ void trace_hwlat_callback(bool enter)
+ * get_sample - sample the CPU TSC and look for likely hardware latencies
+ *
+ * Used to repeatedly capture the CPU TSC (or similar), looking for potential
+- * hardware-induced latency. Called with interrupts disabled and with
+- * hwlat_data.lock held.
++ * hardware-induced latency. Called with interrupts disabled.
+ */
+ static int get_sample(void)
+ {
+@@ -204,6 +203,7 @@ static int get_sample(void)
+ time_type start, t1, t2, last_t2;
+ s64 diff, outer_diff, total, last_total = 0;
+ u64 sample = 0;
++ u64 sample_width = READ_ONCE(hwlat_data.sample_width);
+ u64 thresh = tracing_thresh;
+ u64 outer_sample = 0;
+ int ret = -1;
+@@ -267,7 +267,7 @@ static int get_sample(void)
+ if (diff > sample)
+ sample = diff; /* only want highest value */
+
+- } while (total <= hwlat_data.sample_width);
++ } while (total <= sample_width);
+
+ barrier(); /* finish the above in the view for NMIs */
+ trace_hwlat_callback_enabled = false;
+@@ -285,8 +285,7 @@ static int get_sample(void)
+ if (kdata->nmi_total_ts)
+ do_div(kdata->nmi_total_ts, NSEC_PER_USEC);
+
+- hwlat_data.count++;
+- s.seqnum = hwlat_data.count;
++ s.seqnum = atomic64_inc_return(&hwlat_data.count);
+ s.duration = sample;
+ s.outer_duration = outer_sample;
+ s.nmi_total_ts = kdata->nmi_total_ts;
+@@ -832,7 +831,7 @@ static int hwlat_tracer_init(struct trace_array *tr)
+
+ hwlat_trace = tr;
+
+- hwlat_data.count = 0;
++ atomic64_set(&hwlat_data.count, 0);
+ tr->max_latency = 0;
+ save_tracing_thresh = tracing_thresh;
+
+--
+2.51.0
+
--- /dev/null
+From aac177594ad7c67f178c93aa67c54fe97d6afddd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 15:54:37 -0700
+Subject: tty: vt/keyboard: Split apart vt_do_diacrit()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 0a76a17238f805b231d97b118232a5185bbb7a18 ]
+
+After commit bfb24564b5fd ("tty: vt/keyboard: use __free()"), builds
+using asm goto for put_user() and get_user() with a version of clang
+older than 17 error with:
+
+ drivers/tty/vt/keyboard.c:1709:7: error: cannot jump from this asm goto statement to one of its possible targets
+ if (put_user(asize, &a->kb_cnt))
+ ^
+ ...
+ arch/arm64/include/asm/uaccess.h:298:2: note: expanded from macro '__put_mem_asm'
+ asm goto( \
+ ^
+ drivers/tty/vt/keyboard.c:1687:7: note: possible target of asm goto statement
+ if (put_user(asize, &a->kb_cnt))
+ ^
+ ...
+ arch/arm64/include/asm/uaccess.h:342:2: note: expanded from macro '__raw_put_user'
+ __rpu_failed: \
+ ^
+ drivers/tty/vt/keyboard.c:1697:23: note: jump exits scope of variable with __attribute__((cleanup))
+ void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc),
+ ^
+ drivers/tty/vt/keyboard.c:1671:33: note: jump bypasses initialization of variable with __attribute__((cleanup))
+ struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr),
+ ^
+
+Prior to a fix to clang's scope checker in clang 17 [1], all labels in a
+function were validated as potential targets of all asm gotos in a
+function, regardless of whether they actually were a target of an asm
+goto call, resulting in false positive errors about skipping over
+variables marked with the cleanup attribute.
+
+To workaround this error, split up the bodies of the case statements in
+vt_do_diacrit() into their own functions so that the scope checker does
+not trip up on the multiple instances of __free().
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202509091702.Oc7eCRDw-lkp@intel.com/
+Closes: https://lore.kernel.org/oe-kbuild-all/202511241835.EA8lShgH-lkp@intel.com/
+Link: https://github.com/llvm/llvm-project/commit/f023f5cdb2e6c19026f04a15b5a935c041835d14 [1]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://patch.msgid.link/20251125-tty-vt-keyboard-wa-clang-scope-check-error-v1-1-f5a5ea55c578@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/keyboard.c | 221 ++++++++++++++++++++------------------
+ 1 file changed, 115 insertions(+), 106 deletions(-)
+
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index d65fc60dd7bed..3538d54d6a6ac 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -1649,134 +1649,143 @@ int __init kbd_init(void)
+
+ /* Ioctl support code */
+
+-/**
+- * vt_do_diacrit - diacritical table updates
+- * @cmd: ioctl request
+- * @udp: pointer to user data for ioctl
+- * @perm: permissions check computed by caller
+- *
+- * Update the diacritical tables atomically and safely. Lock them
+- * against simultaneous keypresses
+- */
+-int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm)
++static int vt_do_kdgkbdiacr(void __user *udp)
+ {
+- int asize;
+-
+- switch (cmd) {
+- case KDGKBDIACR:
+- {
+- struct kbdiacrs __user *a = udp;
+- int i;
++ struct kbdiacrs __user *a = udp;
++ int i, asize;
+
+- struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr),
+- GFP_KERNEL);
+- if (!dia)
+- return -ENOMEM;
++ struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr),
++ GFP_KERNEL);
++ if (!dia)
++ return -ENOMEM;
+
+- /* Lock the diacriticals table, make a copy and then
+- copy it after we unlock */
+- scoped_guard(spinlock_irqsave, &kbd_event_lock) {
+- asize = accent_table_size;
+- for (i = 0; i < asize; i++) {
+- dia[i].diacr = conv_uni_to_8bit(accent_table[i].diacr);
+- dia[i].base = conv_uni_to_8bit(accent_table[i].base);
+- dia[i].result = conv_uni_to_8bit(accent_table[i].result);
+- }
++ /* Lock the diacriticals table, make a copy and then
++ copy it after we unlock */
++ scoped_guard(spinlock_irqsave, &kbd_event_lock) {
++ asize = accent_table_size;
++ for (i = 0; i < asize; i++) {
++ dia[i].diacr = conv_uni_to_8bit(accent_table[i].diacr);
++ dia[i].base = conv_uni_to_8bit(accent_table[i].base);
++ dia[i].result = conv_uni_to_8bit(accent_table[i].result);
+ }
+-
+- if (put_user(asize, &a->kb_cnt))
+- return -EFAULT;
+- if (copy_to_user(a->kbdiacr, dia, asize * sizeof(struct kbdiacr)))
+- return -EFAULT;
+- return 0;
+ }
+- case KDGKBDIACRUC:
+- {
+- struct kbdiacrsuc __user *a = udp;
+
+- void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc),
+- GFP_KERNEL);
+- if (buf == NULL)
+- return -ENOMEM;
++ if (put_user(asize, &a->kb_cnt))
++ return -EFAULT;
++ if (copy_to_user(a->kbdiacr, dia, asize * sizeof(struct kbdiacr)))
++ return -EFAULT;
++ return 0;
++}
+
+- /* Lock the diacriticals table, make a copy and then
+- copy it after we unlock */
+- scoped_guard(spinlock_irqsave, &kbd_event_lock) {
+- asize = accent_table_size;
+- memcpy(buf, accent_table, asize * sizeof(struct kbdiacruc));
+- }
++static int vt_do_kdgkbdiacruc(void __user *udp)
++{
++ struct kbdiacrsuc __user *a = udp;
++ int asize;
+
+- if (put_user(asize, &a->kb_cnt))
+- return -EFAULT;
+- if (copy_to_user(a->kbdiacruc, buf, asize * sizeof(struct kbdiacruc)))
+- return -EFAULT;
++ void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc),
++ GFP_KERNEL);
++ if (buf == NULL)
++ return -ENOMEM;
+
+- return 0;
++ /* Lock the diacriticals table, make a copy and then
++ copy it after we unlock */
++ scoped_guard(spinlock_irqsave, &kbd_event_lock) {
++ asize = accent_table_size;
++ memcpy(buf, accent_table, asize * sizeof(struct kbdiacruc));
+ }
+
+- case KDSKBDIACR:
+- {
+- struct kbdiacrs __user *a = udp;
+- struct kbdiacr __free(kfree) *dia = NULL;
+- unsigned int ct;
+- int i;
++ if (put_user(asize, &a->kb_cnt))
++ return -EFAULT;
++ if (copy_to_user(a->kbdiacruc, buf, asize * sizeof(struct kbdiacruc)))
++ return -EFAULT;
+
+- if (!perm)
+- return -EPERM;
+- if (get_user(ct, &a->kb_cnt))
+- return -EFAULT;
+- if (ct >= MAX_DIACR)
+- return -EINVAL;
++ return 0;
++}
+
+- if (ct) {
+- dia = memdup_array_user(a->kbdiacr,
+- ct, sizeof(struct kbdiacr));
+- if (IS_ERR(dia))
+- return PTR_ERR(dia);
+- }
++static int vt_do_kdskbdiacr(void __user *udp, int perm)
++{
++ struct kbdiacrs __user *a = udp;
++ struct kbdiacr __free(kfree) *dia = NULL;
++ unsigned int ct;
++ int i;
+
+- guard(spinlock_irqsave)(&kbd_event_lock);
+- accent_table_size = ct;
+- for (i = 0; i < ct; i++) {
+- accent_table[i].diacr =
+- conv_8bit_to_uni(dia[i].diacr);
+- accent_table[i].base =
+- conv_8bit_to_uni(dia[i].base);
+- accent_table[i].result =
+- conv_8bit_to_uni(dia[i].result);
+- }
++ if (!perm)
++ return -EPERM;
++ if (get_user(ct, &a->kb_cnt))
++ return -EFAULT;
++ if (ct >= MAX_DIACR)
++ return -EINVAL;
+
+- return 0;
++ if (ct) {
++ dia = memdup_array_user(a->kbdiacr,
++ ct, sizeof(struct kbdiacr));
++ if (IS_ERR(dia))
++ return PTR_ERR(dia);
+ }
+
+- case KDSKBDIACRUC:
+- {
+- struct kbdiacrsuc __user *a = udp;
+- unsigned int ct;
+- void __free(kfree) *buf = NULL;
++ guard(spinlock_irqsave)(&kbd_event_lock);
++ accent_table_size = ct;
++ for (i = 0; i < ct; i++) {
++ accent_table[i].diacr =
++ conv_8bit_to_uni(dia[i].diacr);
++ accent_table[i].base =
++ conv_8bit_to_uni(dia[i].base);
++ accent_table[i].result =
++ conv_8bit_to_uni(dia[i].result);
++ }
+
+- if (!perm)
+- return -EPERM;
++ return 0;
++}
+
+- if (get_user(ct, &a->kb_cnt))
+- return -EFAULT;
++static int vt_do_kdskbdiacruc(void __user *udp, int perm)
++{
++ struct kbdiacrsuc __user *a = udp;
++ unsigned int ct;
++ void __free(kfree) *buf = NULL;
+
+- if (ct >= MAX_DIACR)
+- return -EINVAL;
++ if (!perm)
++ return -EPERM;
+
+- if (ct) {
+- buf = memdup_array_user(a->kbdiacruc,
+- ct, sizeof(struct kbdiacruc));
+- if (IS_ERR(buf))
+- return PTR_ERR(buf);
+- }
+- guard(spinlock_irqsave)(&kbd_event_lock);
+- if (ct)
+- memcpy(accent_table, buf,
+- ct * sizeof(struct kbdiacruc));
+- accent_table_size = ct;
+- return 0;
++ if (get_user(ct, &a->kb_cnt))
++ return -EFAULT;
++
++ if (ct >= MAX_DIACR)
++ return -EINVAL;
++
++ if (ct) {
++ buf = memdup_array_user(a->kbdiacruc,
++ ct, sizeof(struct kbdiacruc));
++ if (IS_ERR(buf))
++ return PTR_ERR(buf);
+ }
++ guard(spinlock_irqsave)(&kbd_event_lock);
++ if (ct)
++ memcpy(accent_table, buf,
++ ct * sizeof(struct kbdiacruc));
++ accent_table_size = ct;
++ return 0;
++}
++
++/**
++ * vt_do_diacrit - diacritical table updates
++ * @cmd: ioctl request
++ * @udp: pointer to user data for ioctl
++ * @perm: permissions check computed by caller
++ *
++ * Update the diacritical tables atomically and safely. Lock them
++ * against simultaneous keypresses
++ */
++int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm)
++{
++ switch (cmd) {
++ case KDGKBDIACR:
++ return vt_do_kdgkbdiacr(udp);
++ case KDGKBDIACRUC:
++ return vt_do_kdgkbdiacruc(udp);
++ case KDSKBDIACR:
++ return vt_do_kdskbdiacr(udp, perm);
++ case KDSKBDIACRUC:
++ return vt_do_kdskbdiacruc(udp, perm);
+ }
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 61e9f63afb901460ef15e4f0d95400c07dc45152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 08:12:27 +0800
+Subject: um: Preserve errno within signal handler
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit f68b2d5a907b53eed99cf2efcaaae116df73c298 ]
+
+We rely on errno to determine whether a syscall has failed, so we
+need to ensure that accessing errno is async-signal-safe. Currently,
+we preserve the errno in sig_handler_common(), but it doesn't cover
+every possible case. Let's do it in hard_handler() instead, which
+is the signal handler we actually register.
+
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Link: https://patch.msgid.link/20260106001228.1531146-2-tiwei.btw@antgroup.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/signal.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
+index 327fb3c52fc79..de372b936a804 100644
+--- a/arch/um/os-Linux/signal.c
++++ b/arch/um/os-Linux/signal.c
+@@ -36,7 +36,6 @@ void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *, void *mc) =
+ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc)
+ {
+ struct uml_pt_regs r;
+- int save_errno = errno;
+
+ r.is_user = 0;
+ if (sig == SIGSEGV) {
+@@ -50,8 +49,6 @@ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc)
+ unblock_signals_trace();
+
+ (*sig_info[sig])(sig, si, &r, mc);
+-
+- errno = save_errno;
+ }
+
+ /*
+@@ -207,8 +204,11 @@ static void hard_handler(int sig, siginfo_t *si, void *p)
+ {
+ ucontext_t *uc = p;
+ mcontext_t *mc = &uc->uc_mcontext;
++ int save_errno = errno;
+
+ (*handlers[sig])(sig, (struct siginfo *)si, mc);
++
++ errno = save_errno;
+ }
+
+ void set_handler(int sig)
+--
+2.51.0
+
--- /dev/null
+From 9e7e005e0b234a1fe0bfedf7c8a4fe0045466e7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 16:59:02 +0000
+Subject: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
+
+From: Mario Peter <mario.peter@leica-geosystems.com>
+
+[ Upstream commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123 ]
+
+The ChipIdea UDC driver can encounter "not page aligned sg buffer"
+errors when a USB device is reconnected after being disconnected
+during an active transfer. This occurs because _ep_nuke() returns
+requests to the gadget layer without properly unmapping DMA buffers
+or cleaning up scatter-gather bounce buffers.
+
+Root cause:
+When a disconnect happens during a multi-segment DMA transfer, the
+request's num_mapped_sgs field and sgt.sgl pointer remain set with
+stale values. The request is returned to the gadget driver with status
+-ESHUTDOWN but still has active DMA state. If the gadget driver reuses
+this request on reconnect without reinitializing it, the stale DMA
+state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero
+num_mapped_sgs) and attempt to use freed/invalid DMA addresses,
+leading to alignment errors and potential memory corruption.
+
+The normal completion path via _hardware_dequeue() properly calls
+usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before
+returning the request. The _ep_nuke() path must do the same cleanup
+to ensure requests are returned in a clean, reusable state.
+
+Fix:
+Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror
+the cleanup sequence in _hardware_dequeue():
+- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set
+- Call sglist_do_debounce() with copy=false if bounce buffer exists
+
+This ensures that when requests are returned due to endpoint shutdown,
+they don't retain stale DMA mappings. The 'false' parameter to
+sglist_do_debounce() prevents copying data back (appropriate for
+shutdown path where transfer was aborted).
+
+Signed-off-by: Mario Peter <mario.peter@leica-geosystems.com>
+Reviewed-by: Xu Yang <xu.yang_2@nxp.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/udc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 64a421ae0f05b..c8d931d9d4330 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -931,6 +931,13 @@ __acquires(hwep->lock)
+ list_del_init(&hwreq->queue);
+ hwreq->req.status = -ESHUTDOWN;
+
++ /* Unmap DMA and clean up bounce buffers before giving back */
++ usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent,
++ &hwreq->req, hwep->dir);
++
++ if (hwreq->sgt.sgl)
++ sglist_do_debounce(hwreq, false);
++
+ if (hwreq->req.complete != NULL) {
+ spin_unlock(hwep->lock);
+ usb_gadget_giveback_request(&hwep->ep, &hwreq->req);
+--
+2.51.0
+
--- /dev/null
+From e83c746b9747f024fc9e8efdd955e7d72c88d34b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 08:30:21 +1000
+Subject: usb: gadget: f_fs: fix DMA-BUF OUT queues
+
+From: Sam Day <me@samcday.com>
+
+[ Upstream commit 0145e7acd29855dfba4a2f387d455b5d9a520f0e ]
+
+Currently, DMA_FROM_DEVICE is used when attaching DMABUFs to IN
+endpoints and DMA_TO_DEVICE for OUT endpoints. This is inverted from
+how it should be.
+
+The result is IOMMU read-only mappings placed on OUT queues,
+triggering arm-smmu write faults.
+
+Put differently, OUT endpoints flow data from host -> gadget, meaning
+the UDC peripheral needs to have write access to the buffer to fill it
+with the incoming data.
+
+This commit flips the directions and updates the implicit-sync helpers
+so IN endpoints act as readers and OUT endpoints as writers.
+
+Signed-off-by: Sam Day <me@samcday.com>
+Tested-by: David Heidelberg <david@ixit.cz> # OnePlus 6T on sdm845-next-20251119
+Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-2-e51633891a81@samcday.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index fa467a40949d2..928f51fddc64e 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1509,7 +1509,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd)
+ goto err_dmabuf_detach;
+ }
+
+- dir = epfile->in ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
++ dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
+
+ err = ffs_dma_resv_lock(dmabuf, nonblock);
+ if (err)
+@@ -1639,7 +1639,7 @@ static int ffs_dmabuf_transfer(struct file *file,
+ /* Make sure we don't have writers */
+ timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS);
+ retl = dma_resv_wait_timeout(dmabuf->resv,
+- dma_resv_usage_rw(epfile->in),
++ dma_resv_usage_rw(!epfile->in),
+ true, timeout);
+ if (retl == 0)
+ retl = -EBUSY;
+@@ -1684,7 +1684,7 @@ static int ffs_dmabuf_transfer(struct file *file,
+ dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops,
+ &priv->lock, priv->context, seqno);
+
+- resv_dir = epfile->in ? DMA_RESV_USAGE_WRITE : DMA_RESV_USAGE_READ;
++ resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE;
+
+ dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir);
+ dma_resv_unlock(dmabuf->resv);
+--
+2.51.0
+
--- /dev/null
+From efec1fdaa3688c2d80750550c51c047f84f9e6d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 08:30:20 +1000
+Subject: usb: gadget: f_fs: Fix ioctl error handling
+
+From: Sam Day <me@samcday.com>
+
+[ Upstream commit 8e4c1d06183c25022f6b0002a5cab84979ca6337 ]
+
+When ffs_epfile_ioctl handles FUNCTIONFS_DMABUF_* ioctls, it's currently
+falling through when copy_from_user fails.
+
+However, this fallthrough isn't being checked properly, so the handler
+continues executing further than it should. It then tries the secondary
+dispatch where it ultimately gives up and returns -ENOTTY.
+
+The end result is invalid ioctl invocations will yield a -ENOTTY rather
+than an -EFAULT.
+
+It's a common pattern elsewhere in the kernel code to directly return
+-EFAULT when copy_from_user fails. So we update ffs_epfile_ioctl to do
+the same and fix this issue.
+
+Signed-off-by: Sam Day <me@samcday.com>
+Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-1-e51633891a81@samcday.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 928f51fddc64e..e75d5d8b5ac91 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1744,10 +1744,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ {
+ int fd;
+
+- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
+- ret = -EFAULT;
+- break;
+- }
++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
++ return -EFAULT;
+
+ return ffs_dmabuf_attach(file, fd);
+ }
+@@ -1755,10 +1753,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ {
+ int fd;
+
+- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
+- ret = -EFAULT;
+- break;
+- }
++ if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
++ return -EFAULT;
+
+ return ffs_dmabuf_detach(file, fd);
+ }
+@@ -1766,10 +1762,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ {
+ struct usb_ffs_dmabuf_transfer_req req;
+
+- if (copy_from_user(&req, (void __user *)value, sizeof(req))) {
+- ret = -EFAULT;
+- break;
+- }
++ if (copy_from_user(&req, (void __user *)value, sizeof(req)))
++ return -EFAULT;
+
+ return ffs_dmabuf_transfer(file, &req);
+ }
+--
+2.51.0
+
--- /dev/null
+From 1ffd92e5254399796059f421d04692b36f097b2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:48:48 +0000
+Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
+
+From: Benson Leung <bleung@chromium.org>
+
+[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ]
+
+ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated
+using whichever pdo is in the last position of the src_pdos array, presuming
+it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current
+helpers are used on that last pdo.
+
+However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and
+for PPS) may exist, and are always at the end of the array if they do.
+In the event one of these more advanced chargers are attached the helpers for
+fixed return mangled values.
+
+Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger
+with PPS support:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=13400000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=5790000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS
+APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect.
+
+Instead, enumerate through the src_pdos and filter just for Fixed PDOs for
+now, and find the one with the highest voltage and current respectively.
+
+After, from the same charger:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=20000000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=4000000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Signed-off-by: Benson Leung <bleung@chromium.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c
+index 3abe9370ffaaf..62160c4191718 100644
+--- a/drivers/usb/typec/ucsi/psy.c
++++ b/drivers/usb/typec/ucsi/psy.c
+@@ -112,15 +112,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_voltage = 0;
+
+ switch (UCSI_CONSTAT(con, PWR_OPMODE)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_fixed_voltage(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_voltage = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000;
++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage
++ : max_voltage;
+ }
++ val->intval = max_voltage;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0:
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+@@ -168,6 +173,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_current = 0;
+
+ if (!UCSI_CONSTAT(con, CONNECTED)) {
+ val->intval = 0;
+@@ -176,12 +182,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+
+ switch (UCSI_CONSTAT(con, PWR_OPMODE)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_max_current(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_current = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_current = pdo_max_current(pdo) * 1000;
++ max_current = (pdo_current > max_current) ? pdo_current
++ : max_current;
+ }
++ val->intval = max_current;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+ val->intval = UCSI_TYPEC_1_5_CURRENT * 1000;
+--
+2.51.0
+
--- /dev/null
+From 93503b7e26c4f27ed1ffa475d441977dbb2a33a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 12:27:03 +0530
+Subject: vhost: fix caching attributes of MMIO regions by setting them
+ explicitly
+
+From: Kommula Shiva Shankar <kshankar@marvell.com>
+
+[ Upstream commit 5145b277309f3818e2db507f525d19ac3b910922 ]
+
+Explicitly set non-cached caching attributes for MMIO regions.
+Default write-back mode can cause CPU to cache device memory,
+causing invalid reads and unpredictable behavior.
+
+Invalid read and write issues were observed on ARM64 when mapping the
+notification area to userspace via mmap.
+
+Signed-off-by: Kommula Shiva Shankar <kshankar@marvell.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Message-Id: <20260102065703.656255-1-kshankar@marvell.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index 05a481e4c385a..b0179e8567aba 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -1527,6 +1527,7 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma)
+ if (vma->vm_end - vma->vm_start != notify.size)
+ return -ENOTSUPP;
+
++ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);
+ vma->vm_ops = &vhost_vdpa_vm_ops;
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 18d1bee24af36c559713d264f39864e4ce18ad12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:45 +0100
+Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ]
+
+The unpacked unions within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)'
+ and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 239 | } u;
+ | ^
+
+./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+
+With the recent changes to compile-test the UAPI headers in more cases,
+these warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warnings.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/vbox_vmmdev_types.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
+index 6073858d52a2e..11f3627c3729b 100644
+--- a/include/uapi/linux/vbox_vmmdev_types.h
++++ b/include/uapi/linux/vbox_vmmdev_types.h
+@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 {
+ /** Relative to the request header. */
+ __u32 offset;
+ } page_list;
+- } u;
++ } __packed u;
+ } __packed;
+ VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
+
+@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 {
+ union {
+ __u64 phys_addr;
+ __u64 linear_addr;
+- } u;
++ } __packed u;
+ } __packed pointer;
+ struct {
+ /** Size of the buffer described by the page list. */
+--
+2.51.0
+
--- /dev/null
+From 38f9c07c8f429a9cc179973eee146ae619df0ba2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:34:00 +0100
+Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ]
+
+The gcc-16.0.1 snapshot produces a false-positive warning that turns
+into a build failure with CONFIG_WERROR:
+
+In file included from arch/x86/include/asm/string.h:6,
+ from net/vmw_vsock/vmci_transport.c:10:
+In function 'vmci_transport_packet_init',
+ inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2:
+arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull]
+ 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy'
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+
+This seems relatively harmless, and it so far the only instance of this
+warning I have found. The __vmci_transport_send_control_pkt function
+is called either with wait=NULL or with one of the type values that
+pass 'wait' into memcpy() here, but not from the same caller.
+
+Replacing the memcpy with a struct assignment is otherwise the same
+but avoids the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Bryan Tan <bryan-bt.tan@broadcom.com>
+Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 7eccd6708d664..aca3132689cf1 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt,
+
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
+- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
++ pkt->u.wait = *wait;
+ break;
+
+ case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
+--
+2.51.0
+
--- /dev/null
+From c9c7ff4480472b28d180f2f3725a7fe09740a16f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 22:24:33 +0200
+Subject: watchdog: imx7ulp_wdt: handle the nowayout option
+
+From: Oleksandr Suvorov <cryosay@gmail.com>
+
+[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ]
+
+The module parameter `nowayout` indicates whether the watchdog should ever
+be allowed to stop, but the driver currently ignores this option.
+
+Pass the `nowayout` parameter to the watchdog core by setting the
+WDOG_NO_WAY_OUT flag accordingly.
+
+Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/imx7ulp_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c
+index 0f13a30533574..03479110453ce 100644
+--- a/drivers/watchdog/imx7ulp_wdt.c
++++ b/drivers/watchdog/imx7ulp_wdt.c
+@@ -346,6 +346,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev)
+ watchdog_stop_on_reboot(wdog);
+ watchdog_stop_on_unregister(wdog);
+ watchdog_set_drvdata(wdog, imx7ulp_wdt);
++ watchdog_set_nowayout(wdog, nowayout);
+
+ imx7ulp_wdt->hw = of_device_get_match_data(dev);
+ ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate);
+--
+2.51.0
+
--- /dev/null
+From 826f9935f74dab05ffa98c7d25a5d8987e2367cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Dec 2025 21:09:22 +0100
+Subject: watchdog: rzv2h_wdt: Discard pm_runtime_put() return value
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 2dea984a74265a67e3210f818416a83b87f70200 ]
+
+Failing device probe due to pm_runtime_put() returning an error is not
+particularly useful.
+
+Returning an error code from pm_runtime_put() merely means that it has
+not queued up a work item to check whether or not the device can be
+suspended and there are many perfectly valid situations in which that
+can happen, like after writing "on" to the devices' runtime PM "control"
+attribute in sysfs for one example. It also happens when the kernel is
+configured with CONFIG_PM unset.
+
+Accordingly, update rzt2h_wdt_wdtdcr_init() to simply discard the return
+value of pm_runtime_put() and return success to the caller after
+invoking that function.
+
+This will facilitate a planned change of the pm_runtime_put() return
+type to void in the future.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/rzv2h_wdt.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/watchdog/rzv2h_wdt.c b/drivers/watchdog/rzv2h_wdt.c
+index a694786837e11..f9bb4ef3d327b 100644
+--- a/drivers/watchdog/rzv2h_wdt.c
++++ b/drivers/watchdog/rzv2h_wdt.c
+@@ -270,9 +270,7 @@ static int rzt2h_wdt_wdtdcr_init(struct platform_device *pdev,
+
+ rzt2h_wdt_wdtdcr_count_stop(priv);
+
+- ret = pm_runtime_put(&pdev->dev);
+- if (ret < 0)
+- return ret;
++ pm_runtime_put(&pdev->dev);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From c56de72199e85e37bf6dd8b6f5333ef39ac095ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:56:11 +0000
+Subject: wifi: ath10k: fix lock protection in
+ ath10k_wmi_event_peer_sta_ps_state_chg()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ]
+
+ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to
+assert that ar->data_lock should be held by the caller, but neither
+ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock
+before calling this function.
+
+The field arsta->peer_ps_state is documented as protected by
+ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable,
+ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock.
+
+Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update,
+and remove the lockdep_assert_held() to be aligned with new locking,
+following the pattern used by other WMI event handlers in the driver.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu
+[removed excess blank line]
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index b4aad6604d6d9..ce22141e5efd9 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5289,8 +5289,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ struct ath10k_sta *arsta;
+ u8 peer_addr[ETH_ALEN];
+
+- lockdep_assert_held(&ar->data_lock);
+-
+ ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data;
+ ether_addr_copy(peer_addr, ev->peer_macaddr.addr);
+
+@@ -5305,7 +5303,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ }
+
+ arsta = (struct ath10k_sta *)sta->drv_priv;
++ spin_lock_bh(&ar->data_lock);
+ arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state);
++ spin_unlock_bh(&ar->data_lock);
+
+ exit:
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From 8283b93151407d11a9633967513d1f241242e29e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 17:00:34 -0800
+Subject: wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
+
+From: Ross Vandegrift <ross@kallisti.us>
+
+[ Upstream commit 4015b1972763d7d513172276e51439f37e622a92 ]
+
+Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added
+to the appropriate quirk list. I've tested this patch on top of 6.18.2,
+it fixes the issue for me on 21D4
+
+Mark Pearson provided the other product IDs covering the second Z16 Gen1
+and both Z13 Gen1 identifiers. They share the same firmware, and folks
+in the bugzilla report do indeed see the problem on Z13.
+
+[1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196
+
+Signed-off-by: Ross Vandegrift <ross@kallisti.us>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Tested-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
+index 06b4df2370e95..78a1b0edd8b45 100644
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -994,6 +994,34 @@ static const struct dmi_system_id ath11k_pm_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "21F9"),
+ },
+ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z13 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D2"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z13 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D3"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z16 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D4"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z16 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D5"),
++ },
++ },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 84458810a192ba84d00de77eb51d8773ea93c718 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 11:46:07 +0800
+Subject: wifi: ath11k: Fix failure to connect to a 6 GHz AP
+
+From: Qian Zhang <qian.zhang@oss.qualcomm.com>
+
+[ Upstream commit 0bc8c48de6f06c0cac52dde024ffda4433de6234 ]
+
+STA fails to connect to a 6 GHz AP with the following errors:
+ ath11k_pci 0000:01:00.0: failed to handle chan list with power type 1
+ wlp1s0: deauthenticating from c8:a3:e8:dd:41:e3 by local choice (Reason: 3=DEAUTH_LEAVING)
+
+ath11k_reg_handle_chan_list() treats the update as redundant and
+returns -EINVAL. That causes the connection attempt to fail.
+
+Avoid unnecessary validation during association. Apply the regulatory
+redundant check only when the power type is IEEE80211_REG_UNSET_AP,
+which only occurs during core initialization.
+
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
+
+Signed-off-by: Qian Zhang <qian.zhang@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260108034607.812885-1-qian.zhang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
+index d62a2014315a0..49b79648752cf 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+ * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+ #include <linux/rtnetlink.h>
+
+@@ -926,8 +926,11 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
+ */
+ if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] &&
+ !memcmp((char *)ab->default_regd[pdev_idx]->alpha2,
+- (char *)reg_info->alpha2, 2))
+- goto retfail;
++ (char *)reg_info->alpha2, 2) &&
++ power_type == IEEE80211_REG_UNSET_AP) {
++ ath11k_reg_reset_info(reg_info);
++ return 0;
++ }
+
+ /* Intersect new rules with default regd if a new country setting was
+ * requested, i.e a default regd was already set during initialization
+--
+2.51.0
+
--- /dev/null
+From 52122f844b58aa2386e8b1389be9cd85efa29bb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 15:36:26 +0800
+Subject: wifi: ath12k: fix mac phy capability parsing
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit b5151c9b6e3a347416a4b4b55fc00195526d8771 ]
+
+Currently ath12k_pull_mac_phy_cap_svc_ready_ext() assumes only one band
+supported in each phy, hence it skips 5 GHz band if 2 GHz band support
+is detected. This does not work for device which gets only one phy but
+has both bands supported, such as QCC2072.
+
+Change to check each band individually to fix this issue.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
+
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-6-fc8ce1e43969@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/wmi.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
+index 12f4d378f50d4..1613492b38350 100644
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
++++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -496,6 +496,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ struct ath12k_band_cap *cap_band;
+ struct ath12k_pdev_cap *pdev_cap = &pdev->cap;
+ struct ath12k_fw_pdev *fw_pdev;
++ u32 supported_bands;
+ u32 phy_map;
+ u32 hw_idx, phy_idx = 0;
+ int i;
+@@ -519,14 +520,19 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ return -EINVAL;
+
+ mac_caps = wmi_mac_phy_caps + phy_idx;
++ supported_bands = le32_to_cpu(mac_caps->supported_bands);
++
++ if (!(supported_bands & WMI_HOST_WLAN_2GHZ_CAP) &&
++ !(supported_bands & WMI_HOST_WLAN_5GHZ_CAP))
++ return -EINVAL;
+
+ pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps);
+ pdev->hw_link_id = ath12k_wmi_mac_phy_get_hw_link_id(mac_caps);
+- pdev_cap->supported_bands |= le32_to_cpu(mac_caps->supported_bands);
++ pdev_cap->supported_bands |= supported_bands;
+ pdev_cap->ampdu_density = le32_to_cpu(mac_caps->ampdu_density);
+
+ fw_pdev = &ab->fw_pdev[ab->fw_pdev_count];
+- fw_pdev->supported_bands = le32_to_cpu(mac_caps->supported_bands);
++ fw_pdev->supported_bands = supported_bands;
+ fw_pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps);
+ fw_pdev->phy_id = le32_to_cpu(mac_caps->phy_id);
+ ab->fw_pdev_count++;
+@@ -535,10 +541,12 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ * band to band for a single radio, need to see how this should be
+ * handled.
+ */
+- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) {
++ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) {
+ pdev_cap->tx_chain_mask = le32_to_cpu(mac_caps->tx_chain_mask_2g);
+ pdev_cap->rx_chain_mask = le32_to_cpu(mac_caps->rx_chain_mask_2g);
+- } else if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) {
++ }
++
++ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) {
+ pdev_cap->vht_cap = le32_to_cpu(mac_caps->vht_cap_info_5g);
+ pdev_cap->vht_mcs = le32_to_cpu(mac_caps->vht_supp_mcs_5g);
+ pdev_cap->he_mcs = le32_to_cpu(mac_caps->he_supp_mcs_5g);
+@@ -548,8 +556,6 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ WMI_NSS_RATIO_EN_DIS_GET(mac_caps->nss_ratio);
+ pdev_cap->nss_ratio_info =
+ WMI_NSS_RATIO_INFO_GET(mac_caps->nss_ratio);
+- } else {
+- return -EINVAL;
+ }
+
+ /* tx/rx chainmask reported from fw depends on the actual hw chains used,
+@@ -565,7 +571,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ pdev_cap->rx_chain_mask_shift =
+ find_first_bit((unsigned long *)&pdev_cap->rx_chain_mask, 32);
+
+- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) {
++ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) {
+ cap_band = &pdev_cap->band[NL80211_BAND_2GHZ];
+ cap_band->phy_id = le32_to_cpu(mac_caps->phy_id);
+ cap_band->max_bw_supported = le32_to_cpu(mac_caps->max_bw_supported_2g);
+@@ -585,7 +591,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
+ le32_to_cpu(mac_caps->he_ppet2g.ppet16_ppet8_ru3_ru0[i]);
+ }
+
+- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) {
++ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) {
+ cap_band = &pdev_cap->band[NL80211_BAND_5GHZ];
+ cap_band->phy_id = le32_to_cpu(mac_caps->phy_id);
+ cap_band->max_bw_supported =
+--
+2.51.0
+
--- /dev/null
+From 1e40cb7cab0515323a52503f594dadf150ce1441 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 15:36:24 +0800
+Subject: wifi: ath12k: fix preferred hardware mode calculation
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 7f852de0003219c431a6f2ffd951fd82a4673660 ]
+
+For single pdev device like WCN7850/QCC2072, preferred_hw_mode is
+initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends
+supported modes to host, each mode is compared with the initial one
+and if the priority of the new mode is higher, update the parameter
+and store mode capability.
+
+For WCN7850, this does not result in issue, as one of the supported
+mode indeed has a higher priority. However the only available mode of
+QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the
+comparison, hence mode capability is not stored. Subsequently driver
+initialization fails.
+
+Fix it by accepting a mode with the same priority.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
+
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
+index 3ce5fcb0e4600..12f4d378f50d4 100644
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
++++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -4545,7 +4545,7 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc,
+
+ pref = soc->wmi_ab.preferred_hw_mode;
+
+- if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) {
++ if (ath12k_hw_mode_pri_map[mode] <= ath12k_hw_mode_pri_map[pref]) {
+ svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps;
+ soc->wmi_ab.preferred_hw_mode = mode;
+ }
+--
+2.51.0
+
--- /dev/null
+From 6ad8a64ec3048f507c4c9161dcf999a00ed809cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 13:51:57 +0200
+Subject: wifi: cfg80211: allow only one NAN interface, also in multi radio
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit e69fda4d07701373354e52b0321bd40311d743d0 ]
+
+According to Wi-Fi Aware (TM) 4.0 specification 2.8, A NAN device can
+have one NAN management interface. This applies also to multi radio
+devices.
+The current code allows a driver to support more than one NAN interface,
+if those are not in the same radio.
+
+Fix it.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20260107135129.fdaecec0fe8a.I246b5ba6e9da3ec1481ff197e47f6ce0793d7118@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/core.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index a04f96dc9a1d7..16ccf6fb28b21 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -661,12 +661,8 @@ int wiphy_verify_iface_combinations(struct wiphy *wiphy,
+ c->limits[j].max > 1))
+ return -EINVAL;
+
+- /* Only a single NAN can be allowed, avoid this
+- * check for multi-radio global combination, since it
+- * hold the capabilities of all radio combinations.
+- */
+- if (!combined_radio &&
+- WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
++ /* Only a single NAN can be allowed */
++ if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
+ c->limits[j].max > 1))
+ return -EINVAL;
+
+--
+2.51.0
+
--- /dev/null
+From 54c68e1b940b7da52b6127e4cdbf21ddc201f6c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jan 2026 16:36:08 +0200
+Subject: wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as
+ LPI mode
+
+From: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+
+[ Upstream commit fd5bfcf430ea2fdbb3e78fd0b82ceb0ab02b72ee ]
+
+Although value 4 (INDOOR_SP_AP_OLD) is deprecated in IEEE standards,
+existing APs may still use this control value. Since this value is
+based on the old specification, we cannot trust such APs implement
+proper power controls.
+Therefore, move IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD case
+from SP_AP to LPI_AP power type handling to prevent potential
+power limit violations.
+
+Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20260111163601.6b5a36d3601e.I1704ee575fd25edb0d56f48a0a3169b44ef72ad0@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cfg80211.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 2900202588a54..39a04776705eb 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -10147,9 +10147,9 @@ cfg80211_6ghz_power_type(u8 control, u32 client_flags)
+ case IEEE80211_6GHZ_CTRL_REG_LPI_AP:
+ case IEEE80211_6GHZ_CTRL_REG_INDOOR_LPI_AP:
+ case IEEE80211_6GHZ_CTRL_REG_AP_ROLE_NOT_RELEVANT:
++ case IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD:
+ return IEEE80211_REG_LPI_AP;
+ case IEEE80211_6GHZ_CTRL_REG_SP_AP:
+- case IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD:
+ return IEEE80211_REG_SP_AP;
+ case IEEE80211_6GHZ_CTRL_REG_VLP_AP:
+ return IEEE80211_REG_VLP_AP;
+--
+2.51.0
+
--- /dev/null
+From b6bba25afab274292cf03303614924919b8376d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:30:05 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il3945_store_measurement()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ]
+
+il3945_store_measurement() calls il3945_get_measurement() which internally
+calls il_send_cmd_sync() without holding il->mutex. However,
+il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that
+callers must hold this lock.
+
+Other sysfs store functions in the same file properly acquire the mutex:
+- il3945_store_flags() acquires mutex at 3945-mac.c:3110
+- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144
+
+Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call
+in the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 104748fcdc33e..54991f31c52c5 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3224,7 +3224,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
+
+ D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n",
+ type, params.channel, buf);
++ mutex_lock(&il->mutex);
+ il3945_get_measurement(il, ¶ms, type);
++ mutex_unlock(&il->mutex);
+
+ return count;
+ }
+--
+2.51.0
+
--- /dev/null
+From 65c87c000d6c438f88310c5f2b9c12687324bb4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:40:39 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il4965_store_tx_power()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ]
+
+il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex.
+However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating
+that callers must hold this lock.
+
+All other callers of il_set_tx_power() properly acquire the mutex:
+- il_bg_scan_completed() acquires mutex at common.c:1683
+- il_mac_config() acquires mutex at common.c:5006
+- il3945_commit_rxon() and il4965_commit_rxon() are called via work
+ queues that hold the mutex (like il4965_bg_alive_start)
+
+Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in
+the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 3588dec75ebdd..57fa866efd9f8 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4606,7 +4606,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr,
+ if (ret)
+ IL_INFO("%s is not in decimal form.\n", buf);
+ else {
++ mutex_lock(&il->mutex);
+ ret = il_set_tx_power(il, val, false);
++ mutex_unlock(&il->mutex);
+ if (ret)
+ IL_ERR("failed setting tx power (0x%08x).\n", ret);
+ else
+--
+2.51.0
+
--- /dev/null
+From 0af4dbb34fc4ea3898e3c6997d6ff198c92cd7ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:02:19 +0200
+Subject: wifi: iwlwifi: fix 22000 series SMEM parsing
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 58192b9ce09b0f0f86e2036683bd542130b91a98 ]
+
+If the firmware were to report three LMACs (which doesn't
+exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is
+an overrun of the array. Reject such and use IWL_FW_CHECK
+instead of WARN_ON in this function.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20251110150012.16e8c2d70c26.Iadfcc1aedf43c5175b3f0757bea5aa232454f1ac@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/smem.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+index 90fd69b4860c1..344ddde85b189 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+@@ -6,6 +6,7 @@
+ */
+ #include "iwl-drv.h"
+ #include "runtime.h"
++#include "dbg.h"
+ #include "fw/api/commands.h"
+
+ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
+@@ -17,7 +18,9 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
+ u8 api_ver = iwl_fw_lookup_notif_ver(fwrt->fw, SYSTEM_GROUP,
+ SHARED_MEM_CFG_CMD, 0);
+
+- if (WARN_ON(lmac_num > ARRAY_SIZE(mem_cfg->lmac_smem)))
++ /* Note: notification has 3 entries, but we only expect 2 */
++ if (IWL_FW_CHECK(fwrt, lmac_num > ARRAY_SIZE(fwrt->smem_cfg.lmac),
++ "FW advertises %d LMACs\n", lmac_num))
+ return;
+
+ fwrt->smem_cfg.num_lmacs = lmac_num;
+@@ -26,7 +29,8 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
+ fwrt->smem_cfg.rxfifo2_size = le32_to_cpu(mem_cfg->rxfifo2_size);
+
+ if (api_ver >= 4 &&
+- !WARN_ON_ONCE(iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg))) {
++ !IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg),
++ "bad shared mem notification size\n")) {
+ fwrt->smem_cfg.rxfifo2_control_size =
+ le32_to_cpu(mem_cfg->rxfifo2_control_size);
+ }
+--
+2.51.0
+
--- /dev/null
+From 4ee069cd4011b97b58abc804247ff25c8ff17dbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jan 2026 19:39:12 +0200
+Subject: wifi: iwlwifi: mld: fix chandef start calculation
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit d2fcdf36554316cc51f7928b777944738d06e332 ]
+
+A link pair in which both links are in 5 GHz can be used for EMLSR only
+if they are separated enough.
+
+To check this condition we calculate the start and the end of the
+chandefs of both links in the pair and do some checks.
+
+But the calculation of the start/end of the chandef is currently done
+by subtracting/adding half the bandwidth from/to the control channel's
+center frequency, when it should really be subtracted/added from/to the
+center frequency of the entire chandef.
+
+Fix the wrong calculation.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20260111193638.2138fdb99bd5.I4d2e5957b22482a57b1d6ca444e90fcf73bf2cab@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
+index c6b151f269216..1efefc737248f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
+@@ -844,9 +844,9 @@ iwl_mld_emlsr_pair_state(struct ieee80211_vif *vif,
+ if (c_low->chan->center_freq > c_high->chan->center_freq)
+ swap(c_low, c_high);
+
+- c_low_upper_edge = c_low->chan->center_freq +
++ c_low_upper_edge = c_low->center_freq1 +
+ cfg80211_chandef_get_width(c_low) / 2;
+- c_high_lower_edge = c_high->chan->center_freq -
++ c_high_lower_edge = c_high->center_freq1 -
+ cfg80211_chandef_get_width(c_high) / 2;
+
+ if (a->chandef->chan->band == NL80211_BAND_5GHZ &&
+--
+2.51.0
+
--- /dev/null
+From 6dc4ff671ced6e93af3ead6d83ad07b120b15468 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jan 2026 19:39:14 +0200
+Subject: wifi: iwlwifi: mld: Fix primary link selection logic
+
+From: Nidhish A N <nidhish.a.n@intel.com>
+
+[ Upstream commit 7a749db26cab2334d5b356ac31e6f1147c7682da ]
+
+When assigning emlsr.primary with emlsr.selected_primary
+we are checking if BIT(mld_vif->emlsr.selected_links) are
+a part of vif->active_links. This is incorrect as
+emlsr.selected_links is a bitmap of possibly two selected links.
+Therefore, performing the BIT() operation on it does not
+yield any meaningful result and almost always leads to
+incorrect primary link selection.
+
+Additionally, we cannot rely on vif->active_links at this
+stage of the link switch flow because it contains both the
+removed links and also the newly added links.
+For example, if we had selected links in the past (0x11)
+and we now select links because of TTLM/debugfs (0x100),
+vif->active_links will now be (0x111) and primary link
+will be 0, while 0 is not even an active link. Thus,
+we create our own bitmap of final active links.
+
+Signed-off-by: Nidhish A N <nidhish.a.n@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20260111193638.38b2e14e3a20.Ie81a88dfff0c5d2becedabab8398702808f6b1bf@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/mld/mac80211.c | 23 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+index cd0dce8de8569..3a1b5bfb9ed66 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+@@ -984,7 +984,9 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
+ {
+ struct iwl_mld *mld = IWL_MAC80211_GET_MLD(hw);
+ struct iwl_mld_link *mld_link = iwl_mld_link_from_mac80211(link);
+- unsigned int n_active = iwl_mld_count_active_links(mld, vif);
++ struct iwl_mld_link *temp_mld_link;
++ struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif);
++ u16 final_active_links = 0;
+ int ret;
+
+ lockdep_assert_wiphy(mld->wiphy);
+@@ -992,10 +994,7 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
+ if (WARN_ON(!mld_link))
+ return -EINVAL;
+
+- /* if the assigned one was not counted yet, count it now */
+ if (!rcu_access_pointer(mld_link->chan_ctx)) {
+- n_active++;
+-
+ /* Track addition of non-BSS link */
+ if (ieee80211_vif_type_p2p(vif) != NL80211_IFTYPE_STATION) {
+ ret = iwl_mld_emlsr_check_non_bss_block(mld, 1);
+@@ -1016,17 +1015,25 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
+
+ rcu_assign_pointer(mld_link->chan_ctx, ctx);
+
+- if (n_active > 1) {
+- struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif);
++ /* We cannot rely on vif->active_links at this stage as it contains
++ * both the removed links and the newly added links.
++ * Therefore, we create our own bitmap of the final active links,
++ * which does not include the removed links.
++ */
++ for_each_mld_vif_valid_link(mld_vif, temp_mld_link) {
++ if (rcu_access_pointer(temp_mld_link->chan_ctx))
++ final_active_links |= BIT(link_id);
++ }
+
++ if (hweight16(final_active_links) > 1) {
+ /* Indicate to mac80211 that EML is enabled */
+ vif->driver_flags |= IEEE80211_VIF_EML_ACTIVE;
+ mld_vif->emlsr.last_entry_ts = jiffies;
+
+- if (vif->active_links & BIT(mld_vif->emlsr.selected_links))
++ if (final_active_links == mld_vif->emlsr.selected_links)
+ mld_vif->emlsr.primary = mld_vif->emlsr.selected_primary;
+ else
+- mld_vif->emlsr.primary = __ffs(vif->active_links);
++ mld_vif->emlsr.primary = __ffs(final_active_links);
+
+ iwl_dbg_tlv_time_point(&mld->fwrt, IWL_FW_INI_TIME_ESR_LINK_UP,
+ NULL);
+--
+2.51.0
+
--- /dev/null
+From bc615a15ce4812471f398ce44424cee4a9e5f579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 18:08:46 +0200
+Subject: wifi: iwlwifi: mld: Handle rate selection for NAN interface
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit dbbeebece03050cd510073ce89fee83844e06b00 ]
+
+Frames transmitted over a NAN interface might not have channel
+information assigned to them. In such cases assign the lowest
+OFDM to the frame.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20251110180612.72046f98f878.Ib784931fffd0747acd9d7bb22eabbbec5282733e@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/tx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
+index 3b4b575aadaa5..e3fb4fc4f452e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
+@@ -345,6 +345,11 @@ u8 iwl_mld_get_lowest_rate(struct iwl_mld *mld,
+
+ iwl_mld_get_basic_rates_and_band(mld, vif, info, &basic_rates, &band);
+
++ if (band >= NUM_NL80211_BANDS) {
++ WARN_ON(vif->type != NL80211_IFTYPE_NAN);
++ return IWL_FIRST_OFDM_RATE;
++ }
++
+ sband = mld->hw->wiphy->bands[band];
+ for_each_set_bit(i, &basic_rates, BITS_PER_LONG) {
+ u16 hw = sband->bitrates[i].hw_value;
+--
+2.51.0
+
--- /dev/null
+From 21aecc172c81faf6597b90a491519ffc0a31d5db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:02:15 +0200
+Subject: wifi: iwlwifi: mvm: check the validity of noa_len
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d ]
+
+Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using
+its value to determine the noa_len, which is later used for the NoA
+attribute.
+
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index 867807abde664..49ffc4ecee855 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -1761,6 +1761,20 @@ void iwl_mvm_probe_resp_data_notif(struct iwl_mvm *mvm,
+
+ mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
++ /*
++ * len_low should be 2 + n*13 (where n is the number of descriptors.
++ * 13 is the size of a NoA descriptor). We can have either one or two
++ * descriptors.
++ */
++ if (IWL_FW_CHECK(mvm, notif->noa_active &&
++ notif->noa_attr.len_low != 2 +
++ sizeof(struct ieee80211_p2p_noa_desc) &&
++ notif->noa_attr.len_low != 2 +
++ sizeof(struct ieee80211_p2p_noa_desc) * 2,
++ "Invalid noa_attr.len_low (%d)\n",
++ notif->noa_attr.len_low))
++ return;
++
+ new_data = kzalloc(sizeof(*new_data), GFP_KERNEL);
+ if (!new_data)
+ return;
+--
+2.51.0
+
--- /dev/null
+From 8b774c393e0445dc057b25dbaaad6baf8959de6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:58:06 +0100
+Subject: wifi: libertas: fix WARNING in usb_tx_block
+
+From: Szymon Wilczek <swilczek.lx@gmail.com>
+
+[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ]
+
+The function usb_tx_block() submits cardp->tx_urb without ensuring that
+any previous transmission on this URB has completed. If a second call
+occurs while the URB is still active (e.g. during rapid firmware loading),
+usb_submit_urb() detects the active state and triggers a warning:
+'URB submitted while active'.
+
+Fix this by enforcing serialization: call usb_kill_urb() before
+submitting the new request. This ensures the URB is idle and safe to reuse.
+
+Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
+Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
+Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index b3c4040257a67..924ab93b7b671 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb
+ goto tx_ret;
+ }
+
++ usb_kill_urb(cardp->tx_urb);
++
+ usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
+ usb_sndbulkpipe(cardp->udev,
+ cardp->ep_out),
+--
+2.51.0
+
--- /dev/null
+From 57f89ac7ac8e1f53a8eac951620af75f34871ee3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Nov 2025 16:50:31 +0200
+Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ]
+
+rtw8822b_set_antenna() can be called from userspace when the chip is
+powered off. In that case a WARNING is triggered in
+rtw8822b_config_trx_mode() because trying to read the RF registers
+when the chip is powered off returns an unexpected value.
+
+Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when
+the chip is powered on.
+
+------------[ cut here ]------------
+write RF mode table fail
+WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1
+Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021
+RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+Call Trace:
+ <TASK>
+ rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]
+ rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]
+ ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]
+ nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? netdev_run_todo+0x63/0x550
+ genl_family_rcv_msg_doit+0xfc/0x160
+ genl_rcv_msg+0x1aa/0x2b0
+ ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_genl_rcv_msg+0x10/0x10
+ netlink_rcv_skb+0x59/0x110
+ genl_rcv+0x28/0x40
+ netlink_unicast+0x285/0x3c0
+ ? __alloc_skb+0xdb/0x1a0
+ netlink_sendmsg+0x20d/0x430
+ ____sys_sendmsg+0x39f/0x3d0
+ ? import_iovec+0x2f/0x40
+ ___sys_sendmsg+0x99/0xe0
+ ? refill_obj_stock+0x12e/0x240
+ __sys_sendmsg+0x8a/0xf0
+ do_syscall_64+0x81/0x970
+ ? do_syscall_64+0x81/0x970
+ ? ksys_read+0x73/0xf0
+ ? do_syscall_64+0x81/0x970
+ ? count_memcg_events+0xc2/0x190
+ ? handle_mm_fault+0x1d7/0x2d0
+ ? do_user_addr_fault+0x21a/0x690
+ ? exc_page_fault+0x7e/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+---[ end trace 0000000000000000 ]---
+
+Link: https://github.com/lwfinger/rtw88/issues/366
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+index 89b6485b229a8..4d88cc2f41485 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -1005,7 +1005,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev,
+ hal->antenna_tx = antenna_tx;
+ hal->antenna_rx = antenna_rx;
+
+- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags))
++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 7660e964b07b7801b83beb2423e947d6bbe40267 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 23:09:37 +0500
+Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
+
+From: Roman Peshkichev <roman.peshkichev@gmail.com>
+
+[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ]
+
+The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter,
+while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf.
+In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0.
+
+The driver unconditionally wrote (dtim_period - 1) to
+REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This
+caused delays in broadcast/multicast traffic processing and issues with
+ad-hoc operation.
+
+Convert the function parameter to u8 to match ieee80211_bss_conf and avoid
+the underflow by writing 0 when dtim_period is 0.
+
+Link: https://github.com/lwfinger/rtw88/issues/406
+Signed-off-by: Roman Peshkichev <roman.peshkichev@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 4 ++--
+ drivers/net/wireless/realtek/rtw88/main.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index d93d21656f26c..f72d12c3b2bc6 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -730,10 +730,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel)
+ }
+ EXPORT_SYMBOL(rtw_set_rx_freq_band);
+
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period)
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period)
+ {
+ rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE);
+- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1);
++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0);
+ }
+
+ void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel,
+diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h
+index 43ed6d6b42919..1ab70214ce36e 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -2226,7 +2226,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band)
+ }
+
+ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel);
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period);
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period);
+ void rtw_get_channel_params(struct cfg80211_chan_def *chandef,
+ struct rtw_channel_params *ch_param);
+ bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target);
+--
+2.51.0
+
--- /dev/null
+From cbe44e0b36477f64deb62151ba80090338e93859 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 01:26:45 +0200
+Subject: wifi: rtw88: Fix inadvertent sharing of struct
+ ieee80211_supported_band data
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit fcac0f23d4d20b11014a39f8e2527cdc12ec9c82 ]
+
+Internally wiphy writes to individual channels in this structure,
+so we must not share one static definition of channel list between
+multiple device instances, because that causes hard to debug
+breakage.
+
+For example, with two rtw88 driven devices in the system, channel
+information may get incoherent, preventing channel use.
+
+Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing
+of struct ieee80211_supported_band data").
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 34 +++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 6f35357e73246..dde2ea6a00e06 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1658,16 +1658,41 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev)
+ return len;
+ }
+
++static struct ieee80211_supported_band *
++rtw_sband_dup(struct rtw_dev *rtwdev,
++ const struct ieee80211_supported_band *sband)
++{
++ struct ieee80211_supported_band *dup;
++
++ dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL);
++ if (!dup)
++ return NULL;
++
++ dup->channels = devm_kmemdup_array(rtwdev->dev, sband->channels,
++ sband->n_channels,
++ sizeof(*sband->channels),
++ GFP_KERNEL);
++ if (!dup->channels)
++ return NULL;
++
++ dup->bitrates = devm_kmemdup_array(rtwdev->dev, sband->bitrates,
++ sband->n_bitrates,
++ sizeof(*sband->bitrates),
++ GFP_KERNEL);
++ if (!dup->bitrates)
++ return NULL;
++
++ return dup;
++}
++
+ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ const struct rtw_chip_info *chip)
+ {
+ struct ieee80211_supported_band *sband;
+ struct rtw_dev *rtwdev = hw->priv;
+- struct device *dev = rtwdev->dev;
+
+ if (chip->band & RTW_BAND_2G) {
+- sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband),
+- GFP_KERNEL);
++ sband = rtw_sband_dup(rtwdev, &rtw_band_2ghz);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+@@ -1676,8 +1701,7 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ }
+
+ if (chip->band & RTW_BAND_5G) {
+- sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband),
+- GFP_KERNEL);
++ sband = rtw_sband_dup(rtwdev, &rtw_band_5ghz);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+--
+2.51.0
+
--- /dev/null
+From efe135cf16d1f55071e1ef590e7f7b695e7ab0da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:32:04 +0800
+Subject: wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
+
+From: Hsiu-Ming Chang <cges30901@gmail.com>
+
+[ Upstream commit 77653c327e11c71c5363b18a53fbf2b92ed21da4 ]
+
+Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB
+Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105.
+
+Signed-off-by: Hsiu-Ming Chang <cges30901@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+index 7a0fffc359e25..8cd09d66655db 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+@@ -37,6 +37,8 @@ static const struct usb_device_id rtw_8821cu_id_table[] = {
+ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0105, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Mercusys */
+ {},
+ };
+ MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table);
+--
+2.51.0
+
--- /dev/null
+From c91cb9409e7ab3e537eed73d608cd9db7dfbc7b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 01:25:32 +0200
+Subject: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d ]
+
+Simplify the code by using device managed memory allocations.
+
+This also fixes a memory leak in rtw_register_hw(). The supported bands
+were not freed in the error path.
+
+Copied from commit 145df52a8671 ("wifi: rtw89: Convert
+rtw89_core_set_supported_band to use devm_*").
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index f72d12c3b2bc6..6f35357e73246 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1661,11 +1661,13 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev)
+ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ const struct rtw_chip_info *chip)
+ {
+- struct rtw_dev *rtwdev = hw->priv;
+ struct ieee80211_supported_band *sband;
++ struct rtw_dev *rtwdev = hw->priv;
++ struct device *dev = rtwdev->dev;
+
+ if (chip->band & RTW_BAND_2G) {
+- sband = kmemdup(&rtw_band_2ghz, sizeof(*sband), GFP_KERNEL);
++ sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband),
++ GFP_KERNEL);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+@@ -1674,7 +1676,8 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ }
+
+ if (chip->band & RTW_BAND_5G) {
+- sband = kmemdup(&rtw_band_5ghz, sizeof(*sband), GFP_KERNEL);
++ sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband),
++ GFP_KERNEL);
+ if (!sband)
+ goto err_out;
+ if (chip->ht_supported)
+@@ -1690,13 +1693,6 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
+ rtw_err(rtwdev, "failed to set supported band\n");
+ }
+
+-static void rtw_unset_supported_band(struct ieee80211_hw *hw,
+- const struct rtw_chip_info *chip)
+-{
+- kfree(hw->wiphy->bands[NL80211_BAND_2GHZ]);
+- kfree(hw->wiphy->bands[NL80211_BAND_5GHZ]);
+-}
+-
+ static void rtw_vif_smps_iter(void *data, u8 *mac,
+ struct ieee80211_vif *vif)
+ {
+@@ -2320,10 +2316,7 @@ EXPORT_SYMBOL(rtw_register_hw);
+
+ void rtw_unregister_hw(struct rtw_dev *rtwdev, struct ieee80211_hw *hw)
+ {
+- const struct rtw_chip_info *chip = rtwdev->chip;
+-
+ ieee80211_unregister_hw(hw);
+- rtw_unset_supported_band(hw, chip);
+ rtw_debugfs_deinit(rtwdev);
+ rtw_led_deinit(rtwdev);
+ }
+--
+2.51.0
+
--- /dev/null
+From ef604aebe2760987c95f8e9003a6984927fbe01a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 01:54:21 +0100
+Subject: wifi: rtw89: 8852au: add support for TP TX30U Plus
+
+From: Jan Gerber <j@mailb.org>
+
+[ Upstream commit a2f1fc9ab6fb0d5c9d701a516c342944258fb20e ]
+
+the device shows up like this and everything seams to work:
+
+Bus 004 Device 003: ID 3625:010d Realtek 802.11ax WLAN Adapter
+
+Signed-off-by: Jan Gerber <j@mailb.org>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251212005515.2059533-1-j@mailb.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8852au.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852au.c b/drivers/net/wireless/realtek/rtw89/rtw8852au.c
+index ca782469c455d..74a976c984ad8 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852au.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852au.c
+@@ -60,6 +60,8 @@ static const struct usb_device_id rtw_8852au_id_table[] = {
+ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0141, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010d, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010f, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
+ {},
+--
+2.51.0
+
--- /dev/null
+From f16a7d0f5707370052c5a2fe81c527cdfb80f666 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 12:41:57 +0800
+Subject: wifi: rtw89: 8922a: add digital compensation for 2GHz
+
+From: Po-Hao Huang <phhuang@realtek.com>
+
+[ Upstream commit 8da7e88682d58a7c2e2c2101e49d3c9c9ac481b0 ]
+
+This fixes transmit power too low under 2GHz connection. Previously
+we missed the settings of 2GHz, add the according calibrated tables.
+
+Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260117044157.2392958-10-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8922a.c | 57 +++++++++++++++----
+ 1 file changed, 47 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+index 4bcf20612a455..52da0fa02da01 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+@@ -1770,6 +1770,32 @@ static int rtw8922a_ctrl_rx_path_tmac(struct rtw89_dev *rtwdev,
+ }
+
+ #define DIGITAL_PWR_COMP_REG_NUM 22
++static const u32 rtw8922a_digital_pwr_comp_2g_s0_val[][DIGITAL_PWR_COMP_REG_NUM] = {
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010000, 0x00000101,
++ 0x01010101, 0x02020201, 0x02010000, 0x03030202, 0x00000303,
++ 0x03020101, 0x06060504, 0x01010000, 0x06050403, 0x01000606,
++ 0x05040202, 0x07070706},
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101,
++ 0x01000000, 0x01010101, 0x01010000, 0x02020202, 0x00000404,
++ 0x03020101, 0x04040303, 0x02010000, 0x03030303, 0x00000505,
++ 0x03030201, 0x05050303},
++};
++
++static const u32 rtw8922a_digital_pwr_comp_2g_s1_val[][DIGITAL_PWR_COMP_REG_NUM] = {
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x01010000, 0x01010101, 0x00000101,
++ 0x01010100, 0x01010101, 0x01010000, 0x02020202, 0x01000202,
++ 0x02020101, 0x03030202, 0x02010000, 0x05040403, 0x01000606,
++ 0x05040302, 0x07070605},
++ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
++ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101,
++ 0x01010000, 0x02020201, 0x02010100, 0x03030202, 0x01000404,
++ 0x04030201, 0x05050404, 0x01010100, 0x04030303, 0x01000505,
++ 0x03030101, 0x05050404},
++};
++
+ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = {
+ {0x012C0096, 0x044C02BC, 0x00322710, 0x015E0096, 0x03C8028A,
+ 0x0BB80708, 0x17701194, 0x02020100, 0x03030303, 0x01000303,
+@@ -1784,7 +1810,7 @@ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = {
+ };
+
+ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev,
+- bool enable, u8 nss,
++ u8 band, u8 nss,
+ enum rtw89_rf_path path)
+ {
+ static const u32 ltpc_t0[2] = {R_BE_LTPC_T0_PATH0, R_BE_LTPC_T0_PATH1};
+@@ -1792,14 +1818,25 @@ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev,
+ u32 addr, val;
+ u32 i;
+
+- if (nss == 1)
+- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0];
+- else
+- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1];
++ if (nss == 1) {
++ if (band == RTW89_BAND_2G)
++ digital_pwr_comp = path == RF_PATH_A ?
++ rtw8922a_digital_pwr_comp_2g_s0_val[0] :
++ rtw8922a_digital_pwr_comp_2g_s1_val[0];
++ else
++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0];
++ } else {
++ if (band == RTW89_BAND_2G)
++ digital_pwr_comp = path == RF_PATH_A ?
++ rtw8922a_digital_pwr_comp_2g_s0_val[1] :
++ rtw8922a_digital_pwr_comp_2g_s1_val[1];
++ else
++ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1];
++ }
+
+ addr = ltpc_t0[path];
+ for (i = 0; i < DIGITAL_PWR_COMP_REG_NUM; i++, addr += 4) {
+- val = enable ? digital_pwr_comp[i] : 0;
++ val = digital_pwr_comp[i];
+ rtw89_phy_write32(rtwdev, addr, val);
+ }
+ }
+@@ -1808,7 +1845,7 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev,
+ enum rtw89_phy_idx phy_idx)
+ {
+ const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_CHANCTX_0);
+- bool enable = chan->band_type != RTW89_BAND_2G;
++ u8 band = chan->band_type;
+ u8 path;
+
+ if (rtwdev->mlo_dbcc_mode == MLO_1_PLUS_1_1RF) {
+@@ -1816,10 +1853,10 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev,
+ path = RF_PATH_A;
+ else
+ path = RF_PATH_B;
+- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 1, path);
++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 1, path);
+ } else {
+- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_A);
+- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_B);
++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_A);
++ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_B);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e2c099a7d6040f487106f4aebca2644199cdc907 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Nov 2025 10:18:56 +0100
+Subject: wifi: rtw89: 8922a: set random mac if efuse contains zeroes
+
+From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+
+[ Upstream commit 41be33d3efc120f6a2c02d12742655f2aa09e1b6 ]
+
+I have some rtl8922ae devices with no permanent mac stored in efuse.
+
+It could be properly saved and/or configured from user tools like
+NetworkManager, but it would be desirable to be able to initialize it
+somehow to get the device working by default.
+
+So, in the same way as with other devices, if the mac address read from
+efuse contains zeros, a random mac address is assigned to at least allow
+operation, and the user is warned about this in case any action needs to
+be considered.
+
+Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251126091905.217951-1-jtornosm@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8922a.c | 22 +++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+index 4437279c554b0..4bcf20612a455 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+@@ -636,16 +636,30 @@ static int rtw8922a_read_efuse_rf(struct rtw89_dev *rtwdev, u8 *log_map)
+ static int rtw8922a_read_efuse(struct rtw89_dev *rtwdev, u8 *log_map,
+ enum rtw89_efuse_block block)
+ {
++ struct rtw89_efuse *efuse = &rtwdev->efuse;
++ int ret;
++
+ switch (block) {
+ case RTW89_EFUSE_BLOCK_HCI_DIG_PCIE_SDIO:
+- return rtw8922a_read_efuse_pci_sdio(rtwdev, log_map);
++ ret = rtw8922a_read_efuse_pci_sdio(rtwdev, log_map);
++ break;
+ case RTW89_EFUSE_BLOCK_HCI_DIG_USB:
+- return rtw8922a_read_efuse_usb(rtwdev, log_map);
++ ret = rtw8922a_read_efuse_usb(rtwdev, log_map);
++ break;
+ case RTW89_EFUSE_BLOCK_RF:
+- return rtw8922a_read_efuse_rf(rtwdev, log_map);
++ ret = rtw8922a_read_efuse_rf(rtwdev, log_map);
++ break;
+ default:
+- return 0;
++ ret = 0;
++ break;
++ }
++
++ if (!ret && is_zero_ether_addr(efuse->addr)) {
++ rtw89_info(rtwdev, "efuse mac address is zero, using random mac\n");
++ eth_random_addr(efuse->addr);
+ }
++
++ return ret;
+ }
+
+ #define THM_TRIM_POSITIVE_MASK BIT(6)
+--
+2.51.0
+
--- /dev/null
+From 4ebc361cd81f1167bff9014be2b8afe2c473b345 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 09:49:06 +0800
+Subject: wifi: rtw89: Add default ID 28de:2432 for RTL8832CU
+
+From: Shin-Yi Lin <isaiah@realtek.com>
+
+[ Upstream commit 5f65ebf9aaf00c7443252136066138435ec03958 ]
+
+Add 28de:2432 for RTL8832CU-based adapters that use this default ID.
+
+Signed-off-by: Shin-Yi Lin <isaiah@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260114014906.21829-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8852cu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852cu.c b/drivers/net/wireless/realtek/rtw89/rtw8852cu.c
+index 2708b523ca141..3b9825c92a0d9 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852cu.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852cu.c
+@@ -46,6 +46,8 @@ static const struct usb_device_id rtw_8852cu_id_table[] = {
+ .driver_info = (kernel_ulong_t)&rtw89_8852cu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0x991d, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852cu_info },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x28de, 0x2432, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&rtw89_8852cu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x35b2, 0x0502, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852cu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x35bc, 0x0101, 0xff, 0xff, 0xff),
+--
+2.51.0
+
--- /dev/null
+From be725883c08b2412ae99f36eaf8499d9db45f78d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 08:47:59 +0800
+Subject: wifi: rtw89: Add support for D-Link VR Air Bridge (DWA-F18)
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+[ Upstream commit 292c0bc8acb687de7e83fc454bb98af19187b6bf ]
+
+Add the ID 2001:3323 to the table to support an additional RTL8832AU
+adapter: D-Link VR Air Bridge (DWA-F18).
+
+Compile tested only.
+
+Link: https://github.com/morrownr/rtw89/pull/44
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260112004759.6028-1-zenmchen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8852au.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852au.c b/drivers/net/wireless/realtek/rtw89/rtw8852au.c
+index 74a976c984ad8..ccdbcc178c2a4 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852au.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852au.c
+@@ -52,6 +52,8 @@ static const struct usb_device_id rtw_8852au_id_table[] = {
+ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3321, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3323, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x332c, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x013f, 0xff, 0xff, 0xff),
+--
+2.51.0
+
--- /dev/null
+From d9e4d5c46fdf5e8ac03f0ce27a0f301ca9c11871 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 08:43:58 +0800
+Subject: wifi: rtw89: Add support for MSI AX1800 Nano (GUAX18N)
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+[ Upstream commit 3116f287b81fe777a00b93ab07ec3c270093b185 ]
+
+Add the ID 0db0:f0c8 to the table to support an additional RTL8832BU
+adapter: MSI AX1800 Nano (GUAX18N).
+
+Compile tested only.
+
+Link: https://github.com/morrownr/rtl8852bu-20250826/pull/2
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260112004358.5516-1-zenmchen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
+index 980d17ef68d0a..84cd3ec971f98 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
+@@ -54,6 +54,8 @@ static const struct usb_device_id rtw_8852bu_id_table[] = {
+ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0x6931, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0xf0c8, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3327, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x3574, 0x6121, 0xff, 0xff, 0xff),
+--
+2.51.0
+
--- /dev/null
+From d4cbce0fe1761841b4ec600cc105610560a74f46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:15 +0800
+Subject: wifi: rtw89: disable EHT protocol by chip capabilities
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 7fd36ffedeedc97c44a10249a3f12d471bb2dc26 ]
+
+For certain chip models, EHT protocol is disabled, and driver must follow
+the capabilities. Otherwise, chips become unusable.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-5-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 2 +-
+ drivers/net/wireless/realtek/rtw89/core.h | 1 +
+ drivers/net/wireless/realtek/rtw89/fw.h | 4 ++++
+ drivers/net/wireless/realtek/rtw89/mac.c | 5 +++++
+ 4 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index c5934e4eff711..4b86a7c4fe329 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -5238,7 +5238,7 @@ static void rtw89_init_eht_cap(struct rtw89_dev *rtwdev,
+ u8 val, val_mcs13;
+ int sts = 8;
+
+- if (chip->chip_gen == RTW89_CHIP_AX)
++ if (chip->chip_gen == RTW89_CHIP_AX || hal->no_eht)
+ return;
+
+ if (hal->no_mcs_12_13)
+diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
+index 92636cfc5ca58..a032a20d4c23b 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.h
++++ b/drivers/net/wireless/realtek/rtw89/core.h
+@@ -5039,6 +5039,7 @@ struct rtw89_hal {
+ bool support_cckpd;
+ bool support_igi;
+ bool no_mcs_12_13;
++ bool no_eht;
+
+ atomic_t roc_chanctx_idx;
+ u8 roc_link_index;
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
+index cedb4a47a769c..ba7c332911310 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.h
++++ b/drivers/net/wireless/realtek/rtw89/fw.h
+@@ -42,6 +42,10 @@ struct rtw89_c2hreg_phycap {
+ #define RTW89_C2HREG_PHYCAP_W0_BW GENMASK(31, 24)
+ #define RTW89_C2HREG_PHYCAP_W1_TX_NSS GENMASK(7, 0)
+ #define RTW89_C2HREG_PHYCAP_W1_PROT GENMASK(15, 8)
++#define RTW89_C2HREG_PHYCAP_W1_PROT_11N 1
++#define RTW89_C2HREG_PHYCAP_W1_PROT_11AC 2
++#define RTW89_C2HREG_PHYCAP_W1_PROT_11AX 3
++#define RTW89_C2HREG_PHYCAP_W1_PROT_11BE 4
+ #define RTW89_C2HREG_PHYCAP_W1_NIC GENMASK(23, 16)
+ #define RTW89_C2HREG_PHYCAP_W1_WL_FUNC GENMASK(31, 24)
+ #define RTW89_C2HREG_PHYCAP_W2_HW_TYPE GENMASK(7, 0)
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index 6734e5d5a5e22..fbce71cd5a05c 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -3061,6 +3061,7 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev)
+ struct rtw89_efuse *efuse = &rtwdev->efuse;
+ struct rtw89_mac_c2h_info c2h_info = {};
+ struct rtw89_hal *hal = &rtwdev->hal;
++ u8 protocol;
+ u8 tx_nss;
+ u8 rx_nss;
+ u8 tx_ant;
+@@ -3108,6 +3109,10 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev)
+ rtw89_debug(rtwdev, RTW89_DBG_FW, "TX path diversity=%d\n", hal->tx_path_diversity);
+ rtw89_debug(rtwdev, RTW89_DBG_FW, "Antenna diversity=%d\n", hal->ant_diversity);
+
++ protocol = u32_get_bits(phycap->w1, RTW89_C2HREG_PHYCAP_W1_PROT);
++ if (protocol < RTW89_C2HREG_PHYCAP_W1_PROT_11BE)
++ hal->no_eht = true;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4807369f0b7a4fcf133960b13895ee7132a090bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 17:06:46 +0800
+Subject: wifi: rtw89: fix potential zero beacon interval in beacon tracking
+
+From: Kuan-Chung Chen <damon.chen@realtek.com>
+
+[ Upstream commit eb57be32f438c57c88d6ce756101c1dfbcc03bba ]
+
+During fuzz testing, it was discovered that bss_conf->beacon_int
+might be zero, which could result in a division by zero error in
+subsequent calculations. Set a default value of 100 TU if the
+interval is zero to ensure stability.
+
+Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251231090647.56407-11-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 53d32f3137ebe..c5934e4eff711 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -2787,7 +2787,7 @@ static void rtw89_core_bcn_track_assoc(struct rtw89_dev *rtwdev,
+
+ rcu_read_lock();
+ bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
+- beacon_int = bss_conf->beacon_int;
++ beacon_int = bss_conf->beacon_int ?: 100;
+ dtim = bss_conf->dtim_period;
+ rcu_read_unlock();
+
+@@ -2817,9 +2817,7 @@ static void rtw89_core_bcn_track_reset(struct rtw89_dev *rtwdev)
+ memset(&rtwdev->bcn_track, 0, sizeof(rtwdev->bcn_track));
+ }
+
+-static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
+- struct ieee80211_bss_conf *bss_conf,
+- struct sk_buff *skb)
++static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, struct sk_buff *skb)
+ {
+ #define RTW89_APPEND_TSF_2GHZ 384
+ #define RTW89_APPEND_TSF_5GHZ 52
+@@ -2828,7 +2826,7 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
+ struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
+ struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
+ struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
+- u32 bcn_intvl_us = ieee80211_tu_to_usec(bss_conf->beacon_int);
++ u32 bcn_intvl_us = ieee80211_tu_to_usec(bcn_track->beacon_int);
+ u64 tsf = le64_to_cpu(mgmt->u.beacon.timestamp);
+ u8 wp, num = bcn_stat->num;
+ u16 append;
+@@ -2836,6 +2834,10 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
+ if (!RTW89_CHK_FW_FEATURE(BEACON_TRACKING, &rtwdev->fw))
+ return;
+
++ /* Skip if not yet associated */
++ if (!bcn_intvl_us)
++ return;
++
+ switch (rx_status->band) {
+ default:
+ case NL80211_BAND_2GHZ:
+@@ -2923,7 +2925,7 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,
+ pkt_stat->beacon_rate = desc_info->data_rate;
+ pkt_stat->beacon_len = skb->len;
+
+- rtw89_vif_rx_bcn_stat(rtwdev, bss_conf, skb);
++ rtw89_vif_rx_bcn_stat(rtwdev, skb);
+ }
+
+ if (!ether_addr_equal(bss_conf->addr, hdr->addr1))
+--
+2.51.0
+
--- /dev/null
+From 50d51d65dea68e022de482a659b6a26907b55ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 09:39:50 +0800
+Subject: wifi: rtw89: fix unable to receive probe responses under MLO
+ connection
+
+From: Po-Hao Huang <phhuang@realtek.com>
+
+[ Upstream commit 6f6d7a325fbde4f025ee1b1277f6f44727e21223 ]
+
+During MLO connections, A1 of the probe responses we received are
+in link address, these frames will then be dropped by mac80211 due to
+not matching the MLD address in ieee80211_scan_accept_presp().
+Fix this by using MLD address to scan when not using random MAC address.
+
+Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260114013950.19704-13-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/fw.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index 7b9d9989e5170..2f68a04cc028f 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -8114,6 +8114,7 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
+ struct cfg80211_scan_request *req = &scan_req->req;
+ const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
+ rtwvif_link->chanctx_idx);
++ struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
+ struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
+ struct rtw89_chanctx_pause_parm pause_parm = {
+ .rsn = RTW89_CHANCTX_PAUSE_REASON_HW_SCAN,
+@@ -8142,6 +8143,8 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
+ if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
+ get_random_mask_addr(mac_addr, req->mac_addr,
+ req->mac_addr_mask);
++ else if (ieee80211_vif_is_mld(vif))
++ ether_addr_copy(mac_addr, vif->addr);
+ else
+ ether_addr_copy(mac_addr, rtwvif_link->mac_addr);
+
+--
+2.51.0
+
--- /dev/null
+From 5ccc750deda5d7875f7559ddef415a746ff71c80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:17 +0800
+Subject: wifi: rtw89: mac: correct page number for CSI response
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit aa2a44d0d22d45d659b9f01638809b1735e46cff ]
+
+For beamforming procedure, hardware reserve memory page for CSI response.
+The unit of register is (value - 1), so add one accordingly as expected.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-7-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac_be.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
+index 9b9e646487346..dee5ff71b75fe 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
+@@ -1175,7 +1175,7 @@ static int resp_pktctl_init_be(struct rtw89_dev *rtwdev, u8 mac_idx)
+
+ reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_RESP_CSI_RESERVED_PAGE, mac_idx);
+ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_START_PAGE_MASK, qt_cfg.pktid);
+- rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num);
++ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num + 1);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 6b8feef86039bc991a5f002ba10d07596bb9d9a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 11:06:51 +0800
+Subject: wifi: rtw89: mcc: reset probe counter when receiving beacon
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit 1b40c1c7571fcf926095ed92f25bd87900bdc8ed ]
+
+For BE chips, needs to transmit QoS null data periodically to ensure
+the connection with AP in GC+STA mode. However, in environments
+with interference, the Qos null data might fail to transmit
+successfully. Therefore, when receive the beacon from AP will
+reset the QoS null data failure counter to avoid unnecessary
+disconnection.
+
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251223030651.480633-13-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/chan.c | 5 ++++-
+ drivers/net/wireless/realtek/rtw89/mac80211.c | 1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c
+index 86f1b39a967fe..8fe6a7ef738f7 100644
+--- a/drivers/net/wireless/realtek/rtw89/chan.c
++++ b/drivers/net/wireless/realtek/rtw89/chan.c
+@@ -2608,17 +2608,20 @@ bool rtw89_mcc_detect_go_bcn(struct rtw89_dev *rtwdev,
+ static void rtw89_mcc_detect_connection(struct rtw89_dev *rtwdev,
+ struct rtw89_mcc_role *role)
+ {
++ struct rtw89_vif_link *rtwvif_link = role->rtwvif_link;
+ struct ieee80211_vif *vif;
+ bool start_detect;
+ int ret;
+
+ ret = rtw89_core_send_nullfunc(rtwdev, role->rtwvif_link, true, false,
+ RTW89_MCC_PROBE_TIMEOUT);
+- if (ret)
++ if (ret &&
++ READ_ONCE(rtwvif_link->sync_bcn_tsf) == rtwvif_link->last_sync_bcn_tsf)
+ role->probe_count++;
+ else
+ role->probe_count = 0;
+
++ rtwvif_link->last_sync_bcn_tsf = READ_ONCE(rtwvif_link->sync_bcn_tsf);
+ if (role->probe_count < RTW89_MCC_PROBE_MAX_TRIES)
+ return;
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
+index f39ca1c2ed100..d08eac3d99266 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
+@@ -127,6 +127,7 @@ static int __rtw89_ops_add_iface_link(struct rtw89_dev *rtwdev,
+ rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT;
+ rtwvif_link->rand_tsf_done = false;
+ rtwvif_link->detect_bcn_count = 0;
++ rtwvif_link->last_sync_bcn_tsf = 0;
+
+ rcu_read_lock();
+
+--
+2.51.0
+
--- /dev/null
+From c98052379a3b4cca2244f5454711035a6217e307 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 16:50:35 +0800
+Subject: wifi: rtw89: pci: restore LDO setting after device resume
+
+From: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+
+[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ]
+
+The LDO (Low Dropout Regulator) setting is missing after suspend/resume
+in some platforms, and it will cause card loss. Therefore, reconfigure
+this setting to avoid it.
+
+Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index b8135cf15d13c..fb4469a76bc03 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -4605,6 +4605,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev)
+ rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1,
+ B_AX_SEL_REQ_ENTR_L1);
+ }
++ rtw89_pci_hci_ldo(rtwdev);
+ rtw89_pci_l2_hci_ldo(rtwdev);
+
+ rtw89_pci_basic_cfg(rtwdev, true);
+--
+2.51.0
+
--- /dev/null
+From 50ae29386aed5f2f8993d4c056b36e54162a370d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 09:39:56 +0800
+Subject: wifi: rtw89: pci: validate release report content before using for
+ RTL8922DE
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 5f93d611b33a05bd03d6843c8efe8cb6a1992620 ]
+
+The commit 957eda596c76
+("wifi: rtw89: pci: validate sequence number of TX release report")
+does validation on existing chips, which somehow a release report of SKB
+becomes malformed. As no clear cause found, add rules ahead for RTL8922DE
+to avoid crash if it happens.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260123013957.16418-11-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index 093960d7279f8..b8135cf15d13c 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -604,8 +604,10 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp)
+
+ info->parse_rpp(rtwdev, rpp, &rpp_info);
+
+- if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) {
+- rtw89_warn(rtwdev, "should no fwcmd release report\n");
++ if (unlikely(rpp_info.txch >= RTW89_TXCH_NUM ||
++ info->tx_dma_ch_mask & BIT(rpp_info.txch))) {
++ rtw89_warn(rtwdev, "should no release report on txch %d\n",
++ rpp_info.txch);
+ return;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5119fbf9fd713801afd4b922ba0bfa636a127120 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:12 +0800
+Subject: wifi: rtw89: pci: validate sequence number of TX release report
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 957eda596c7665f2966970fd1dcc35fe299b38e8 ]
+
+Hardware rarely reports abnormal sequence number in TX release report,
+which will access out-of-bounds of wd_ring->pages array, causing NULL
+pointer dereference.
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] PREEMPT SMP NOPTI
+ CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U
+ 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)
+ Call Trace:
+ <IRQ>
+ rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]
+ rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]
+ net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759
+ handle_softirqs+0xbe/0x290 kernel/softirq.c:601
+ ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]
+ __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423
+ </IRQ>
+ <TASK>
+ rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]
+ ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0
+ irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314
+ ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202
+ ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220
+ kthread+0xea/0x110 kernel/kthread.c:376
+ ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287
+ ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
+ </TASK>
+
+To prevent crash, validate rpp_info.seq before using.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-2-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index a66fcdb0293b6..093960d7279f8 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -604,11 +604,16 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp)
+
+ info->parse_rpp(rtwdev, rpp, &rpp_info);
+
+- if (rpp_info.txch == RTW89_TXCH_CH12) {
++ if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) {
+ rtw89_warn(rtwdev, "should no fwcmd release report\n");
+ return;
+ }
+
++ if (unlikely(rpp_info.seq >= RTW89_PCI_TXWD_NUM_MAX)) {
++ rtw89_warn(rtwdev, "invalid seq %d\n", rpp_info.seq);
++ return;
++ }
++
+ tx_ring = &rtwpci->tx.rings[rpp_info.txch];
+ wd_ring = &tx_ring->wd_ring;
+ txwd = &wd_ring->pages[rpp_info.seq];
+--
+2.51.0
+
--- /dev/null
+From 6207db92e78462bca3d7cb9bc8afa13556a51428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Dec 2025 11:09:25 +0800
+Subject: wifi: rtw89: regd: 6 GHz power type marks default when inactive
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit 8c96752d99c0b094af68317a8c701b09bd0862d9 ]
+
+When inactive, 6 GHz power type has been assigned to the default one,
+but missed to mark the local control variable, dflt, true. Then, this
+might let some 6 GHz power info of disconnected APs keep being taken
+into account under certain cases.
+
+So, mark default when inactive.
+
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251229030926.27004-12-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/regd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/regd.c b/drivers/net/wireless/realtek/rtw89/regd.c
+index 209d84909f885..c3425ed44732e 100644
+--- a/drivers/net/wireless/realtek/rtw89/regd.c
++++ b/drivers/net/wireless/realtek/rtw89/regd.c
+@@ -1142,6 +1142,7 @@ static int rtw89_reg_6ghz_power_recalc(struct rtw89_dev *rtwdev,
+ }
+ } else {
+ rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT;
++ dflt = true;
+ }
+
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From 85a3797d667e2137c0b8c09926d9150638b377c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 11:06:44 +0800
+Subject: wifi: rtw89: ser: enable error IMR after recovering from L1
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit f4de946bdb379f543e3a599f8f048d741ad4a58e ]
+
+After recovering from L1, explicitly enable error IMR to ensure next
+L1 SER (system error recovery) can work normally.
+
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251223030651.480633-6-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac.c | 1 +
+ drivers/net/wireless/realtek/rtw89/mac.h | 1 +
+ drivers/net/wireless/realtek/rtw89/mac_be.c | 1 +
+ drivers/net/wireless/realtek/rtw89/ser.c | 10 ++++++++++
+ 4 files changed, 13 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index d78fbe73e3657..b4c292c7e829d 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -7184,6 +7184,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_ax = {
+ .check_mac_en = rtw89_mac_check_mac_en_ax,
+ .sys_init = sys_init_ax,
+ .trx_init = trx_init_ax,
++ .err_imr_ctrl = err_imr_ctrl_ax,
+ .hci_func_en = rtw89_mac_hci_func_en_ax,
+ .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_ax,
+ .dle_func_en = dle_func_en_ax,
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h
+index 0007229d67537..a4ed1c545609e 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.h
++++ b/drivers/net/wireless/realtek/rtw89/mac.h
+@@ -1019,6 +1019,7 @@ struct rtw89_mac_gen_def {
+ enum rtw89_mac_hwmod_sel sel);
+ int (*sys_init)(struct rtw89_dev *rtwdev);
+ int (*trx_init)(struct rtw89_dev *rtwdev);
++ void (*err_imr_ctrl)(struct rtw89_dev *rtwdev, bool en);
+ void (*hci_func_en)(struct rtw89_dev *rtwdev);
+ void (*dmac_func_pre_en)(struct rtw89_dev *rtwdev);
+ void (*dle_func_en)(struct rtw89_dev *rtwdev, bool enable);
+diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
+index 556e5f98e8d41..9b9e646487346 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
++++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
+@@ -2601,6 +2601,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_be = {
+ .check_mac_en = rtw89_mac_check_mac_en_be,
+ .sys_init = sys_init_be,
+ .trx_init = trx_init_be,
++ .err_imr_ctrl = err_imr_ctrl_be,
+ .hci_func_en = rtw89_mac_hci_func_en_be,
+ .dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_be,
+ .dle_func_en = dle_func_en_be,
+diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
+index f99e179f7ff9f..7fdc69578da31 100644
+--- a/drivers/net/wireless/realtek/rtw89/ser.c
++++ b/drivers/net/wireless/realtek/rtw89/ser.c
+@@ -431,6 +431,14 @@ static void hal_send_m4_event(struct rtw89_ser *ser)
+ rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RCVY_EN);
+ }
+
++static void hal_enable_err_imr(struct rtw89_ser *ser)
++{
++ struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
++
++ mac->err_imr_ctrl(rtwdev, true);
++}
++
+ /* state handler */
+ static void ser_idle_st_hdl(struct rtw89_ser *ser, u8 evt)
+ {
+@@ -552,6 +560,8 @@ static void ser_do_hci_st_hdl(struct rtw89_ser *ser, u8 evt)
+ break;
+
+ case SER_EV_MAC_RESET_DONE:
++ hal_enable_err_imr(ser);
++
+ ser_state_goto(ser, SER_IDLE_ST);
+ break;
+
+--
+2.51.0
+
--- /dev/null
+From c01358eb7c18249d795f2d68ec3e2b8aaa8c2d6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 11:06:50 +0800
+Subject: wifi: rtw89: setting TBTT AGG number when mac port initialization
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit 5e5f83fba48381098b26a8b2513a6d5fc5c66ccb ]
+
+When initializing mac port, needs to set TBTT AGG number to trigger TBTT
+related interrupts. Otherwise, after sending join info H2C command with
+disconnection mode, firmware will clear TBTT AGG number. Without the
+setting from mac port initialization after that, this port will not be
+able to transmit beacons.
+
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251223030651.480633-12-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index b4c292c7e829d..6734e5d5a5e22 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -4341,6 +4341,7 @@ static void rtw89_mac_bcn_drop(struct rtw89_dev *rtwdev,
+ #define BCN_HOLD_DEF 200
+ #define BCN_MASK_DEF 0
+ #define TBTT_ERLY_DEF 5
++#define TBTT_AGG_DEF 1
+ #define BCN_SET_UNIT 32
+ #define BCN_ERLY_SET_DLY (10 * 2)
+
+@@ -4644,6 +4645,16 @@ static void rtw89_mac_port_cfg_tbtt_early(struct rtw89_dev *rtwdev,
+ B_AX_TBTTERLY_MASK, TBTT_ERLY_DEF);
+ }
+
++static void rtw89_mac_port_cfg_tbtt_agg(struct rtw89_dev *rtwdev,
++ struct rtw89_vif_link *rtwvif_link)
++{
++ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
++ const struct rtw89_port_reg *p = mac->port_base;
++
++ rtw89_write16_port_mask(rtwdev, rtwvif_link, p->tbtt_agg,
++ B_AX_TBTT_AGG_NUM_MASK, TBTT_AGG_DEF);
++}
++
+ static void rtw89_mac_port_cfg_bss_color(struct rtw89_dev *rtwdev,
+ struct rtw89_vif_link *rtwvif_link)
+ {
+@@ -4904,6 +4915,7 @@ int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvi
+ rtw89_mac_port_cfg_bcn_hold_time(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_bcn_mask_area(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_tbtt_early(rtwdev, rtwvif_link);
++ rtw89_mac_port_cfg_tbtt_agg(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_bss_color(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_mbssid(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_func_en(rtwdev, rtwvif_link, true);
+--
+2.51.0
+
--- /dev/null
+From f7805324ea7e34d512cbac3ed461f0ad7652e441 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:13 +0800
+Subject: wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
+
+From: Chin-Yen Lee <timlee@realtek.com>
+
+[ Upstream commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b ]
+
+Some APs disconnect clients by sending a Disassociation frame
+rather than a Deauthentication frame. Since these frames use
+different reason codes in WoWLAN mode, this commit adds support
+for handling Disassociation to prevent missed disconnection events.
+
+Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/wow.c | 4 ++++
+ drivers/net/wireless/realtek/rtw89/wow.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
+index 46aba4cb2ee9e..534966b4d9c43 100644
+--- a/drivers/net/wireless/realtek/rtw89/wow.c
++++ b/drivers/net/wireless/realtek/rtw89/wow.c
+@@ -809,6 +809,10 @@ static void rtw89_wow_show_wakeup_reason(struct rtw89_dev *rtwdev)
+
+ reason = rtw89_read8(rtwdev, wow_reason_reg);
+ switch (reason) {
++ case RTW89_WOW_RSN_RX_DISASSOC:
++ wakeup.disconnect = true;
++ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx disassoc\n");
++ break;
+ case RTW89_WOW_RSN_RX_DEAUTH:
+ wakeup.disconnect = true;
+ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx deauth\n");
+diff --git a/drivers/net/wireless/realtek/rtw89/wow.h b/drivers/net/wireless/realtek/rtw89/wow.h
+index d2ba6cebc2a6b..71e07f482174f 100644
+--- a/drivers/net/wireless/realtek/rtw89/wow.h
++++ b/drivers/net/wireless/realtek/rtw89/wow.h
+@@ -33,6 +33,7 @@
+ enum rtw89_wake_reason {
+ RTW89_WOW_RSN_RX_PTK_REKEY = 0x1,
+ RTW89_WOW_RSN_RX_GTK_REKEY = 0x2,
++ RTW89_WOW_RSN_RX_DISASSOC = 0x4,
+ RTW89_WOW_RSN_RX_DEAUTH = 0x8,
+ RTW89_WOW_RSN_DISCONNECT = 0x10,
+ RTW89_WOW_RSN_RX_MAGIC_PKT = 0x21,
+--
+2.51.0
+
--- /dev/null
+From 00ac21f42fa80a07f44692f5df7e64e6e6fe0da7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:58:00 -0800
+Subject: x86/hyperv: Move hv crash init after hypercall pg setup
+
+From: Mukesh R <mrathor@linux.microsoft.com>
+
+[ Upstream commit c3a6ae7ea2d3f507cbddb5818ccc65b9d84d6dc7 ]
+
+hv_root_crash_init() is not setting up the hypervisor crash collection
+for baremetal cases because when it's called, hypervisor page is not
+setup.
+
+Fix is simple, just move the crash init call after the hypercall
+page setup.
+
+Signed-off-by: Mukesh Rathor <mrathor@linux.microsoft.com>
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/hyperv/hv_init.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
+index 14de43f4bc6c1..7f3301bd081ec 100644
+--- a/arch/x86/hyperv/hv_init.c
++++ b/arch/x86/hyperv/hv_init.c
+@@ -558,7 +558,6 @@ void __init hyperv_init(void)
+ memunmap(src);
+
+ hv_remap_tsc_clocksource();
+- hv_root_crash_init();
+ hv_sleep_notifiers_register();
+ } else {
+ hypercall_msr.guest_physical_address = vmalloc_to_pfn(hv_hypercall_pg);
+@@ -567,6 +566,9 @@ void __init hyperv_init(void)
+
+ hv_set_hypercall_pg(hv_hypercall_pg);
+
++ if (hv_root_partition()) /* after set hypercall pg */
++ hv_root_crash_init();
++
+ skip_hypercall_pg_init:
+ /*
+ * hyperv_init() is called before LAPIC is initialized: see
+--
+2.51.0
+
--- /dev/null
+From da2d9117ddfd7bf18e366b364742a826f421ec6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 12:37:49 +0100
+Subject: x86/sev: Use kfree_sensitive() when freeing a SNP message descriptor
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+[ Upstream commit af05e558988ed004a20fc4de7d0f80cfbba663f0 ]
+
+Use the proper helper instead of an open-coded variant.
+
+Closes: https://lore.kernel.org/r/202512202235.WHPQkLZu-lkp@intel.com
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Julia Lawall <julia.lawall@inria.fr>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Link: https://patch.msgid.link/20260112114147.GBaWTd-8HSy_Xp4S3X@fat_crate.local
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/sev/core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c
+index 9ae3b11754e65..c8ddb9febe3d9 100644
+--- a/arch/x86/coco/sev/core.c
++++ b/arch/x86/coco/sev/core.c
+@@ -2008,8 +2008,7 @@ void snp_msg_free(struct snp_msg_desc *mdesc)
+ free_shared_pages(mdesc->request, sizeof(struct snp_guest_msg));
+ iounmap((__force void __iomem *)mdesc->secrets);
+
+- memset(mdesc, 0, sizeof(*mdesc));
+- kfree(mdesc);
++ kfree_sensitive(mdesc);
+ }
+ EXPORT_SYMBOL_GPL(snp_msg_free);
+
+--
+2.51.0
+
--- /dev/null
+From cf5fea3614e156a7ca95596b7915090c61908ec5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 12:00:08 +0800
+Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when
+ CONFIG_X86_PAE is set
+
+From: Hou Wenlong <houwenlong.hwl@antgroup.com>
+
+[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ]
+
+The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests
+do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds
+different pagetables depending on whether CONFIG_X86_PAE is set.
+Therefore, enabling PAE mode for 32-bit KVM guests without
+CONFIG_X86_PAE being set would result in a boot failure during CR3
+loading.
+
+Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <d09ce9a134eb9cbc16928a5b316969f8ba606b81.1768017442.git.houwenlong.hwl@antgroup.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/pvh/head.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
+index 344030c1a81d4..53ee2d53fcf8e 100644
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -91,10 +91,12 @@ SYM_CODE_START(pvh_start_xen)
+
+ leal rva(early_stack_end)(%ebp), %esp
+
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ /* Enable PAE mode. */
+ mov %cr4, %eax
+ orl $X86_CR4_PAE, %eax
+ mov %eax, %cr4
++#endif
+
+ #ifdef CONFIG_X86_64
+ /* Enable Long mode. */
+--
+2.51.0
+
--- /dev/null
+From e9f0c2699c355805f95e0ec8e17a18c3a996ec1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 17:47:29 -0500
+Subject: xenbus: Use .freeze/.thaw to handle xenbus devices
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ]
+
+The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming
+from s3 or s2idle disconnects its PV devices during resume. The
+backends are not expecting this and do not reconnect.
+
+b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/
+resume/chkpt") changed xen_suspend()/do_suspend() from
+PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the
+suspend/resume callbacks remained.
+
+.freeze/restore are used with hiberation where Linux restarts in a new
+place in the future. .suspend/resume are useful for runtime power
+management for the duration of a boot.
+
+The current behavior of the callbacks works for an xl save/restore or
+live migration where the domain is restored/migrated to a new location
+and connecting to a not-already-connected backend.
+
+Change xenbus_pm_ops to use .freeze/thaw/restore and drop the
+.suspend/resume hook. This matches the use in drivers/xen/manage.c for
+save/restore and live migration. With .suspend/resume empty, PV devices
+are left connected during s2idle and s3, so PV devices are not changed
+and work after resume.
+
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Acked-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index 6d1819269cbe5..199917b6f77ca 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev)
+ }
+
+ static const struct dev_pm_ops xenbus_pm_ops = {
+- .suspend = xenbus_dev_suspend,
+- .resume = xenbus_frontend_dev_resume,
+ .freeze = xenbus_dev_suspend,
+ .thaw = xenbus_dev_cancel,
+- .restore = xenbus_dev_resume,
++ .restore = xenbus_frontend_dev_resume,
+ };
+
+ static struct xen_bus_type xenbus_frontend = {
+--
+2.51.0
+
--- /dev/null
+From 8edef5ced29996136a3d5804b5c304364c9d1f07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 00:32:14 +0800
+Subject: ACPI: processor: Fix NULL-pointer dereference in
+ acpi_processor_errata_piix4()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ]
+
+In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
+device and then reassigned an ISA device:
+
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
+ dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
+
+If the first lookup succeeds but the second fails, dev becomes NULL. This
+leads to a potential null-pointer dereference when dev_dbg() is called:
+
+ if (errata.piix4.bmisx)
+ dev_dbg(&dev->dev, ...);
+
+To prevent this, use two temporary pointers and retrieve each device
+independently, avoiding overwriting dev with a possible NULL value.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+[ rjw: Subject adjustment, added an empty code line ]
+Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_processor.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index c0f9cf9768ea9..5e409f86f0709 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -39,6 +39,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ {
+ u8 value1 = 0;
+ u8 value2 = 0;
++ struct pci_dev *ide_dev = NULL, *isa_dev = NULL;
+
+
+ if (!dev)
+@@ -96,12 +97,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * each IDE controller's DMA status to make sure we catch all
+ * DMA activity.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- errata.piix4.bmisx = pci_resource_start(dev, 4);
+- pci_dev_put(dev);
++ if (ide_dev) {
++ errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
++ pci_dev_put(ide_dev);
+ }
+
+ /*
+@@ -113,24 +114,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
+ * disable C3 support if this is enabled, as some legacy
+ * devices won't operate well if fast DMA is disabled.
+ */
+- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
++ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_82371AB_0,
+ PCI_ANY_ID, PCI_ANY_ID, NULL);
+- if (dev) {
+- pci_read_config_byte(dev, 0x76, &value1);
+- pci_read_config_byte(dev, 0x77, &value2);
++ if (isa_dev) {
++ pci_read_config_byte(isa_dev, 0x76, &value1);
++ pci_read_config_byte(isa_dev, 0x77, &value2);
+ if ((value1 & 0x80) || (value2 & 0x80))
+ errata.piix4.fdma = 1;
+- pci_dev_put(dev);
++ pci_dev_put(isa_dev);
+ }
+
+ break;
+ }
+
+- if (errata.piix4.bmisx)
+- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
+- if (errata.piix4.fdma)
+- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
++ if (ide_dev)
++ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
++
++ if (isa_dev)
++ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 46290166990146f3a0a08a33991518145687f8f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 13:25:33 +0100
+Subject: ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ]
+
+The ACPI specification states that when executing AML_FATAL_OP,
+the OS should log the fatal error event and shutdown in a timely
+fashion.
+
+Windows complies with this requirement by immediatly entering a
+Bso_d, effectively aborting the execution of the AML bytecode in
+question.
+
+ACPICA however might continue with the AML bytecode execution
+should acpi_os_signal() simply return AE_OK. This will cause issues
+because ACPI BIOS implementations might assume that the Fatal()
+operator does not return.
+
+Fix this by aborting the AML bytecode execution in such a case
+by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a
+local variable because of its small size (12 bytes) and to ensure
+that acpi_os_signal() always receives valid information about the
+fatal ACPI BIOS error.
+
+Link: https://github.com/acpica/acpica/commit/d516c7758ba6
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++---------------------
+ 1 file changed, 18 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
+index d3091f619909e..41758343657dd 100644
+--- a/drivers/acpi/acpica/exoparg3.c
++++ b/drivers/acpi/acpica/exoparg3.c
+@@ -10,6 +10,7 @@
+ #include <acpi/acpi.h>
+ #include "accommon.h"
+ #include "acinterp.h"
++#include <acpi/acoutput.h>
+ #include "acparser.h"
+ #include "amlcode.h"
+
+@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3")
+ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ {
+ union acpi_operand_object **operand = &walk_state->operands[0];
+- struct acpi_signal_fatal_info *fatal;
+- acpi_status status = AE_OK;
++ struct acpi_signal_fatal_info fatal;
+
+ ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R,
+ acpi_ps_get_opcode_name(walk_state->opcode));
+@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ switch (walk_state->opcode) {
+ case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */
+
+- ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+- "FatalOp: Type %X Code %X Arg %X "
+- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
+- (u32)operand[0]->integer.value,
+- (u32)operand[1]->integer.value,
+- (u32)operand[2]->integer.value));
+-
+- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info));
+- if (fatal) {
+- fatal->type = (u32) operand[0]->integer.value;
+- fatal->code = (u32) operand[1]->integer.value;
+- fatal->argument = (u32) operand[2]->integer.value;
+- }
++ fatal.type = (u32)operand[0]->integer.value;
++ fatal.code = (u32)operand[1]->integer.value;
++ fatal.argument = (u32)operand[2]->integer.value;
+
+- /* Always signal the OS! */
++ ACPI_BIOS_ERROR((AE_INFO,
++ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n",
++ fatal.type, fatal.code, fatal.argument));
+
+- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal);
++ /* Always signal the OS! */
+
+- /* Might return while OS is shutting down, just continue */
++ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal);
+
+- ACPI_FREE(fatal);
+- goto cleanup;
++ /*
++ * Might return while OS is shutting down, so abort the AML execution
++ * by returning an error.
++ */
++ return_ACPI_STATUS(AE_ERROR);
+
+ case AML_EXTERNAL_OP:
+ /*
+@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
+ * wrong if an external opcode ever gets here.
+ */
+ ACPI_ERROR((AE_INFO, "Executed External Op"));
+- status = AE_OK;
+- goto cleanup;
++
++ return_ACPI_STATUS(AE_OK);
+
+ default:
+
+ ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X",
+ walk_state->opcode));
+
+- status = AE_AML_BAD_OPCODE;
+- goto cleanup;
++ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
+ }
+-
+-cleanup:
+-
+- return_ACPI_STATUS(status);
+ }
+
+ /*******************************************************************************
+--
+2.51.0
+
--- /dev/null
+From 8bb32205f8b4cb46ae6e4553a375e26ac7005753 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 23:55:01 +0800
+Subject: ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
+
+From: gongqi <550230171hxy@gmail.com>
+
+[ Upstream commit f2581ea2d9f30844c437e348a462027ea25c12e9 ]
+
+The headset microphone on the MECHREVO Wujie 15X Pro requires the
+CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID
+(0x1d05:0x3012) to the quirk table.
+
+Signed-off-by: gongqi <550230171hxy@gmail.com>
+Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 157efd1530fbf..fd141185ce2b9 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1127,6 +1127,7 @@ static const struct hda_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
+ SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
++ SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC),
+ HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER),
+ HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER),
+ {}
+--
+2.51.0
+
--- /dev/null
+From b2d6b4634f08f6d4b48dab6bd2c05db9a949058b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 08:38:29 +0000
+Subject: ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
+
+From: Lianqin Hu <hulianqin@vivo.com>
+
+[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ]
+
+Setting up the interface when suspended/resumeing fail on this card.
+Adding a reset and delay quirk will eliminate this problem.
+
+usb 1-1: New USB device found, idVendor=001f, idProduct=0b21
+usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+usb 1-1: Product: AB13X USB Audio
+usb 1-1: Manufacturer: Generic
+usb 1-1: SerialNumber: 20210926172016
+
+Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
+Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index cde5b5c165096..ff2bbe761ee3a 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2047,6 +2047,8 @@ struct usb_audio_quirk_flags_table {
+
+ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ /* Device matches */
++ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */
++ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
+ DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
+ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
+ DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
+--
+2.51.0
+
--- /dev/null
+From 1be1cf1dfca3b8abe16679fcf35eae60a1ba4160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:07 +0100
+Subject: ALSA: usb-audio: Add sanity check for OOB writes at silencing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ]
+
+At silencing the playback URB packets in the implicit fb mode before
+the actual playback, we blindly assume that the received packets fit
+with the buffer size. But when the setup in the capture stream
+differs from the playback stream (e.g. due to the USB core limitation
+of max packet size), such an inconsistency may lead to OOB writes to
+the buffer, resulting in a crash.
+
+For addressing it, add a sanity check of the transfer buffer size at
+prepare_silent_urb(), and stop the data copy if the received data
+overflows. Also, report back the transfer error properly from there,
+too.
+
+Note that this doesn't fix the root cause of the playback error
+itself, but this merely covers the kernel Oops.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
+Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 39 ++++++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 17 deletions(-)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index d33835a769f5e..1092b964167e9 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -278,8 +278,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip)
+ return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH;
+ }
+
+-static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+- struct snd_urb_ctx *ctx)
++static int prepare_silent_urb(struct snd_usb_endpoint *ep,
++ struct snd_urb_ctx *ctx)
+ {
+ struct urb *urb = ctx->urb;
+ unsigned int offs = 0;
+@@ -292,28 +292,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+ extra = sizeof(packet_length);
+
+ for (i = 0; i < ctx->packets; ++i) {
+- unsigned int offset;
+- unsigned int length;
+- int counts;
+-
+- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
+- length = counts * ep->stride; /* number of silent bytes */
+- offset = offs * ep->stride + extra * i;
+- urb->iso_frame_desc[i].offset = offset;
++ int length;
++
++ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
++ if (length < 0)
++ return length;
++ length *= ep->stride; /* number of silent bytes */
++ if (offs + length + extra > ctx->buffer_size)
++ break;
++ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = length + extra;
+ if (extra) {
+ packet_length = cpu_to_le32(length);
+- memcpy(urb->transfer_buffer + offset,
++ memcpy(urb->transfer_buffer + offs,
+ &packet_length, sizeof(packet_length));
++ offs += extra;
+ }
+- memset(urb->transfer_buffer + offset + extra,
++ memset(urb->transfer_buffer + offs,
+ ep->silence_value, length);
+- offs += counts;
++ offs += length;
+ }
+
+- urb->number_of_packets = ctx->packets;
+- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra;
++ if (!offs)
++ return -EPIPE;
++
++ urb->number_of_packets = i;
++ urb->transfer_buffer_length = offs;
+ ctx->queued = 0;
++ return 0;
+ }
+
+ /*
+@@ -335,8 +341,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep,
+ if (data_subs && ep->prepare_data_urb)
+ return ep->prepare_data_urb(data_subs, urb, in_stream_lock);
+ /* no data provider, so send silence */
+- prepare_silent_urb(ep, ctx);
+- break;
++ return prepare_silent_urb(ep, ctx);
+
+ case SND_USB_ENDPOINT_TYPE_SYNC:
+ if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) {
+--
+2.51.0
+
--- /dev/null
+From b2eecf54a9b9d5f04700a78e61f275382e227cf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Feb 2026 15:12:05 +0100
+Subject: ALSA: usb-audio: Update the number of packets properly at receiving
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ]
+
+At receiving the packets from the implicit feedback source, we didn't
+update ctx->packets field but only the ctx->packet_size[] data.
+In exceptional cases, this might lead to unexpectedly superfluous data
+transfer (although this won't happen usually due to the nature of USB
+isochronous transfer). Fix it to update the field properly.
+
+Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 17ae74b067c5e..d33835a769f5e 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -489,6 +489,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+
+ /* copy over the length information */
+ if (implicit_fb) {
++ ctx->packets = packet->packets;
+ for (i = 0; i < packet->packets; i++)
+ ctx->packet_size[i] = packet->packet_size[i];
+ }
+--
+2.51.0
+
--- /dev/null
+From 9c7637ef2a414220be06a3e15a3a2196e637b295 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:05 +0100
+Subject: APEI/GHES: ensure that won't go past CPER allocated record
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ]
+
+The logic at ghes_new() prevents allocating too large records, by
+checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
+Yet, the allocation is done with the actual number of pages from the
+CPER bios table location, which can be smaller.
+
+Yet, a bad firmware could send data with a different size, which might
+be bigger than the allocated memory, causing an OOPS:
+
+ Unable to handle kernel paging request at virtual address fff00000f9b40000
+ Mem abort info:
+ ESR = 0x0000000096000007
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x07: level 3 translation fault
+ Data abort info:
+ ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+ swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
+ [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
+ Internal error: Oops: 0000000096000007 [#1] SMP
+ Modules linked in:
+ CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
+ Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
+ Workqueue: kacpi_notify acpi_os_execute_deferred
+ pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+ pc : hex_dump_to_buffer+0x30c/0x4a0
+ lr : hex_dump_to_buffer+0x328/0x4a0
+ sp : ffff800080e13880
+ x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
+ x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
+ x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
+ x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
+ x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
+ x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
+ x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
+ x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
+ x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
+ x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
+ Call trace:
+ hex_dump_to_buffer+0x30c/0x4a0 (P)
+ print_hex_dump+0xac/0x170
+ cper_estatus_print_section+0x90c/0x968
+ cper_estatus_print+0xf0/0x158
+ __ghes_print_estatus+0xa0/0x148
+ ghes_proc+0x1bc/0x220
+ ghes_notify_hed+0x5c/0xb8
+ notifier_call_chain+0x78/0x148
+ blocking_notifier_call_chain+0x4c/0x80
+ acpi_hed_notify+0x28/0x40
+ acpi_ev_notify_dispatch+0x50/0x80
+ acpi_os_execute_deferred+0x24/0x48
+ process_one_work+0x15c/0x3b0
+ worker_thread+0x2d0/0x400
+ kthread+0x148/0x228
+ ret_from_fork+0x10/0x20
+ Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
+ ---[ end trace 0000000000000000 ]---
+
+Prevent that by taking the actual allocated are into account when
+checking for CPER length.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 6 +++++-
+ include/acpi/ghes.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index e768dfd345fb2..9c0d256fc72b1 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -28,6 +28,7 @@
+ #include <linux/timer.h>
+ #include <linux/cper.h>
+ #include <linux/platform_device.h>
++#include <linux/minmax.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+ #include <linux/vmalloc.h>
+@@ -290,6 +291,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
+ error_block_length = GHES_ESTATUS_MAX_SIZE;
+ }
+ ghes->estatus = kmalloc(error_block_length, GFP_KERNEL);
++ ghes->estatus_length = error_block_length;
+ if (!ghes->estatus) {
+ rc = -ENOMEM;
+ goto err_unmap_status_addr;
+@@ -361,13 +363,15 @@ static int __ghes_check_estatus(struct ghes *ghes,
+ struct acpi_hest_generic_status *estatus)
+ {
+ u32 len = cper_estatus_len(estatus);
++ u32 max_len = min(ghes->generic->error_block_length,
++ ghes->estatus_length);
+
+ if (len < sizeof(*estatus)) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n");
+ return -EIO;
+ }
+
+- if (len > ghes->generic->error_block_length) {
++ if (!len || len > max_len) {
+ pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n");
+ return -EIO;
+ }
+diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
+index be1dd4c1a9174..16646fdd1f841 100644
+--- a/include/acpi/ghes.h
++++ b/include/acpi/ghes.h
+@@ -21,6 +21,7 @@ struct ghes {
+ struct acpi_hest_generic_v2 *generic_v2;
+ };
+ struct acpi_hest_generic_status *estatus;
++ unsigned int estatus_length;
+ unsigned long flags;
+ union {
+ struct list_head list;
+--
+2.51.0
+
--- /dev/null
+From 350ba285a6bf9cb894974938f2a7f23e0ea151a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 10:56:33 +0100
+Subject: ARM: 9467/1: mm: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weissschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ]
+
+Restricted pointers ("%pK") were never meant to be used
+through printk(). They can acquire sleeping locks in atomic contexts.
+
+Switch to %px over the more secure %p as this usage is a debugging aid,
+gated behind CONFIG_DEBUG_VIRTUAL and used by WARN().
+
+Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/physaddr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c
+index 3f263c840ebc4..1a37ebfacbba9 100644
+--- a/arch/arm/mm/physaddr.c
++++ b/arch/arm/mm/physaddr.c
+@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x)
+ phys_addr_t __virt_to_phys(unsigned long x)
+ {
+ WARN(!__virt_addr_valid(x),
+- "virt_to_phys used for non-linear address: %pK (%pS)\n",
++ "virt_to_phys used for non-linear address: %px (%pS)\n",
+ (void *)x, (void *)x);
+
+ return __virt_to_phys_nodebug(x);
+--
+2.51.0
+
--- /dev/null
+From 7ad3c74f3e17464007c6b5788b50fe0b0d6e83f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 17:24:48 +0800
+Subject: arm64: Add support for TSV110 Spectre-BHB mitigation
+
+From: Jinqian Yang <yangjinqian1@huawei.com>
+
+[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ]
+
+The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
+Buffer) attack, which can be exploited to leak information through
+branch prediction side channels. This commit adds the MIDR of TSV110
+to the list for software mitigation.
+
+Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
+Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/proton-pack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
+index 2c81e0efaf378..19518a9da53f8 100644
+--- a/arch/arm64/kernel/proton-pack.c
++++ b/arch/arm64/kernel/proton-pack.c
+@@ -896,6 +896,7 @@ static u8 spectre_bhb_loop_affected(void)
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ {},
+ };
+ static const struct midr_range spectre_bhb_k24_list[] = {
+--
+2.51.0
+
--- /dev/null
+From 85deb4a27b3ffa9810780cff62a617922c99c842 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 21:27:21 +0000
+Subject: arm64: tegra: smaug: Add usb-role-switch support
+
+From: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+
+[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ]
+
+The USB2 port on Smaug is configured for OTG operation but lacked the
+required 'usb-role-switch' property, leading to a failed probe and a
+non-functioning USB port. Add the property along with setting the default
+role to host.
+
+Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+index 53805555dd2d2..a75c6c1928a4a 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+@@ -1724,6 +1724,8 @@ usb2-0 {
+ status = "okay";
+ vbus-supply = <&usbc_vbus>;
+ mode = "otg";
++ usb-role-switch;
++ role-switch-default-mode = "host";
+ };
+
+ usb3-0 {
+--
+2.51.0
+
--- /dev/null
+From 0fc0733d12eedf8951e071011b9d2931ca084835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 17:19:04 +0800
+Subject: ASoC: codecs: max98390: Check return value of
+ devm_gpiod_get_optional() in max98390_i2c_probe()
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ]
+
+The devm_gpiod_get_optional() function may return an error pointer
+(ERR_PTR) in case of a genuine failure during GPIO acquisition,
+not just NULL which indicates the legitimate absence of an optional
+GPIO.
+
+Add an IS_ERR() check after the function call to catch such errors and
+propagate them to the probe function, ensuring the driver fails to load
+safely rather than proceeding with an invalid pointer.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98390.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c
+index 5b8e78e516302..f2a1306d042b7 100644
+--- a/sound/soc/codecs/max98390.c
++++ b/sound/soc/codecs/max98390.c
+@@ -1076,6 +1076,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c)
+
+ reset_gpio = devm_gpiod_get_optional(&i2c->dev,
+ "reset", GPIOD_OUT_HIGH);
++ if (IS_ERR(reset_gpio))
++ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio),
++ "Failed to get reset gpio\n");
+
+ /* Power on device */
+ if (reset_gpio) {
+--
+2.51.0
+
--- /dev/null
+From 7e0582a5f58ea53997019ae4034a5e7e27f7b761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jan 2026 00:00:17 +0800
+Subject: ASoC: es8328: Add error unwind in resume
+
+From: Hsieh Hung-En <hungen3108@gmail.com>
+
+[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ]
+
+Handle failures in the resume path by unwinding previously enabled
+resources.
+
+If enabling regulators or syncing the regcache fails, disable regulators
+and unprepare the clock to avoid leaking resources and leaving the device
+in a partially resumed state.
+
+Signed-off-by: Hsieh Hung-En <hungen3108@gmail.com>
+Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index 43792e175d75f..864c6a858628d 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -750,17 +750,23 @@ static int es8328_resume(struct snd_soc_component *component)
+ es8328->supplies);
+ if (ret) {
+ dev_err(component->dev, "unable to enable regulators\n");
+- return ret;
++ goto err_clk;
+ }
+
+ regcache_mark_dirty(regmap);
+ ret = regcache_sync(regmap);
+ if (ret) {
+ dev_err(component->dev, "unable to sync regcache\n");
+- return ret;
++ goto err_regulators;
+ }
+
+ return 0;
++
++err_regulators:
++ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies);
++err_clk:
++ clk_disable_unprepare(es8328->clk);
++ return ret;
+ }
+
+ static int es8328_component_probe(struct snd_soc_component *component)
+--
+2.51.0
+
--- /dev/null
+From 60695e1a55c8bed1224eb20e26efc5f9fbfa26b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 11:32:50 +0800
+Subject: ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ]
+
+Add check for the return value of devm_regmap_init_mmio() and return the
+error if it fails in order to catch the error.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun50i-dmic.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c
+index 2599683a582dc..9071bc4835759 100644
+--- a/sound/soc/sunxi/sun50i-dmic.c
++++ b/sound/soc/sunxi/sun50i-dmic.c
+@@ -324,6 +324,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev)
+
+ host->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+ &sun50i_dmic_regmap_config);
++ if (IS_ERR(host->regmap))
++ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap),
++ "failed to initialise regmap\n");
+
+ /* Clocks */
+ host->bus_clk = devm_clk_get(&pdev->dev, "bus");
+--
+2.51.0
+
--- /dev/null
+From 6980cfc036becd6207b3a381d3a54fcd6645596b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:08 +0100
+Subject: ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ]
+
+This bit is handled by a separate control.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 4f50b07848fd8..8aaa91a16d8b9 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1759,7 +1759,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18),
+
+
+ SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0),
+-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA),
++SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX),
+
+ SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0),
+ SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA),
+--
+2.51.0
+
--- /dev/null
+From 64c7058e6d91976095c8b4ee2ab64419d0be39fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 04:02:10 +0100
+Subject: ASoC: wm8962: Don't report a microphone if it's shorted to ground on
+ plug
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ]
+
+This usually means that a TRS plug with no microphone pin has been plugged
+into a TRRS socket. Cases where a user is plugging in a microphone while
+pressing a button will be handled via incoming interrupt after the user
+releases the button, so the microphone will still be detected once it
+becomes usable.
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 8aaa91a16d8b9..68a5ca176d6f0 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -67,6 +67,8 @@ struct wm8962_priv {
+ struct mutex dsp2_ena_lock;
+ u16 dsp2_ena;
+
++ int mic_status;
++
+ struct delayed_work mic_work;
+ struct snd_soc_jack *jack;
+
+@@ -3073,8 +3075,16 @@ static void wm8962_mic_work(struct work_struct *work)
+ if (reg & WM8962_MICSHORT_STS) {
+ status |= SND_JACK_BTN_0;
+ irq_pol |= WM8962_MICSCD_IRQ_POL;
++
++ /* Don't report a microphone if it's shorted right after
++ * plugging in, as this may be a TRS plug in a TRRS socket.
++ */
++ if (!(wm8962->mic_status & WM8962_MICDET_STS))
++ status = 0;
+ }
+
++ wm8962->mic_status = status;
++
+ snd_soc_jack_report(wm8962->jack, status,
+ SND_JACK_MICROPHONE | SND_JACK_BTN_0);
+
+--
+2.51.0
+
--- /dev/null
+From 761bd80303d90e09e0abb93ced17c54d973670f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:46:22 +0800
+Subject: ata: libata: avoid long timeouts on hot-unplugged SATA DAS
+
+From: Henry Tseng <henrytseng@qnap.com>
+
+[ Upstream commit 151cabd140322205e27dae5c4bbf261ede0056e3 ]
+
+When a SATA DAS enclosure is connected behind a Thunderbolt PCIe
+switch, hot-unplugging the whole enclosure causes pciehp to tear down
+the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and
+START STOP UNIT for the disks.
+
+libata still queues these commands and the AHCI driver tries to access
+the HBA registers even though the PCI channel is already offline. This
+results in a series of timeouts and error recovery attempts, e.g.:
+
+ [ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
+ [ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec)
+ [ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec)
+ [ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec)
+ [ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+ ...
+ [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec)
+ [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec)
+ [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec)
+ [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+
+With this patch applied, the same hot-unplug looks like:
+
+ [ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
+ [ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+ ...
+ [ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
+ Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
+
+In this test setup with two disks, the hot-unplug sequence shrinks from
+about 226 seconds (~3.8 minutes) between the Link Down event and the
+last SYNCHRONIZE CACHE failure to under a second. Without this patch the
+total delay grows roughly with the number of disks, because each disk
+gets its own SYNCHRONIZE CACHE and qc timeout series.
+
+If the underlying PCI device is already gone, these commands cannot
+succeed anyway. Avoid issuing them by introducing
+ata_adapter_is_online(), which checks pci_channel_offline() for
+PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL,
+causing the SCSI layer to fail new commands with DID_BAD_TARGET
+immediately, and from ata_qc_issue() to bail out before touching the
+HBA registers.
+
+Since such failures would otherwise trigger libata error handling,
+ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler().
+When the adapter is offline, libata skips ap->ops->error_handler(ap) and
+completes error handling using the existing path, rather than running
+a full EH sequence against a dead adapter.
+
+With this change, SYNCHRONIZE CACHE and START STOP UNIT commands
+issued during hot-unplug fail quickly once the PCI channel is offline,
+without qc timeout spam or long libata EH delays.
+
+Suggested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Henry Tseng <henrytseng@qnap.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 24 ++++++++++++++++++++++++
+ drivers/ata/libata-eh.c | 3 ++-
+ drivers/ata/libata-scsi.c | 3 +++
+ drivers/ata/libata.h | 1 +
+ 4 files changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index d5e713f284b71..91c6291b01f4e 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2318,6 +2318,24 @@ static bool ata_dev_check_adapter(struct ata_device *dev,
+ return false;
+ }
+
++bool ata_adapter_is_online(struct ata_port *ap)
++{
++ struct device *dev;
++
++ if (!ap || !ap->host)
++ return false;
++
++ dev = ap->host->dev;
++ if (!dev)
++ return false;
++
++ if (dev_is_pci(dev) &&
++ pci_channel_offline(to_pci_dev(dev)))
++ return false;
++
++ return true;
++}
++
+ static int ata_dev_config_ncq(struct ata_device *dev,
+ char *desc, size_t desc_sz)
+ {
+@@ -5023,6 +5041,12 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
+ qc->flags |= ATA_QCFLAG_ACTIVE;
+ ap->qc_active |= 1ULL << qc->tag;
+
++ /* Make sure the device is still accessible. */
++ if (!ata_adapter_is_online(ap)) {
++ qc->err_mask |= AC_ERR_HOST_BUS;
++ goto sys_err;
++ }
++
+ /*
+ * We guarantee to LLDs that they will have at least one
+ * non-zero sg if the command is a data command.
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 3263fc13491e1..fc2c508c41bd4 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -723,7 +723,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap)
+ spin_unlock_irqrestore(ap->lock, flags);
+
+ /* invoke EH, skip if unloading or suspended */
+- if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)))
++ if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)) &&
++ ata_adapter_is_online(ap))
+ ap->ops->error_handler(ap);
+ else {
+ /* if unloading, commence suicide */
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 8f6a7acf770e4..51980996200c8 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2867,6 +2867,9 @@ ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev)
+ {
+ struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev);
+
++ if (!ata_adapter_is_online(ap))
++ return NULL;
++
+ if (unlikely(!dev || !ata_dev_enabled(dev)))
+ return NULL;
+
+diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
+index 05ac80da8ebc7..9927d79e55878 100644
+--- a/drivers/ata/libata.h
++++ b/drivers/ata/libata.h
+@@ -75,6 +75,7 @@ extern int atapi_check_dma(struct ata_queued_cmd *qc);
+ extern void swap_buf_le16(u16 *buf, unsigned int buf_words);
+ extern bool ata_phys_link_online(struct ata_link *link);
+ extern bool ata_phys_link_offline(struct ata_link *link);
++bool ata_adapter_is_online(struct ata_port *ap);
+ extern void ata_dev_init(struct ata_device *dev);
+ extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp);
+ extern int sata_link_init_spd(struct ata_link *link);
+--
+2.51.0
+
--- /dev/null
+From 0c4ebabf73a9c8cdf111e1f5b56cf90bba980641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 20:49:30 +0100
+Subject: audit: add fchmodat2() to change attributes class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ]
+
+fchmodat2(), introduced in version 6.6 is currently not in the change
+attribute class of audit. Calling fchmodat2() to change a file
+attribute in the same fashion than chmod() or fchmodat() will bypass
+audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds fchmodat2() to the change attributes class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_change_attr.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h
+index 331670807cf01..6c311d4d37f4e 100644
+--- a/include/asm-generic/audit_change_attr.h
++++ b/include/asm-generic/audit_change_attr.h
+@@ -20,6 +20,9 @@ __NR_fremovexattr,
+ __NR_fchownat,
+ __NR_fchmodat,
+ #endif
++#ifdef __NR_fchmodat2
++__NR_fchmodat2,
++#endif
+ #ifdef __NR_chown32
+ __NR_chown32,
+ __NR_fchown32,
+--
+2.51.0
+
--- /dev/null
+From 44f325108849c74a8a9ddf3c8e0238710da6ae16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Dec 2025 09:39:24 +0100
+Subject: audit: add missing syscalls to read class
+
+From: Jeffrey Bencteux <jeff@bencteux.fr>
+
+[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ]
+
+The "at" variant of getxattr() and listxattr() are missing from the
+audit read class. Calling getxattrat() or listxattrat() on a file to
+read its extended attributes will bypass audit rules such as:
+
+-w /tmp/test -p rwa -k test_rwa
+
+The current patch adds missing syscalls to the audit read class.
+
+Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/audit_read.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h
+index 7bb7b5a83ae2e..fb9991f53fb6f 100644
+--- a/include/asm-generic/audit_read.h
++++ b/include/asm-generic/audit_read.h
+@@ -4,9 +4,15 @@ __NR_readlink,
+ #endif
+ __NR_quotactl,
+ __NR_listxattr,
++#ifdef __NR_listxattrat
++__NR_listxattrat,
++#endif
+ __NR_llistxattr,
+ __NR_flistxattr,
+ __NR_getxattr,
++#ifdef __NR_getxattrat
++__NR_getxattrat,
++#endif
+ __NR_lgetxattr,
+ __NR_fgetxattr,
+ #ifdef __NR_readlinkat
+--
+2.51.0
+
--- /dev/null
+From 0cd4003159944ef5eeb0259c85a90b32e68a0681 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 15:29:50 +0100
+Subject: binder: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log. Since commit ad67b74d2469 ("printk: hash
+addresses printed with %p") the regular %p has been improved to avoid
+this issue. Furthermore, restricted pointers ("%pK") were never meant
+to be used through printk(). They can still unintentionally leak raw
+pointers or acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+There are still a few users of %pK left, but these use it through
+seq_file, for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Carlos Llamas <cmllamas@google.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binder.c | 2 +-
+ drivers/android/binder_alloc.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 43f11f66970b2..73408a5b45b3b 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4211,7 +4211,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ }
+ }
+ binder_debug(BINDER_DEBUG_DEAD_BINDER,
+- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+ proc->pid, thread->pid, (u64)cookie,
+ death);
+ if (death == NULL) {
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 34c27223cb7dd..6a4be6087ae6b 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -79,7 +79,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc,
+ new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: add free buffer, size %zd, at %pK\n",
++ "%d: add free buffer, size %zd, at %p\n",
+ alloc->pid, new_buffer_size, new_buffer);
+
+ while (*p) {
+@@ -474,7 +474,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
+ }
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
++ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
+ alloc->pid, size, buffer, buffer_size);
+
+ has_page_addr = (void __user *)
+@@ -646,7 +646,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
+ ALIGN(buffer->extra_buffers_size, sizeof(void *));
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+- "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
++ "%d: binder_free_buf %p size %zd buffer_size %zd\n",
+ alloc->pid, buffer, size, buffer_size);
+
+ BUG_ON(buffer->free);
+--
+2.51.0
+
--- /dev/null
+From 8a7c8abb60095c3f418891f4ef9b53197311a107 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 16:05:22 +0800
+Subject: blk-mq-debugfs: add missing debugfs_mutex in
+ blk_mq_debugfs_register_hctxs()
+
+From: Yu Kuai <yukuai@fnnas.com>
+
+[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ]
+
+In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while
+creating debugfs entries for hctxs. Hence add debugfs_mutex there,
+it's safe because queue is not frozen.
+
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index c3b5930106b28..e0677043f00de 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -730,8 +730,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ unsigned long i;
+
++ mutex_lock(&q->debugfs_mutex);
+ queue_for_each_hw_ctx(q, hctx, i)
+ blk_mq_debugfs_register_hctx(q, hctx);
++ mutex_unlock(&q->debugfs_mutex);
+ }
+
+ void blk_mq_debugfs_unregister_hctxs(struct request_queue *q)
+--
+2.51.0
+
--- /dev/null
+From ece9ed9ba24416b1739275afd8cc15aea5c1001d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 10:13:04 +0100
+Subject: Bluetooth: btusb: Add device ID for Realtek RTL8761BU
+
+From: Jacopo Scannella <code@charlie.cat>
+
+[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ]
+
+Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek
+RTL8761BU Bluetooth adapter.
+
+Reference:
+https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth
+
+Signed-off-by: Jacopo Scannella <code@charlie.cat>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 5381fa17d5e89..168e46ce59976 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -721,6 +721,7 @@ static const struct usb_device_id quirks_table[] = {
+
+ /* Additional Realtek 8723BU Bluetooth devices */
+ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK },
+
+ /* Additional Realtek 8723DE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
+--
+2.51.0
+
--- /dev/null
+From 8fe298ac8594ab69373c333e6a99ddbf81ac74e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 15:03:35 +1100
+Subject: Bluetooth: btusb: Add new VID/PID for RTL8852CE
+
+From: Shell Chen <w27@sorz.org>
+
+[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ]
+
+Add VID:PID 13d3:3612 to the quirks_table.
+
+This ID pair is found in the Realtek RTL8852CE PCIe module
+in an ASUS TUF A14 2025 (FA401KM) laptop.
+
+Tested on aforementioned laptop.
+
+The device info from /sys/kernel/debug/usb/devices is listed as below.
+
+T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3612 Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=Bluetooth Radio
+S: SerialNumber=00e04c000001
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+
+Signed-off-by: Shell Chen <w27@sorz.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index eaeacdadb2023..5381fa17d5e89 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -548,6 +548,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
+--
+2.51.0
+
--- /dev/null
+From 3f9baf0e0e4f21c236a14774ddcd66696710f302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:10 +0100
+Subject: Bluetooth: hci_conn: Set link_policy on incoming ACL connections
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d ]
+
+The connection link policy is only set when establishing an outgoing
+ACL connection causing connection idle modes not to be available on
+incoming connections. Move the setting of the link policy to the
+creation of the connection so all ACL connection will use the link
+policy set on the HCI device.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 1 +
+ net/bluetooth/hci_sync.c | 2 --
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index ff9d2520ba749..a7a37dfa47d5a 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -951,6 +951,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t
+ switch (type) {
+ case ACL_LINK:
+ conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
++ conn->link_policy = hdev->link_policy;
+ conn->mtu = hdev->acl_mtu;
+ break;
+ case LE_LINK:
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index f0eb52d5c0581..6a14f76071077 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -6860,8 +6860,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
+
+ conn->attempt++;
+
+- conn->link_policy = hdev->link_policy;
+-
+ memset(&cp, 0, sizeof(cp));
+ bacpy(&cp.bdaddr, &conn->dst);
+ cp.pscan_rep_mode = 0x02;
+--
+2.51.0
+
--- /dev/null
+From a39be69ef613374eeb59eb0f4a3313380784d4df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 10:20:09 +0100
+Subject: Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Sørensen <ssorensen@roku.com>
+
+[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ]
+
+hci_conn_enter_active_mode() uses queue_delayed_work() with the
+intention that the work will run after the given timeout. However,
+queue_delayed_work() does nothing if the work is already queued, so
+depending on the link policy we may end up putting the connection
+into idle mode every hdev->idle_timeout ms.
+
+Use mod_delayed_work() instead so the work is queued if not already
+queued, and the timeout is updated otherwise.
+
+Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index a7a37dfa47d5a..30feeaf7e6424 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2518,8 +2518,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
+
+ timer:
+ if (hdev->idle_timeout > 0)
+- queue_delayed_work(hdev->workqueue, &conn->idle_work,
+- msecs_to_jiffies(hdev->idle_timeout));
++ mod_delayed_work(hdev->workqueue, &conn->idle_work,
++ msecs_to_jiffies(hdev->idle_timeout));
+ }
+
+ /* Drop all connection on the device */
+--
+2.51.0
+
--- /dev/null
+From a414212c48c22f36bae0506e0c60960a83f99ad5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 18:02:19 +0000
+Subject: bpf: verifier improvement in 32bit shift sign extension pattern
+
+From: Cupertino Miranda <cupertino.miranda@oracle.com>
+
+[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ]
+
+This patch improves the verifier to correctly compute bounds for
+sign extension compiler pattern composed of left shift by 32bits
+followed by a sign right shift by 32bits. Pattern in the verifier was
+limitted to positive value bounds and would reset bound computation for
+negative values. New code allows both positive and negative values for
+sign extension without compromising bound computation and verifier to
+pass.
+
+This change is required by GCC which generate such pattern, and was
+detected in the context of systemd, as described in the following GCC
+bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731
+
+Three new tests were added in verifier_subreg.c.
+
+Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com>
+Signed-off-by: Andrew Pinski <andrew.pinski@oss.qualcomm.com>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Cc: David Faust <david.faust@oracle.com>
+Cc: Jose Marchesi <jose.marchesi@oracle.com>
+Cc: Elena Zannoni <elena.zannoni@oracle.com>
+Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 45b2f06de452c..4af7c96f6985d 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -13136,21 +13136,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg,
+ u64 umin_val, u64 umax_val)
+ {
+ /* Special case <<32 because it is a common compiler pattern to sign
+- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are
+- * positive we know this shift will also be positive so we can track
+- * bounds correctly. Otherwise we lose all sign bit information except
+- * what we can pick up from var_off. Perhaps we can generalize this
+- * later to shifts of any length.
++ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct
++ * because s32 bounds don't flip sign when shifting to the left by
++ * 32bits.
+ */
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0)
++ if (umin_val == 32 && umax_val == 32) {
+ dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32;
+- else
+- dst_reg->smax_value = S64_MAX;
+-
+- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0)
+ dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32;
+- else
++ } else {
++ dst_reg->smax_value = S64_MAX;
+ dst_reg->smin_value = S64_MIN;
++ }
+
+ /* If we might shift our top bit out, then we know nothing */
+ if (dst_reg->umax_value > 1ULL << (63 - umax_val)) {
+--
+2.51.0
+
--- /dev/null
+From f3378b78e1dd6732716d620ba03fb9a1b44955c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 07:06:40 +0000
+Subject: btrfs: handle user interrupt properly in btrfs_trim_fs()
+
+From: jinbaohong <jinbaohong@synology.com>
+
+[ Upstream commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 ]
+
+When a fatal signal is pending or the process is freezing,
+btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS.
+Currently this is treated as a regular error: the loops continue to the
+next iteration and count it as a block group or device failure.
+
+Instead, break out of the loops immediately and return -ERESTARTSYS to
+userspace without counting it as a failure. Also skip the device loop
+entirely if the block group loop was interrupted.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Robbie Ko <robbieko@synology.com>
+Signed-off-by: jinbaohong <jinbaohong@synology.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 5e3d1a87b7e9d..8f9d2392dc5a4 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6196,6 +6196,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ range->minlen);
+
+ trimmed += group_trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR) {
++ btrfs_put_block_group(cache);
++ break;
++ }
+ if (ret) {
+ bg_failed++;
+ bg_ret = ret;
+@@ -6209,6 +6213,9 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ "failed to trim %llu block group(s), last error %d",
+ bg_failed, bg_ret);
+
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ return ret;
++
+ mutex_lock(&fs_devices->device_list_mutex);
+ list_for_each_entry(device, &fs_devices->devices, dev_list) {
+ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
+@@ -6217,6 +6224,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ ret = btrfs_trim_free_extents(device, &group_trimmed);
+
+ trimmed += group_trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ break;
+ if (ret) {
+ dev_failed++;
+ dev_ret = ret;
+@@ -6230,6 +6239,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ "failed to trim %llu device(s), last error %d",
+ dev_failed, dev_ret);
+ range->len = trimmed;
++ if (ret == -ERESTARTSYS || ret == -EINTR)
++ return ret;
+ if (bg_ret)
+ return bg_ret;
+ return dev_ret;
+--
+2.51.0
+
--- /dev/null
+From 9fc0a1239153213541674b0b09500b03c6bff804 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 22:53:57 +0530
+Subject: btrfs: replace BUG() with error handling in __btrfs_balance()
+
+From: Adarsh Das <adarshdas950@gmail.com>
+
+[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ]
+
+We search with offset (u64)-1 which should never match exactly.
+Previously this was handled with BUG(). Now logs an error
+and return -EUCLEAN.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 8207b0b4c43a0..6ce083a6ed61f 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -3980,8 +3980,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info)
+ * this shouldn't happen, it means the last relocate
+ * failed
+ */
+- if (ret == 0)
+- BUG(); /* FIXME break ? */
++ if (unlikely(ret == 0)) {
++ btrfs_err(fs_info,
++ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx",
++ key.offset);
++ mutex_unlock(&fs_info->reclaim_bgs_lock);
++ ret = -EUCLEAN;
++ goto error;
++ }
+
+ ret = btrfs_previous_item(chunk_root, path, 0,
+ BTRFS_CHUNK_ITEM_KEY);
+--
+2.51.0
+
--- /dev/null
+From 23df5e56ee1922c45ff1840763d39efc54ea54a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 18:42:06 +0800
+Subject: ceph: supply snapshot context in ceph_uninline_data()
+
+From: ethanwu <ethanwu@synology.com>
+
+[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ]
+
+The ceph_uninline_data function was missing proper snapshot context
+handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and
+CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate
+snapshot context, which could lead to unnecessary object clone.
+
+Reproducer:
+../src/vstart.sh --new -x --localhost --bluestore
+// turn on cephfs inline data
+./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it
+// allow fs_a client to take snapshot
+./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a'
+// mount cephfs with fuse, since kernel cephfs doesn't support inline write
+ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/
+// bump snapshot seq
+mkdir /mnt/mycephfs/.snap/snap1
+echo "foo" > /mnt/mycephfs/test
+// umount and mount it again using kernel cephfs client
+umount /mnt/mycephfs
+mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf
+echo "bar" >> /mnt/mycephfs/test
+./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000
+
+will see this object does unnecessary clone
+1000000000a.00000000 (seq:2):
+cloneid snaps size overlap
+2 2 4 []
+head - 8
+
+but it's expected to see
+10000000000.00000000 (seq:2):
+cloneid snaps size overlap
+head - 8
+
+since there's no snapshot between these 2 writes
+
+clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't
+pass snap context so object is created with snap seq 0, but later data
+writeback is equipped with snapshot context.
+snap.seq(1) > object snap seq(0), so osd does object clone.
+
+This fix properly acquiring the snapshot context before performing
+write operations.
+
+Signed-off-by: ethanwu <ethanwu@synology.com>
+Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/addr.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index 2c92de964c5a2..db4d11604e9d5 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -1833,6 +1833,7 @@ int ceph_uninline_data(struct file *file)
+ struct ceph_osd_request *req = NULL;
+ struct ceph_cap_flush *prealloc_cf = NULL;
+ struct folio *folio = NULL;
++ struct ceph_snap_context *snapc = NULL;
+ u64 inline_version = CEPH_INLINE_NONE;
+ struct page *pages[1];
+ int err = 0;
+@@ -1860,6 +1861,24 @@ int ceph_uninline_data(struct file *file)
+ if (inline_version == 1) /* initial version, no data */
+ goto out_uninline;
+
++ down_read(&fsc->mdsc->snap_rwsem);
++ spin_lock(&ci->i_ceph_lock);
++ if (__ceph_have_pending_cap_snap(ci)) {
++ struct ceph_cap_snap *capsnap =
++ list_last_entry(&ci->i_cap_snaps,
++ struct ceph_cap_snap,
++ ci_item);
++ snapc = ceph_get_snap_context(capsnap->context);
++ } else {
++ if (!ci->i_head_snapc) {
++ ci->i_head_snapc = ceph_get_snap_context(
++ ci->i_snap_realm->cached_context);
++ }
++ snapc = ceph_get_snap_context(ci->i_head_snapc);
++ }
++ spin_unlock(&ci->i_ceph_lock);
++ up_read(&fsc->mdsc->snap_rwsem);
++
+ folio = read_mapping_folio(inode->i_mapping, 0, file);
+ if (IS_ERR(folio)) {
+ err = PTR_ERR(folio);
+@@ -1875,7 +1894,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 0, 1,
+ CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE,
+- NULL, 0, 0, false);
++ snapc, 0, 0, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+ goto out_unlock;
+@@ -1891,7 +1910,7 @@ int ceph_uninline_data(struct file *file)
+ req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
+ ceph_vino(inode), 0, &len, 1, 3,
+ CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE,
+- NULL, ci->i_truncate_seq,
++ snapc, ci->i_truncate_seq,
+ ci->i_truncate_size, false);
+ if (IS_ERR(req)) {
+ err = PTR_ERR(req);
+@@ -1954,6 +1973,7 @@ int ceph_uninline_data(struct file *file)
+ folio_put(folio);
+ }
+ out:
++ ceph_put_snap_context(snapc);
+ ceph_free_cap_flush(prealloc_cf);
+ dout("uninline_data %p %llx.%llx inline_version %llu = %d\n",
+ inode, ceph_vinop(inode), inline_version, err);
+--
+2.51.0
+
--- /dev/null
+From 8938fbfe24fb3c2e5db94ce29dc1d97db4cb8c59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:29 +0100
+Subject: char: tpm: cr50: Remove IRQF_ONESHOT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+
+The flag also prevents force-threading of the primary handler and the
+irq-core will warn about this.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +--
+ drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+index e70abd69e1ae3..0f589f301e5bb 100644
+--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c
++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c
+@@ -713,8 +713,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client)
+
+ if (client->irq > 0) {
+ rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler,
+- IRQF_TRIGGER_FALLING | IRQF_ONESHOT |
+- IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
+ dev->driver->name, chip);
+ if (rc < 0) {
+ dev_err(dev, "Failed to probe IRQ %d\n", client->irq);
+diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c
+index f4937280e9406..32920b4cecfb4 100644
+--- a/drivers/char/tpm/tpm_tis_spi_cr50.c
++++ b/drivers/char/tpm/tpm_tis_spi_cr50.c
+@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi)
+ if (spi->irq > 0) {
+ ret = devm_request_irq(&spi->dev, spi->irq,
+ cr50_spi_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ "cr50_spi", cr50_phy);
+ if (ret < 0) {
+ if (ret == -EPROBE_DEFER)
+--
+2.51.0
+
--- /dev/null
+From eb175365f9afbd619a494a8e124eaf58c845f40c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 14:46:28 -0500
+Subject: clk: microchip: core: correct return value on *_get_parent()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ]
+
+roclk_get_parent() and sclk_get_parent() has the possibility of
+returning -EINVAL, however the framework expects this call to always
+succeed since the return value is unsigned.
+
+If there is no parent map defined, then the current value programmed in
+the hardware is used. Let's use that same value in the case where
+-EINVAL is currently returned.
+
+This index is only used by clk_core_get_parent_by_index(), and it
+validates that it doesn't overflow the number of available parents.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/microchip/clk-core.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c
+index 1b4f023cdc8be..71fbaf8318f22 100644
+--- a/drivers/clk/microchip/clk-core.c
++++ b/drivers/clk/microchip/clk-core.c
+@@ -281,14 +281,13 @@ static u8 roclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK;
+
+- if (!refo->parent_map)
+- return v;
+-
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (refo->parent_map[i] == v)
+- return i;
++ if (refo->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (refo->parent_map[i] == v)
++ return i;
++ }
+
+- return -EINVAL;
++ return v;
+ }
+
+ static unsigned long roclk_calc_rate(unsigned long parent_rate,
+@@ -823,13 +822,13 @@ static u8 sclk_get_parent(struct clk_hw *hw)
+
+ v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK;
+
+- if (!sclk->parent_map)
+- return v;
++ if (sclk->parent_map) {
++ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
++ if (sclk->parent_map[i] == v)
++ return i;
++ }
+
+- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+- if (sclk->parent_map[i] == v)
+- return i;
+- return -EINVAL;
++ return v;
+ }
+
+ static int sclk_set_parent(struct clk_hw *hw, u8 index)
+--
+2.51.0
+
--- /dev/null
+From 2572715e988dca357b0dac0b1e675a7b69a614f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 23:13:41 +0100
+Subject: clocksource/drivers/sh_tmu: Always leave device running after probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ]
+
+The TMU device can be used as both a clocksource and a clockevent
+provider. The driver tries to be smart and power itself on and off, as
+well as enabling and disabling its clock when it's not in operation.
+This behavior is slightly altered if the TMU is used as an early
+platform device in which case the device is left powered on after probe,
+but the clock is still enabled and disabled at runtime.
+
+This has worked for a long time, but recent improvements in PREEMPT_RT
+and PROVE_LOCKING have highlighted an issue. As the TMU registers itself
+as a clockevent provider, clockevents_register_device(), it needs to use
+raw spinlocks internally as this is the context of which the clockevent
+framework interacts with the TMU driver. However in the context of
+holding a raw spinlock the TMU driver can't really manage its power
+state or clock with calls to pm_runtime_*() and clk_*() as these calls
+end up in other platform drivers using regular spinlocks to control
+power and clocks.
+
+This mix of spinlock contexts trips a lockdep warning.
+
+ =============================
+ [ BUG: Invalid wait context ]
+ 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted
+ -----------------------------
+ swapper/0/0 is trying to lock:
+ ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88
+ other info that might help us debug this:
+ context-{5:5}
+ 1 lock held by swapper/0/0:
+ ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0
+ #0: ffff8000817ec298
+ ccree e6601000.crypto: ARM ccree device initialized
+ (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT
+ Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
+ Call trace:
+ show_stack+0x14/0x1c (C)
+ dump_stack_lvl+0x6c/0x90
+ dump_stack+0x14/0x1c
+ __lock_acquire+0x904/0x1584
+ lock_acquire+0x220/0x34c
+ _raw_spin_lock_irqsave+0x58/0x80
+ __pm_runtime_resume+0x38/0x88
+ sh_tmu_clock_event_set_oneshot+0x84/0xd4
+ clockevents_switch_state+0xfc/0x13c
+ tick_broadcast_set_event+0x30/0xa4
+ __tick_broadcast_oneshot_control+0x1e0/0x3a8
+ tick_broadcast_oneshot_control+0x30/0x40
+ cpuidle_enter_state+0x40c/0x680
+ cpuidle_enter+0x30/0x40
+ do_idle+0x1f4/0x280
+ cpu_startup_entry+0x34/0x40
+ kernel_init+0x0/0x130
+ do_one_initcall+0x0/0x230
+ __primary_switched+0x88/0x90
+
+For non-PREEMPT_RT builds this is not really an issue, but for
+PREEMPT_RT builds where normal spinlocks can sleep this might be an
+issue. Be cautious and always leave the power and clock running after
+probe.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/sh_tmu.c | 18 ------------------
+ 1 file changed, 18 deletions(-)
+
+diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
+index beffff81c00f3..3fc6ed9b56300 100644
+--- a/drivers/clocksource/sh_tmu.c
++++ b/drivers/clocksource/sh_tmu.c
+@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start)
+
+ static int __sh_tmu_enable(struct sh_tmu_channel *ch)
+ {
+- int ret;
+-
+- /* enable clock */
+- ret = clk_enable(ch->tmu->clk);
+- if (ret) {
+- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n",
+- ch->index);
+- return ret;
+- }
+-
+ /* make sure channel is disabled */
+ sh_tmu_start_stop_ch(ch, 0);
+
+@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch)
+ if (ch->enable_count++ > 0)
+ return 0;
+
+- pm_runtime_get_sync(&ch->tmu->pdev->dev);
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, true);
+
+ return __sh_tmu_enable(ch);
+@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch)
+
+ /* disable interrupts in TMU block */
+ sh_tmu_write(ch, TCR, TCR_TPSC_CLK4);
+-
+- /* stop clock */
+- clk_disable(ch->tmu->clk);
+ }
+
+ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch)
+ __sh_tmu_disable(ch);
+
+ dev_pm_syscore_device(&ch->tmu->pdev->dev, false);
+- pm_runtime_put(&ch->tmu->pdev->dev);
+ }
+
+ static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta,
+@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
+ goto err_clk_unprepare;
+
+ tmu->rate = clk_get_rate(tmu->clk) / 4;
+- clk_disable(tmu->clk);
+
+ /* Map the memory resource. */
+ ret = sh_tmu_map_memory(tmu);
+@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev)
+ out:
+ if (tmu->has_clockevent || tmu->has_clocksource)
+ pm_runtime_irq_safe(&pdev->dev);
+- else
+- pm_runtime_idle(&pdev->dev);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From a778f17367d213b95dd8f8890a7e094aac9a2c6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 12:17:23 +0100
+Subject: clocksource/drivers/timer-integrator-ap: Add missing Kconfig
+ dependency on OF
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ]
+
+This driver accesses the of_aliases global variable declared in
+linux/of.h and defined in drivers/base/of.c. It requires OF support or
+will cause a link failure. Add the missing Kconfig dependency.
+
+Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index 8208a3d895634..5b526b74e5dee 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -236,6 +236,7 @@ config KEYSTONE_TIMER
+
+ config INTEGRATOR_AP_TIMER
+ bool "Integrator-AP timer driver" if COMPILE_TEST
++ depends on OF
+ select CLKSRC_MMIO
+ help
+ Enables support for the Integrator-AP timer.
+--
+2.51.0
+
--- /dev/null
+From b91ed55c59dfd7fe01be661f126fc792d1f3d24c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 16:25:35 +0100
+Subject: cpufreq: dt-platdev: Block the driver from probing on more QC
+ platforms
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+[ Upstream commit 7b781899072c5701ef9538c365757ee9ab9c00bd ]
+
+Add a number of QC platforms to the blocklist, they all use either the
+qcom-cpufreq-hw driver.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq-dt-platdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index 8b53388280d73..ad4f23e2158be 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -158,8 +158,11 @@ static const struct of_device_id blocklist[] __initconst = {
+ { .compatible = "qcom,sdm845", },
+ { .compatible = "qcom,sdx75", },
+ { .compatible = "qcom,sm6115", },
++ { .compatible = "qcom,sm6125", },
++ { .compatible = "qcom,sm6150", },
+ { .compatible = "qcom,sm6350", },
+ { .compatible = "qcom,sm6375", },
++ { .compatible = "qcom,sm7125", },
+ { .compatible = "qcom,sm7225", },
+ { .compatible = "qcom,sm8150", },
+ { .compatible = "qcom,sm8250", },
+--
+2.51.0
+
--- /dev/null
+From f58855f435dd61f7e37a78caf7fe19291df9382f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 18:18:03 +0800
+Subject: crypto: hisilicon/qm - move the barrier before writing to the mailbox
+ register
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit ebf35d8f9368816c930f5d70783a72716fab5e19 ]
+
+Before sending the data via the mailbox to the hardware, to ensure
+that the data accessed by the hardware is the most up-to-date,
+a write barrier should be added before writing to the mailbox register.
+The current memory barrier is placed after writing to the register,
+the barrier order should be modified to be before writing to the register.
+
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 2c0ca68914e2f..e09357fea057c 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -633,9 +633,13 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src)
+ }
+
+ #if IS_ENABLED(CONFIG_ARM64)
++ /*
++ * The dmb oshst instruction ensures that the data in the
++ * mailbox is written before it is sent to the hardware.
++ */
+ asm volatile("ldp %0, %1, %3\n"
+- "stp %0, %1, %2\n"
+ "dmb oshst\n"
++ "stp %0, %1, %2\n"
+ : "=&r" (tmp0),
+ "=&r" (tmp1),
+ "+Q" (*((char __iomem *)fun_base))
+--
+2.51.0
+
--- /dev/null
+From e6c21fc194b151447a476c4469a7b3a128403f42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 20:03:50 +0800
+Subject: dm: remove fake timeout to avoid leak request
+
+From: Ding Hui <dinghui@sangfor.com.cn>
+
+[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ]
+
+Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
+blk_mq_complete_request"), drivers are responsible for calling
+blk_should_fake_timeout() at appropriate code paths and opportunities.
+
+However, the dm driver does not implement its own timeout handler and
+relies on the timeout handling of its slave devices.
+
+If an io-timeout-fail error is injected to a dm device, the request
+will be leaked and never completed, causing tasks to hang indefinitely.
+
+Reproduce:
+1. prepare dm which has iscsi slave device
+2. inject io-timeout-fail to dm
+ echo 1 >/sys/class/block/dm-0/io-timeout-fail
+ echo 100 >/sys/kernel/debug/fail_io_timeout/probability
+ echo 10 >/sys/kernel/debug/fail_io_timeout/times
+3. read/write dm
+4. iscsiadm -m node -u
+
+Result: hang task like below
+[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
+[ 862.244133] Tainted: G E 6.19.0-rc1+ #51
+[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000
+[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
+[ 862.245264] Call Trace:
+[ 862.245587] <TASK>
+[ 862.245814] __schedule+0x810/0x15c0
+[ 862.246557] schedule+0x69/0x180
+[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120
+[ 862.247688] elevator_change+0x16d/0x460
+[ 862.247893] elevator_set_none+0x87/0xf0
+[ 862.248798] blk_unregister_queue+0x12e/0x2a0
+[ 862.248995] __del_gendisk+0x231/0x7e0
+[ 862.250143] del_gendisk+0x12f/0x1d0
+[ 862.250339] sd_remove+0x85/0x130 [sd_mod]
+[ 862.250650] device_release_driver_internal+0x36d/0x530
+[ 862.250849] bus_remove_device+0x1dd/0x3f0
+[ 862.251042] device_del+0x38a/0x930
+[ 862.252095] __scsi_remove_device+0x293/0x360
+[ 862.252291] scsi_remove_target+0x486/0x760
+[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
+[ 862.252886] process_one_work+0x633/0xe50
+[ 862.253101] worker_thread+0x6df/0xf10
+[ 862.253647] kthread+0x36d/0x720
+[ 862.254533] ret_from_fork+0x2a6/0x470
+[ 862.255852] ret_from_fork_asm+0x1a/0x30
+[ 862.256037] </TASK>
+
+Remove the blk_should_fake_timeout() check from dm, as dm has no
+native timeout handling and should not attempt to fake timeouts.
+
+Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 499f8cc8a39fb..92d3d3de37ca6 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -278,8 +278,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error)
+ struct dm_rq_target_io *tio = tio_from_request(rq);
+
+ tio->error = error;
+- if (likely(!blk_should_fake_timeout(rq->q)))
+- blk_mq_complete_request(rq);
++ blk_mq_complete_request(rq);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 28c64d8bdccce6f8f404c86e29559809f6cd8631 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 04:49:37 +0100
+Subject: dm: replace -EEXIST with -EBUSY
+
+From: Daniel Gomez <da.gomez@samsung.com>
+
+[ Upstream commit b13ef361d47f09b7aecd18e0383ecc83ff61057e ]
+
+The -EEXIST error code is reserved by the module loading infrastructure
+to indicate that a module is already loaded. When a module's init
+function returns -EEXIST, userspace tools like kmod interpret this as
+"module already loaded" and treat the operation as successful, returning
+0 to the user even though the module initialization actually failed.
+
+This follows the precedent set by commit 54416fd76770 ("netfilter:
+conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
+issue in nf_conntrack_helper_register().
+
+Affected modules:
+ * dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache
+ * dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity
+ * dm_queue_length dm_service_time dm_snapshot
+
+Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-exception-store.c | 2 +-
+ drivers/md/dm-log.c | 2 +-
+ drivers/md/dm-path-selector.c | 2 +-
+ drivers/md/dm-target.c | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
+index c3799757bf4a0..88f119a0a2ae0 100644
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -116,7 +116,7 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type)
+ if (!__find_exception_store_type(type->name))
+ list_add(&type->list, &_exception_store_types);
+ else
+- r = -EEXIST;
++ r = -EBUSY;
+ spin_unlock(&_lock);
+
+ return r;
+diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
+index f7f9c2100937b..e215478bcee04 100644
+--- a/drivers/md/dm-log.c
++++ b/drivers/md/dm-log.c
+@@ -121,7 +121,7 @@ int dm_dirty_log_type_register(struct dm_dirty_log_type *type)
+ if (!__find_dirty_log_type(type->name))
+ list_add(&type->list, &_log_types);
+ else
+- r = -EEXIST;
++ r = -EBUSY;
+ spin_unlock(&_lock);
+
+ return r;
+diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c
+index 3e4cb81ce512c..78f98545ca72d 100644
+--- a/drivers/md/dm-path-selector.c
++++ b/drivers/md/dm-path-selector.c
+@@ -107,7 +107,7 @@ int dm_register_path_selector(struct path_selector_type *pst)
+
+ if (__find_path_selector_type(pst->name)) {
+ kfree(psi);
+- r = -EEXIST;
++ r = -EBUSY;
+ } else
+ list_add(&psi->list, &_path_selectors);
+
+diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
+index 27e2992ff2492..4d1f04b40653f 100644
+--- a/drivers/md/dm-target.c
++++ b/drivers/md/dm-target.c
+@@ -88,7 +88,7 @@ int dm_register_target(struct target_type *tt)
+ if (__find_target_type(tt->name)) {
+ DMERR("%s: '%s' target already registered",
+ __func__, tt->name);
+- rv = -EEXIST;
++ rv = -EBUSY;
+ } else {
+ list_add(&tt->list, &_targets);
+ }
+--
+2.51.0
+
--- /dev/null
+From 505a91a1de60f7a3130358d8056a1533d8794734 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 09:15:03 +0100
+Subject: dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix
+ warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ]
+
+m2m_hw_period is initialized only when chan_config->m2m_hw is true. This
+triggers a warning:
+‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized]
+Although m2m_hw_period is only used when chan_config->m2m_hw is true and
+ignored otherwise, initialize it unconditionally to 0.
+
+ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not
+empty. This triggers a warning:
+‘ccr’ may be used uninitialized [-Wmaybe-uninitialized]
+Indeed, it could be used uninitialized if the sg list is empty. Initialize
+it to 0.
+
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Reviewed-by: Clément Le Goffic <legoffic.clement@gmail.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32-mdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
+index f414efdbd809e..87956563cb1d3 100644
+--- a/drivers/dma/stm32-mdma.c
++++ b/drivers/dma/stm32-mdma.c
+@@ -732,7 +732,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan,
+ struct stm32_mdma_chan_config *chan_config = &chan->chan_config;
+ struct scatterlist *sg;
+ dma_addr_t src_addr, dst_addr;
+- u32 m2m_hw_period, ccr, ctcr, ctbr;
++ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr;
+ int i, ret = 0;
+
+ if (chan_config->m2m_hw)
+--
+2.51.0
+
--- /dev/null
+From e733149ce3194dde2d78db99b9152062bf600335 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:04:48 +0800
+Subject: dmaengine: sun6i: Choose appropriate burst length under maxburst
+
+From: Chen-Yu Tsai <wens@kernel.org>
+
+[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ]
+
+maxburst, as provided by the client, specifies the largest amount of
+data that is allowed to be transferred in one burst. This limit is
+normally provided to avoid a data burst overflowing the target FIFO.
+It does not mean that the DMA engine can only do bursts in that size.
+
+Let the driver pick the largest supported burst length within the
+given limit. This lets the driver work correctly with some clients that
+give a large maxburst value. In particular, the 8250_dw driver will give
+a quarter of the UART's FIFO size as maxburst. On some systems the FIFO
+size is 256 bytes, giving a maxburst of 64 bytes, while the hardware
+only supports bursts of up to 16 bytes.
+
+Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
+index 2469efddf5401..6a384bd469528 100644
+--- a/drivers/dma/sun6i-dma.c
++++ b/drivers/dma/sun6i-dma.c
+@@ -582,6 +582,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id)
+ return ret;
+ }
+
++static u32 find_burst_size(const u32 burst_lengths, u32 maxburst)
++{
++ if (!maxburst)
++ return 1;
++
++ if (BIT(maxburst) & burst_lengths)
++ return maxburst;
++
++ /* Hardware only does power-of-two bursts. */
++ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2)
++ if (BIT(burst) & burst_lengths)
++ return burst;
++
++ return 1;
++}
++
+ static int set_config(struct sun6i_dma_dev *sdev,
+ struct dma_slave_config *sconfig,
+ enum dma_transfer_direction direction,
+@@ -615,15 +631,13 @@ static int set_config(struct sun6i_dma_dev *sdev,
+ return -EINVAL;
+ if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths))
+ return -EINVAL;
+- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths))
+- return -EINVAL;
+- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths))
+- return -EINVAL;
+
+ src_width = convert_buswidth(src_addr_width);
+ dst_width = convert_buswidth(dst_addr_width);
+- dst_burst = convert_burst(dst_maxburst);
+- src_burst = convert_burst(src_maxburst);
++ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst);
++ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst);
++ dst_burst = convert_burst(dst_burst);
++ src_burst = convert_burst(src_burst);
+
+ *p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) |
+ DMA_CHAN_CFG_DST_WIDTH(dst_width);
+--
+2.51.0
+
--- /dev/null
+From eaa622f798c193f02aa9fef8c6d41df67c970a13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jan 2026 08:22:26 -0500
+Subject: drm: Account property blob allocations to memcg
+
+From: Xiao Kan <814091656@qq.com>
+
+[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ]
+
+DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
+property blobs backed by kernel memory.
+
+Currently, the blob data allocation is not accounted to the allocating
+process's memory cgroup, allowing unprivileged users to trigger unbounded
+kernel memory consumption and potentially cause system-wide OOM.
+
+Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
+is properly charged to the caller's memcg. This ensures existing cgroup
+memory limits apply and prevents uncontrolled kernel memory growth without
+introducing additional policy or per-file limits.
+
+Signed-off-by: Xiao Kan <814091656@qq.com>
+Signed-off-by: Xiao Kan <xiao.kan@samsung.com>
+Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_property.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
+index dfec479830e49..b4ee7d4110f84 100644
+--- a/drivers/gpu/drm/drm_property.c
++++ b/drivers/gpu/drm/drm_property.c
+@@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
+ if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
+ return ERR_PTR(-EINVAL);
+
+- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
++ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT);
+ if (!blob)
+ return ERR_PTR(-ENOMEM);
+
+--
+2.51.0
+
--- /dev/null
+From 04ee48240351ec4766b1701307b899e629f472b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 14:47:01 +0800
+Subject: drm/amd/display: Avoid updating surface with the same surface under
+ MPO
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ]
+
+[Why & How]
+Although it's dummy updates of surface update for committing stream
+updates, we should not have dummy_updates[j].surface all indicating
+to the same surface under multiple surfaces case. Otherwise,
+copy_surface_update_to_plane() in update_planes_and_stream_state()
+will update to the same surface only.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index faef07fdfd302..26047109726eb 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -8934,7 +8934,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
+ */
+ dummy_updates = kzalloc(sizeof(struct dc_surface_update) * MAX_SURFACES, GFP_ATOMIC);
+ for (j = 0; j < status->plane_count; j++)
+- dummy_updates[j].surface = status->plane_states[0];
++ dummy_updates[j].surface = status->plane_states[j];
+
+
+ mutex_lock(&dm->dc_lock);
+--
+2.51.0
+
--- /dev/null
+From dbd867ccbedca73e627cb8733d7d5c5e6c70b216 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 11:11:19 -0500
+Subject: drm/amd/display: Ensure link output is disabled in backend reset for
+ PLL_ON
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 4589712e0111352973131bad975023b25569287c ]
+
+[Why]
+We're missing the code to actually disable the link output when we have
+to leave the SYMCLK_ON but the TX remains OFF.
+
+[How]
+Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable
+the link output when the backend is reset.
+
+Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c
+index 22da2007601ee..a782ffc5f4cf9 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c
+@@ -523,8 +523,22 @@ static void dcn31_reset_back_end_for_pipe(
+ if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass)
+ pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
+ pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
++ /*
++ * TODO - convert symclk_ref_cnts for otg to a bit map to solve
++ * the case where the same symclk is shared across multiple otg
++ * instances
++ */
+ if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal))
+- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0;
++ link->phy_state.symclk_ref_cnts.otg = 0;
++
++ if (pipe_ctx->top_pipe == NULL) {
++ if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) {
++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res);
++
++ link_hwss->disable_link_output(link, &pipe_ctx->link_res, pipe_ctx->stream->signal);
++ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF;
++ }
++ }
+
+ if (pipe_ctx->stream_res.tg->funcs->set_drr)
+ pipe_ctx->stream_res.tg->funcs->set_drr(
+--
+2.51.0
+
--- /dev/null
+From f5147f8223067558045a12f11a5cbb5514af4241 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 22:05:16 -0700
+Subject: drm/amd/display: Remove conditional for shaper 3DLUT power-on
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ]
+
+[Why]
+Shaper programming has high chance to fail on first time after
+power-on or reboot. This can be verified by running IGT's kms_colorop.
+
+[How]
+Always power on the shaper and 3DLUT before programming by
+removing the debug flag of low power mode.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
+index 1d052f08aff5e..f20f0b2be4c7d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
+@@ -716,8 +716,7 @@ bool mpc32_program_shaper(
+ return false;
+ }
+
+- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc)
+- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
++ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
+
+ current_mode = mpc32_get_shaper_current(mpc, mpcc_id);
+
+--
+2.51.0
+
--- /dev/null
+From b2ff2c4fdef6b11778fd29ea3236ac4abafc5be0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:24:01 +0000
+Subject: drm/amdgpu: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for amdgpu.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index caf590caaf2c7..e759004046938 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3449,6 +3449,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((adev->pdev->device == 0x666f) &&
++ (adev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (adev->asic_type == CHIP_OLAND) {
+ if ((adev->pdev->revision == 0xC7) ||
+ (adev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From bda724c80ca8da8d66ceefa672d612146bce2cc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 10:46:47 +0800
+Subject: drm/amdgpu: add support for HDP IP version 6.1.1
+
+From: Tim Huang <tim.huang@amd.com>
+
+[ Upstream commit e2fd14f579b841f54a9b7162fef15234d8c0627a ]
+
+This initializes HDP IP version 6.1.1.
+
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Tim Huang <tim.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index 2e492f779b54c..5c4aa5ff873b6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -2491,6 +2491,7 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ case IP_VERSION(6, 0, 0):
+ case IP_VERSION(6, 0, 1):
+ case IP_VERSION(6, 1, 0):
++ case IP_VERSION(6, 1, 1):
+ adev->hdp.funcs = &hdp_v6_0_funcs;
+ break;
+ default:
+--
+2.51.0
+
--- /dev/null
+From efffc39192b14cbc18a2b8cf5ef092d442121c7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 15:32:01 +0800
+Subject: drm/amdgpu: Adjust usleep_range in fence wait
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ]
+
+Tune the sleep interval in the PSP fence wait loop from 10-100us to
+60-100us.This adjustment results in an overall wait window of 1.2s
+(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations),
+which guarantees that we can retrieve the correct fence value
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 08886e0ee6428..2ef87646e6bb1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -656,7 +656,7 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ ras_intr = amdgpu_ras_intr_triggered();
+ if (ras_intr)
+ break;
+- usleep_range(10, 100);
++ usleep_range(60, 100);
+ amdgpu_device_invalidate_hdp(psp->adev, NULL);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 7c5f374ed6a015ecc0e8778f7af60ed53ed768f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 11:46:48 -0500
+Subject: drm/amdgpu: avoid a warning in timedout job handler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74 ]
+
+Only set an error on the fence if the fence is not
+signalled. We can end up with a warning if the
+per queue reset path signals the fence and sets an error
+as part of the reset, but fails to recover.
+
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+index e9adfc88a54ab..8175d831abd4d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -65,7 +65,8 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job)
+ DRM_ERROR("Process information: process %s pid %d thread %s pid %d\n",
+ ti.process_name, ti.tgid, ti.task_name, ti.pid);
+
+- dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
++ if (dma_fence_get_status(&s_job->s_fence->finished) == 0)
++ dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
+
+ if (amdgpu_device_should_recover_gpu(ring->adev)) {
+ struct amdgpu_reset_context reset_context;
+--
+2.51.0
+
--- /dev/null
+From d008452b5ab113a5617c9275033fb90645404b33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 19:36:56 +0530
+Subject: drm/amdkfd: Fix GART PTE for non-4K pagesize in
+ svm_migrate_gart_map()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ]
+
+In svm_migrate_gart_map(), while migrating GART mapping, the number of
+bytes copied for the GART table only accounts for CPU pages. On non-4K
+systems, each CPU page can contain multiple GPU pages, and the GART
+requires one 8-byte PTE per GPU page. As a result, an incorrect size was
+passed to the DMA, causing only a partial update of the GART table.
+
+Fix this function to work correctly on non-4K page-size systems by
+accounting for the number of GPU pages per CPU page when calculating the
+number of bytes to be copied.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index f99e3b812ee44..59575e2424d07 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -62,7 +62,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, uint64_t npages,
+ *gart_addr = adev->gmc.gart_start;
+
+ num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8);
+- num_bytes = npages * 8;
++ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE;
+
+ r = amdgpu_job_alloc_with_ib(adev, &adev->mman.high_pr,
+ AMDGPU_FENCE_OWNER_UNDEFINED,
+--
+2.51.0
+
--- /dev/null
+From 87a3dbb602ce585d10c977c81759106975561ac4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 11:38:25 +0100
+Subject: drm/atmel-hlcdc: don't reject the commit if the src rect has
+ fractional parts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ]
+
+Don’t reject the commit when the source rectangle has fractional parts.
+This can occur due to scaling: drm_atomic_helper_check_plane_state() calls
+drm_rect_clip_scaled(), which may introduce fractional parts while
+computing the clipped source rectangle. This does not imply the commit is
+invalid, so we should accept it instead of discarding it.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 390c4fc62af7c..ec4fe0de989d4 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -78,8 +78,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s)
+ return container_of(s, struct atmel_hlcdc_plane_state, base);
+ }
+
+-#define SUBPIXEL_MASK 0xffff
+-
+ static uint32_t rgb_formats[] = {
+ DRM_FORMAT_C8,
+ DRM_FORMAT_XRGB4444,
+@@ -619,24 +617,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p,
+ if (ret || !s->visible)
+ return ret;
+
+- hstate->src_x = s->src.x1;
+- hstate->src_y = s->src.y1;
+- hstate->src_w = drm_rect_width(&s->src);
+- hstate->src_h = drm_rect_height(&s->src);
++ hstate->src_x = s->src.x1 >> 16;
++ hstate->src_y = s->src.y1 >> 16;
++ hstate->src_w = drm_rect_width(&s->src) >> 16;
++ hstate->src_h = drm_rect_height(&s->src) >> 16;
+ hstate->crtc_x = s->dst.x1;
+ hstate->crtc_y = s->dst.y1;
+ hstate->crtc_w = drm_rect_width(&s->dst);
+ hstate->crtc_h = drm_rect_height(&s->dst);
+
+- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) &
+- SUBPIXEL_MASK)
+- return -EINVAL;
+-
+- hstate->src_x >>= 16;
+- hstate->src_y >>= 16;
+- hstate->src_w >>= 16;
+- hstate->src_h >>= 16;
+-
+ hstate->nplanes = fb->format->num_planes;
+ if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From f4a0f9926a1b30361417c01ec8ea1902c038c5af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:52 +0200
+Subject: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state
+ callback
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ]
+
+After several commits, the slab memory increases. Some drm_crtc_commit
+objects are not freed. The atomic_destroy_state callback only put the
+framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
+to put all the objects that are no longer needed.
+
+It has been seen after hours of usage of a graphics application or using
+kmemleak:
+
+unreferenced object 0xc63a6580 (size 64):
+ comm "egt_basic", pid 171, jiffies 4294940784
+ hex dump (first 32 bytes):
+ 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.
+ 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.
+ backtrace (crc c25aa925):
+ kmemleak_alloc+0x34/0x3c
+ __kmalloc_cache_noprof+0x150/0x1a4
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index daa508504f47d..390c4fc62af7c 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -934,8 +934,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
+ state->dscrs[i]->self);
+ }
+
+- if (s->fb)
+- drm_framebuffer_put(s->fb);
++ __drm_atomic_helper_plane_destroy_state(s);
+
+ kfree(state);
+ }
+--
+2.51.0
+
--- /dev/null
+From f505e86c76cbf975609d62b45b849a87ee09c8df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 18:14:53 +0200
+Subject: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ]
+
+The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
+the atmel_hlcdc_plane state structure without properly duplicating the
+drm_plane_state. In particular, state->commit remained set to the old
+state commit, which can lead to a use-after-free in the next
+drm_atomic_commit() call.
+
+Fix this by calling
+__drm_atomic_helper_duplicate_plane_state(), which correctly clones
+the base drm_plane_state (including the ->commit pointer).
+
+It has been seen when closing and re-opening the device node while
+another DRM client (e.g. fbdev) is still attached:
+
+=============================================================================
+BUG kmalloc-64 (Not tainted): Poison overwritten
+-----------------------------------------------------------------------------
+
+0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b
+FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b
+Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0
+pid=29
+ drm_atomic_helper_setup_commit+0x1e8/0x7bc
+ drm_atomic_helper_commit+0x3c/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_framebuffer_remove+0x4cc/0x5a8
+ drm_mode_rmfb_work_fn+0x6c/0x80
+ process_one_work+0x12c/0x2cc
+ worker_thread+0x2a8/0x400
+ kthread+0xc0/0xdc
+ ret_from_fork+0x14/0x28
+Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0
+pid=169
+ drm_atomic_helper_commit_hw_done+0x100/0x150
+ drm_atomic_helper_commit_tail+0x64/0x8c
+ commit_tail+0x168/0x18c
+ drm_atomic_helper_commit+0x138/0x15c
+ drm_atomic_commit+0xc0/0xf4
+ drm_atomic_helper_set_config+0x84/0xb8
+ drm_mode_setcrtc+0x32c/0x810
+ drm_ioctl+0x20c/0x488
+ sys_ioctl+0x14c/0xc20
+ ret_fast_syscall+0x0/0x54
+Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0
+flags=0x200(workingset|zone=0)
+Object 0xc611b340 @offset=832 fp=0xc611b7c0
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index ec4fe0de989d4..b35d367b86141 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -904,8 +904,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
+ return NULL;
+ }
+
+- if (copy->base.fb)
+- drm_framebuffer_get(copy->base.fb);
++ __drm_atomic_helper_plane_duplicate_state(p, ©->base);
+
+ return ©->base;
+ }
+--
+2.51.0
+
--- /dev/null
+From b9b6b0f7f195745a355048a836b7d944ceb8022e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 15:16:50 +0530
+Subject: drm/display/dp_mst: Add protection against 0 vcpi
+
+From: Suraj Kandpal <suraj.kandpal@intel.com>
+
+[ Upstream commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa ]
+
+When releasing a timeslot there is a slight chance we may end up
+with the wrong payload mask due to overflow if the delayed_destroy_work
+ends up coming into play after a DP 2.1 monitor gets disconnected
+which causes vcpi to become 0 then we try to make the payload =
+~BIT(vcpi - 1) which is a negative shift. VCPI id should never
+really be 0 hence skip changing the payload mask if VCPI is 0.
+
+Otherwise it leads to
+<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc
+[drm_display_helper]] port ffff888126ce9000 (3)
+<4> [515.287267] -----------[ cut here ]-----------
+<3> [515.287268] UBSAN: shift-out-of-bounds in
+../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36
+<3> [515.287271] shift exponent -1 is negative
+<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G
+S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)
+<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
+<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P
+WIFI, BIOS 1645 03/15/2024
+<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work
+[drm_display_helper]
+<4> [515.287303] Call Trace:
+<4> [515.287304] <TASK>
+<4> [515.287306] dump_stack_lvl+0xc1/0xf0
+<4> [515.287313] dump_stack+0x10/0x20
+<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0
+<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0
+<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d
+[drm_display_helper]
+<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]
+<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0
+<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60
+<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe]
+<4> [515.287740] ? find_held_lock+0x31/0x90
+<4> [515.287747] ? lock_release+0xce/0x2a0
+<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40
+<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140
+<4> [515.287765] drm_atomic_commit+0x6e/0xf0
+<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10
+<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0
+<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0
+<4> [515.287795] ? mutex_lock_nested+0x1b/0x30
+<4> [515.287801] drm_client_modeset_commit+0x26/0x50
+<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110
+<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140
+<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0
+<4> [515.287819] drm_client_hotplug+0x6c/0xf0
+<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0
+<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30
+<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410
+[drm_display_helper]
+<4> [515.287861] process_one_work+0x22b/0x6f0
+<4> [515.287874] worker_thread+0x1e8/0x3d0
+<4> [515.287879] ? __pfx_worker_thread+0x10/0x10
+<4> [515.287882] kthread+0x11c/0x250
+<4> [515.287886] ? __pfx_kthread+0x10/0x10
+<4> [515.287890] ret_from_fork+0x2d7/0x310
+<4> [515.287894] ? __pfx_kthread+0x10/0x10
+<4> [515.287897] ret_from_fork_asm+0x1a/0x30
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303
+Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+index 21ff7ef7ce920..d4a5489d010c4 100644
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -4527,7 +4527,8 @@ int drm_dp_atomic_release_time_slots(struct drm_atomic_state *state,
+ if (!payload->delete) {
+ payload->pbn = 0;
+ payload->delete = true;
+- topology_state->payload_mask &= ~BIT(payload->vcpi - 1);
++ if (payload->vcpi > 0)
++ topology_state->payload_mask &= ~BIT(payload->vcpi - 1);
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 28144826725702dc94c6d1d9d4dee9d02003a5e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Feb 2026 07:26:00 +0000
+Subject: drm/radeon: Add HAINAN clock adjustment
+
+From: decce6 <decce6@proton.me>
+
+[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ]
+
+This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
+850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
+patch is for radeon.
+
+Signed-off-by: decce6 <decce6@proton.me>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index fbf968e3f6d78..c688b4d914819 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2969,6 +2969,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ max_sclk = 60000;
+ max_mclk = 80000;
+ }
++ if ((rdev->pdev->device == 0x666f) &&
++ (rdev->pdev->revision == 0x00)) {
++ max_sclk = 80000;
++ max_mclk = 95000;
++ }
+ } else if (rdev->family == CHIP_OLAND) {
+ if ((rdev->pdev->revision == 0xC7) ||
+ (rdev->pdev->revision == 0x80) ||
+--
+2.51.0
+
--- /dev/null
+From a759d9ccd4408576718365a52793d69b060bb2c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 21:03:23 +0800
+Subject: drm/v3d: Set DMA segment size to avoid debug warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ]
+
+When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
+kernel occasionally reports a segment size mismatch. This is because
+'max_seg_size' is not set. The kernel defaults to 64K. setting
+'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
+from complaining about the over-mapping of the V3D segment length.
+
+DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device
+ claims to support [len=8290304] [max=65536]
+WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388
+CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1
+Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : debug_dma_map_sg+0x330/0x388
+lr : debug_dma_map_sg+0x330/0x388
+sp : ffff8000829a3ac0
+x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000
+x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000
+x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002
+x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff
+x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573
+x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000
+x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c
+x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001
+x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280
+Call trace:
+ debug_dma_map_sg+0x330/0x388
+ __dma_map_sg_attrs+0xc0/0x278
+ dma_map_sgtable+0x30/0x58
+ drm_gem_shmem_get_pages_sgt+0xb4/0x140
+ v3d_bo_create_finish+0x28/0x130 [v3d]
+ v3d_create_bo_ioctl+0x54/0x180 [v3d]
+ drm_ioctl_kernel+0xc8/0x140
+ drm_ioctl+0x2d4/0x4d8
+
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
+index 0e8ea99011884..691a8c8848e40 100644
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -242,6 +242,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ if (ret)
+ goto clk_disable;
+
++ dma_set_max_seg_size(&pdev->dev, UINT_MAX);
++
+ v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH);
+
+ ident1 = V3D_READ(V3D_HUB_IDENT1);
+--
+2.51.0
+
--- /dev/null
+From a0db68a0d2b436e3ea5444e7d8a834026eb737af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:06 +0100
+Subject: EFI/CPER: don't dump the entire memory region
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ]
+
+The current logic at cper_print_fw_err() doesn't check if the
+error record length is big enough to handle offset. On a bad firmware,
+if the ofset is above the actual record, length -= offset will
+underflow, making it dump the entire memory.
+
+The end result can be:
+
+ - the logic taking a lot of time dumping large regions of memory;
+ - data disclosure due to the memory dumps;
+ - an OOPS, if it tries to dump an unmapped memory region.
+
+Fix it by checking if the section length is too small before doing
+a hex dump.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject tweaks ]
+Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 74ffaf44d74ce..4e744ce7256d5 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -555,6 +555,11 @@ static void cper_print_fw_err(const char *pfx,
+ } else {
+ offset = sizeof(*fw_err);
+ }
++ if (offset > length) {
++ printk("%s""error section length is too small: offset=%d, length=%d\n",
++ pfx, offset, length);
++ return;
++ }
+
+ buf += offset;
+ length -= offset;
+--
+2.51.0
+
--- /dev/null
+From dc6fc2adb4e438e40aefd1289f2b7ba6e8efd7d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:35:04 +0100
+Subject: EFI/CPER: don't go past the ARM processor CPER record buffer
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ]
+
+There's a logic inside GHES/CPER to detect if the section_length
+is too small, but it doesn't detect if it is too big.
+
+Currently, if the firmware receives an ARM processor CPER record
+stating that a section length is big, kernel will blindly trust
+section_length, producing a very long dump. For instance, a 67
+bytes record with ERR_INFO_NUM set 46198 and section length
+set to 854918320 would dump a lot of data going a way past the
+firmware memory-mapped area.
+
+Fix it by adding a logic to prevent it to go past the buffer
+if ERR_INFO_NUM is too big, making it report instead:
+
+ [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+ [Hardware Error]: event severity: recoverable
+ [Hardware Error]: Error 0, type: recoverable
+ [Hardware Error]: section_type: ARM processor error
+ [Hardware Error]: MIDR: 0xff304b2f8476870a
+ [Hardware Error]: section length: 854918320, CPER size: 67
+ [Hardware Error]: section length is too big
+ [Hardware Error]: firmware-generated error record is incorrect
+ [Hardware Error]: ERR_INFO_NUM is 46198
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+[ rjw: Subject and changelog tweaks ]
+Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper-arm.c | 12 ++++++++----
+ drivers/firmware/efi/cper.c | 3 ++-
+ include/linux/cper.h | 3 ++-
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
+index 52d18490b59e3..70e1735dfcdd4 100644
+--- a/drivers/firmware/efi/cper-arm.c
++++ b/drivers/firmware/efi/cper-arm.c
+@@ -226,7 +226,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
+ }
+
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc)
++ const struct cper_sec_proc_arm *proc,
++ u32 length)
+ {
+ int i, len, max_ctx_type;
+ struct cper_arm_err_info *err_info;
+@@ -238,9 +239,12 @@ void cper_print_proc_arm(const char *pfx,
+
+ len = proc->section_length - (sizeof(*proc) +
+ proc->err_info_num * (sizeof(*err_info)));
+- if (len < 0) {
+- printk("%ssection length: %d\n", pfx, proc->section_length);
+- printk("%ssection length is too small\n", pfx);
++
++ if (len < 0 || proc->section_length > length) {
++ printk("%ssection length: %d, CPER size: %d\n",
++ pfx, proc->section_length, length);
++ printk("%ssection length is too %s\n", pfx,
++ (len < 0) ? "small" : "big");
+ printk("%sfirmware-generated error record is incorrect\n", pfx);
+ printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num);
+ return;
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 4e744ce7256d5..9d0f0bf3067cc 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -640,7 +640,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata
+
+ printk("%ssection_type: ARM processor error\n", newpfx);
+ if (gdata->error_data_length >= sizeof(*arm_err))
+- cper_print_proc_arm(newpfx, arm_err);
++ cper_print_proc_arm(newpfx, arm_err,
++ gdata->error_data_length);
+ else
+ goto err_section_too_small;
+ #endif
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index ad1ed24730917..c588e5c2a96c6 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -568,7 +568,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *,
+ const char *cper_mem_err_unpack(struct trace_seq *,
+ struct cper_mem_err_compact *);
+ void cper_print_proc_arm(const char *pfx,
+- const struct cper_sec_proc_arm *proc);
++ const struct cper_sec_proc_arm *proc,
++ u32 length);
+ void cper_print_proc_ia(const char *pfx,
+ const struct cper_sec_proc_ia *proc);
+ int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg);
+--
+2.51.0
+
--- /dev/null
+From 4bf155f186349ad94cf3a11a15615e55cf776140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:41 +0800
+Subject: ext4: mark group add fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ]
+
+Fast commits only log operations that have dedicated replay support.
+Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group
+descriptor metadata without going through the fast commit tracking
+paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+ext4_ioctl_group_add() adds new block groups.
+This forces those transactions to fall back to a full commit,
+ensuring that the filesystem geometry updates are captured by the
+normal journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_ADD safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted
+ filesystem and checked the resize ineligible reason:
+ ./group_add_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows "Resize": > 0.
+3. Fsynced a file on the resized filesystem and verified that the fast
+ commit stats report at least one ineligible commit:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+ shows fc stats ineligible > 0.
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 4f931f80cb348..2a9d944ccad79 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -963,6 +963,7 @@ static long ext4_ioctl_group_add(struct file *file,
+
+ err = ext4_group_add(sb, input);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From 79356352260f8c095b8f1bc70f2fcec27dd5d587 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:51:42 +0800
+Subject: ext4: mark group extend fast-commit ineligible
+
+From: Li Chen <me@linux.beauty>
+
+[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ]
+
+Fast commits only log operations that have dedicated replay support.
+EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last
+block group and updates the same on-disk metadata without going
+through the fast commit tracking paths.
+In practice these operations are rare and usually followed by further
+updates, but mixing them into a fast commit makes the overall
+semantics harder to reason about and risks replay gaps if new call
+sites appear.
+
+Teach ext4 to mark the filesystem fast-commit ineligible when
+EXT4_IOC_GROUP_EXTEND grows the filesystem.
+This forces those transactions to fall back to a full commit,
+ensuring that the group extension changes are captured by the normal
+journal rather than partially encoded in fast commit TLVs.
+This change should not affect common workloads but makes online
+resize via GROUP_EXTEND safer and easier to reason about under fast
+commit.
+
+Testing:
+1. prepare:
+ dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
+ mkfs.ext4 -O fast_commit -F /root/fc_resize.img
+ mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
+2. Extended the filesystem to the end of the last block group using a
+ helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem
+ and checked fc_info:
+ ./group_extend_helper /mnt/fc_resize
+ cat /proc/fs/ext4/loop0/fc_info
+ shows the "Resize" ineligible reason increased.
+3. Fsynced a file on the resized filesystem and confirmed that the fast
+ commit ineligible counter incremented for the resize transaction:
+ touch /mnt/fc_resize/file
+ /root/fsync_file /mnt/fc_resize/file
+ sync
+ cat /proc/fs/ext4/loop0/fc_info
+
+Signed-off-by: Li Chen <me@linux.beauty>
+Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ioctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 2a9d944ccad79..d34affd2075eb 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1316,6 +1316,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+
+ err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+ if (EXT4_SB(sb)->s_journal) {
++ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE,
++ NULL);
+ jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+ err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
+ jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+--
+2.51.0
+
--- /dev/null
+From a014797cca6e8d7b0a9d04719ab5af7d8bb08b7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 21:31:16 +0800
+Subject: ext4: move ext4_percpu_param_init() before ext4_mb_init()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 270564513489d98b721a1e4a10017978d5213bff ]
+
+When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the
+`DOUBLE_CHECK` macro defined, the following panic is triggered:
+
+==================================================================
+EXT4-fs error (device vdc): ext4_validate_block_bitmap:423:
+ comm mount: bg 0: bad block bitmap checksum
+BUG: unable to handle page fault for address: ff110000fa2cc000
+PGD 3e01067 P4D 3e02067 PUD 0
+Oops: Oops: 0000 [#1] SMP NOPTI
+CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W
+ 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none)
+RIP: 0010:percpu_counter_add_batch+0x13/0xa0
+Call Trace:
+ <TASK>
+ ext4_mark_group_bitmap_corrupted+0xcb/0xe0
+ ext4_validate_block_bitmap+0x2a1/0x2f0
+ ext4_read_block_bitmap+0x33/0x50
+ mb_group_bb_bitmap_alloc+0x33/0x80
+ ext4_mb_add_groupinfo+0x190/0x250
+ ext4_mb_init_backend+0x87/0x290
+ ext4_mb_init+0x456/0x640
+ __ext4_fill_super+0x1072/0x1680
+ ext4_fill_super+0xd3/0x280
+ get_tree_bdev_flags+0x132/0x1d0
+ vfs_get_tree+0x29/0xd0
+ vfs_cmd_create+0x59/0xe0
+ __do_sys_fsconfig+0x4f6/0x6b0
+ do_syscall_64+0x50/0x1f0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+==================================================================
+
+This issue can be reproduced using the following commands:
+ mkfs.ext4 -F -q -b 1024 /dev/sda 5G
+ tune2fs -O quota,project /dev/sda
+ mount /dev/sda /tmp/test
+
+With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads
+and validates the block bitmap. When the validation fails,
+ext4_mark_group_bitmap_corrupted() attempts to update
+sbi->s_freeclusters_counter. However, this percpu_counter has not been
+initialized yet at this point, which leads to the panic described above.
+
+Fix this by moving the execution of ext4_percpu_param_init() to occur
+before ext4_mb_init(), ensuring the per-CPU counters are initialized
+before they are used.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index c5c6faa995e1c..561f670768f96 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5563,6 +5563,10 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ clear_opt2(sb, MB_OPTIMIZE_SCAN);
+ }
+
++ err = ext4_percpu_param_init(sbi);
++ if (err)
++ goto failed_mount5;
++
+ err = ext4_mb_init(sb);
+ if (err) {
+ ext4_msg(sb, KERN_ERR, "failed to initialize mballoc (%d)",
+@@ -5578,10 +5582,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
+ sbi->s_journal->j_commit_callback =
+ ext4_journal_commit_callback;
+
+- err = ext4_percpu_param_init(sbi);
+- if (err)
+- goto failed_mount6;
+-
+ if (ext4_has_feature_flex_bg(sb))
+ if (!ext4_fill_flex_info(sb)) {
+ ext4_msg(sb, KERN_ERR,
+@@ -5661,8 +5661,8 @@ failed_mount8: __maybe_unused
+ failed_mount6:
+ ext4_mb_release(sb);
+ ext4_flex_groups_free(sbi);
+- ext4_percpu_param_destroy(sbi);
+ failed_mount5:
++ ext4_percpu_param_destroy(sbi);
+ ext4_ext_release(sb);
+ ext4_release_system_zone(sb);
+ failed_mount4a:
+--
+2.51.0
+
--- /dev/null
+From 8dfe53d30bec87aa9a7ff02e15c3a18c3eaf1299 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 13:11:24 +0100
+Subject: fix it87_wdt early reboot by reporting running timer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ]
+
+Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87
+wdt enabled by the firmware and a broken BIOS option that does not
+allow to change the time or turn it off. As this makes installing
+Linux rather difficult, change the it87_wdt to report it running to
+the watchdog core.
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/it87_wdt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
+index 239947df613db..1392e557fa371 100644
+--- a/drivers/watchdog/it87_wdt.c
++++ b/drivers/watchdog/it87_wdt.c
+@@ -183,6 +183,12 @@ static void _wdt_update_timeout(unsigned int t)
+ superio_outb(t >> 8, WDTVALMSB);
+ }
+
++/* Internal function, should be called after superio_select(GPIO) */
++static bool _wdt_running(void)
++{
++ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB));
++}
++
+ static int wdt_update_timeout(unsigned int t)
+ {
+ int ret;
+@@ -365,6 +371,12 @@ static int __init it87_wdt_init(void)
+ }
+ }
+
++ /* wdt already left running by firmware? */
++ if (_wdt_running()) {
++ pr_info("Left running by firmware.\n");
++ set_bit(WDOG_HW_RUNNING, &wdt_dev.status);
++ }
++
+ superio_exit();
+
+ if (timeout < 1 || timeout > max_units * 60) {
+--
+2.51.0
+
--- /dev/null
+From ee5a9ecdcb7ea50526143a5f10b46bb222b70a2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 16:58:48 +0100
+Subject: fpga: of-fpga-region: Fail if any bridge is missing
+
+From: Romain Gantois <romain.gantois@bootlin.com>
+
+[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ]
+
+When parsing the region bridge list from the "fpga-bridges" device tree
+property, the of-fpga-region driver will silently ignore bridges which fail
+to be obtained, for example due to a missing bridge driver or invalid
+phandle.
+
+This can lead to hardware issues if a region bridge stays coupled when
+partial programming is performed.
+
+Fail if any of the bridges specified in "fpga-bridges" cannot be obtained.
+
+Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
+Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com
+Reviewed-by: Xu Yilun <yilun.xu@intel.com>
+Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/of-fpga-region.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
+index a6affd83f2757..ed6eae9851179 100644
+--- a/drivers/fpga/of-fpga-region.c
++++ b/drivers/fpga/of-fpga-region.c
+@@ -83,7 +83,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np)
+ * done with the bridges.
+ *
+ * Return: 0 for success (even if there are no bridges specified)
+- * or -EBUSY if any of the bridges are in use.
++ * or an error code if any of the bridges are not available.
+ */
+ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ {
+@@ -130,10 +130,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region)
+ ®ion->bridge_list);
+ of_node_put(br);
+
+- /* If any of the bridges are in use, give up */
+- if (ret == -EBUSY) {
++ /* If any of the bridges are not available, give up */
++ if (ret) {
+ fpga_bridges_put(®ion->bridge_list);
+- return -EBUSY;
++ return ret;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9d5d2b732aba6125a69076eaebfd7e981c18033b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 18:42:11 +0530
+Subject: fs/buffer: add alert in try_to_free_buffers() for folios without
+ buffers
+
+From: Deepakkumar Karn <dkarn@redhat.com>
+
+[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ]
+
+try_to_free_buffers() can be called on folios with no buffers attached
+when filemap_release_folio() is invoked on a folio belonging to a mapping
+with AS_RELEASE_ALWAYS set but no release_folio operation defined.
+
+In such cases, folio_needs_release() returns true because of the
+AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This
+causes try_to_free_buffers() to call drop_buffers() on a folio with no
+buffers, leading to a null pointer dereference.
+
+Adding a check in try_to_free_buffers() to return early if the folio has no
+buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.
+This provides defensive hardening.
+
+Signed-off-by: Deepakkumar Karn <dkarn@redhat.com>
+Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/buffer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 32df6163ffed5..c225eef13279b 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2950,6 +2950,10 @@ bool try_to_free_buffers(struct folio *folio)
+ if (folio_test_writeback(folio))
+ return false;
+
++ /* Misconfigured folio check */
++ if (WARN_ON_ONCE(!folio_buffers(folio)))
++ return true;
++
+ if (mapping == NULL) { /* can this still happen? */
+ ret = drop_buffers(folio, &buffers_to_free);
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From 4fb3af601cf3297d54716164aec82198698fa4dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 16:07:32 +0100
+Subject: fs/ntfs3: avoid calling run_get_entry() when run == NULL in
+ ntfs_read_run_nb_ra()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ]
+
+When ntfs_read_run_nb_ra() is invoked with run == NULL the code later
+assumes run is valid and may call run_get_entry(NULL, ...), and also
+uses clen/idx without initializing them. Smatch reported uninitialized
+variable warnings and this can lead to undefined behaviour. This patch
+fixes it.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fsntfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index 446079b0866d4..e17d4c1ba06f0 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -1272,6 +1272,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run,
+
+ } while (len32);
+
++ if (!run) {
++ err = -EINVAL;
++ goto out;
++ }
++
++ /* Get next fragment to read. */
+ vcn_next = vcn + clen;
+ if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) ||
+ vcn != vcn_next) {
+--
+2.51.0
+
--- /dev/null
+From 9b47a311c9c6b5e266e2fcb422465ad23d4d3af3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 19:59:59 +0900
+Subject: fs: ntfs3: check return value of indx_find to avoid infinite loop
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed dentry in the ntfs3 filesystem can cause the kernel to hang
+during the lookup operations. By setting the HAS_SUB_NODE flag in an
+INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the
+VCN pointer, an attacker can cause the indx_find() function to repeatedly
+read the same block, allocating 4 KB of memory each time. The kernel lacks
+VCN loop detection and depth limits, causing memory exhaustion and an OOM
+crash.
+
+This patch adds a return value check for fnd_push() to prevent a memory
+exhaustion vulnerability caused by infinite loops. When the index exceeds the
+size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()
+function checks this return value and stops processing, preventing further
+memory allocation.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index f227db9f76c2b..4330c2b39e505 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1192,7 +1192,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni,
+ return -EINVAL;
+ }
+
+- fnd_push(fnd, node, e);
++ err = fnd_push(fnd, node, e);
++
++ if (err) {
++ put_indx_node(node);
++ return err;
++ }
+ }
+
+ *entry = e;
+--
+2.51.0
+
--- /dev/null
+From 8e7c8296aef739d31801beed64e70c215c556ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 14:27:48 +0300
+Subject: fs/ntfs3: drop preallocated clusters for sparse and compressed files
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ]
+
+Do not keep preallocated clusters for sparsed and compressed files.
+Preserving preallocation in these cases causes fsx failures when running
+with sparse files and preallocation enabled.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index ca9ee8eddcf4b..8f033e30e0d79 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -449,8 +449,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type,
+
+ is_ext = is_attr_ext(attr_b);
+ align = sbi->cluster_size;
+- if (is_ext)
++ if (is_ext) {
+ align <<= attr_b->nres.c_unit;
++ keep_prealloc = false;
++ }
+
+ old_valid = le64_to_cpu(attr_b->nres.valid_size);
+ old_size = le64_to_cpu(attr_b->nres.data_size);
+--
+2.51.0
+
--- /dev/null
+From 4ff1fb3c378eed4973c23650ecffbc48ad13daab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:09 +0900
+Subject: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
+ metadata
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an attribute header
+indicates an empty run list, while directory entries reference it as
+containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way
+to represent an empty run list, and run_unpack() correctly handles this by
+checking if evcn + 1 equals svcn and returning early without parsing any run
+data. However, this creates a problem when there is metadata inconsistency,
+where the attribute header claims to be empty (evcn=-1) but the caller
+expects to read actual data. When run_unpack() immediately returns success
+upon seeing this condition, it leaves the runs_tree uninitialized with
+run->runs as a NULL. The calling function attr_load_runs_range() assumes
+that a successful return means that the runs were loaded and sets clen to 0,
+expecting the next run_lookup_entry() call to succeed. Because runs_tree
+remains uninitialized, run_lookup_entry() continues to fail, and the loop
+increments vcn by zero (vcn += 0), leading to an infinite loop.
+
+This patch adds a retry counter to detect when run_lookup_entry() fails
+consecutively after attr_load_runs_vcn(). If the run is still not found on
+the second attempt, it indicates corrupted metadata and returns -EINVAL,
+preventing the Denial-of-Service (DoS) vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index e25989dd2c6bb..ca9ee8eddcf4b 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -1367,19 +1367,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type,
+ CLST vcn;
+ CLST vcn_last = (to - 1) >> cluster_bits;
+ CLST lcn, clen;
+- int err;
++ int err = 0;
++ int retry = 0;
+
+ for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) {
+ if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) {
++ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */
++ err = -EINVAL;
++ break;
++ }
+ err = attr_load_runs_vcn(ni, type, name, name_len, run,
+ vcn);
+ if (err)
+- return err;
++ break;
++
+ clen = 0; /* Next run_lookup_entry(vcn) must be success. */
++ retry++;
+ }
++ else
++ retry = 0;
+ }
+
+- return 0;
++ return err;
+ }
+
+ #ifdef CONFIG_NTFS3_LZX_XPRESS
+--
+2.51.0
+
--- /dev/null
+From b1850bfee548aae045d0d810380dac07e2177dad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 20:01:46 +0900
+Subject: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ]
+
+We found an infinite loop bug in the ntfs3 file system that can lead to a
+Denial-of-Service (DoS) condition.
+
+A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
+indicates a zero data size while the driver allocates memory for it.
+
+When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
+to zero, it still allocates memory because of al_aligned(0). This creates an
+inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
+non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
+list exists and enumerates only the primary MFT record. When it finds
+ATTR_LIST, the code reloads it and restarts the enumeration, repeating
+indefinitely. The mount operation never completes, hanging the kernel thread.
+
+This patch adds validation to ensure that data_size is non-zero before memory
+allocation. When a zero-sized ATTR_LIST is detected, the function returns
+-EINVAL, preventing a DoS vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrlist.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
+index 9f4bd8d260901..9355b4416719d 100644
+--- a/fs/ntfs3/attrlist.c
++++ b/fs/ntfs3/attrlist.c
+@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+
+ if (!attr->non_res) {
+ lsize = le32_to_cpu(attr->res.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ /* attr is resident: lsize < record_size (1K or 4K) */
+ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+ u16 run_off = le16_to_cpu(attr->nres.run_off);
+
+ lsize = le64_to_cpu(attr->nres.data_size);
++ if (!lsize) {
++ err = -EINVAL;
++ goto out;
++ }
+
+ run_init(&ni->attr_list.run);
+
+--
+2.51.0
+
--- /dev/null
+From afb35d5bee9bc3ca54568961199f3c9cab91ab01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 15:52:57 +0100
+Subject: gfs2: fiemap page fault fix
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ]
+
+In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode
+glock. This can lead to recursive glock taking if the fiemap buffer is
+memory mapped to the same inode and accessing it triggers a page fault.
+
+Fix by disabling page faults for iomap_fiemap() and faulting in the
+buffer by hand if necessary.
+
+Fixes xfstest generic/742.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/inode.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index b65444bc1b5f2..45040622d316e 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -2105,6 +2105,14 @@ static int gfs2_getattr(struct mnt_idmap *idmap,
+ return 0;
+ }
+
++static bool fault_in_fiemap(struct fiemap_extent_info *fi)
++{
++ struct fiemap_extent __user *dest = fi->fi_extents_start;
++ size_t size = sizeof(*dest) * fi->fi_extents_max;
++
++ return fault_in_safe_writeable((char __user *)dest, size) == 0;
++}
++
+ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ u64 start, u64 len)
+ {
+@@ -2114,14 +2122,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+
+ inode_lock_shared(inode);
+
++retry:
+ ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh);
+ if (ret)
+ goto out;
+
++ pagefault_disable();
+ ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops);
++ pagefault_enable();
+
+ gfs2_glock_dq_uninit(&gh);
+
++ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) {
++ fieinfo->fi_extents_mapped = 0;
++ goto retry;
++ }
++
+ out:
+ inode_unlock_shared(inode);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 6b2cc62710004f405f78311a19c3637ffac99f0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:26:26 +0800
+Subject: gpio: aspeed-sgpio: Change the macro to support deferred probe
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ]
+
+Use module_platform_driver() to replace module_platform_driver_probe().
+The former utilizes platform_driver_register(), which allows the driver to
+defer probing when it doesn't acquire the necessary resources due to probe
+order. In contrast, the latter uses __platform_driver_probe(), which
+includes the comment "Note that this is incompatible with deferred
+probing." Since our SGPIO driver requires access to the clock resource, the
+former is more suitable.
+
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed-sgpio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
+index 72755fee64784..e69a6ce7be3fb 100644
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -534,7 +534,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = {
+
+ MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table);
+
+-static int __init aspeed_sgpio_probe(struct platform_device *pdev)
++static int aspeed_sgpio_probe(struct platform_device *pdev)
+ {
+ u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask;
+ const struct aspeed_sgpio_pdata *pdata;
+@@ -629,11 +629,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ }
+
+ static struct platform_driver aspeed_sgpio_driver = {
++ .probe = aspeed_sgpio_probe,
+ .driver = {
+ .name = KBUILD_MODNAME,
+ .of_match_table = aspeed_sgpio_of_table,
+ },
+ };
+
+-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe);
++module_platform_driver(aspeed_sgpio_driver);
+ MODULE_DESCRIPTION("Aspeed Serial GPIO Driver");
+--
+2.51.0
+
--- /dev/null
+From d9fe9a87c1949cb4e2d2bfc361f52cdcfe9da576 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 04:57:17 +0000
+Subject: gro: change the BUG_ON() in gro_pull_from_frag0()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ]
+
+Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE()
+
+$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2
+add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116)
+Function old new delta
+gro_try_pull_from_frag0 - 196 +196
+napi_gro_frags 771 929 +158
+__pfx_gro_try_pull_from_frag0 - 16 +16
+__pfx_gro_pull_from_frag0 16 - -16
+dev_gro_receive 1514 1464 -50
+gro_pull_from_frag0 188 - -188
+Total: Before=22565899, After=22566015, chg +0.00%
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/gro.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/gro.c b/net/core/gro.c
+index 87889cb75d219..92cb86d4ce50a 100644
+--- a/net/core/gro.c
++++ b/net/core/gro.c
+@@ -386,7 +386,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow)
+ {
+ struct skb_shared_info *pinfo = skb_shinfo(skb);
+
+- BUG_ON(skb->end - skb->tail < grow);
++ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow);
+
+ memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
+
+--
+2.51.0
+
--- /dev/null
+From d6a85fedceb45748a32d583764e8f17edfc57613 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Dec 2025 19:58:22 -0800
+Subject: hfsplus: fix volume corruption issue for generic/498
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ]
+
+The xfstests' test-case generic/498 leaves HFS+ volume
+in corrupted state:
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
+(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details)
+
+Ran: generic/498
+Failures: generic/498
+Failed 1 of 1 tests
+
+sudo fsck.hfsplus -d /dev/loop51
+** /dev/loop51
+Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+Executing fsck_hfs (version 540.1-Linux).
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+Invalid leaf record count
+(It should be 16 instead of 2)
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
+CBTStat = 0x8000 CatStat = 0x00000000
+** Repairing volume.
+** Rechecking volume.
+** Checking non-journaled HFS Plus Volume.
+The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking multi-linked files.
+CheckHardLinks: found 1 pre-Leopard file inodes.
+** Checking catalog hierarchy.
+** Checking extended attributes file.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled was repaired successfully.
+
+The generic/498 test executes such steps on final phase:
+
+mkdir $SCRATCH_MNT/A
+mkdir $SCRATCH_MNT/B
+mkdir $SCRATCH_MNT/A/C
+touch $SCRATCH_MNT/B/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo
+
+ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo
+$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A
+
+"Simulate a power failure and mount the filesystem
+to check that what we explicitly fsync'ed exists."
+
+_flakey_drop_and_remount
+
+The FSCK tool complains about "Invalid leaf record count".
+HFS+ b-tree header contains leaf_count field is updated
+by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert()
+is involved into hard link creation process. However,
+modified in-core leaf_count field is stored into HFS+
+b-tree header by hfs_btree_write() method. But,
+unfortunately, hfs_btree_write() hasn't been called
+by hfsplus_cat_write_inode() and hfsplus_file_fsync()
+stores not fully consistent state of the Catalog File's
+b-tree.
+
+This patch adds calling hfs_btree_write() method in
+the hfsplus_cat_write_inode() with the goal of
+storing consistent state of Catalog File's b-tree.
+Finally, it makes FSCK tool happy.
+
+sudo ./check generic/498
+FSTYP -- hfsplus
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/498 33s ... 31s
+Ran: generic/498
+Passed all 1 tests
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/inode.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 2619e5371ec9c..2dd17192d11c3 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -604,6 +604,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ int hfsplus_cat_write_inode(struct inode *inode)
+ {
+ struct inode *main_inode = inode;
++ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree;
+ struct hfs_find_data fd;
+ hfsplus_cat_entry entry;
+ int res = 0;
+@@ -614,7 +615,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ if (!main_inode->i_nlink)
+ return 0;
+
+- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd))
++ if (hfs_find_init(tree, &fd))
+ /* panic? */
+ return -EIO;
+
+@@ -679,6 +680,15 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags);
+ out:
+ hfs_find_exit(&fd);
++
++ if (!res) {
++ res = hfs_btree_write(tree);
++ if (res) {
++ pr_err("b-tree write err: %d, ino %lu\n",
++ res, inode->i_ino);
++ }
++ }
++
+ return res;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 17f67ed0df33d6adb61c8d520fc6cb426ca9068b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 18:39:33 +0900
+Subject: hfsplus: pretend special inodes as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index 7e889820a63d0..954ceaa748e62 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -52,6 +52,12 @@ static int hfsplus_system_read_inode(struct inode *inode)
+ return -EIO;
+ }
+
++ /*
++ * Assign a dummy file type, for may_open() requires that
++ * an inode has a valid file type.
++ */
++ inode->i_mode = S_IFREG;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e4603667da8e357191cc18f8bfae883e5a4eddd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 06:06:23 +0000
+Subject: HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple
+ keyboards
+
+From: Joey Bednar <linux@joeybednar.com>
+
+[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ]
+
+The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium
+Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX
+KN85 Keyboard" to the list of non-apple keyboards fixes the function
+keys.
+
+Signed-off-by: Joey Bednar <linux@joeybednar.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 2b8021628d3c6..9dd5c698fefe0 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -340,6 +340,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+ };
+
+ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
++ { "SONiX KN85 Keyboard" },
+ { "SONiX USB DEVICE" },
+ { "SONiX AK870 PRO" },
+ { "Keychron" },
+--
+2.51.0
+
--- /dev/null
+From 8a6a22b18a3485883ad5a5670b43682de4d2a76b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 12:56:09 +0900
+Subject: HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
+
+From: David Phillips <david@profile.sh>
+
+[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ]
+
+New model in the ELECOM HUGE trackball line that has 8 buttons but the
+report descriptor specifies only 5. The HUGE Plus supports connecting via
+Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable.
+Each connection type reports a different device id, 01AA for cable,
+01AB for USB dongle, and 01AC for Bluetooth.
+
+This patch adds these device IDs and applies the fixups similar to the
+other ELECOM devices to get all 8 buttons working for all 3 connection
+types.
+
+For reference, the usbhid-dump output:
+001:013:001:DESCRIPTOR 1769085639.598405
+ 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01
+ 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01
+ 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10
+ 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06
+ 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0
+ C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01
+ 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01
+ 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03
+ 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00
+ A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81
+ 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26
+ FF 00 75 08 95 07 B1 02 C0
+
+Signed-off-by: David Phillips <david@profile.sh>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-elecom.c | 16 ++++++++++++++++
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 3 +++
+ 4 files changed, 23 insertions(+)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index ffbeb39341e1a..851ddbc25bedd 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -328,6 +328,7 @@ config HID_ELECOM
+ - EX-G Trackballs (M-XT3DRBK, M-XT3URBK)
+ - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ - HUGE Plus Trackball (M-HT1MRBK)
+
+ config HID_ELO
+ tristate "ELO USB 4000/4500 touchscreen"
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index f76fec79e8903..9aeb2d2b43a43 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -5,6 +5,7 @@
+ * - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK)
+ * - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
+ * - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
++ * - HUGE Plus Trackball (M-HT1MRBK)
+ *
+ * Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
+ * Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
+@@ -111,12 +112,25 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
+ break;
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB:
++ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC:
++ /*
++ * Report descriptor format:
++ * 24: button bit count
++ * 28: padding bit count
++ * 22: button report size
++ * 16: button usage maximum
++ */
++ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8);
++ break;
+ }
+ return rdesc;
+ }
+
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+@@ -127,6 +141,8 @@ static const struct hid_device_id elecom_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, elecom_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index fa54c0303d8b0..a1910e12f7e05 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -453,6 +453,9 @@
+ #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d
+ #define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab
++#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac
+
+ #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34
+ #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 1f531626192cd..7a3e0675d9ba2 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -415,6 +415,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+@@ -424,6 +425,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_ELO)
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
+--
+2.51.0
+
--- /dev/null
+From ceef55048c7e1b294e9058b50642ba654206b56f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 09:57:05 +0100
+Subject: HID: multitouch: add eGalaxTouch EXC3188 support
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ]
+
+Add support for the for the EXC3188 touchscreen from eGalaxy.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 931746cf36302..fa54c0303d8b0 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -427,6 +427,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
+
+ #define USB_VENDOR_ID_EDIFIER 0x2d99
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 6d9a85c5fc409..b6c2cb7153fde 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2020,6 +2020,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
++ { .driver_data = MT_CLS_EGALAX_SERIAL,
++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) },
+ { .driver_data = MT_CLS_EGALAX,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
+--
+2.51.0
+
--- /dev/null
+From 52d854c0b0a4c2e9747f5b3567ba9da18fa71ad2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 10:02:03 +0800
+Subject: hisi_acc_vfio_pci: update status after RAS error
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ]
+
+After a RAS error occurs on the accelerator device, the accelerator
+device will be reset. The live migration state will be abnormal
+after reset, and the original state needs to be restored during
+the reset process.
+Therefore, reset processing needs to be performed in a live
+migration scenario.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+index 712b178c42aae..e544fd0a710c0 100644
+--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
++++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+@@ -1152,8 +1152,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev)
+ {
+ struct hisi_acc_vf_core_device *hisi_acc_vdev = hisi_acc_drvdata(pdev);
+
+- if (hisi_acc_vdev->core_device.vdev.migration_flags !=
+- VFIO_MIGRATION_STOP_COPY)
++ if (!hisi_acc_vdev->core_device.vdev.mig_ops)
+ return;
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 18d0fc58b98941020e01c1d6a14f4a6faef9e782 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 13:10:40 +0800
+Subject: hwmon: (f71882fg) Add F81968 support
+
+From: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+
+[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ]
+
+Add hardware monitoring support for the Fintek F81968 Super I/O chip.
+It is fully compatible with F81866.
+
+Several products share compatibility with the F81866. To better distinguish
+between them, ensure that the Product ID is displayed when the device is
+probed.
+
+Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
+Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/f71882fg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
+index 27207ec6f7feb..5e3c8be255e87 100644
+--- a/drivers/hwmon/f71882fg.c
++++ b/drivers/hwmon/f71882fg.c
+@@ -51,6 +51,7 @@
+ #define SIO_F81866_ID 0x1010 /* Chipset ID */
+ #define SIO_F71858AD_ID 0x0903 /* Chipset ID */
+ #define SIO_F81966_ID 0x1502 /* Chipset ID */
++#define SIO_F81968_ID 0x1806 /* Chipset ID */
+
+ #define REGION_LENGTH 8
+ #define ADDR_REG_OFFSET 5
+@@ -2571,6 +2572,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ break;
+ case SIO_F81866_ID:
+ case SIO_F81966_ID:
++ case SIO_F81968_ID:
+ sio_data->type = f81866a;
+ break;
+ default:
+@@ -2600,9 +2602,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
+ address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */
+
+ err = address;
+- pr_info("Found %s chip at %#x, revision %d\n",
++ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n",
+ f71882fg_names[sio_data->type], (unsigned int)address,
+- (int)superio_inb(sioaddr, SIO_REG_DEVREV));
++ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid);
+ exit:
+ superio_exit(sioaddr);
+ return err;
+--
+2.51.0
+
--- /dev/null
+From 6b0a784d75c2f8e3054baa1cd98649d22c84737c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 17:53:14 +0200
+Subject: hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
+
+From: Denis Pauk <pauk.denis@gmail.com>
+
+[ Upstream commit 246167b17c14e8a5142368ac6457e81622055e0a ]
+
+Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's
+no use of it because of resource conflict with WMI method.
+
+Add the board to the WMI monitoring list.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807
+Signed-off-by: Denis Pauk <pauk.denis@gmail.com>
+Tested-by: Marcus <shoes2ga@gmail.com>
+Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775-platform.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c
+index 7e0ac3fcbc050..b09fd5791db8e 100644
+--- a/drivers/hwmon/nct6775-platform.c
++++ b/drivers/hwmon/nct6775-platform.c
+@@ -1356,6 +1356,7 @@ static const char * const asus_msi_boards[] = {
+ "Pro WS W680-ACE IPMI",
+ "Pro WS W790-ACE",
+ "Pro WS W790E-SAGE SE",
++ "Pro WS WRX90E-SAGE SE",
+ "ProArt B650-CREATOR",
+ "ProArt B660-CREATOR D4",
+ "ProArt B760-CREATOR D4",
+--
+2.51.0
+
--- /dev/null
+From d05e746b985864e77aec90c67dc3012eaa178b37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:44 +0100
+Subject: hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ]
+
+The unpacked union within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value'
+ is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)'
+ and is usually due to 'struct hv_kvp_exchg_msg_value' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 361 | union {
+ | ^
+
+With the recent changes to compile-test the UAPI headers in more cases,
+this warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warning.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/hyperv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h
+index aaa502a7bff46..1749b35ab2c21 100644
+--- a/include/uapi/linux/hyperv.h
++++ b/include/uapi/linux/hyperv.h
+@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value {
+ __u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE];
+ __u32 value_u32;
+ __u64 value_u64;
+- };
++ } __attribute__((packed));
+ } __attribute__((packed));
+
+ struct hv_kvp_msg_enumerate {
+--
+2.51.0
+
--- /dev/null
+From 7a7dc687b9597eb74006840919fa8ee7160f32ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:08:51 -0500
+Subject: i3c: master: svc: Initialize 'dev' to NULL in
+ svc_i3c_master_ibi_isr()
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ]
+
+Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add
+a NULL check in the error path.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 3222b8f56a926..94792f3559a0f 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -418,8 +418,8 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ {
+ struct svc_i3c_master *master = container_of(work, struct svc_i3c_master, ibi_work);
+ struct svc_i3c_i2c_dev_data *data;
++ struct i3c_dev_desc *dev = NULL;
+ unsigned int ibitype, ibiaddr;
+- struct i3c_dev_desc *dev;
+ u32 status, val;
+ int ret;
+
+@@ -503,7 +503,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ * for the slave to interrupt again.
+ */
+ if (svc_i3c_master_error(master)) {
+- if (master->ibi.tbq_slot) {
++ if (master->ibi.tbq_slot && dev) {
+ data = i3c_dev_get_master_data(dev);
+ i3c_generic_ibi_recycle_slot(data->ibi_pool,
+ master->ibi.tbq_slot);
+--
+2.51.0
+
--- /dev/null
+From 43027fd97c554f125508544d7d562e46e3510380 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:38 +0100
+Subject: iio: magnetometer: Remove IRQF_ONESHOT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+The force-threading functionality is required on PREEMPT_RT because the
+handler is using locks with can sleep on PREEMPT_RT.
+
+Remove IRQF_ONESHOT from irqflags.
+
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index 3a98d6bae1b20..c1894a26ffd67 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -542,7 +542,7 @@ static int ak8975_setup_irq(struct ak8975_data *data)
+ irq = gpiod_to_irq(data->eoc_gpiod);
+
+ rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_TRIGGER_RISING,
+ dev_name(&client->dev), data);
+ if (rc < 0) {
+ dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc);
+--
+2.51.0
+
--- /dev/null
+From 9f6038e65e684bdfc5d314d63c72ca963f29fa7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:36 +0100
+Subject: iio: Use IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ]
+
+The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke
+other interrupt handler and this supposed to happen from within the
+hardirq.
+
+Use IRQF_NO_THREAD to forbid forced-threading.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/bma180.c | 5 +++--
+ drivers/iio/adc/ad7766.c | 2 +-
+ drivers/iio/gyro/itg3200_buffer.c | 8 +++-----
+ drivers/iio/light/si1145.c | 2 +-
+ 4 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
+index 13439f52d26db..0eabcd6957979 100644
+--- a/drivers/iio/accel/bma180.c
++++ b/drivers/iio/accel/bma180.c
+@@ -996,8 +996,9 @@ static int bma180_probe(struct i2c_client *client)
+ }
+
+ ret = devm_request_irq(dev, client->irq,
+- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING,
+- "bma180_event", data->trig);
++ iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "bma180_event", data->trig);
+ if (ret) {
+ dev_err(dev, "unable to request IRQ\n");
+ goto err_trigger_free;
+diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c
+index 3079a0872947e..d1d010c1dbf6c 100644
+--- a/drivers/iio/adc/ad7766.c
++++ b/drivers/iio/adc/ad7766.c
+@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi)
+ * don't enable the interrupt to avoid extra load on the system
+ */
+ ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq,
+- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
++ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD,
+ dev_name(&spi->dev),
+ ad7766->trig);
+ if (ret < 0)
+diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
+index 4cfa0d4395605..d1c125a77308a 100644
+--- a/drivers/iio/gyro/itg3200_buffer.c
++++ b/drivers/iio/gyro/itg3200_buffer.c
+@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev)
+ if (!st->trig)
+ return -ENOMEM;
+
+- ret = request_irq(st->i2c->irq,
+- &iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_RISING,
+- "itg3200_data_rdy",
+- st->trig);
++ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll,
++ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
++ "itg3200_data_rdy", st->trig);
+ if (ret)
+ goto error_free_trig;
+
+diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c
+index 77666b780a5c5..9655214a38276 100644
+--- a/drivers/iio/light/si1145.c
++++ b/drivers/iio/light/si1145.c
+@@ -1251,7 +1251,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev)
+
+ ret = devm_request_irq(&client->dev, client->irq,
+ iio_trigger_generic_data_rdy_poll,
+- IRQF_TRIGGER_FALLING,
++ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD,
+ "si1145_irq",
+ trig);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From ead903f96e4ff4639a71381bfc8b4b4943e1d0b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 15:54:06 +0100
+Subject: include: uapi: netfilter_bridge.h: Cover for musl libc
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ]
+
+Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
+zero. To avoid struct redefinition errors, user space is therefore
+supposed to include netinet/if_ether.h before (or instead of)
+linux/if_ether.h. To relieve them from this burden, include the libc
+header here if not building for kernel space.
+
+Reported-by: Alyssa Ross <hi@alyssa.is>
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter_bridge.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 1610fdbab98df..ad520d3e9df8f 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -5,6 +5,10 @@
+ /* bridge-specific defines for netfilter.
+ */
+
++#ifndef __KERNEL__
++#include <netinet/if_ether.h> /* for __UAPI_DEF_ETHHDR if defined */
++#endif
++
+ #include <linux/in.h>
+ #include <linux/netfilter.h>
+ #include <linux/if_ether.h>
+--
+2.51.0
+
--- /dev/null
+From a3b4987ebcdef9e6ec8a928987f31e97a830b16d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 14:39:40 +0000
+Subject: iommu/amd: move wait_on_sem() out of spinlock
+
+From: Ankit Soni <Ankit.Soni@amd.com>
+
+[ Upstream commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf ]
+
+With iommu.strict=1, the existing completion wait path can cause soft
+lockups under stressed environment, as wait_on_sem() busy-waits under the
+spinlock with interrupts disabled.
+
+Move the completion wait in iommu_completion_wait() out of the spinlock.
+wait_on_sem() only polls the hardware-updated cmd_sem and does not require
+iommu->lock, so holding the lock during the busy wait unnecessarily
+increases contention and extends the time with interrupts disabled.
+
+Signed-off-by: Ankit Soni <Ankit.Soni@amd.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 23cfb98fe90a7..d119a104a3436 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -941,7 +941,12 @@ static int wait_on_sem(struct amd_iommu *iommu, u64 data)
+ {
+ int i = 0;
+
+- while (*iommu->cmd_sem != data && i < LOOP_TIMEOUT) {
++ /*
++ * cmd_sem holds a monotonically non-decreasing completion sequence
++ * number.
++ */
++ while ((__s64)(READ_ONCE(*iommu->cmd_sem) - data) < 0 &&
++ i < LOOP_TIMEOUT) {
+ udelay(1);
+ i += 1;
+ }
+@@ -1210,14 +1215,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+
+ ret = __iommu_queue_command_sync(iommu, &cmd, false);
++ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++
+ if (ret)
+- goto out_unlock;
++ return ret;
+
+ ret = wait_on_sem(iommu, data);
+
+-out_unlock:
+- raw_spin_unlock_irqrestore(&iommu->lock, flags);
+-
+ return ret;
+ }
+
+@@ -2879,13 +2883,18 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
+ raw_spin_lock_irqsave(&iommu->lock, flags);
+ ret = __iommu_queue_command_sync(iommu, &cmd, true);
+ if (ret)
+- goto out;
++ goto out_err;
+ ret = __iommu_queue_command_sync(iommu, &cmd2, false);
+ if (ret)
+- goto out;
++ goto out_err;
++ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++
+ wait_on_sem(iommu, data);
+-out:
++ return;
++
++out_err:
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
++ return;
+ }
+
+ static void set_dte_irq_entry(struct amd_iommu *iommu, u16 devid,
+--
+2.51.0
+
--- /dev/null
+From 5c91d29986205c48554e0f0dd0eb309b0754bb79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 13:28:57 -0800
+Subject: iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
+
+From: Alexander Grest <Alexander.Grest@microsoft.com>
+
+[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ]
+
+The SMMU CMDQ lock is highly contentious when there are multiple CPUs
+issuing commands and the queue is nearly full.
+
+The lock has the following states:
+ - 0: Unlocked
+ - >0: Shared lock held with count
+ - INT_MIN+N: Exclusive lock held, where N is the # of shared waiters
+ - INT_MIN: Exclusive lock held, no shared waiters
+
+When multiple CPUs are polling for space in the queue, they attempt to
+grab the exclusive lock to update the cons pointer from the hardware. If
+they fail to get the lock, they will spin until either the cons pointer
+is updated by another CPU.
+
+The current code allows the possibility of shared lock starvation
+if there is a constant stream of CPUs trying to grab the exclusive lock.
+This leads to severe latency issues and soft lockups.
+
+Consider the following scenario where CPU1's attempt to acquire the
+shared lock is starved by CPU2 and CPU0 contending for the exclusive
+lock.
+
+CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock`
+--------------------------------------------------------------------------
+trylock() //takes | | | 0
+ | shared_lock() | | INT_MIN
+ | fetch_inc() | | INT_MIN
+ | no return | | INT_MIN + 1
+ | spins // VAL >= 0 | | INT_MIN + 1
+unlock() | spins... | | INT_MIN + 1
+set_release(0) | spins... | | 0 see[NOTE]
+(done) | (sees 0) | trylock() // takes | 0
+ | *exits loop* | cmpxchg(0, INT_MIN) | 0
+ | | *cuts in* | INT_MIN
+ | cmpxchg(0, 1) | | INT_MIN
+ | fails // != 0 | | INT_MIN
+ | spins // VAL >= 0 | | INT_MIN
+ | *starved* | | INT_MIN
+
+[NOTE] The current code resets the exclusive lock to 0 regardless of the
+state of the lock. This causes two problems:
+1. It opens the possibility of back-to-back exclusive locks and the
+ downstream effect of starving shared lock.
+2. The count of shared lock waiters are lost.
+
+To mitigate this, we release the exclusive lock by only clearing the sign
+bit while retaining the shared lock waiter count as a way to avoid
+starving the shared lock waiters.
+
+Also deleted cmpxchg loop while trying to acquire the shared lock as it
+is not needed. The waiters can see the positive lock count and proceed
+immediately after the exclusive lock is released.
+
+Exclusive lock is not starved in that submitters will try exclusive lock
+first when new spaces become available.
+
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Alexander Grest <Alexander.Grest@microsoft.com>
+Signed-off-by: Jacob Pan <jacob.pan@linux.microsoft.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++-------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+index f2260f45728e7..bb7365b432198 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+@@ -443,20 +443,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
+ */
+ static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq)
+ {
+- int val;
+-
+ /*
+- * We can try to avoid the cmpxchg() loop by simply incrementing the
+- * lock counter. When held in exclusive state, the lock counter is set
+- * to INT_MIN so these increments won't hurt as the value will remain
+- * negative.
++ * When held in exclusive state, the lock counter is set to INT_MIN
++ * so these increments won't hurt as the value will remain negative.
++ * The increment will also signal the exclusive locker that there are
++ * shared waiters.
+ */
+ if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0)
+ return;
+
+- do {
+- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0);
+- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val);
++ /*
++ * Someone else is holding the lock in exclusive state, so wait
++ * for them to finish. Since we already incremented the lock counter,
++ * no exclusive lock can be acquired until we finish. We don't need
++ * the return value since we only care that the exclusive lock is
++ * released (i.e. the lock counter is non-negative).
++ * Once the exclusive locker releases the lock, the sign bit will
++ * be cleared and our increment will make the lock counter positive,
++ * allowing us to proceed.
++ */
++ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0);
+ }
+
+ static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq)
+@@ -483,9 +489,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq)
+ __ret; \
+ })
+
++/*
++ * Only clear the sign bit when releasing the exclusive lock this will
++ * allow any shared_lock() waiters to proceed without the possibility
++ * of entering the exclusive lock in a tight loop.
++ */
+ #define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \
+ ({ \
+- atomic_set_release(&cmdq->lock, 0); \
++ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \
+ local_irq_restore(flags); \
+ })
+
+--
+2.51.0
+
--- /dev/null
+From ccf6562acd023907c3e856ae07e0f6857bcb7b71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 04:35:24 +0000
+Subject: ipv4: fib: Annotate access to struct fib_alias.fa_state.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ]
+
+syzbot reported that struct fib_alias.fa_state can be
+modified locklessly by RCU readers. [0]
+
+Let's use READ_ONCE()/WRITE_ONCE() properly.
+
+[0]:
+BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup
+
+write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0:
+ fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline]
+ fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1:
+ fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline]
+ fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565
+ fib_lookup include/net/ip_fib.h:390 [inline]
+ ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
+ ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
+ __ip_route_output_key include/net/route.h:169 [inline]
+ ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
+ udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
+ inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
+ sock_sendmsg_nosec net/socket.c:727 [inline]
+ __sock_sendmsg net/socket.c:742 [inline]
+ ____sys_sendmsg+0x53a/0x600 net/socket.c:2592
+ ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
+ __sys_sendmmsg+0x185/0x320 net/socket.c:2735
+ __do_sys_sendmmsg net/socket.c:2762 [inline]
+ __se_sys_sendmmsg net/socket.c:2759 [inline]
+ __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
+ x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+value changed: 0x00 -> 0x01
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
+
+Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/fib_lookup.h | 6 ++++--
+ net/ipv4/fib_trie.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
+index f9b9e26c32c19..0b72796dd1ad3 100644
+--- a/net/ipv4/fib_lookup.h
++++ b/net/ipv4/fib_lookup.h
+@@ -28,8 +28,10 @@ struct fib_alias {
+ /* Don't write on fa_state unless needed, to keep it shared on all cpus */
+ static inline void fib_alias_accessed(struct fib_alias *fa)
+ {
+- if (!(fa->fa_state & FA_S_ACCESSED))
+- fa->fa_state |= FA_S_ACCESSED;
++ u8 fa_state = READ_ONCE(fa->fa_state);
++
++ if (!(fa_state & FA_S_ACCESSED))
++ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED);
+ }
+
+ /* Exported by fib_semantics.c */
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 4d148d0892327..c9e1526e749b2 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1285,7 +1285,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
+ new_fa->fa_dscp = fa->fa_dscp;
+ new_fa->fa_info = fi;
+ new_fa->fa_type = cfg->fc_type;
+- state = fa->fa_state;
++ state = READ_ONCE(fa->fa_state);
+ new_fa->fa_state = state & ~FA_S_ACCESSED;
+ new_fa->fa_slen = fa->fa_slen;
+ new_fa->tb_id = tb->tb_id;
+@@ -1751,7 +1751,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb,
+
+ fib_remove_alias(t, tp, l, fa_to_delete);
+
+- if (fa_to_delete->fa_state & FA_S_ACCESSED)
++ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED)
+ rt_cache_flush(cfg->fc_nlinfo.nl_net);
+
+ fib_release_info(fa_to_delete->fa_info);
+--
+2.51.0
+
--- /dev/null
+From 37cae65d949dc03c7dbb849d48b4cef22d3cf58b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 17:22:47 +0000
+Subject: ipv4: igmp: annotate data-races around idev->mr_maxdelay
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit e4faaf65a75f650ac4366ddff5dabb826029ca5a ]
+
+idev->mr_maxdelay is read and written locklessly,
+add READ_ONCE()/WRITE_ONCE() annotations.
+
+While we are at it, make this field an u32.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/inetdevice.h | 2 +-
+ net/ipv4/igmp.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index ddb27fc0ee8c8..b157ff4f727fb 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -38,11 +38,11 @@ struct in_device {
+ struct ip_mc_list *mc_tomb;
+ unsigned long mr_v1_seen;
+ unsigned long mr_v2_seen;
+- unsigned long mr_maxdelay;
+ unsigned long mr_qi; /* Query Interval */
+ unsigned long mr_qri; /* Query Response Interval */
+ unsigned char mr_qrv; /* Query Robustness Variable */
+ unsigned char mr_gq_running;
++ u32 mr_maxdelay;
+ u32 mr_ifc_count;
+ struct timer_list mr_gq_timer; /* general query timer */
+ struct timer_list mr_ifc_timer; /* interface change timer */
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index d515881d02a6f..2836020bf12d5 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -224,7 +224,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
+
+ static void igmp_gq_start_timer(struct in_device *in_dev)
+ {
+- int tv = get_random_u32_below(in_dev->mr_maxdelay);
++ int tv = get_random_u32_below(READ_ONCE(in_dev->mr_maxdelay));
+ unsigned long exp = jiffies + tv + 2;
+
+ if (in_dev->mr_gq_running &&
+@@ -1006,7 +1006,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
+ if (!max_delay)
+ max_delay = 1; /* can't mod w/ 0 */
+- in_dev->mr_maxdelay = max_delay;
++ WRITE_ONCE(in_dev->mr_maxdelay, max_delay);
+
+ /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently
+ * received value was zero, use the default or statically
+--
+2.51.0
+
--- /dev/null
+From 801cb6f43aead3c5b9b6009dc367943203fd00fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:37 +0000
+Subject: ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ]
+
+Add missing READ_ONCE() when reading sysctl values.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ipv6.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 9e5e44c6da0a6..d98f5390ffad3 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -1017,11 +1017,11 @@ static inline int ip6_default_np_autolabel(struct net *net)
+ #if IS_ENABLED(CONFIG_IPV6)
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_policy;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy);
+ }
+ static inline u32 ip6_multipath_hash_fields(const struct net *net)
+ {
+- return net->ipv6.sysctl.multipath_hash_fields;
++ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields);
+ }
+ #else
+ static inline int ip6_multipath_hash_policy(const struct net *net)
+--
+2.51.0
+
--- /dev/null
+From b5821a8c6ecec3b1acc7ae44f0dca71347f8c211 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 09:41:40 +0000
+Subject: ipv6: exthdrs: annotate data-race over multiple sysctl
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ]
+
+Following four sysctls can change under us, add missing READ_ONCE().
+
+- ipv6.sysctl.max_dst_opts_len
+- ipv6.sysctl.max_dst_opts_cnt
+- ipv6.sysctl.max_hbh_opts_len
+- ipv6.sysctl.max_hbh_opts_cnt
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/exthdrs.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index 02e9ffb63af19..d0aaa35fc2e9e 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -313,7 +313,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_dst_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len))
+ goto fail_and_free;
+
+ opt->lastopt = opt->dst1 = skb_network_header_len(skb);
+@@ -321,7 +321,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
+ dstbuf = opt->dst1;
+ #endif
+
+- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) {
++ if (ip6_parse_tlv(false, skb,
++ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ #if IS_ENABLED(CONFIG_IPV6_MIP6)
+@@ -1053,11 +1054,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
+ }
+
+ extlen = (skb_transport_header(skb)[1] + 1) << 3;
+- if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
++ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len))
+ goto fail_and_free;
+
+ opt->flags |= IP6SKB_HOPBYHOP;
+- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) {
++ if (ip6_parse_tlv(true, skb,
++ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ opt->nhoff = sizeof(struct ipv6hdr);
+--
+2.51.0
+
--- /dev/null
+From f0097270e345304dc682c0f1bedf178376af71f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 19:38:01 +0800
+Subject: jfs: Add missing set_freezable() for freezable kthread
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ]
+
+The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(),
+causing it to remain non-freezable by default. This prevents proper
+freezing during system suspend.
+
+Add set_freezable() to make the thread freezable as intended.
+
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_logmgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
+index cb6d1fda66a70..32e589bb663ae 100644
+--- a/fs/jfs/jfs_logmgr.c
++++ b/fs/jfs/jfs_logmgr.c
+@@ -2312,6 +2312,7 @@ int jfsIOWait(void *arg)
+ {
+ struct lbuf *bp;
+
++ set_freezable();
+ do {
+ spin_lock_irq(&log_redrive_lock);
+ while ((bp = log_redrive_list)) {
+--
+2.51.0
+
--- /dev/null
+From 5400fcdd5dd1dc40cb5fb549b4bd0c872b7c1a54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 13:22:12 +0100
+Subject: jfs: nlink overflow in jfs_rename
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ]
+
+If nlink is maximal for a directory (-1) and inside that directory you
+perform a rename for some child directory (not moving from the parent),
+then the nlink of the first directory is first incremented and later
+decremented. Normally this is fine, but when nlink = -1 this causes a
+wrap around to 0, and then drop_nlink issues a warning.
+
+After applying the patch syzbot no longer issues any warnings. I also
+ran some basic fs tests to look for any regressions.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
+Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/namei.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
+index 57d7a4300210d..649184d712ad0 100644
+--- a/fs/jfs/namei.c
++++ b/fs/jfs/namei.c
+@@ -1227,7 +1227,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ jfs_err("jfs_rename: dtInsert returned -EIO");
+ goto out_tx;
+ }
+- if (S_ISDIR(old_ip->i_mode))
++ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
+ inc_nlink(new_dir);
+ }
+ /*
+@@ -1243,7 +1243,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ goto out_tx;
+ }
+ if (S_ISDIR(old_ip->i_mode)) {
+- drop_nlink(old_dir);
++ if (new_ip || old_dir != new_dir)
++ drop_nlink(old_dir);
++
+ if (old_dir != new_dir) {
+ /*
+ * Change inode number of parent for moved directory
+--
+2.51.0
+
--- /dev/null
+From 3befba1c0e375acfb3529d977c7c2b38a0b63915 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 16:30:50 +0200
+Subject: libceph: define and enforce CEPH_MAX_KEY_LEN
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ]
+
+When decoding the key, verify that the key material would fit into
+a fixed-size buffer in process_auth_done() and generally has a sane
+length.
+
+The new CEPH_MAX_KEY_LEN check replaces the existing check for a key
+with no key material which is a) not universal since CEPH_CRYPTO_NONE
+has to be excluded and b) doesn't provide much value since a smaller
+than needed key is just as invalid as no key -- this has to be handled
+elsewhere anyway.
+
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/crypto.c | 8 +++++---
+ net/ceph/crypto.h | 2 +-
+ net/ceph/messenger_v2.c | 2 +-
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
+index 051d22c0e4ad4..3397d105f74f9 100644
+--- a/net/ceph/crypto.c
++++ b/net/ceph/crypto.c
+@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf)
+ return -ENOTSUPP;
+ }
+
+- if (!key->len)
+- return -EINVAL;
+-
+ key->key = kmemdup(buf, key->len, GFP_NOIO);
+ if (!key->key) {
+ ret = -ENOMEM;
+@@ -95,6 +92,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
+ ceph_decode_copy(p, &key->created, sizeof(key->created));
+ key->len = ceph_decode_16(p);
+ ceph_decode_need(p, end, key->len, bad);
++ if (key->len > CEPH_MAX_KEY_LEN) {
++ pr_err("secret too big %d\n", key->len);
++ return -EINVAL;
++ }
++
+ ret = set_secret(key, *p);
+ memzero_explicit(*p, key->len);
+ *p += key->len;
+diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h
+index 13bd526349fa1..0d32f1649f3d0 100644
+--- a/net/ceph/crypto.h
++++ b/net/ceph/crypto.h
+@@ -5,7 +5,7 @@
+ #include <linux/ceph/types.h>
+ #include <linux/ceph/buffer.h>
+
+-#define CEPH_KEY_LEN 16
++#define CEPH_MAX_KEY_LEN 16
+ #define CEPH_MAX_CON_SECRET_LEN 64
+
+ /*
+diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
+index 8581987244396..f82029bd33db8 100644
+--- a/net/ceph/messenger_v2.c
++++ b/net/ceph/messenger_v2.c
+@@ -2393,7 +2393,7 @@ static int process_auth_reply_more(struct ceph_connection *con,
+ */
+ static int process_auth_done(struct ceph_connection *con, void *p, void *end)
+ {
+- u8 session_key_buf[CEPH_KEY_LEN + 16];
++ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16];
+ u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16];
+ u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16);
+ u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16);
+--
+2.51.0
+
--- /dev/null
+From 29b130121f9fc5b67863da362b610d0b54222177 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:09:18 -0800
+Subject: libperf build: Always place libperf includes first
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ]
+
+When building tools/perf the CFLAGS can contain a directory for the
+installed headers.
+
+As the headers may be being installed while building libperf.a this can
+cause headers to be partially installed and found in the include path
+while building an object file for libperf.a.
+
+The installed header may reference other installed headers that are
+missing given the partial nature of the install and then the build fails
+with a missing header file.
+
+Avoid this by ensuring the libperf source headers are always first in
+the CFLAGS.
+
+Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index 478fe57bf8cee..703a8ff0b3430 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -63,9 +63,9 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
++override CFLAGS := $(INCLUDES) $(CFLAGS)
+ override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+-override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += $(EXTRA_CFLAGS)
+--
+2.51.0
+
--- /dev/null
+From f8ad878710fce9c3ccab55f335315be9d6d1c632 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 11:40:09 +0000
+Subject: libperf: Don't remove -g when EXTRA_CFLAGS are used
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit f5b07010c13c77541e8ade167d05bef3b8a63739 ]
+
+When using EXTRA_CFLAGS, for example "EXTRA_CFLAGS=-DREFCNT_CHECKING=1",
+this construct stops setting -g which you'd expect would not be affected
+by adding extra flags. Additionally, EXTRA_CFLAGS should be the last
+thing to be appended so that it can be used to undo any defaults. And no
+condition is required, just += appends to any existing CFLAGS and also
+appends or doesn't append EXTRA_CFLAGS if they are or aren't set.
+
+It's not clear why DEBUG=1 is required for -g in Perf when in libperf
+it's always on, but I don't think we need to change that behavior now
+because someone may be depending on it.
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250319114009.417865-1-james.clark@linaro.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 8c5b40678c63 ("libperf build: Always place libperf includes first")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/Makefile | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
+index 3a9b2140aa048..478fe57bf8cee 100644
+--- a/tools/lib/perf/Makefile
++++ b/tools/lib/perf/Makefile
+@@ -54,13 +54,6 @@ endif
+
+ TEST_ARGS := $(if $(V),-v)
+
+-# Set compile option CFLAGS
+-ifdef EXTRA_CFLAGS
+- CFLAGS := $(EXTRA_CFLAGS)
+-else
+- CFLAGS := -g -Wall
+-endif
+-
+ INCLUDES = \
+ -I$(srctree)/tools/lib/perf/include \
+ -I$(srctree)/tools/lib/ \
+@@ -70,11 +63,12 @@ INCLUDES = \
+ -I$(srctree)/tools/include/uapi
+
+ # Append required CFLAGS
+-override CFLAGS += $(EXTRA_WARNINGS)
+-override CFLAGS += -Werror -Wall
++override CFLAGS += -g -Werror -Wall
+ override CFLAGS += -fPIC
+ override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
++override CFLAGS += $(EXTRA_WARNINGS)
++override CFLAGS += $(EXTRA_CFLAGS)
+
+ all:
+
+--
+2.51.0
+
--- /dev/null
+From c1be1435b195224c1efa9b3e28090758f8ff8ca4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 16:36:32 -0500
+Subject: libsubcmd: Fix null intersection case in exclude_cmds()
+
+From: Sri Jayaramappa <sjayaram@akamai.com>
+
+[ Upstream commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8 ]
+
+When there is no exclusion occurring from the cmds list - for example -
+cmds contains ["read-vdso32"] and excludes contains ["archive"] - the
+main loop completes with ci == cj == 0. In the original code the loop
+processing the remaining elements in the list was conditional:
+
+ if (ci != cj) { ...}
+
+So we end up in the assertion loop since ci < cmds->cnt and we
+incorrectly try to assert the list elements to be NULL and fail with
+the following error
+
+ help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+Fix this by moving the if (ci != cj) check inside of a broader loop.
+If ci != cj, left shift the list elements, as before, and then
+unconditionally advance the ci and cj indicies which also covers the
+ci == cj case.
+
+Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()")
+Reviewed-by: Guilherme Amadio <amadio@gentoo.org>
+Signed-off-by: Sri Jayaramappa <sjayaram@akamai.com>
+Tested-by: Guilherme Amadio <amadio@gentoo.org>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: Joshua Hunt <johunt@akamai.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index ddaeb4eb3e249..db94aa685b73b 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -97,11 +97,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ ei++;
+ }
+ }
+- if (ci != cj) {
+- while (ci < cmds->cnt) {
+- cmds->names[cj++] = cmds->names[ci];
+- cmds->names[ci++] = NULL;
++ while (ci < cmds->cnt) {
++ if (ci != cj) {
++ cmds->names[cj] = cmds->names[ci];
++ cmds->names[ci] = NULL;
+ }
++ ci++;
++ cj++;
+ }
+ for (ci = cj; ci < cmds->cnt; ci++)
+ assert(cmds->names[ci] == NULL);
+--
+2.51.0
+
--- /dev/null
+From 00e80e09637b04d35ba7782eeb8ff6b20b2f0303 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Dec 2025 21:04:01 +0900
+Subject: m68k: nommu: fix memmove() with differently aligned src and dest for
+ 68000
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ]
+
+68000 has different alignment needs to 68020+.
+memcpy() checks if the destination is aligned and does a smaller copy
+to fix the alignment and then critically for 68000 it checks if the
+source is still unaligned and if it is reverts to smaller copies.
+
+memmove() does not currently do the second part and malfunctions if
+one of the pointers is aligned and the other isn't.
+
+This is apparently getting triggered by printk. If I put breakpoints
+into the new checks added by this commit the first hit looks like this:
+
+memmove (n=205, src=0x2f3971 <printk_shared_pbufs+205>, dest=0x2f3980 <printk_shared_pbufs+220>) at arch/m68k/lib/memmove.c:82
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Signed-off-by: Greg Ungerer <gerg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/lib/memmove.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c
+index 6519f7f349f66..e33f00b02e4c0 100644
+--- a/arch/m68k/lib/memmove.c
++++ b/arch/m68k/lib/memmove.c
+@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *cdest++ = *csrc++;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n)
+ src = csrc;
+ n--;
+ }
++#if defined(CONFIG_M68000)
++ if ((long)src & 1) {
++ char *cdest = dest;
++ const char *csrc = src;
++ for (; n; n--)
++ *--cdest = *--csrc;
++ return xdest;
++ }
++#endif
+ if (n > 2 && (long)dest & 2) {
+ short *sdest = dest;
+ const short *ssrc = src;
+--
+2.51.0
+
--- /dev/null
+From dfb052dd18d33dad7c995f95d0482df82a604f2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:24 +0100
+Subject: mailbox: bcm-ferxrm-mailbox: Use default primary handler
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ]
+
+request_threaded_irq() is invoked with a primary and a secondary handler
+and no flags are passed. The primary handler is the same as
+irq_default_primary_handler() so there is no need to have an identical
+copy.
+
+The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt
+source is not masked while the threaded handler is active. This means,
+especially on LEVEL typed interrupt lines, the interrupt can fire again
+before the threaded handler had a chance to run.
+
+Use the default primary interrupt handler by specifying NULL and set
+IRQF_ONESHOT so the interrupt source is masked until the secondary handler
+is done.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index a2b8839d4e7c5..a1e02efe93ad2 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset)
+
+ /* ====== FlexRM interrupt handler ===== */
+
+-static irqreturn_t flexrm_irq_event(int irq, void *dev_id)
+-{
+- /* We only have MSI for completions so just wakeup IRQ thread */
+- /* Ring related errors will be informed via completion descriptors */
+-
+- return IRQ_WAKE_THREAD;
+-}
+-
+ static irqreturn_t flexrm_irq_thread(int irq, void *dev_id)
+ {
+ flexrm_process_completions(dev_id);
+@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan)
+ ret = -ENODEV;
+ goto fail_free_cmpl_memory;
+ }
+- ret = request_threaded_irq(ring->irq,
+- flexrm_irq_event,
+- flexrm_irq_thread,
+- 0, dev_name(ring->mbox->dev), ring);
++ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread,
++ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring);
+ if (ret) {
+ dev_err(ring->mbox->dev,
+ "failed to request ring%d IRQ\n", ring->num);
+--
+2.51.0
+
--- /dev/null
+From 8d94b95eb70b7dd20ab6991d4c0169a6a6a4fdce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 16:00:54 +0800
+Subject: mailbox: imx: Skip the suspend flag for i.MX7ULP
+
+From: Jacky Bai <ping.bai@nxp.com>
+
+[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ]
+
+In current imx-mailbox driver, the MU IRQ is configured with
+'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow,
+the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx:
+fix wakeup failure from freeze mode"), if the MU IRQ is triggered after
+the priv->suspended flag has been set, the system suspend will be
+aborted.
+
+On i.MX7ULP platform, certain drivers that depend on rpmsg may need
+to send rpmsg request and receive an acknowledgment from the remote
+core during the late_suspend stage. Early suspend abort is not
+expected, and the i.MX7ULP already has additional hardware and
+software to make sure the system can be wakeup from freeze mode
+correctly when MU IRQ is trigger.
+
+Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the
+early abort when doing suspend.
+
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/imx-mailbox.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
+index 3ef4dd8adf5db..5eef59f00abd5 100644
+--- a/drivers/mailbox/imx-mailbox.c
++++ b/drivers/mailbox/imx-mailbox.c
+@@ -113,6 +113,7 @@ struct imx_mu_dcfg {
+ u32 xRR; /* Receive Register0 */
+ u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */
+ u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */
++ bool skip_suspend_flag;
+ };
+
+ #define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x))))
+@@ -906,6 +907,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = {
+ .xRR = 0x40,
+ .xSR = {0x60, 0x60, 0x60, 0x60},
+ .xCR = {0x64, 0x64, 0x64, 0x64, 0x64},
++ .skip_suspend_flag = true,
+ };
+
+ static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = {
+@@ -986,7 +988,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev)
+ priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = true;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = true;
+
+ return 0;
+ }
+@@ -1009,7 +1012,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev)
+ imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]);
+ }
+
+- priv->suspend = false;
++ if (!priv->dcfg->skip_suspend_flag)
++ priv->suspend = false;
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From bcd998e875f9cc3c312e505bc1c569de1a45569e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jan 2026 14:07:40 +0000
+Subject: mailbox: pcc: Remove spurious IRQF_ONESHOT usage
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ]
+
+The PCC code currently specifies IRQF_ONESHOT if the interrupt could
+potentially be shared but doesn't actually use request_threaded_irq() and
+the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is
+never relevant. Since commit aef30c8d569c ("genirq: Warn about using
+IRQF_ONESHOT without a threaded handler") specifying it has resulted in a
+WARN_ON(), fix this by removing IRQF_ONESHOT.
+
+Reported-by: Aishwarya TCV <Aishwarya.TCV@arm.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/pcc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
+index 2b7d0bc920726..1d4191cb91380 100644
+--- a/drivers/mailbox/pcc.c
++++ b/drivers/mailbox/pcc.c
+@@ -481,7 +481,7 @@ static int pcc_startup(struct mbox_chan *chan)
+
+ if (pchan->plat_irq > 0) {
+ irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ?
+- IRQF_SHARED | IRQF_ONESHOT : 0;
++ IRQF_SHARED : 0;
+ rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq,
+ irqflags, MBOX_IRQ_NAME, chan);
+ if (unlikely(rc)) {
+--
+2.51.0
+
--- /dev/null
+From c215b8ce2379ea4f430f0ca8af32b35bf5e9f5ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:36 +0100
+Subject: mailbox: sprd: clear delivery flag before handling TX done
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ]
+
+If there are any pending messages in the mailbox queue, they are sent
+as soon as a TX done event arrives from the driver. This may trigger a
+new delivery interrupt while the previous one is still being handled.
+If the delivery status is cleared after this, the interrupt is lost.
+To prevent this from happening, clear the delivery status immediately
+after checking it and before any new messages are sent.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index 845ceb041464e..109ff60c4ac74 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -167,6 +167,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ return IRQ_NONE;
+ }
+
++ /* Clear FIFO delivery and overflow status first */
++ writel(fifo_sts &
++ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
++ priv->inbox_base + SPRD_MBOX_FIFO_RST);
++
+ while (send_sts) {
+ id = __ffs(send_sts);
+ send_sts &= (send_sts - 1);
+@@ -182,11 +187,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
+ mbox_chan_txdone(chan, 0);
+ }
+
+- /* Clear FIFO delivery and overflow status */
+- writel(fifo_sts &
+- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
+- priv->inbox_base + SPRD_MBOX_FIFO_RST);
+-
+ /* Clear irq status */
+ writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS);
+
+--
+2.51.0
+
--- /dev/null
+From c7b3cca8ece8474ea4918422920eb06abc4e240b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 16:43:38 +0100
+Subject: mailbox: sprd: mask interrupts that are not handled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Otto Pflüger <otto.pflueger@abscue.de>
+
+[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ]
+
+To reduce the amount of spurious interrupts, disable the interrupts that
+are not handled in this driver.
+
+Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index 9ae57de77d4d7..845ceb041464e 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -244,21 +244,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan)
+ /* Select outbox FIFO mode and reset the outbox FIFO status */
+ writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST);
+
+- /* Enable inbox FIFO overflow and delivery interrupt */
+- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ);
++ /* Enable inbox FIFO delivery interrupt */
++ val = SPRD_INBOX_FIFO_IRQ_MASK;
++ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ;
+ writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable outbox FIFO not empty interrupt */
+- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK);
++ val = SPRD_OUTBOX_FIFO_IRQ_MASK;
+ val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
+
+ /* Enable supplementary outbox as the fundamental one */
+ if (priv->supp_base) {
+ writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST);
+- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK);
+- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
+ writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 9de752bf9a4e926764a97b4c40c112acee6b3e9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jan 2026 14:59:03 +0000
+Subject: md-cluster: fix NULL pointer dereference in process_metadata_update
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ]
+
+The function process_metadata_update() blindly dereferences the 'thread'
+pointer (acquired via rcu_dereference_protected) within the wait_event()
+macro.
+
+While the code comment states "daemon thread must exist", there is a valid
+race condition window during the MD array startup sequence (md_run):
+
+1. bitmap_load() is called, which invokes md_cluster_ops->join().
+2. join() starts the "cluster_recv" thread (recv_daemon).
+3. At this point, recv_daemon is active and processing messages.
+4. However, mddev->thread (the main MD thread) is not initialized until
+ later in md_run().
+
+If a METADATA_UPDATED message is received from a remote node during this
+specific window, process_metadata_update() will be called while
+mddev->thread is still NULL, leading to a kernel panic.
+
+To fix this, we must validate the 'thread' pointer. If it is NULL, we
+release the held lock (no_new_dev_lockres) and return early, safely
+ignoring the update request as the array is not yet fully ready to
+process it.
+
+Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Signed-off-by: Yu Kuai <yukuai@fnnas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-cluster.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index 6a89f6b5d64f9..54f90afbafe96 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -532,8 +532,13 @@ static void process_metadata_update(struct mddev *mddev, struct cluster_msg *msg
+
+ dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_CR);
+
+- /* daemaon thread must exist */
+ thread = rcu_dereference_protected(mddev->thread, true);
++ if (!thread) {
++ pr_warn("md-cluster: Received metadata update but MD thread is not ready\n");
++ dlm_unlock_sync(cinfo->no_new_dev_lockres);
++ return;
++ }
++
+ wait_event(thread->wqueue,
+ (got_lock = mddev_trylock(mddev)) ||
+ test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state));
+--
+2.51.0
+
--- /dev/null
+From 882795e2890602a6980ba4cbc3dfbfd400934b31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 15:29:57 +0100
+Subject: media: adv7180: fix frame interval in progressive mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thorsten Schmelzer <tschmelzer@topcon.com>
+
+[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ]
+
+The ADV7280-M may internally convert interlaced video input to
+progressive video. If this mode is enabled, the ADV7280-M delivers
+progressive video frames at the field rate of 50 fields per second (PAL)
+or 60 fields per second (NTSC).
+
+Fix the reported frame interval if progressive video is enabled.
+
+Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index ecb0e7b1f2a5f..4778ae653ca9d 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -471,6 +471,13 @@ static int adv7180_g_frame_interval(struct v4l2_subdev *sd,
+ fi->interval.denominator = 25;
+ }
+
++ /*
++ * If the de-interlacer is active, the chip produces full video frames
++ * at the field rate.
++ */
++ if (state->field == V4L2_FIELD_NONE)
++ fi->interval.denominator *= 2;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From fe77c7342873ce5c647a2f9db8c72b06fff3b54b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 11:02:22 +0800
+Subject: media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
+
+From: Ming Qian <ming.qian@oss.nxp.com>
+
+[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ]
+
+The V4L2_DEC_CMD_START command may be used to handle the dynamic source
+change, which will triggers an implicit decoder drain.
+The last_buffer_dequeued flag is set in the implicit decoder drain,
+so driver need to clear it to continue the following decoding flow.
+
+Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vdec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
+index 4f438eaa7d385..d7e477f0eb430 100644
+--- a/drivers/media/platform/amphion/vdec.c
++++ b/drivers/media/platform/amphion/vdec.c
+@@ -630,6 +630,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd
+ switch (cmd->cmd) {
+ case V4L2_DEC_CMD_START:
+ vdec_cmd_start(inst);
++ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx));
+ break;
+ case V4L2_DEC_CMD_STOP:
+ vdec_cmd_stop(inst);
+--
+2.51.0
+
--- /dev/null
+From 8cb1c8bed953845eafe02fb10e6ffa08df7d7601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 15:46:47 +0800
+Subject: media: cx25821: Fix a resource leak in cx25821_dev_setup()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ]
+
+Add release_mem_region() if ioremap() fails to release the memory
+region obtained by cx25821_get_resources().
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index 6627fa9166d30..a7336be444748 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
+
+ if (!dev->lmmio) {
+ CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n");
++ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0));
+ cx25821_iounmap(dev);
+ return -ENOMEM;
+ }
+--
+2.51.0
+
--- /dev/null
+From da1f55557a34021d85c63f73fe478b32d6768bc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 08:57:35 +0200
+Subject: media: dvb-core: dmxdevfilter must always flush bufs
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ]
+
+Currently the buffers are being filled until full, which works fine
+for the transport stream, but not when reading sections, those have
+to be returned to userspace immediately, otherwise dvbv5-scan will
+just wait forever.
+
+Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether
+the buffer must be flushed or wait until it is full.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dmxdev.c | 8 ++++----
+ drivers/media/dvb-core/dvb_vb2.c | 5 +++--
+ include/media/dvb_vb2.h | 6 ++++--
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index 9ce5f010de3f8..804fb339f7355 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -396,11 +396,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
+ if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) {
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, true);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
+ buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, true);
+ } else {
+ ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer,
+ buffer1, buffer1_len);
+@@ -451,10 +451,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
+
+ if (dvb_vb2_is_streaming(ctx)) {
+ ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len,
+- buffer_flags);
++ buffer_flags, false);
+ if (ret == buffer1_len)
+ ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len,
+- buffer_flags);
++ buffer_flags, false);
+ } else {
+ if (buffer->error) {
+ spin_unlock(&dmxdevfilter->dev->lock);
+diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c
+index 909df82fed332..8950e608a87a4 100644
+--- a/drivers/media/dvb-core/dvb_vb2.c
++++ b/drivers/media/dvb-core/dvb_vb2.c
+@@ -252,7 +252,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx)
+
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags)
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush)
+ {
+ unsigned long flags = 0;
+ void *vbuf = NULL;
+@@ -309,7 +310,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ }
+ }
+
+- if (ctx->nonblocking && ctx->buf) {
++ if (flush && ctx->buf) {
+ vb2_set_plane_payload(&ctx->buf->vb, 0, ll);
+ vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE);
+ list_del(&ctx->buf->list);
+diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h
+index 8cb88452cd6c2..0fbbfc65157e6 100644
+--- a/include/media/dvb_vb2.h
++++ b/include/media/dvb_vb2.h
+@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx)
+ return 0;
+ };
+ #define dvb_vb2_is_streaming(ctx) (0)
+-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0)
++#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0)
+
+ static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx,
+ struct file *file,
+@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx);
+ * @buffer_flags:
+ * pointer to buffer flags as defined by &enum dmx_buffer_flags.
+ * can be NULL.
++ * @flush: flush the buffer, even if it isn't full.
+ */
+ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
+ const unsigned char *src, int len,
+- enum dmx_buffer_flags *buffer_flags);
++ enum dmx_buffer_flags *buffer_flags,
++ bool flush);
+
+ /**
+ * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV
+--
+2.51.0
+
--- /dev/null
+From 250cc23f2062648d908ae667989f9c1da82d5fc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 14:16:16 -0500
+Subject: media: mediatek: vcodec: Don't try to decode 422/444 VP9
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 3e92d7e4935084ecdbdc88880cc4688618ae1557 ]
+
+This is not supported by the hardware and trying to decode
+these leads to LAT timeout errors.
+
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
+index e29c9c58f3dac..fb629a7cd8127 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
+@@ -475,6 +475,12 @@ static int mtk_vdec_s_ctrl(struct v4l2_ctrl *ctrl)
+ mtk_v4l2_vdec_err(ctx, "VP9: bit_depth:%d", frame->bit_depth);
+ return -EINVAL;
+ }
++
++ if (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
++ !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)) {
++ mtk_v4l2_vdec_err(ctx, "VP9: only 420 subsampling is supported");
++ return -EINVAL;
++ }
+ break;
+ case V4L2_CID_STATELESS_AV1_SEQUENCE:
+ seq = (struct v4l2_ctrl_av1_sequence *)hdr_ctrl->p_new.p;
+--
+2.51.0
+
--- /dev/null
+From c89968f84572346d817cd0001a9d4503d9d89534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 15:26:40 +0200
+Subject: media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ]
+
+The isp_video_mbus_to_pix/pix_to_mbus functions did not take
+the last empty entry { 0, } of the formats array into account.
+
+As a result, isp_video_mbus_to_pix would accept code 0 and
+isp_video_pix_to_mbus would select code 0 if no match was found.
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index daca689dc0825..7334e1b4f0b2b 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video,
+ pix->width = mbus->width;
+ pix->height = mbus->height;
+
+- for (i = 0; i < ARRAY_SIZE(formats); ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
+ if (formats[i].code == mbus->code)
+ break;
+ }
+
+- if (WARN_ON(i == ARRAY_SIZE(formats)))
++ if (WARN_ON(i == ARRAY_SIZE(formats) - 1))
+ return 0;
+
+ min_bpl = pix->width * formats[i].bpp;
+@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix,
+ /* Skip the last format in the loop so that it will be selected if no
+ * match is found.
+ */
+- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
++ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) {
+ if (formats[i].pixelformat == pix->pixelformat)
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 815e07362053bcd159c262633d4819e1cdab5925 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 17:09:18 +0200
+Subject: media: omap3isp: isppreview: always clamp in preview_try_format()
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ]
+
+If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't
+clamped. Just always clamp.
+
+This fixes a v4l2-compliance error:
+
+ fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
+ fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
+test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c
+index 53aedec7990da..32e4348e6837a 100644
+--- a/drivers/media/platform/ti/omap3isp/isppreview.c
++++ b/drivers/media/platform/ti/omap3isp/isppreview.c
+@@ -1744,22 +1744,17 @@ static void preview_try_format(struct isp_prev_device *prev,
+
+ switch (pad) {
+ case PREV_PAD_SINK:
+- /* When reading data from the CCDC, the input size has already
+- * been mangled by the CCDC output pad so it can be accepted
+- * as-is.
+- *
+- * When reading data from memory, clamp the requested width and
+- * height. The TRM doesn't specify a minimum input height, make
++ /*
++ * Clamp the requested width and height.
++ * The TRM doesn't specify a minimum input height, make
+ * sure we got enough lines to enable the noise filter and color
+ * filter array interpolation.
+ */
+- if (prev->input == PREVIEW_INPUT_MEMORY) {
+- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
+- preview_max_out_width(prev));
+- fmt->height = clamp_t(u32, fmt->height,
+- PREV_MIN_IN_HEIGHT,
+- PREV_MAX_IN_HEIGHT);
+- }
++ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
++ preview_max_out_width(prev));
++ fmt->height = clamp_t(u32, fmt->height,
++ PREV_MIN_IN_HEIGHT,
++ PREV_MAX_IN_HEIGHT);
+
+ fmt->colorspace = V4L2_COLORSPACE_SRGB;
+
+--
+2.51.0
+
--- /dev/null
+From 99b07f5a5bb0b0c98ed689586d6b2c8ae40e48c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 09:21:53 +0200
+Subject: media: omap3isp: set initial format
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ]
+
+Initialize the v4l2_format to a default. Empty formats are
+not allowed in V4L2, so this fixes v4l2-compliance issues:
+
+ fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height
+test VIDIOC_G_FMT: FAIL
+
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
+index 7334e1b4f0b2b..b9e0b6215fa04 100644
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -1288,6 +1288,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = {
+ static int isp_video_open(struct file *file)
+ {
+ struct isp_video *video = video_drvdata(file);
++ struct v4l2_mbus_framefmt fmt;
+ struct isp_video_fh *handle;
+ struct vb2_queue *queue;
+ int ret = 0;
+@@ -1329,6 +1330,13 @@ static int isp_video_open(struct file *file)
+
+ memset(&handle->format, 0, sizeof(handle->format));
+ handle->format.type = video->type;
++ handle->format.fmt.pix.width = 720;
++ handle->format.fmt.pix.height = 480;
++ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY;
++ handle->format.fmt.pix.field = V4L2_FIELD_NONE;
++ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
++ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt);
++ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix);
+ handle->timeperframe.denominator = 1;
+
+ handle->video = video;
+--
+2.51.0
+
--- /dev/null
+From f3e024f16a8a927677a27331b67781649c2a483f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 19:24:19 +0100
+Subject: media: pvrusb2: fix URB leak in pvr2_send_request_ex
+
+From: Szymon Wilczek <szymonwilczek@gmx.com>
+
+[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ]
+
+When pvr2_send_request_ex() submits a write URB successfully but fails to
+submit the read URB (e.g. returns -ENOMEM), it returns immediately without
+waiting for the write URB to complete. Since the driver reuses the same
+URB structure, a subsequent call to pvr2_send_request_ex() attempts to
+submit the still-active write URB, triggering a 'URB submitted while
+active' warning in usb_submit_urb().
+
+Fix this by ensuring the write URB is unlinked and waited upon if the read
+URB submission fails.
+
+Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
+Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com>
+Acked-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 2de104736f874..943d56b10251b 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -3709,6 +3709,11 @@ status);
+ "Failed to submit read-control URB status=%d",
+ status);
+ hdw->ctl_read_pend_flag = 0;
++ if (hdw->ctl_write_pend_flag) {
++ usb_unlink_urb(hdw->ctl_write_urb);
++ while (hdw->ctl_write_pend_flag)
++ wait_for_completion(&hdw->ctl_done);
++ }
+ goto done;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From f7cdf8ded8a460b4b0dd4ba870e8347ea6e0cd6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 12:11:42 -0500
+Subject: media: rkisp1: Fix filter mode register configuration
+
+From: Rui Wang <rui.wang@ideasonboard.com>
+
+[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ]
+
+The rkisp1_flt_config() function performs an initial direct write to
+RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA
+bit, which clears the filter enable bit in the hardware.
+
+The subsequent read/modify/write sequence then reads back the register
+with the enable bit already cleared and cannot restore it, resulting in
+the filter being inadvertently disabled.
+
+Remove the redundant direct write. The read/modify/write sequence alone
+correctly preserves the existing enable bit state while updating the
+DNR mode and filter configuration bits.
+
+Signed-off-by: Rui Wang <rui.wang@ideasonboard.com>
+Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+index 3482f7d707b75..09c20fb2d92ee 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+@@ -385,12 +385,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params,
+ rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT,
+ arg->lum_weight);
+
+- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE,
+- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) |
+- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) |
+- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) |
+- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1));
+-
+ /* avoid to override the old enable value */
+ filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE);
+ filt_mode &= RKISP1_CIF_ISP_FLT_ENA;
+--
+2.51.0
+
--- /dev/null
+From 05354e2680367ca92bcb4f47deeedc24452e6edc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 19:00:35 -0800
+Subject: media: solo6x10: Check for out of bounds chip_id
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ]
+
+Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
+(literal "1" is an "int") could end up being shifted beyond 32 bits,
+so instrumentation was added (and due to the double is_tw286x() call
+seen via inlining), Clang decides the second one must now be undefined
+behavior and elides the rest of the function[1]. This is a known problem
+with Clang (that is still being worked on), but we can avoid the entire
+problem by actually checking the existing max chip ID, and now there is
+no runtime instrumentation added at all since everything is known to be
+within bounds.
+
+Additionally use an unsigned value for the shift to remove the
+instrumentation even without the explicit bounds checking.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
+Suggested-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: fix checkpatch warning for is_tw286x]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+index 1b7c22a9bc94f..8f53946c67928 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c
++++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c
+@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = {
+ 0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0,
+ };
+
+-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id)))
++#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id))))
+
+ static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off,
+ u8 tw_off)
+@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ if (val > 255 || val < 0)
+ return -ERANGE;
+
+@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
+ chip_num = ch / 4;
+ ch %= 4;
+
++ if (chip_num >= TW_NUM_CHIP)
++ return -EINVAL;
++
+ switch (ctrl) {
+ case V4L2_CID_SHARPNESS:
+ /* Only 286x has sharpness */
+--
+2.51.0
+
--- /dev/null
+From dbe1f7a373bee781b3b4445c6e9cee77bfda57a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 13:48:40 +0200
+Subject: media: v4l2-async: Fix error handling on steps after finding a match
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 7345d6d356336c448d6b9230ed8704f39679fd12 ]
+
+Once an async connection is found to be matching with an fwnode, a
+sub-device may be registered (in case it wasn't already), its bound
+operation is called, ancillary links are created, the async connection
+is added to the sub-device's list of connections and removed from the
+global waiting connection list. Further on, the sub-device's possible own
+notifier is searched for possible additional matches.
+
+Fix these specific issues:
+
+- If v4l2_async_match_notify() failed before the sub-notifier handling,
+ the async connection was unbound and its entry removed from the
+ sub-device's async connection list. The latter part was also done in
+ v4l2_async_match_notify().
+
+- The async connection's sd field was only set after creating ancillary
+ links in v4l2_async_match_notify(). It was however dereferenced in
+ v4l2_async_unbind_subdev_one(), which was called on error path of
+ v4l2_async_match_notify() failure.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Tested-by: "Yew, Chang Ching" <chang.ching.yew@intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-async.c | 45 +++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
+index ac4d987bba255..cf2923dea84b3 100644
+--- a/drivers/media/v4l2-core/v4l2-async.c
++++ b/drivers/media/v4l2-core/v4l2-async.c
+@@ -339,7 +339,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ struct v4l2_subdev *sd,
+ struct v4l2_async_connection *asc)
+ {
+- struct v4l2_async_notifier *subdev_notifier;
+ bool registered = false;
+ int ret;
+
+@@ -385,6 +384,25 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ dev_dbg(notifier_dev(notifier), "v4l2-async: %s bound (ret %d)\n",
+ dev_name(sd->dev), ret);
+
++ return 0;
++
++err_call_unbind:
++ v4l2_async_nf_call_unbind(notifier, sd, asc);
++ list_del(&asc->asc_subdev_entry);
++
++err_unregister_subdev:
++ if (registered)
++ v4l2_device_unregister_subdev(sd);
++
++ return ret;
++}
++
++static int
++v4l2_async_nf_try_subdev_notifier(struct v4l2_async_notifier *notifier,
++ struct v4l2_subdev *sd)
++{
++ struct v4l2_async_notifier *subdev_notifier;
++
+ /*
+ * See if the sub-device has a notifier. If not, return here.
+ */
+@@ -400,16 +418,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
+ subdev_notifier->parent = notifier;
+
+ return v4l2_async_nf_try_all_subdevs(subdev_notifier);
+-
+-err_call_unbind:
+- v4l2_async_nf_call_unbind(notifier, sd, asc);
+- list_del(&asc->asc_subdev_entry);
+-
+-err_unregister_subdev:
+- if (registered)
+- v4l2_device_unregister_subdev(sd);
+-
+- return ret;
+ }
+
+ /* Test all async sub-devices in a notifier for a match. */
+@@ -441,6 +449,10 @@ v4l2_async_nf_try_all_subdevs(struct v4l2_async_notifier *notifier)
+ if (ret < 0)
+ return ret;
+
++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
++ if (ret < 0)
++ return ret;
++
+ /*
+ * v4l2_async_match_notify() may lead to registering a
+ * new notifier and thus changing the async subdevs
+@@ -823,7 +835,11 @@ int v4l2_async_register_subdev(struct v4l2_subdev *sd)
+ ret = v4l2_async_match_notify(notifier, v4l2_dev, sd,
+ asc);
+ if (ret)
+- goto err_unbind;
++ goto err_unlock;
++
++ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
++ if (ret)
++ goto err_unbind_one;
+
+ ret = v4l2_async_nf_try_complete(notifier);
+ if (ret)
+@@ -847,9 +863,10 @@ int v4l2_async_register_subdev(struct v4l2_subdev *sd)
+ if (subdev_notifier)
+ v4l2_async_nf_unbind_all_subdevs(subdev_notifier);
+
+- if (asc)
+- v4l2_async_unbind_subdev_one(notifier, asc);
++err_unbind_one:
++ v4l2_async_unbind_subdev_one(notifier, asc);
+
++err_unlock:
+ mutex_unlock(&list_lock);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 4904d3a0a71248341dac15586eaae3b1c52b438e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 16:39:47 +0100
+Subject: minix: Add required sanity checking to minix_check_superblock()
+
+From: Jori Koolstra <jkoolstra@xs4all.nl>
+
+[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ]
+
+The fs/minix implementation of the minix filesystem does not currently
+support any other value for s_log_zone_size than 0. This is also the
+only value supported in util-linux; see mkfs.minix.c line 511. In
+addition, this patch adds some sanity checking for the other minix
+superblock fields, and moves the minix_blocks_needed() checks for the
+zmap and imap also to minix_check_super_block().
+
+This also closes a related syzbot bug report.
+
+Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
+Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/inode.c | 50 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 29 insertions(+), 21 deletions(-)
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index ee8a6fe360e72..820c7753bd105 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -153,10 +153,38 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)
+ static bool minix_check_superblock(struct super_block *sb)
+ {
+ struct minix_sb_info *sbi = minix_sb(sb);
++ unsigned long block;
+
+- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
++ if (sbi->s_log_zone_size != 0) {
++ printk("minix-fs error: zone size must equal block size. "
++ "s_log_zone_size > 0 is not supported.\n");
++ return false;
++ }
++
++ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
++ sbi->s_firstdatazone >= sbi->s_nzones)
+ return false;
+
++ /* Apparently minix can create filesystems that allocate more blocks for
++ * the bitmaps than needed. We simply ignore that, but verify it didn't
++ * create one with not enough blocks and bail out if so.
++ */
++ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize);
++ if (sbi->s_imap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "imap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
++ block = minix_blocks_needed(
++ (sbi->s_nzones - sbi->s_firstdatazone + 1),
++ sb->s_blocksize);
++ if (sbi->s_zmap_blocks < block) {
++ printk("MINIX-fs: file system does not have enough "
++ "zmap blocks allocated. Refusing to mount.\n");
++ return false;
++ }
++
+ /*
+ * s_max_size must not exceed the block mapping limitation. This check
+ * is only needed for V1 filesystems, since V2/V3 support an extra level
+@@ -275,26 +303,6 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ minix_set_bit(0,sbi->s_imap[0]->b_data);
+ minix_set_bit(0,sbi->s_zmap[0]->b_data);
+
+- /* Apparently minix can create filesystems that allocate more blocks for
+- * the bitmaps than needed. We simply ignore that, but verify it didn't
+- * create one with not enough blocks and bail out if so.
+- */
+- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
+- if (sbi->s_imap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "imap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+- block = minix_blocks_needed(
+- (sbi->s_nzones - sbi->s_firstdatazone + 1),
+- s->s_blocksize);
+- if (sbi->s_zmap_blocks < block) {
+- printk("MINIX-fs: file system does not have enough "
+- "zmap blocks allocated. Refusing to mount.\n");
+- goto out_no_bitmap;
+- }
+-
+ /* set up enough so that it can read an inode */
+ s->s_op = &minix_sops;
+ s->s_time_min = 0;
+--
+2.51.0
+
--- /dev/null
+From 2d0c3ad253d007a138098f383afd949759b31409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 09:40:06 +0000
+Subject: MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ]
+
+The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which
+is a valid index - so add a check for this.
+
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mach-loongson64/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h
+index 3414a1fd17835..89bb4deab98a6 100644
+--- a/arch/mips/include/asm/mach-loongson64/topology.h
++++ b/arch/mips/include/asm/mach-loongson64/topology.h
+@@ -7,7 +7,7 @@
+ #define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2)
+
+ extern cpumask_t __node_cpumask[];
+-#define cpumask_of_node(node) (&__node_cpumask[node])
++#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node])
+
+ struct pci_bus;
+ extern int pcibus_to_node(struct pci_bus *);
+--
+2.51.0
+
--- /dev/null
+From 4853805b346c5bcfa5d92a673685637ee009430b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 14:36:37 +0800
+Subject: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ]
+
+In the function bcm_vk_read(), the pointer entry is checked, indicating
+that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
+following code may cause null-pointer dereferences:
+
+ struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+ set_msg_id(&tmp_msg, entry->usr_msg_id);
+ tmp_msg.size = entry->to_h_blks - 1;
+
+To prevent these possible null-pointer dereferences, copy to_h_msg,
+usr_msg_id, and to_h_blks from iter into temporary variables, and return
+these temporary variables to the application instead of accessing them
+through a potentially NULL entry.
+
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Reviewed-by: Scott Branden <scott.branden@broadcom.com>
+Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
+index e17d81231ea6d..54e25e9bc51b1 100644
+--- a/drivers/misc/bcm-vk/bcm_vk_msg.c
++++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
+@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ struct device *dev = &vk->pdev->dev;
+ struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan;
+ struct bcm_vk_wkent *entry = NULL, *iter;
++ struct vk_msg_blk tmp_msg;
++ u32 tmp_usr_msg_id;
++ u32 tmp_blks;
+ u32 q_num;
+ u32 rsp_length;
+
+@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file,
+ entry = iter;
+ } else {
+ /* buffer not big enough */
++ tmp_msg = iter->to_h_msg[0];
++ tmp_usr_msg_id = iter->usr_msg_id;
++ tmp_blks = iter->to_h_blks;
+ rc = -EMSGSIZE;
+ }
+ goto read_loop_exit;
+@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file,
+
+ bcm_vk_free_wkent(dev, entry);
+ } else if (rc == -EMSGSIZE) {
+- struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
+-
+ /*
+ * in this case, return just the first block, so
+ * that app knows what size it is looking for.
+ */
+- set_msg_id(&tmp_msg, entry->usr_msg_id);
+- tmp_msg.size = entry->to_h_blks - 1;
++ set_msg_id(&tmp_msg, tmp_usr_msg_id);
++ tmp_msg.size = tmp_blks - 1;
+ if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) {
+ dev_err(dev, "Error return 1st block in -EMSGSIZE\n");
+ rc = -EFAULT;
+--
+2.51.0
+
--- /dev/null
+From c29e4f8a5a31d2da136cc257f2f7c49a770c4504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 11:48:24 +0100
+Subject: misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
+
+From: Markus Perkins <markus@notsyncing.net>
+
+[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ]
+
+commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66
+compatible strings") added support for 93xx56 and 93xx66 eeproms, but
+didn't take into account that the write enable/disable + erase all
+commands are hardcoded for the 6-bit address of the 93xx46.
+
+This commit fixes the command word generation by increasing the number
+of shifts as the address field grows, keeping the command intact.
+
+Also, the check for 8-bit or 16-bit mode is no longer required as this
+is already taken into account in the edev->addrlen field.
+
+Signed-off-by: Markus Perkins <markus@notsyncing.net>
+Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index b630625b3024b..b510d0b5ddfa7 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -23,6 +23,7 @@
+ #define OP_START 0x4
+ #define OP_WRITE (OP_START | 0x1)
+ #define OP_READ (OP_START | 0x2)
++/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */
+ #define ADDR_EWDS 0x00
+ #define ADDR_ERAL 0x20
+ #define ADDR_EWEN 0x30
+@@ -173,10 +174,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1;
+- else
+- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS);
++ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+@@ -320,10 +318,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev)
+ bits = edev->addrlen + 3;
+
+ cmd_addr = OP_START << edev->addrlen;
+- if (edev->pdata->flags & EE_ADDR8)
+- cmd_addr |= ADDR_ERAL << 1;
+- else
+- cmd_addr |= ADDR_ERAL;
++ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6);
+
+ if (has_quirk_instruction_length(edev)) {
+ cmd_addr <<= 2;
+--
+2.51.0
+
--- /dev/null
+From 124513a43ec3761abadfaae64afb6efed2989d12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 13:13:30 +0100
+Subject: modpost: Amend ppc64 save/restfpr symnames for -Os build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ]
+
+Building a size optimized ppc64 kernel (-Os), gcc emits more FP
+save/restore symbols, that the linker generates on demand into the
+.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c,
+too. They are needed for the amdgpu in-kernel floating point support.
+
+MODPOST Module.symvers
+ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
+WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many)
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 3eb7fda8a98ff..96a6e68730981 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -608,6 +608,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
+ /* Special register function linked on all modules during final link of .ko */
+ if (strstarts(symname, "_restgpr0_") ||
+ strstarts(symname, "_savegpr0_") ||
++ strstarts(symname, "_restgpr1_") ||
++ strstarts(symname, "_savegpr1_") ||
++ strstarts(symname, "_restfpr_") ||
++ strstarts(symname, "_savefpr_") ||
+ strstarts(symname, "_restvr_") ||
+ strstarts(symname, "_savevr_") ||
+ strcmp(symname, ".TOC.") == 0)
+--
+2.51.0
+
--- /dev/null
+From e92cb3e2c881c4620239b73ca5d12237389a438b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 17:28:09 +0100
+Subject: myri10ge: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ]
+
+While compile testing on less common architectures, I noticed that gcc-10 on
+s390 finds a bug that all other configurations seem to miss:
+
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized]
+ 391 | buf->data0 = htonl(data->data0);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+ | ^~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings':
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized]
+ 392 | buf->data1 = htonl(data->data1);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+ | ^~~
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized]
+ 393 | buf->data2 = htonl(data->data2);
+drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here
+ 1939 | struct myri10ge_cmd cmd;
+
+It would be nice to understand how to make other compilers catch this as
+well, but for the moment I'll just shut up the warning by fixing the
+undefined behavior in this driver.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index 7b7e1c5b00f47..f3b1605f6adc9 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
+
+ /* probe for IPv6 TSO support */
+ mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE,
+ &cmd, 0);
+ if (status == 0) {
+@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp,
+ | (addr[2] << 8) | addr[3]);
+
+ cmd.data1 = ((addr[4] << 8) | (addr[5]));
++ cmd.data2 = 0;
+
+ status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0);
+ return status;
+@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause)
+ int status, ctl;
+
+ ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL;
++ cmd.data0 = 0,
++ cmd.data1 = 0,
++ cmd.data2 = 0,
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, 0);
+
+ if (status) {
+@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic)
+ int status, ctl;
+
+ ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC;
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic);
+ if (status)
+ netdev_err(mgp->dev, "Failed to set promisc mode\n");
+@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss)
+ /* get ring sizes */
+ slice = ss - mgp->ss;
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
+ tx_ring_size = cmd.data0;
+ cmd.data0 = slice;
+@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice)
+ status = 0;
+ if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) {
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET,
+ &cmd, 0);
+ ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *)
+ (mgp->sram + cmd.data0);
+ }
+ cmd.data0 = slice;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET,
+ &cmd, 0);
+ ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *)
+@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev)
+ if (mgp->num_slices > 1) {
+ cmd.data0 = mgp->num_slices;
+ cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE;
++ cmd.data2 = 0;
+ if (mgp->dev->real_num_tx_queues > 1)
+ cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES,
+@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev)
+
+ /* now give firmware buffers sizes, and MTU */
+ cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0);
+ cmd.data0 = mgp->small_bytes;
+ status |=
+@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev)
+ static int myri10ge_close(struct net_device *dev)
+ {
+ struct myri10ge_priv *mgp = netdev_priv(dev);
+- struct myri10ge_cmd cmd;
+ int status, old_down_cnt;
+ int i;
+
+@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev)
+
+ netif_tx_stop_all_queues(dev);
+ if (mgp->rebooted == 0) {
++ struct myri10ge_cmd cmd;
++
+ old_down_cnt = mgp->down_cnt;
+ mb();
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ status =
+ myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0);
+ if (status)
+@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev)
+
+ /* Disable multicast filtering */
+
++ cmd.data0 = 0;
++ cmd.data1 = 0;
++ cmd.data2 = 0;
+ err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1);
+ if (err != 0) {
+ netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n",
+--
+2.51.0
+
--- /dev/null
+From 5f1dd221b45c918ffbc336e090bdd79c63fa4fdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:47:55 +0800
+Subject: net: hns3: extend HCLGE_FD_AD_QID to 11 bits
+
+From: Jijie Shao <shaojijie@huawei.com>
+
+[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ]
+
+Currently, HCLGE_FD_AD_QID has only 10 bits and supports a
+maximum of 1023 queues. However, there are actually scenarios
+where the queue_id exceeds 1023.
+
+This patch adds an additional bit to HCLGE_FD_AD_QID to ensure
+that queue_id greater than 1023 are supported.
+
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++--
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 659d6351f26c8..f404a4c10e8f5 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd {
+
+ #define HCLGE_FD_AD_DROP_B 0
+ #define HCLGE_FD_AD_DIRECT_QID_B 1
+-#define HCLGE_FD_AD_QID_S 2
+-#define HCLGE_FD_AD_QID_M GENMASK(11, 2)
++#define HCLGE_FD_AD_QID_L_S 2
++#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2)
+ #define HCLGE_FD_AD_USE_COUNTER_B 12
+ #define HCLGE_FD_AD_COUNTER_NUM_S 13
+ #define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)
+@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd {
+ #define HCLGE_FD_AD_TC_OVRD_B 16
+ #define HCLGE_FD_AD_TC_SIZE_S 17
+ #define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17)
++#define HCLGE_FD_AD_QID_H_B 21
+
+ struct hclge_fd_ad_config_cmd {
+ u8 stage;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 72a5df4e3a329..04c58928585ca 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5606,11 +5606,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc,
+ hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M,
+ HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size);
+ }
++ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B,
++ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0);
+ ad_data <<= 32;
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B,
+ action->forward_to_direct_queue);
+- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S,
++ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S,
+ action->queue_id);
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter);
+ hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M,
+--
+2.51.0
+
--- /dev/null
+From a2b2efedce92716ec4f3e502f7a1c4825dc94cbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 22:57:20 -0700
+Subject: net/rds: Clear reconnect pending bit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ]
+
+When canceling the reconnect worker, care must be taken to reset the
+reconnect-pending bit. If the reconnect worker has not yet been
+scheduled before it is canceled, the reconnect-pending bit will stay
+on forever.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 00bda534b9ce2..98c0d5ff9de9c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -428,6 +428,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ * to the conn hash, so we never trigger a reconnect on this
+ * conn - the reconnect is always triggered by the active peer. */
+ cancel_delayed_work_sync(&cp->cp_conn_w);
++
++ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags);
+ rcu_read_lock();
+ if (!hlist_unhashed(&conn->c_hash_node)) {
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From e5e12a9e76a764ea1baa468c29f44e60a1f8eb7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jan 2026 22:52:12 -0700
+Subject: net/rds: No shortcut out of RDS_CONN_ERROR
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ]
+
+RDS connections carry a state "rds_conn_path::cp_state"
+and transitions from one state to another and are conditional
+upon an expected state: "rds_conn_path_transition."
+
+There is one exception to this conditionality, which is
+"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"
+regardless of what state the condition is currently in.
+
+But as soon as a connection enters state "RDS_CONN_ERROR",
+the connection handling code expects it to go through the
+shutdown-path.
+
+The RDS/TCP multipath changes added a shortcut out of
+"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"
+via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").
+
+A subsequent "rds_tcp_reset_callbacks" can then transition
+the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.
+
+That'll trip up "rds_conn_init_shutdown", which was
+never adjusted to handle "RDS_CONN_RESETTING" and subsequently
+drops the connection with the dreaded "DR_INV_CONN_STATE",
+which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever.
+
+So we do two things here:
+
+a) Don't shortcut "RDS_CONN_ERROR", but take the longer
+ path through the shutdown code.
+
+b) Add "RDS_CONN_RESETTING" to the expected states in
+ "rds_conn_init_shutdown" so that we won't error out
+ and get stuck, if we ever hit weird state transitions
+ like this again."
+
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 2 ++
+ net/rds/tcp_listen.c | 5 -----
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index b4cc699c5fad3..00bda534b9ce2 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -381,6 +381,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ if (!rds_conn_path_transition(cp, RDS_CONN_UP,
+ RDS_CONN_DISCONNECTING) &&
+ !rds_conn_path_transition(cp, RDS_CONN_ERROR,
++ RDS_CONN_DISCONNECTING) &&
++ !rds_conn_path_transition(cp, RDS_CONN_RESETTING,
+ RDS_CONN_DISCONNECTING)) {
+ rds_conn_path_error(cp,
+ "shutdown called in state %d\n",
+diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
+index 53b3535a1e4a8..2e2f1a6750496 100644
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -59,9 +59,6 @@ void rds_tcp_keepalive(struct socket *sock)
+ * socket and force a reconneect from smaller -> larger ip addr. The reason
+ * we special case cp_index 0 is to allow the rds probe ping itself to itself
+ * get through efficiently.
+- * Since reconnects are only initiated from the node with the numerically
+- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side
+- * by moving them to CONNECTING in this function.
+ */
+ static
+ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+@@ -86,8 +83,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
+ struct rds_conn_path *cp = &conn->c_path[i];
+
+ if (rds_conn_path_transition(cp, RDS_CONN_DOWN,
+- RDS_CONN_CONNECTING) ||
+- rds_conn_path_transition(cp, RDS_CONN_ERROR,
+ RDS_CONN_CONNECTING)) {
+ return cp->cp_transport_data;
+ }
+--
+2.51.0
+
--- /dev/null
+From b0ff36ebc31034ade020c9cb3e892c67e97cf32b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 09:59:49 +0800
+Subject: net: usb: r8152: fix transmit queue timeout
+
+From: Mingj Ye <insyelu@gmail.com>
+
+[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ]
+
+When the TX queue length reaches the threshold, the netdev watchdog
+immediately detects a TX queue timeout.
+
+This patch updates the trans_start timestamp of the transmit queue
+on every asynchronous USB URB submission along the transmit path,
+ensuring that the network watchdog accurately reflects ongoing
+transmission activity.
+
+Signed-off-by: Mingj Ye <insyelu@gmail.com>
+Reviewed-by: Hayes Wang <hayeswang@realtek.com>
+Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 386376ceeda25..a2e3f9583def7 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -2445,6 +2445,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
+ ret = usb_submit_urb(agg->urb, GFP_ATOMIC);
+ if (ret < 0)
+ usb_autopm_put_interface_async(tp->intf);
++ else
++ netif_trans_update(tp->netdev);
+
+ out_tx_fill:
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From b2be4e1c3e27a129524b20b2c6352f283f50d61a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Feb 2026 17:39:09 -0800
+Subject: net: usb: sr9700: remove code to drive nonexistent multicast filter
+
+From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+
+[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ]
+
+Several registers referenced in this driver's source code do not
+actually exist (they are not writable and read as zero in my testing).
+They exist in this driver because it originated as a copy of the dm9601
+driver. Notably, these include the multicast filter registers - this
+causes the driver to not support multicast packets correctly. Remove
+the multicast filter code and register definitions. Instead, set the
+chip to receive all multicast filter packets when any multicast
+addresses are in the list.
+
+Reviewed-by: Simon Horman <horms@kernel.org> (from v1)
+Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/Kconfig | 1 -
+ drivers/net/usb/sr9700.c | 25 ++++---------------------
+ drivers/net/usb/sr9700.h | 7 +------
+ 3 files changed, 5 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index 3fd7dccf0f9c9..fe9e8483e8c59 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -320,7 +320,6 @@ config USB_NET_DM9601
+ config USB_NET_SR9700
+ tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
+ depends on USB_USBNET
+- select CRC32
+ help
+ This option adds support for CoreChip-sz SR9700 based USB 1.1
+ 10/100 Ethernet adapters.
+diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
+index 213b4817cfdf6..e4d7bcd0d99c2 100644
+--- a/drivers/net/usb/sr9700.c
++++ b/drivers/net/usb/sr9700.c
+@@ -18,7 +18,6 @@
+ #include <linux/ethtool.h>
+ #include <linux/mii.h>
+ #include <linux/usb.h>
+-#include <linux/crc32.h>
+ #include <linux/usb/usbnet.h>
+
+ #include "sr9700.h"
+@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = {
+ static void sr9700_set_multicast(struct net_device *netdev)
+ {
+ struct usbnet *dev = netdev_priv(netdev);
+- /* We use the 20 byte dev->data for our 8 byte filter buffer
+- * to avoid allocating memory that is tricky to free later
+- */
+- u8 *hashes = (u8 *)&dev->data;
+ /* rx_ctl setting : enable, disable_long, disable_crc */
+ u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG;
+
+- memset(hashes, 0x00, SR_MCAST_SIZE);
+- /* broadcast address */
+- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG;
+- if (netdev->flags & IFF_PROMISC) {
++ if (netdev->flags & IFF_PROMISC)
+ rx_ctl |= RCR_PRMSC;
+- } else if (netdev->flags & IFF_ALLMULTI ||
+- netdev_mc_count(netdev) > SR_MCAST_MAX) {
+- rx_ctl |= RCR_RUNT;
+- } else if (!netdev_mc_empty(netdev)) {
+- struct netdev_hw_addr *ha;
+-
+- netdev_for_each_mc_addr(ha, netdev) {
+- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26;
+- hashes[crc >> 3] |= 1 << (crc & 0x7);
+- }
+- }
++ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev))
++ /* The chip has no multicast filter */
++ rx_ctl |= RCR_ALL;
+
+- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes);
+ sr_write_reg_async(dev, SR_RCR, rx_ctl);
+ }
+
+diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
+index ea2b4de621c86..c479908f7d823 100644
+--- a/drivers/net/usb/sr9700.h
++++ b/drivers/net/usb/sr9700.h
+@@ -104,9 +104,7 @@
+ #define WCR_LINKEN (1 << 5)
+ /* Physical Address Reg */
+ #define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */
+-/* Multicast Address Reg */
+-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */
+-/* 0x1e unused */
++/* 0x16 --> 0x1E unused */
+ /* Phy Reset Reg */
+ #define SR_PRR 0x1F
+ #define PRR_PHY_RST (1 << 0)
+@@ -161,9 +159,6 @@
+ /* parameters */
+ #define SR_SHARE_TIMEOUT 1000
+ #define SR_EEPROM_LEN 256
+-#define SR_MCAST_SIZE 8
+-#define SR_MCAST_ADDR_FLAG 0x80
+-#define SR_MCAST_MAX 64
+ #define SR_TX_OVERHEAD 2 /* 2bytes header */
+ #define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */
+
+--
+2.51.0
+
--- /dev/null
+From 36c7a4950071ceaa30669b656f75d07ce74d490a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Dec 2025 20:53:51 +0900
+Subject: netfilter: nf_conntrack: Add allow_clash to generic protocol handler
+
+From: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+
+[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ]
+
+The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
+ ("netfilter: conntrack: introduce clash resolution on insertion race"),
+sets allow_clash=true in the UDP/UDPLITE protocol handler
+but does not set it in the generic protocol handler.
+
+As a result, packets composed of connectionless protocols at each layer,
+such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
+
+To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.
+
+Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_generic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
+index e831637bc8ca8..cb260eb3d012c 100644
+--- a/net/netfilter/nf_conntrack_proto_generic.c
++++ b/net/netfilter/nf_conntrack_proto_generic.c
+@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net)
+ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
+ {
+ .l4proto = 255,
++ .allow_clash = true,
+ #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ .ctnl_timeout = {
+ .nlattr_to_obj = generic_timeout_nlattr_to_obj,
+--
+2.51.0
+
--- /dev/null
+From fcc78087507bbba7cc44c88d41006c29dfd9484d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 12:30:42 +0100
+Subject: netfilter: xt_tcpmss: check remaining length before reading optlen
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ]
+
+Quoting reporter:
+ In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
+ op[i+1] directly without validating the remaining option length.
+
+ If the last byte of the option field is not EOL/NOP (0/1), the code attempts
+ to index op[i+1]. In the case where i + 1 == optlen, this causes an
+ out-of-bounds read, accessing memory past the optlen boundary
+ (either reading beyond the stack buffer _opt or the
+ following payload).
+
+Reported-by: sungzii <sungzii@pm.me>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_tcpmss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
+index 37704ab017992..0d32d4841cb32 100644
+--- a/net/netfilter/xt_tcpmss.c
++++ b/net/netfilter/xt_tcpmss.c
+@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ return (mssval >= info->mss_min &&
+ mssval <= info->mss_max) ^ info->invert;
+ }
+- if (op[i] < 2)
++ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i+1] ? : 1;
+--
+2.51.0
+
--- /dev/null
+From db93742bd3132c498d9ec8a15d7a27b1dc8be6a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 19:11:39 +0800
+Subject: nfc: nxp-nci: remove interrupt trigger type
+
+From: Carl Lee <carl.lee@amd.com>
+
+[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ]
+
+For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and
+active high, not edge-triggered.
+
+Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail
+to trigger correctly.
+
+Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured
+via Device Tree.
+
+Signed-off-by: Carl Lee <carl.lee@amd.com>
+Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index 3ae4b41c59ac3..edf5514795fd0 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -305,7 +305,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client)
+
+ r = request_threaded_irq(client->irq, NULL,
+ nxp_nci_i2c_irq_thread_fn,
+- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ IRQF_ONESHOT,
+ NXP_NCI_I2C_DRIVER_NAME, phy);
+ if (r < 0)
+ nfc_err(&client->dev, "Unable to register IRQ handler\n");
+--
+2.51.0
+
--- /dev/null
+From 2f6ca6c4fe96a26444aecfeca5b5d13ce9aab288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:18 -0800
+Subject: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]
+
+Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
+This patch protects against invalid index out of bounds access to mw_sizes
+When invalid access print message to user that configuration is not valid.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index b5f93f07e22a4..c60adef1ba727 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev)
+ for (i = 0; i < sndev->nr_lut_mw; i++) {
+ int idx = sndev->nr_direct_mw + i;
+
++ if (idx >= MAX_MWS) {
++ dev_err(&sndev->stdev->dev,
++ "Total number of MW cannot be bigger than %d", MAX_MWS);
++ break;
++ }
++
+ sndev->self_shared->mw_sizes[idx] = LUT_SIZE;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 142c7f6eda6e0f3fbaa222b6133891f17bd11b50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 14:53:17 -0800
+Subject: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
+
+From: Maciej Grochowski <Maciej.Grochowski@sony.com>
+
+[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]
+
+Number of MW LUTs depends on NTB configuration and can be set to zero,
+in such scenario rounddown_pow_of_two will cause undefined behaviour and
+should not be performed.
+This patch ensures that rounddown_pow_of_two is called on valid value.
+
+Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index c60adef1ba727..7f23f10ef64e4 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+ sndev->mmio_self_ctrl);
+
+ sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries);
+- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
++ if (sndev->nr_lut_mw)
++ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n",
+ sndev->nr_direct_mw, sndev->nr_lut_mw);
+@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
+
+ sndev->peer_nr_lut_mw =
+ ioread16(&sndev->mmio_peer_ctrl->lut_table_entries);
+- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
++ if (sndev->peer_nr_lut_mw)
++ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
+
+ dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n",
+ sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw);
+--
+2.51.0
+
--- /dev/null
+From 2256bfdb47bfc505ca592f02752f501ce2190cc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 18:21:47 +0530
+Subject: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ]
+
+NIX SQ manager sticky mode is known to cause stalls when multiple SQs
+share an SMQ and transmit concurrently. Additionally, PSE may deadlock
+on transitions between sticky and non-sticky transmissions. There is
+also a credit drop issue observed when certain condition clocks are
+gated.
+
+work around these hardware errata by:
+- Disabling SQM sticky operation:
+ - Clear TM6 (bit 15)
+ - Clear TM11 (bit 14)
+- Disabling sticky → non-sticky transition path that can deadlock PSE:
+ - Clear TM5 (bit 23)
+- Preventing credit drops by keeping the control-flow clock enabled:
+ - Set TM9 (bit 21)
+
+These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this
+configuration the SQM/PSE maintain forward progress under load without
+credit loss, at the cost of disabling sticky optimizations.
+
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index 29487518ca672..0703b0d8df783 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -4509,12 +4509,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw)
+ /* Set chan/link to backpressure TL3 instead of TL2 */
+ rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
+
+- /* Disable SQ manager's sticky mode operation (set TM6 = 0)
++ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0)
+ * This sticky mode is known to cause SQ stalls when multiple
+- * SQs are mapped to same SMQ and transmitting pkts at a time.
++ * SQs are mapped to same SMQ and transmitting pkts simultaneously.
++ * NIX PSE may deadlock when there are any sticky to non-sticky
++ * transmission. Hence disable it (TM5 = 0).
+ */
+ cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
+- cfg &= ~BIT_ULL(15);
++ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23));
++ /* NIX may drop credits when condition clocks are turned off.
++ * Hence enable control flow clk (set TM9 = 1).
++ */
++ cfg |= BIT_ULL(21);
+ rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
+
+ ltdefs = rvu->kpu.lt_def;
+--
+2.51.0
+
--- /dev/null
+From 805154f0762008a9c942504a416584a096ff69e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 12:07:23 -0500
+Subject: openrisc: define arch-specific version of nop()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ]
+
+When compiling a driver written for MIPS on OpenRISC that uses the nop()
+function, it fails due to the following error:
+
+ drivers/watchdog/pic32-wdt.c: Assembler messages:
+ drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop'
+
+The driver currently uses the generic version of nop() from
+include/asm-generic/barrier.h:
+
+ #ifndef nop
+ #define nop() asm volatile ("nop")
+ #endif
+
+Let's fix this on OpenRISC by defining an architecture-specific version
+of nop().
+
+This was tested by performing an allmodconfig openrisc cross compile on
+an aarch64 host.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/barrier.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+index 7538294721bed..8e592c9909023 100644
+--- a/arch/openrisc/include/asm/barrier.h
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -4,6 +4,8 @@
+
+ #define mb() asm volatile ("l.msync" ::: "memory")
+
++#define nop() asm volatile ("l.nop")
++
+ #include <asm-generic/barrier.h>
+
+ #endif /* __ASM_BARRIER_H */
+--
+2.51.0
+
--- /dev/null
+From 0f93d584b5f65c2d59bfea042bfe6ef29221cf9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 17:58:55 +0100
+Subject: parisc: Prevent interrupts during reboot
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/process.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index ed93bd8c15453..d7b0f233f2cc9 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -85,6 +85,9 @@ void machine_restart(char *cmd)
+ #endif
+ /* set up a new led state on systems shipped with a LED State panel */
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN);
++
++ /* prevent interrupts during reboot */
++ set_eiem(0);
+
+ /* "Normal" system reset */
+ pdc_do_reset();
+--
+2.51.0
+
--- /dev/null
+From dcee68c345470ba045a2643b105e536806471358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 13:53:32 +0530
+Subject: PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
+
+From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+
+[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ]
+
+The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability,
+but they do provide ACS-like features to disable peer transactions and
+validate bus numbers in requests.
+
+Add an ACS quirk for Hamoa & Glymur.
+
+Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 082facd11ddf3..ddfc48f894db6 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5110,6 +5110,10 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
+ /* QCOM SA8775P root port */
+ { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },
++ /* QCOM Hamoa root port */
++ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs },
++ /* QCOM Glymur root port */
++ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs },
+ /* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */
+ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs },
+ /* Intel PCH root ports */
+--
+2.51.0
+
--- /dev/null
+From a8bd3c2682a380673b27b52e5f935cb73b706e7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 18:01:01 +0800
+Subject: PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+[ Upstream commit b5d712e5b87fc56ff838684afb1bae359eb8069f ]
+
+Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR
+memories and they cause below resource allocation issue during probe.
+
+ pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port
+ pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff]
+ pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff]
+ pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref]
+ ...
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
+ pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing
+ pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing
+ pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
+ pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
+
+Since there is no use of the Root Port BAR memories, disable both of them.
+
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+[mani: reworded the description and comment]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-dw-rockchip.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+index 8af7a837a0612..615bb9b42c513 100644
+--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c
++++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+@@ -48,6 +48,8 @@
+ #define PCIE_LTSSM_ENABLE_ENHANCE BIT(4)
+ #define PCIE_LTSSM_STATUS_MASK GENMASK(5, 0)
+
++#define PCIE_TYPE0_HDR_DBI2_OFFSET 0x100000
++
+ struct rockchip_pcie {
+ struct dw_pcie pci;
+ void __iomem *apb_base;
+@@ -198,6 +200,8 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
+ if (irq < 0)
+ return irq;
+
++ pci->dbi_base2 = pci->dbi_base + PCIE_TYPE0_HDR_DBI2_OFFSET;
++
+ ret = rockchip_pcie_init_irq_domain(rockchip);
+ if (ret < 0)
+ dev_err(dev, "failed to init irq domain\n");
+@@ -211,6 +215,10 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
+ rockchip_pcie_writel_apb(rockchip, PCIE_CLIENT_RC_MODE,
+ PCIE_CLIENT_GENERAL_CONTROL);
+
++ /* Disable Root Ports BAR0 and BAR1 as they report bogus size */
++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_0, 0x0);
++ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_1, 0x0);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9c5bdd4194fa9eed95b2ee7af8cb065934607cfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 21:04:47 +0530
+Subject: PCI: Enable ACS after configuring IOMMU for OF platforms
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ]
+
+Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets
+'pci_acs_enable' to request that ACS be enabled for any devices enumerated
+in the future.
+
+OF platforms called pci_enable_acs() for the first device before
+of_iommu_configure() called pci_request_acs(), so ACS was never enabled for
+that device (typically a Root Port).
+
+Call pci_enable_acs() later, from pci_dma_configure(), after
+of_dma_configure() has had a chance to call pci_request_acs().
+
+Here's the call path, showing the move of pci_enable_acs() from
+pci_acs_init() to pci_dma_configure(), where it always happens after
+pci_request_acs():
+
+ pci_device_add
+ pci_init_capabilities
+ pci_acs_init
+ - pci_enable_acs
+ - if (pci_acs_enable) <-- previous test
+ - ...
+ device_add
+ bus_notify(BUS_NOTIFY_ADD_DEVICE)
+ iommu_bus_notifier
+ iommu_probe_device
+ iommu_init_device
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ of_dma_configure
+ of_iommu_configure
+ pci_request_acs
+ pci_acs_enable = 1 <-- set
+ + pci_enable_acs
+ + if (pci_acs_enable) <-- new test
+ + ...
+ bus_probe_device
+ device_initial_probe
+ ...
+ really_probe
+ dev->bus->dma_configure
+ pci_dma_configure # pci_bus_type.dma_configure
+ ...
+ pci_enable_acs
+
+Note that we will now call pci_enable_acs() twice for every device, first
+from the iommu_probe_device() path and again from the really_probe() path.
+Presumably that's not an issue since we also call dev->bus->dma_configure()
+twice.
+
+For the ACPI platforms, pci_request_acs() is called during ACPI
+initialization time itself, independent of the IOMMU framework.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 8 ++++++++
+ drivers/pci/pci.c | 10 +---------
+ drivers/pci/pci.h | 1 +
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 8c941d6267a5c..b7a6d8a28fe93 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1668,6 +1668,14 @@ static int pci_dma_configure(struct device *dev)
+ ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
+ }
+
++ /*
++ * Attempt to enable ACS regardless of capability because some Root
++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
++ * the standard ACS capability but still support ACS via those
++ * quirks.
++ */
++ pci_enable_acs(to_pci_dev(dev));
++
+ pci_put_host_bridge_device(bridge);
+
+ if (!ret && !driver->driver_managed_dma) {
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 4cce61a6aba0b..9730b58164270 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -986,7 +986,7 @@ static void pci_std_enable_acs(struct pci_dev *dev)
+ * pci_enable_acs - enable ACS if hardware support it
+ * @dev: the PCI device
+ */
+-static void pci_enable_acs(struct pci_dev *dev)
++void pci_enable_acs(struct pci_dev *dev)
+ {
+ if (!pci_acs_enable)
+ goto disable_acs_redir;
+@@ -3761,14 +3761,6 @@ bool pci_acs_path_enabled(struct pci_dev *start,
+ void pci_acs_init(struct pci_dev *dev)
+ {
+ dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
+-
+- /*
+- * Attempt to enable ACS regardless of capability because some Root
+- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+- * the standard ACS capability but still support ACS via those
+- * quirks.
+- */
+- pci_enable_acs(dev);
+ }
+
+ /**
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 24441a26be1e6..485f917641e11 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -555,6 +555,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
+ }
+
+ void pci_acs_init(struct pci_dev *dev);
++void pci_enable_acs(struct pci_dev *dev);
+ #ifdef CONFIG_PCI_QUIRKS
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);
+--
+2.51.0
+
--- /dev/null
+From 771ea160f67de4398317174e4b0057d83eec67d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jan 2026 08:59:51 -0800
+Subject: PCI: Fix pci_slot_lock () device locking
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ]
+
+Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to
+prevent warnings like:
+
+ pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0
+
+Take and release the lock for the bridge providing the slot for the
+lock/trylock and unlock routines.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 2f6c5bf2ae2f5..4cce61a6aba0b 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5793,10 +5793,9 @@ static int pci_bus_trylock(struct pci_bus *bus)
+ /* Do any devices on or below this slot prevent a bus reset? */
+ static bool pci_slot_resettable(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+- if (slot->bus->self &&
+- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
++ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
+ return false;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+@@ -5813,7 +5812,10 @@ static bool pci_slot_resettable(struct pci_slot *slot)
+ /* Lock devices from the top of the tree down */
+ static void pci_slot_lock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge)
++ pci_dev_lock(bridge);
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5828,7 +5830,7 @@ static void pci_slot_lock(struct pci_slot *slot)
+ /* Unlock devices from the bottom of the tree up */
+ static void pci_slot_unlock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5838,12 +5840,18 @@ static void pci_slot_unlock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ }
+
+ /* Return 1 on successful lock, 0 on contention */
+ static int pci_slot_trylock(struct pci_slot *slot)
+ {
+- struct pci_dev *dev;
++ struct pci_dev *dev, *bridge = slot->bus->self;
++
++ if (bridge && !pci_dev_trylock(bridge))
++ return 0;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+@@ -5868,6 +5876,9 @@ static int pci_slot_trylock(struct pci_slot *slot)
+ else
+ pci_dev_unlock(dev);
+ }
++
++ if (bridge)
++ pci_dev_unlock(bridge);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8ce4d48227b7bc909f4ec975fa85194222b7e1a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 17:02:08 -0700
+Subject: PCI: Mark ASM1164 SATA controller to avoid bus reset
+
+From: Alex Williamson <alex.williamson@nvidia.com>
+
+[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ]
+
+User forums report issues when assigning ASM1164 SATA controllers to VMs,
+especially in configurations with multiple controllers. Logs show the
+device fails to retrain after bus reset. Reports suggest this is an issue
+across multiple platforms. The device indicates support for PM reset,
+therefore the device still has a viable function level reset mechanism.
+The reporting user confirms the device is well behaved in this use case
+with bus reset disabled.
+
+Reported-by: Patrick Bianchi <patrick.w.bianchi@gmail.com>
+Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
+Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index f89070b1379fe..082facd11ddf3 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3784,6 +3784,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset);
+ */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
+
++/*
++ * Reports from users making use of PCI device assignment with ASM1164
++ * controllers indicate an issue with bus reset where the device fails to
++ * retrain. The issue appears more common in configurations with multiple
++ * controllers. The device does indicate PM reset support (NoSoftRst-),
++ * therefore this still leaves a viable reset method.
++ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset);
++
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
+ /*
+--
+2.51.0
+
--- /dev/null
+From 41193f9b974e472e5280ae221319ebc66db43a5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 16:44:06 +0800
+Subject: PCI: Mark Nvidia GB10 to avoid bus reset
+
+From: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+
+[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ]
+
+After asserting Secondary Bus Reset to downstream devices via a GB10 Root
+Port, the link may not retrain correctly, e.g., the link may retrain with a
+lower lane count or config accesses to downstream devices may fail.
+
+Prevent use of Secondary Bus Reset for devices below GB10.
+
+Signed-off-by: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
+[bhelgaas: drop pci_ids.h update (only used once), update commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index ddfc48f894db6..cab4cdbb31387 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3741,6 +3741,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+ }
+
++/*
++ * After asserting Secondary Bus Reset to downstream devices via a GB10
++ * Root Port, the link may not retrain correctly.
++ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset);
++
+ /*
+ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
+ * prevented for those affected devices.
+--
+2.51.0
+
--- /dev/null
+From 1c9e931ff0df57c4d33d8897dac3137ca7a1e290 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 22:44:52 +0800
+Subject: PCI/MSI: Unmap MSI-X region on error
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ]
+
+msix_capability_init() fails to unmap the MSI-X region if
+msix_setup_interrupts() fails.
+
+Add the missing iounmap() for that error path.
+
+[ tglx: Massaged change log ]
+
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi/msi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
+index b638731aa5ff2..f6f4a778a9867 100644
+--- a/drivers/pci/msi/msi.c
++++ b/drivers/pci/msi/msi.c
+@@ -737,7 +737,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+
+ ret = msix_setup_interrupts(dev, entries, nvec, affd);
+ if (ret)
+- goto out_disable;
++ goto out_unmap;
+
+ /* Disable INTX */
+ pci_intx_for_msi(dev, 0);
+@@ -756,6 +756,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ pcibios_free_irq(dev);
+ return 0;
+
++out_unmap:
++ iounmap(dev->msix_base);
+ out_disable:
+ dev->msix_enabled = 0;
+ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
+--
+2.51.0
+
--- /dev/null
+From 14c105323409829f3ab5b1aa7809b0a58ce4f2c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 16:39:54 +0000
+Subject: perf/arm-cmn: Support CMN-600AE
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ]
+
+The functional safety features of CMN-600AE have little to no impact on
+the PMU relative to the base CMN-600 design, so for simplicity we can
+reasonably just treat it as the same thing. The only obvious difference
+is that the revision numbers aren't aligned, so we may hide some aliases
+for events which do actually exist, but those can still be specified via
+the underlying "type,eventid" format so it's not too big a deal.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Tested-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 77aa37de59880..be02b00a70610 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -205,6 +205,7 @@ enum cmn_model {
+ enum cmn_part {
+ PART_CMN600 = 0x434,
+ PART_CMN650 = 0x436,
++ PART_CMN600AE = 0x438,
+ PART_CMN700 = 0x43c,
+ PART_CI700 = 0x43a,
+ };
+@@ -2167,6 +2168,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01);
+ part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg);
+ part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8;
++ /* 600AE is close enough that it's not really worth more complexity */
++ if (part == PART_CMN600AE)
++ part = PART_CMN600;
+ if (cmn->part && cmn->part != part)
+ dev_warn(cmn->dev,
+ "Firmware binding mismatch: expected part number 0x%x, found 0x%x\n",
+--
+2.51.0
+
--- /dev/null
+From d00cc8050475ff91e90e56e3e89253c088da7d5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:36 -0800
+Subject: perf callchain: Fix srcline printing with inlines
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ]
+
+sample__fprintf_callchain() was using map__fprintf_srcline() which won't
+report inline line numbers.
+
+Fix by using the srcline from the callchain and falling back to the map
+variant.
+
+Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel_fprintf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
+index 8719b3cb56466..99310f8423967 100644
+--- a/tools/perf/util/evsel_fprintf.c
++++ b/tools/perf/util/evsel_fprintf.c
+@@ -181,8 +181,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
+ if (print_dso && (!sym || !sym->inlined))
+ printed += map__fprintf_dsoname_dsoff(map, print_dsoff, addr, fp);
+
+- if (print_srcline)
+- printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ if (print_srcline) {
++ if (node->srcline)
++ printed += fprintf(fp, "\n %s", node->srcline);
++ else
++ printed += map__fprintf_srcline(map, addr, "\n ", fp);
++ }
+
+ if (sym && sym->inlined)
+ printed += fprintf(fp, " (inlined)");
+--
+2.51.0
+
--- /dev/null
+From 7752794dca43c722c35dd4bb754802f3c975e2f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jan 2026 10:55:34 +0100
+Subject: perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 ]
+
+Passing IRQF_ONESHOT ensures that the interrupt source is masked until
+the secondary (threaded) handler is done. If only a primary handler is
+used then the flag makes no sense because the interrupt can not fire
+(again) while its handler is running.
+The flag also disallows force-threading of the primary handler and the
+irq-core will warn about this.
+
+The intention here was probably not allowing forced-threading.
+
+Replace IRQF_ONESHOT with IRQF_NO_THREAD.
+
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/cxl_pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c
+index c03df0f528898..3e1a4f9006119 100644
+--- a/drivers/perf/cxl_pmu.c
++++ b/drivers/perf/cxl_pmu.c
+@@ -885,7 +885,7 @@ static int cxl_pmu_probe(struct device *dev)
+ if (!irq_name)
+ return -ENOMEM;
+
+- rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_ONESHOT,
++ rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD,
+ irq_name, info);
+ if (rc)
+ return rc;
+--
+2.51.0
+
--- /dev/null
+From 1e8d937529e16c3180cf584567eb9873ad64c369 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 14:32:16 +0100
+Subject: perf test stat tests: Fix for virtualized machines
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit e272628902c1c96731e2d9f62a7fc77767686eb0 ]
+
+On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for
+z/VM systems. The root cause is this statement:
+
+ $(perf stat -a -- sleep 0.1 2>&1 |\
+ grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* -c)
+
+The 'perf stat' output on a s390 z/VM system is
+
+ # perf stat -a -- sleep 0.1 2>&1
+ Performance counter stats for 'system wide':
+
+ 56 context-switches # 46.3 cs/sec cs_per_second
+ 1,210.41 msec cpu-clock # 11.9 CPUs CPUs_utilized
+ 12 cpu-migrations # 9.9 migrations/sec ...
+ 81 page-faults # 66.9 faults/sec ...
+
+ 0.100891009 seconds time elapsed
+
+The grep command does not match any single line and exits with error
+code 1.
+
+As the bash script is executed with 'set -e', it aborts with the first
+error code being non-zero.
+
+Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'.
+
+Output before:
+
+ # perf test 102
+ 102: perf stat tests : FAILED!
+ #
+
+Output after:
+
+ # perf test 102
+ 102: perf stat tests : Ok
+ #
+
+Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: linux-s390@vger.kernel.org
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index a20bf3bdcb9f8..a76ccf2deb563 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -159,7 +159,7 @@ test_hybrid() {
+ fi
+
+ # Run default Perf stat
+- cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c)
++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " | wc -l)
+
+ # The expectation is that default output will have a cycles events on each
+ # hybrid PMU. In situations with no cycles PMU events, like virtualized, this
+--
+2.51.0
+
--- /dev/null
+From 6cadf744a4b2926ba13754cca58f3cc4a4685f49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 13:22:04 -0800
+Subject: perf test stat: Update test expectations and events
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit a48cd551d7436be3b1bd65c63a6d00163f7e7706 ]
+
+test_stat_record_report and test_stat_record_script used default
+output which triggers a bug when sending metrics. As this isn't
+relevant to the test switch to using named software events.
+
+Update the match in test_hybrid as the cycles event is now cpu-cycles
+to workaround potential ARM issues.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: e272628902c1 ("perf test stat tests: Fix for virtualized machines")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index 62f13dfeae8e4..a20bf3bdcb9f8 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -18,7 +18,7 @@ test_default_stat() {
+
+ test_stat_record_report() {
+ echo "stat record and report test"
+- if ! perf stat record -o - true | perf stat report -i - 2>&1 | \
++ if ! perf stat record -e task-clock -o - true | perf stat report -i - 2>&1 | \
+ grep -E -q "Performance counter stats for 'pipe':"
+ then
+ echo "stat record and report test [Failed]"
+@@ -30,7 +30,7 @@ test_stat_record_report() {
+
+ test_stat_record_script() {
+ echo "stat record and script test"
+- if ! perf stat record -o - true | perf script -i - 2>&1 | \
++ if ! perf stat record -e task-clock -o - true | perf script -i - 2>&1 | \
+ grep -E -q "CPU[[:space:]]+THREAD[[:space:]]+VAL[[:space:]]+ENA[[:space:]]+RUN[[:space:]]+TIME[[:space:]]+EVENT"
+ then
+ echo "stat record and script test [Failed]"
+@@ -159,7 +159,7 @@ test_hybrid() {
+ fi
+
+ # Run default Perf stat
+- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c)
++ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c)
+
+ # The expectation is that default output will have a cycles events on each
+ # hybrid PMU. In situations with no cycles PMU events, like virtualized, this
+--
+2.51.0
+
--- /dev/null
+From 6bd2026706308e15070a5af86679aced18520457 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 20:13:32 -0800
+Subject: perf unwind-libdw: Fix invalid reference counts
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f815fc0c66e777c727689666cfb46b8d461c2f99 ]
+
+The addition of addr_location__exit() causes use-after put on the maps
+and map references in the unwind info. Add the gets and then add the
+map_symbol__exit() calls.
+
+Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Cc: Tony Jones <tonyj@suse.de>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/unwind-libdw.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index 6013335a8daea..bd027fdf6af17 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -133,8 +133,8 @@ static int entry(u64 ip, struct unwind_info *ui)
+ }
+
+ e->ip = ip;
+- e->ms.maps = al.maps;
+- e->ms.map = al.map;
++ e->ms.maps = maps__get(al.maps);
++ e->ms.map = map__get(al.map);
+ e->ms.sym = al.sym;
+
+ pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n",
+@@ -319,6 +319,9 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
+ if (err)
+ pr_debug("unwind: failed with '%s'\n", dwfl_errmsg(-1));
+
++ for (i = 0; i < ui->idx; i++)
++ map_symbol__exit(&ui->entries[i].ms);
++
+ dwfl_end(ui->dwfl);
+ free(ui);
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From f1de4c9506267e5fb53ed319e2b8a37776a0831c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 19:17:12 +0800
+Subject: phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ]
+
+Disabling PHYs in runtime usually causes the client with external abort
+exception or similar issue due to lack of API to notify clients about PHY
+removal. This patch removes the possibility to unbind i.MX PHY drivers in
+runtime.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+index 043063699e064..41194083e358c 100644
+--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+@@ -411,6 +411,7 @@ static struct platform_driver imx8mq_usb_phy_driver = {
+ .driver = {
+ .name = "imx8mq-usb-phy",
+ .of_match_table = imx8mq_usb_phy_of_match,
++ .suppress_bind_attrs = true,
+ }
+ };
+ module_platform_driver(imx8mq_usb_phy_driver);
+--
+2.51.0
+
--- /dev/null
+From 0baec6bff3b5a39f68cac85470d11bf0d47dcc93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 15:06:43 +0000
+Subject: phy: mvebu-cp110-utmi: fix dr_mode property read from dts
+
+From: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+
+[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ]
+
+The problem with the current implementation is that it does not consider
+that the USB controller can have multiple PHY handles with different
+arguments count, as for example we have in our cn9131 based platform:
+"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;".
+
+In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells)
+leads to not proper phy detection, taking the "marvell,cp110-utmi-phy"
+dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0
+(#phy-cells = <0>) and safely look for that phy.
+
+Signed-off-by: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
+Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+index 4922a5f3327d5..30391d0d7d4b4 100644
+--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
++++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+@@ -326,7 +326,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
+- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1);
++ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0);
+ if ((port->dr_mode != USB_DR_MODE_HOST) &&
+ (port->dr_mode != USB_DR_MODE_PERIPHERAL)) {
+ dev_err(&pdev->dev,
+--
+2.51.0
+
--- /dev/null
+From 411723637ee4b5200a6dacff905beea3bfcdc13f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 10:03:58 +0800
+Subject: pstore: ram_core: fix incorrect success return when vmap() fails
+
+From: Ruipeng Qi <ruipengqi3@gmail.com>
+
+[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ]
+
+In persistent_ram_vmap(), vmap() may return NULL on failure.
+
+If offset is non-zero, adding offset_in_page(start) causes the function
+to return a non-NULL pointer even though the mapping failed.
+persistent_ram_buffer_map() therefore incorrectly returns success.
+
+Subsequent access to prz->buffer may dereference an invalid address
+and cause crashes.
+
+Add proper NULL checking for vmap() failures.
+
+Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
+Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index c9eaacdec37e4..7b6d6378a3b87 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot);
+ kfree(pages);
+
++ /*
++ * vmap() may fail and return NULL. Do not add the offset in this
++ * case, otherwise a NULL mapping would appear successful.
++ */
++ if (!vaddr)
++ return NULL;
++
+ /*
+ * Since vmap() uses page granularity, we must add the offset
+ * into the page here, to get the byte granularity address
+--
+2.51.0
+
--- /dev/null
+From a4602585630abd4bb57ae3a307c506b04742a7eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:15:16 +0100
+Subject: RDMA/rtrs-clt: For conn rejection use actual err number
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ]
+
+When the connection establishment request is rejected from the server
+side, then the actual error number sent back should be used.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com
+Reviewed-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index eaf911e2ffa9f..1af2ee8c8ed5e 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1922,7 +1922,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ struct rtrs_path *s = con->c.path;
+ const struct rtrs_msg_conn_rsp *msg;
+ const char *rej_msg;
+- int status, errno;
++ int status, errno = -ECONNRESET;
+ u8 data_len;
+
+ status = ev->status;
+@@ -1944,7 +1944,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
+ status, rej_msg);
+ }
+
+- return -ECONNRESET;
++ return errno;
+ }
+
+ void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait)
+--
+2.51.0
+
--- /dev/null
+From 8b6713c6f0c8151f2cb7ce70959ce18f581217c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 14:28:23 +0200
+Subject: remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox
+ TX channel is uninitialized
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ]
+
+Firmwares that do not use mailbox communication (e.g., the hello_world
+sample) leave priv->tx_ch as NULL. The current suspend logic
+unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without
+an initialized TX channel.
+
+Detect the no_mailboxes case early and skip sending the suspend
+message. Instead, proceed directly to the runtime PM suspend path,
+which is the correct behavior for firmwares that cannot respond to
+mailbox requests.
+
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c
+index 8fcda9b745459..960fbd4b1d9b9 100644
+--- a/drivers/remoteproc/imx_dsp_rproc.c
++++ b/drivers/remoteproc/imx_dsp_rproc.c
+@@ -1250,6 +1250,15 @@ static int imx_dsp_suspend(struct device *dev)
+ if (rproc->state != RPROC_RUNNING)
+ goto out;
+
++ /*
++ * No channel available for sending messages;
++ * indicates no mailboxes present, so trigger PM runtime suspend
++ */
++ if (!priv->tx_ch) {
++ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n");
++ goto out;
++ }
++
+ reinit_completion(&priv->pm_comp);
+
+ /* Tell DSP that suspend is happening */
+--
+2.51.0
+
--- /dev/null
+From 0aae9d10b74295142f3c414ed8df63e67808713d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 11:07:55 +0000
+Subject: remoteproc: mediatek: Break lock dependency to `prepare_lock`
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ]
+
+A potential circular locking dependency (ABBA deadlock) exists between
+`ec_dev->lock` and the clock framework's `prepare_lock`.
+
+The first order (A -> B) occurs when scp_ipi_send() is called while
+`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()):
+1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send().
+2. scp_ipi_send() calls clk_prepare_enable(), which acquires
+ `prepare_lock`.
+See #0 in the following example calling trace.
+(Lock Order: `ec_dev->lock` -> `prepare_lock`)
+
+The reverse order (B -> A) is more complex and has been observed
+(learned) by lockdep. It involves the clock prepare operation
+triggering power domain changes, which then propagates through sysfs
+and power supply uevents, eventually calling back into the ChromeOS EC
+driver and attempting to acquire `ec_dev->lock`:
+1. Something calls clk_prepare(), which acquires `prepare_lock`. It
+ then triggers genpd operations like genpd_runtime_resume(), which
+ takes `&genpd->mlock`.
+2. Power domain changes can trigger regulator changes; regulator
+ changes can then trigger device link changes; device link changes
+ can then trigger sysfs changes. Eventually, power_supply_uevent()
+ is called.
+3. This leads to calls like cros_usbpd_charger_get_prop(), which calls
+ cros_ec_cmd_xfer_status(), which then attempts to acquire
+ `ec_dev->lock`.
+See #1 ~ #6 in the following example calling trace.
+(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`)
+
+Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the
+remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock`
+is only acquired in prepare()/unprepare() callbacks. Since
+`ec_dev->lock` is not involved in the callbacks, the dependency loop is
+broken.
+
+This means the clock is always "prepared" when the SCP is running. The
+prolonged "prepared time" for the clock should be acceptable as SCP is
+designed to be a very power efficient processor. The power consumption
+impact can be negligible.
+
+A simplified calling trace reported by lockdep:
+> -> #6 (&ec_dev->lock)
+> cros_ec_cmd_xfer
+> cros_ec_cmd_xfer_status
+> cros_usbpd_charger_get_port_status
+> cros_usbpd_charger_get_prop
+> power_supply_get_property
+> power_supply_show_property
+> power_supply_uevent
+> dev_uevent
+> uevent_show
+> dev_attr_show
+> sysfs_kf_seq_show
+> kernfs_seq_show
+> -> #5 (kn->active#2)
+> kernfs_drain
+> __kernfs_remove
+> kernfs_remove_by_name_ns
+> sysfs_remove_file_ns
+> device_del
+> __device_link_del
+> device_links_driver_bound
+> -> #4 (device_links_lock)
+> device_link_remove
+> _regulator_put
+> regulator_put
+> -> #3 (regulator_list_mutex)
+> regulator_lock_dependent
+> regulator_disable
+> scpsys_power_off
+> _genpd_power_off
+> genpd_power_off
+> -> #2 (&genpd->mlock/1)
+> genpd_add_subdomain
+> pm_genpd_add_subdomain
+> scpsys_add_subdomain
+> scpsys_probe
+> -> #1 (&genpd->mlock)
+> genpd_runtime_resume
+> __rpm_callback
+> rpm_callback
+> rpm_resume
+> __pm_runtime_resume
+> clk_core_prepare
+> clk_prepare
+> -> #0 (prepare_lock)
+> clk_prepare
+> scp_ipi_send
+> scp_send_ipi
+> mtk_rpmsg_send
+> rpmsg_send
+> cros_ec_pkt_xfer_rpmsg
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++---------
+ drivers/remoteproc/mtk_scp_ipi.c | 4 ++--
+ 2 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
+index c4c535b011812..ecbece2b5ce7c 100644
+--- a/drivers/remoteproc/mtk_scp.c
++++ b/drivers/remoteproc/mtk_scp.c
+@@ -225,7 +225,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+ struct mtk_scp *scp = priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return IRQ_NONE;
+@@ -233,7 +233,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
+
+ scp->data->scp_irq_handler(scp);
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return IRQ_HANDLED;
+ }
+@@ -467,7 +467,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -482,7 +482,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+
+ ret = scp_elf_load_segments(rproc, fw);
+ leave:
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+@@ -493,14 +493,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw)
+ struct device *dev = scp->dev;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+ }
+
+ ret = scp_ipi_init(scp, fw);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -511,7 +511,7 @@ static int scp_start(struct rproc *rproc)
+ struct scp_run *run = &scp->run;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clocks\n");
+ return ret;
+@@ -536,14 +536,14 @@ static int scp_start(struct rproc *rproc)
+ goto stop;
+ }
+
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver);
+
+ return 0;
+
+ stop:
+ scp->data->scp_reset_assert(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+ return ret;
+ }
+
+@@ -638,7 +638,7 @@ static int scp_stop(struct rproc *rproc)
+ struct mtk_scp *scp = rproc->priv;
+ int ret;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clocks\n");
+ return ret;
+@@ -646,12 +646,29 @@ static int scp_stop(struct rproc *rproc)
+
+ scp->data->scp_reset_assert(scp);
+ scp->data->scp_stop(scp);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return 0;
+ }
+
++static int scp_prepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ return clk_prepare(scp->clk);
++}
++
++static int scp_unprepare(struct rproc *rproc)
++{
++ struct mtk_scp *scp = rproc->priv;
++
++ clk_unprepare(scp->clk);
++ return 0;
++}
++
+ static const struct rproc_ops scp_ops = {
++ .prepare = scp_prepare,
++ .unprepare = scp_unprepare,
+ .start = scp_start,
+ .stop = scp_stop,
+ .load = scp_load,
+diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c
+index 9c7c17b9d181f..0c3ed37bd0821 100644
+--- a/drivers/remoteproc/mtk_scp_ipi.c
++++ b/drivers/remoteproc/mtk_scp_ipi.c
+@@ -168,7 +168,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+ WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf))
+ return -EINVAL;
+
+- ret = clk_prepare_enable(scp->clk);
++ ret = clk_enable(scp->clk);
+ if (ret) {
+ dev_err(scp->dev, "failed to enable clock\n");
+ return ret;
+@@ -208,7 +208,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
+
+ unlock_mutex:
+ mutex_unlock(&scp->send_lock);
+- clk_disable_unprepare(scp->clk);
++ clk_disable(scp->clk);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 84fcd6ae0954241cdc5f1c93ecee29e200dd8c0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 17:16:51 +0100
+Subject: Revert "mfd: da9052-spi: Change read-mask to write-mask"
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ]
+
+This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed.
+
+Almost every register in this chip can be customized via OTP
+memory. Somehow the value for R19, which decide if the flag is set
+on read or write operation, seems to have been overwritten for the chip
+the original patch were written for.
+
+Revert the change to follow the default behavior.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9052-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c
+index 80fc5c0cac2fb..be5f2b34e18ae 100644
+--- a/drivers/mfd/da9052-spi.c
++++ b/drivers/mfd/da9052-spi.c
+@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)
+ spi_set_drvdata(spi, da9052);
+
+ config = da9052_regmap_config;
+- config.write_flag_mask = 1;
++ config.read_flag_mask = 1;
+ config.reg_bits = 7;
+ config.pad_bits = 1;
+ config.val_bits = 8;
+--
+2.51.0
+
--- /dev/null
+From e9b5b5964ca6699d5a15fb601a42f9298b086b40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 13:47:33 +0100
+Subject: rnbd-srv: Zero the rsp buffer before using it
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ]
+
+Before using the data buffer to send back the response message, zero it
+completely. This prevents any stray bytes to be picked up by the client
+side when there the message is exchanged between different protocol
+versions.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-srv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
+index b67e39a34010b..ebc0f4c091051 100644
+--- a/drivers/block/rnbd/rnbd-srv.c
++++ b/drivers/block/rnbd/rnbd-srv.c
+@@ -536,6 +536,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp,
+ {
+ struct block_device *bdev = sess_dev->bdev;
+
++ memset(rsp, 0, sizeof(*rsp));
++
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP);
+ rsp->device_id = cpu_to_le32(sess_dev->device_id);
+ rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev));
+@@ -641,6 +643,7 @@ static void process_msg_sess_info(struct rnbd_srv_session *srv_sess,
+
+ trace_process_msg_sess_info(srv_sess, sess_info_msg);
+
++ memset(rsp, 0, sizeof(*rsp));
+ rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP);
+ rsp->ver = srv_sess->ver;
+ }
+--
+2.51.0
+
--- /dev/null
+From a88edc45b6500221268143febcaec1c749dc2d46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 17:35:19 +0000
+Subject: rtc: interface: Alarm race handling should not discard preceding
+ error
+
+From: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+
+[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ]
+
+Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting
+alarm") should not discard any errors from the preceding validations.
+
+Prior to that commit, if the alarm feature was disabled, or the
+set_alarm failed, a meaningful error code would be returned to the
+caller for further action.
+
+After, more often than not, the __rtc_read_time will cause a success
+return code instead, misleading the caller.
+
+An example of this is when timer_enqueue is called for a rtc-abx080x
+device. Since that driver does not clear the alarm feature bit, but
+instead relies on the set_alarm operation to return invalid, the discard
+of the return code causes very different behaviour; i.e.
+ hwclock: select() to /dev/rtc0 to wait for clock tick timed out
+
+Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm")
+Signed-off-by: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
+Reviewed-by: Esben Haabendal <esben@geanix.com>
+Tested-by: Nick Bowler <nbowler@draconx.ca>
+Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 93baffe110c00..13de2cb07f75d 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ * are in, we can return -ETIME to signal that the timer has already
+ * expired, which is true in both cases.
+ */
+- if ((scheduled - now) <= 1) {
++ if (!err && (scheduled - now) <= 1) {
+ err = __rtc_read_time(rtc, &tm);
+ if (err)
+ return err;
+--
+2.51.0
+
--- /dev/null
+From 2d6327e62d065d3b3bf8db23ce67dc97e1d5bbb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jan 2026 13:53:45 +0000
+Subject: rtc: zynqmp: correct frequency value
+
+From: Tomas Melin <tomas.melin@vaisala.com>
+
+[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ]
+
+Fix calibration value in case a clock reference is provided.
+The actual calibration value written into register is
+frequency - 1.
+
+Reviewed-by: Harini T <harini.t@amd.com>
+Tested-by: Harini T <harini.t@amd.com>
+Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-zynqmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c
+index b6f96c10196ae..f49af7d963fbd 100644
+--- a/drivers/rtc/rtc-zynqmp.c
++++ b/drivers/rtc/rtc-zynqmp.c
+@@ -330,7 +330,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev)
+ &xrtcdev->freq);
+ if (ret)
+ xrtcdev->freq = RTC_CALIB_DEF;
++ } else {
++ xrtcdev->freq--;
+ }
++
+ ret = readl(xrtcdev->reg_base + RTC_CALIB_RD);
+ if (!ret)
+ writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR));
+--
+2.51.0
+
--- /dev/null
+From 5c32838614e1002a9aef324b8f6866578d806c0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 10:14:12 +0100
+Subject: s390/perf: Disable register readout on sampling events
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ]
+
+Running commands
+ # ./perf record -IR0,R1 -a sleep 1
+extracts and displays register value of general purpose register r1 and r0.
+However the value displayed of any register is random and does not
+reflect the register value recorded at the time of the sample interrupt.
+
+The sampling device driver on s390 creates a very large buffer
+for the hardware to store the samples. Only when that large buffer
+gets full an interrupt is generated and many hundreds of sample
+entries are processed and copied to the kernel ring buffer and
+eventually get copied to the perf tool. It is during the copy
+to the kernel ring buffer that each sample is processed (on s390)
+and at that time the register values are extracted.
+This is not the original goal, the register values should be read
+when the samples are created not when the samples are copied to the
+kernel ring buffer.
+
+Prevent this event from being installed in the first place and
+return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Jan Polensky <japo@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index e52c89739bc9a..c6cac49f3ae72 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -925,7 +925,7 @@ static bool is_callchain_event(struct perf_event *event)
+ u64 sample_type = event->attr.sample_type;
+
+ return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER |
+- PERF_SAMPLE_STACK_USER);
++ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER);
+ }
+
+ static int cpumsf_pmu_event_init(struct perf_event *event)
+--
+2.51.0
+
--- /dev/null
+From 54f8e1c2755e6b6e764e602e6c9b2615baa2ef2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 16:47:07 +0100
+Subject: s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ]
+
+Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
+to scripts/Makefile.extrawarn, since clang generates warnings for the
+dummy variable in typecheck():
+
+ CC arch/s390/purgatory/purgatory.o
+ arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
+ 221 | return psw_bits(regs->psw).pstate;
+ | ^
+ arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
+ 98 | typecheck(psw_t, __psw); \
+ | ^
+ include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
+ 11 | typeof(x) __dummy2; \
+ | ^
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/purgatory/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
+index fe7e71f91711b..0cbfa716a64a7 100644
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -29,6 +29,7 @@ KBUILD_CFLAGS += -fno-stack-protector
+ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+ KBUILD_CFLAGS += $(CLANG_FLAGS)
+ KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
+ KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS))
+
+ # Since we link purgatory with -r unresolved symbols are not checked, so we
+--
+2.51.0
+
--- /dev/null
+From 5907f3fa6bce8dba6995dc901fbfa9d95c1d9b3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:33:15 +0100
+Subject: scsi: buslogic: Reduce stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ]
+
+Some randconfig builds run into excessive stack usage with gcc-14 or
+higher, which use __attribute__((cold)) where earlier versions did not do
+that:
+
+drivers/scsi/BusLogic.c: In function 'blogic_init':
+drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
+
+The problem is that a lot of code gets inlined into blogic_init() here. Two
+functions stick out, but they are a bit different:
+
+ - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel
+ stack, which is a problem in combination with other functions that also
+ do. Marking this one as noinline means that the stack slots get get
+ reused between function calls
+
+ - blogic_reportconfig() has a few large variables, but whenever it is not
+ inlined into its caller, the compiler is actually smart enough to reuse
+ stack slots for these automatically, so marking it as noinline saves
+ most of the stack space by itself.
+
+The combination of both of these should avoid the problem entirely.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/BusLogic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index 72ceaf650b0d5..dfe97e25635ed 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -919,7 +919,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter)
+ a particular probe order.
+ */
+
+-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter)
++static noinline_for_stack void __init
++blogic_init_probeinfo_list(struct blogic_adapter *adapter)
+ {
+ /*
+ If a PCI BIOS is present, interrogate it for MultiMaster and
+@@ -1689,7 +1690,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter)
+ blogic_reportconfig reports the configuration of Host Adapter.
+ */
+
+-static bool __init blogic_reportconfig(struct blogic_adapter *adapter)
++static noinline_for_stack bool __init
++blogic_reportconfig(struct blogic_adapter *adapter)
+ {
+ unsigned short alltgt_mask = (1 << adapter->maxdev) - 1;
+ unsigned short sync_ok, fast_ok;
+--
+2.51.0
+
--- /dev/null
+From bd54ef7056c4b2aa72d076ed014233e390479297 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:48:29 +0530
+Subject: serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
+ termination is done
+
+From: Moteen Shah <m-shah@ti.com>
+
+[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ]
+
+Clear rx_running flag only after DMA teardown polling completes. In the
+previous implementation the flag was being cleared while hardware teardown
+was still in progress, creating a mismatch between software state
+(flag = 0, "ready") and hardware state (still terminating).
+
+Signed-off-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 9ed62bc7cdd83..776373423b2a0 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -924,7 +924,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+
+ cookie = dma->rx_cookie;
+- dma->rx_running = 0;
+
+ /* Re-enable RX FIFO interrupt now that transfer is complete */
+ if (priv->habit & UART_HAS_RHR_IT_DIS) {
+@@ -958,6 +957,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ goto out;
+ ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+
++ dma->rx_running = 0;
+ p->port.icount.rx += ret;
+ p->port.icount.buf_overrun += count - ret;
+ out:
+--
+2.51.0
+
--- /dev/null
+From d6e4295fb919543bd701d6980bec4201240ff03e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 17:54:25 +0300
+Subject: serial: 8250_dw: handle clock enable errors in runtime_resume
+
+From: Artem Shimko <a.shimko.dev@gmail.com>
+
+[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ]
+
+Add error checking for clk_prepare_enable() calls in
+dw8250_runtime_resume(). Currently if either clock fails to enable,
+the function returns success while leaving clocks in inconsistent state.
+
+This change implements comprehensive error handling by checking the return
+values of both clk_prepare_enable() calls. If the second clock enable
+operation fails after the first clock has already been successfully
+enabled, the code now properly cleans up by disabling and unpreparing
+the first clock before returning. The error code is then propagated to
+the caller, ensuring that clock enable failures are properly reported
+rather than being silently ignored.
+
+Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
+Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index 57b27f9ea1f03..60a05bfecde39 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -753,11 +753,18 @@ static int dw8250_runtime_suspend(struct device *dev)
+
+ static int dw8250_runtime_resume(struct device *dev)
+ {
++ int ret;
+ struct dw8250_data *data = dev_get_drvdata(dev);
+
+- clk_prepare_enable(data->pclk);
++ ret = clk_prepare_enable(data->pclk);
++ if (ret)
++ return ret;
+
+- clk_prepare_enable(data->clk);
++ ret = clk_prepare_enable(data->clk);
++ if (ret) {
++ clk_disable_unprepare(data->pclk);
++ return ret;
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
asoc-dt-bindings-asahi-kasei-ak4458-set-unevaluatedproperties-false.patch
asoc-dt-bindings-asahi-kasei-ak4458-fix-the-supply-names.patch
asoc-dt-bindings-asahi-kasei-ak5558-fix-the-supply-names.patch
+perf-test-stat-update-test-expectations-and-events.patch
+perf-test-stat-tests-fix-for-virtualized-machines.patch
+perf-unwind-libdw-fix-invalid-reference-counts.patch
+perf-callchain-fix-srcline-printing-with-inlines.patch
+libsubcmd-fix-null-intersection-case-in-exclude_cmds.patch
+libperf-don-t-remove-g-when-extra_cflags-are-used.patch
+libperf-build-always-place-libperf-includes-first.patch
+rtc-interface-alarm-race-handling-should-not-discard.patch
+audit-add-fchmodat2-to-change-attributes-class.patch
+hfsplus-fix-volume-corruption-issue-for-generic-498.patch
+fs-buffer-add-alert-in-try_to_free_buffers-for-folio.patch
+audit-add-missing-syscalls-to-read-class.patch
+hfsplus-pretend-special-inodes-as-regular-files.patch
+i3c-master-svc-initialize-dev-to-null-in-svc_i3c_mas.patch
+minix-add-required-sanity-checking-to-minix_check_su.patch
+btrfs-handle-user-interrupt-properly-in-btrfs_trim_f.patch
+smb-client-add-proper-locking-around-ses-iface_last_.patch
+gfs2-fiemap-page-fault-fix.patch
+smb-client-prevent-races-in-query_interfaces.patch
+tools-power-cpupower-reset-errno-before-strtoull.patch
+s390-purgatory-add-wno-default-const-init-unsafe-to-.patch
+perf-arm-cmn-support-cmn-600ae.patch
+arm64-add-support-for-tsv110-spectre-bhb-mitigation.patch
+rnbd-srv-zero-the-rsp-buffer-before-using-it.patch
+x86-xen-pvh-enable-pae-mode-for-32-bit-guest-only-wh.patch
+efi-cper-don-t-dump-the-entire-memory-region.patch
+apei-ghes-ensure-that-won-t-go-past-cper-allocated-r.patch
+efi-cper-don-t-go-past-the-arm-processor-cper-record.patch
+acpi-processor-fix-null-pointer-dereference-in-acpi_.patch
+acpica-abort-aml-bytecode-execution-when-executing-a.patch
+md-cluster-fix-null-pointer-dereference-in-process_m.patch
+cpufreq-dt-platdev-block-the-driver-from-probing-on-.patch
+s390-perf-disable-register-readout-on-sampling-event.patch
+perf-cxlpmu-replace-irqf_oneshot-with-irqf_no_thread.patch
+xenbus-use-.freeze-.thaw-to-handle-xenbus-devices.patch
+blk-mq-debugfs-add-missing-debugfs_mutex-in-blk_mq_d.patch
+sparc-synchronize-user-stack-on-fork-and-clone.patch
+sparc-don-t-reference-obsolete-termio-struct-for-tc-.patch
+bpf-verifier-improvement-in-32bit-shift-sign-extensi.patch
+clocksource-drivers-sh_tmu-always-leave-device-runni.patch
+clocksource-drivers-timer-integrator-ap-add-missing-.patch
+pci-msi-unmap-msi-x-region-on-error.patch
+crypto-hisilicon-qm-move-the-barrier-before-writing-.patch
+mailbox-bcm-ferxrm-mailbox-use-default-primary-handl.patch
+char-tpm-cr50-remove-irqf_oneshot.patch
+pstore-ram_core-fix-incorrect-success-return-when-vm.patch
+arm64-tegra-smaug-add-usb-role-switch-support.patch
+parisc-prevent-interrupts-during-reboot.patch
+drm-display-dp_mst-add-protection-against-0-vcpi.patch
+spi-geni-qcom-initialize-mode-related-registers-to-0.patch
+spi-geni-qcom-use-xfer-bits_per_word-for-can_dma.patch
+media-dvb-core-dmxdevfilter-must-always-flush-bufs.patch
+spi-stm32-fix-overrun-issue-at-8bpw.patch
+drm-v3d-set-dma-segment-size-to-avoid-debug-warnings.patch
+media-omap3isp-isp_video_mbus_to_pix-pix_to_mbus-fix.patch
+media-omap3isp-isppreview-always-clamp-in-preview_tr.patch
+media-omap3isp-set-initial-format.patch
+media-mediatek-vcodec-don-t-try-to-decode-422-444-vp.patch
+drm-amdgpu-add-support-for-hdp-ip-version-6.1.1.patch
+drm-amdgpu-avoid-a-warning-in-timedout-job-handler.patch
+hid-apple-add-sonix-kn85-keyboard-to-the-list-of-non.patch
+asoc-wm8962-add-wm8962_adc_monomix-to-3d-coefficient.patch
+asoc-wm8962-don-t-report-a-microphone-if-it-s-shorte.patch
+spi-spi-mem-limit-octal-dtr-constraints-to-octal-dtr.patch
+media-amphion-clear-last_buffer_dequeued-flag-for-de.patch
+media-adv7180-fix-frame-interval-in-progressive-mode.patch
+media-pvrusb2-fix-urb-leak-in-pvr2_send_request_ex.patch
+media-solo6x10-check-for-out-of-bounds-chip_id.patch
+media-cx25821-fix-a-resource-leak-in-cx25821_dev_set.patch
+media-v4l2-async-fix-error-handling-on-steps-after-f.patch
+drm-amdkfd-fix-gart-pte-for-non-4k-pagesize-in-svm_m.patch
+drm-account-property-blob-allocations-to-memcg.patch
+hyper-v-mark-inner-union-in-hv_kvp_exchg_msg_value-a.patch
+virt-vbox-uapi-mark-inner-unions-in-packed-structs-a.patch
+drm-amd-display-ensure-link-output-is-disabled-in-ba.patch
+drm-atmel-hlcdc-fix-memory-leak-from-the-atomic_dest.patch
+drm-atmel-hlcdc-don-t-reject-the-commit-if-the-src-r.patch
+drm-atmel-hlcdc-fix-use-after-free-of-drm_crtc_commi.patch
+media-rkisp1-fix-filter-mode-register-configuration.patch
+hid-multitouch-add-egalaxtouch-exc3188-support.patch
+hid-elecom-add-support-for-elecom-huge-plus-m-ht1mrb.patch
+alsa-hda-conexant-add-headset-mic-fix-for-mechrevo-w.patch
+gpio-aspeed-sgpio-change-the-macro-to-support-deferr.patch
+asoc-sunxi-sun50i-dmic-add-missing-check-for-devm_re.patch
+spi-spi-mem-protect-dirmap_create-with-spi_mem_acces.patch
+asoc-codecs-max98390-check-return-value-of-devm_gpio.patch
+hwmon-nct6775-add-asus-pro-ws-wrx90e-sage-se.patch
+hwmon-f71882fg-add-f81968-support.patch
+asoc-es8328-add-error-unwind-in-resume.patch
+modpost-amend-ppc64-save-restfpr-symnames-for-os-bui.patch
+alsa-usb-audio-add-iface-reset-and-delay-quirk-for-a.patch
+jfs-add-missing-set_freezable-for-freezable-kthread.patch
+jfs-nlink-overflow-in-jfs_rename.patch
+wifi-rtw88-fix-dtim-period-handling-when-conf-dtim_p.patch
+wifi-rtw88-8822b-avoid-warning-in-rtw8822b_config_tr.patch
+wifi-rtw88-rtw8821cu-add-id-for-mercusys-mu6h.patch
+dm-replace-eexist-with-ebusy.patch
+dm-remove-fake-timeout-to-avoid-leak-request.patch
+iommu-arm-smmu-v3-improve-cmdq-lock-fairness-and-eff.patch
+wifi-libertas-fix-warning-in-usb_tx_block.patch
+iommu-amd-move-wait_on_sem-out-of-spinlock.patch
+wifi-rtw89-wow-add-reason-codes-for-disassociation-i.patch
+pci-dw-rockchip-disable-bar-0-and-bar-1-for-root-por.patch
+wifi-ath11k-add-pm-quirk-for-thinkpad-z13-z16-gen1.patch
+wifi-ath12k-fix-preferred-hardware-mode-calculation.patch
+ipv6-annotate-data-races-in-ip6_multipath_hash_-poli.patch
+ipv6-exthdrs-annotate-data-race-over-multiple-sysctl.patch
+ext4-mark-group-add-fast-commit-ineligible.patch
+ext4-move-ext4_percpu_param_init-before-ext4_mb_init.patch
+ext4-mark-group-extend-fast-commit-ineligible.patch
+netfilter-nf_conntrack-add-allow_clash-to-generic-pr.patch
+netfilter-xt_tcpmss-check-remaining-length-before-re.patch
+openrisc-define-arch-specific-version-of-nop.patch
+net-usb-r8152-fix-transmit-queue-timeout.patch
+wifi-iwlwifi-mvm-check-the-validity-of-noa_len.patch
+net-rds-no-shortcut-out-of-rds_conn_error.patch
+gro-change-the-bug_on-in-gro_pull_from_frag0.patch
+ipv4-igmp-annotate-data-races-around-idev-mr_maxdela.patch
+net-hns3-extend-hclge_fd_ad_qid-to-11-bits.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il4965.patch
+wifi-iwlegacy-add-missing-mutex-protection-in-il3945.patch
+ipv4-fib-annotate-access-to-struct-fib_alias.fa_stat.patch
+bluetooth-hci_conn-set-link_policy-on-incoming-acl-c.patch
+bluetooth-hci_conn-use-mod_delayed_work-for-active-m.patch
+bluetooth-btusb-add-new-vid-pid-for-rtl8852ce.patch
+bluetooth-btusb-add-device-id-for-realtek-rtl8761bu.patch
+octeontx2-af-workaround-sqm-pse-stalls-by-disabling-.patch
+wifi-rtw89-pci-restore-ldo-setting-after-device-resu.patch
+wifi-ath10k-fix-lock-protection-in-ath10k_wmi_event_.patch
+net-usb-sr9700-remove-code-to-drive-nonexistent-mult.patch
+vmw_vsock-bypass-false-positive-wnonnull-warning-wit.patch
+net-rds-clear-reconnect-pending-bit.patch
+pci-mark-asm1164-sata-controller-to-avoid-bus-reset.patch
+pci-fix-pci_slot_lock-device-locking.patch
+pci-enable-acs-after-configuring-iommu-for-of-platfo.patch
+pci-add-acs-quirk-for-qualcomm-hamoa-glymur.patch
+pci-mark-nvidia-gb10-to-avoid-bus-reset.patch
+myri10ge-avoid-uninitialized-variable-use.patch
+nfc-nxp-nci-remove-interrupt-trigger-type.patch
+rdma-rtrs-clt-for-conn-rejection-use-actual-err-numb.patch
+ata-libata-avoid-long-timeouts-on-hot-unplugged-sata.patch
+hisi_acc_vfio_pci-update-status-after-ras-error.patch
+scsi-buslogic-reduce-stack-usage.patch
+vhost-fix-caching-attributes-of-mmio-regions-by-sett.patch
+tracing-fix-false-sharing-in-hwlat-get_sample.patch
+remoteproc-imx_dsp_rproc-skip-rp_mbox_suspend_system.patch
+mailbox-pcc-remove-spurious-irqf_oneshot-usage.patch
+mailbox-imx-skip-the-suspend-flag-for-i.mx7ulp.patch
+mailbox-sprd-mask-interrupts-that-are-not-handled.patch
+remoteproc-mediatek-break-lock-dependency-to-prepare.patch
+mailbox-sprd-clear-delivery-flag-before-handling-tx-.patch
+clk-microchip-core-correct-return-value-on-_get_pare.patch
+m68k-nommu-fix-memmove-with-differently-aligned-src-.patch
+soundwire-dmi-quirks-add-mapping-for-avell-b.on-oem-.patch
+staging-rtl8723bs-fix-missing-status-update-on-sdio_.patch
+serial-8250_dw-handle-clock-enable-errors-in-runtime.patch
+usb-typec-ucsi-psy-fix-voltage-and-current-max-for-n.patch
+fpga-of-fpga-region-fail-if-any-bridge-is-missing.patch
+dmaengine-sun6i-choose-appropriate-burst-length-unde.patch
+dmaengine-stm32-mdma-initialize-m2m_hw_period-and-cc.patch
+misc-bcm_vk-fix-possible-null-pointer-dereferences-i.patch
+misc-eeprom-fix-ewen-ewds-eral-commands-for-93xx56-a.patch
+staging-rtl8723bs-fix-memory-leak-on-failure-path.patch
+serial-8250-8250_omap.c-clear-dma-rx-running-status-.patch
+fix-it87_wdt-early-reboot-by-reporting-running-timer.patch
+binder-don-t-use-pk-through-printk.patch
+watchdog-imx7ulp_wdt-handle-the-nowayout-option.patch
+phy-mvebu-cp110-utmi-fix-dr_mode-property-read-from-.patch
+phy-fsl-imx8mq-usb-disable-bind-unbind-platform-driv.patch
+revert-mfd-da9052-spi-change-read-mask-to-write-mask.patch
+iio-use-irqf_no_thread.patch
+iio-magnetometer-remove-irqf_oneshot.patch
+mips-loongson-make-cpumask_of_node-robust-against-nu.patch
+fs-ntfs3-check-return-value-of-indx_find-to-avoid-in.patch
+fs-ntfs3-fix-infinite-loop-in-attr_load_runs_range-o.patch
+fs-ntfs3-fix-infinite-loop-triggered-by-zero-sized-a.patch
+fs-ntfs3-drop-preallocated-clusters-for-sparse-and-c.patch
+fs-ntfs3-avoid-calling-run_get_entry-when-run-null-i.patch
+ceph-supply-snapshot-context-in-ceph_uninline_data.patch
+libceph-define-and-enforce-ceph_max_key_len.patch
+thermal-int340x-fix-sysfs-group-leak-on-dlvr-registr.patch
+include-uapi-netfilter_bridge.h-cover-for-musl-libc.patch
+arm-9467-1-mm-don-t-use-pk-through-printk.patch
+drm-amd-display-avoid-updating-surface-with-the-same.patch
+drm-amdgpu-adjust-usleep_range-in-fence-wait.patch
+alsa-usb-audio-update-the-number-of-packets-properly.patch
+drm-amdgpu-add-hainan-clock-adjustment.patch
+drm-radeon-add-hainan-clock-adjustment.patch
+alsa-usb-audio-add-sanity-check-for-oob-writes-at-si.patch
+btrfs-replace-bug-with-error-handling-in-__btrfs_bal.patch
+drm-amd-display-remove-conditional-for-shaper-3dlut-.patch
+rtc-zynqmp-correct-frequency-value.patch
+ntb-ntb_hw_switchtec-fix-array-index-out-of-bounds-a.patch
+ntb-ntb_hw_switchtec-fix-shift-out-of-bounds-for-0-m.patch
--- /dev/null
+From 02c41a70f57a7efbb1d045b7fb58f7dd647511e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 14:54:45 -0300
+Subject: smb: client: add proper locking around ses->iface_last_update
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ]
+
+There is a missing ses->iface_lock in cifs_setup_session,
+around ses->iface_last_update.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/connect.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
+index 86c89917f18e9..59220ebd6ecce 100644
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -4065,7 +4065,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
+ ses->ses_status = SES_IN_SETUP;
+
+ /* force iface_list refresh */
++ spin_lock(&ses->iface_lock);
+ ses->iface_last_update = 0;
++ spin_unlock(&ses->iface_lock);
+ }
+ spin_unlock(&ses->ses_lock);
+
+--
+2.51.0
+
--- /dev/null
+From cfcbb96a7c7afb173f11cc35495dba654ec6d128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 14:54:44 -0300
+Subject: smb: client: prevent races in ->query_interfaces()
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ]
+
+It was possible for two query interface works to be concurrently trying
+to update the interfaces.
+
+Prevent this by checking and updating iface_last_update under
+iface_lock.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index 138b3ed08217c..a745ed9e20460 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -595,13 +595,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ p = buf;
+
+ spin_lock(&ses->iface_lock);
+- /* do not query too frequently, this time with lock held */
+- if (ses->iface_last_update &&
+- time_before(jiffies, ses->iface_last_update +
+- (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
+- spin_unlock(&ses->iface_lock);
+- return 0;
+- }
+
+ /*
+ * Go through iface_list and mark them as inactive
+@@ -624,7 +617,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ "Empty network interface list returned by server %s\n",
+ ses->server->hostname);
+ rc = -EOPNOTSUPP;
+- ses->iface_last_update = jiffies;
+ goto out;
+ }
+
+@@ -753,8 +745,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ + sizeof(p->Next) && p->Next))
+ cifs_dbg(VFS, "%s: incomplete interface info\n", __func__);
+
+- ses->iface_last_update = jiffies;
+-
+ out:
+ /*
+ * Go through the list again and put the inactive entries
+@@ -783,10 +773,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_
+ struct TCP_Server_Info *pserver;
+
+ /* do not query too frequently */
++ spin_lock(&ses->iface_lock);
+ if (ses->iface_last_update &&
+ time_before(jiffies, ses->iface_last_update +
+- (SMB_INTERFACE_POLL_INTERVAL * HZ)))
++ (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
++ spin_unlock(&ses->iface_lock);
+ return 0;
++ }
++
++ ses->iface_last_update = jiffies;
++
++ spin_unlock(&ses->iface_lock);
+
+ rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
+ FSCTL_QUERY_NETWORK_INTERFACE_INFO,
+--
+2.51.0
+
--- /dev/null
+From 03b8acfacc2688eb14397bb725f2d050e9ba1e9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 15:09:47 +0200
+Subject: soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of
+ NUC15)
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ]
+
+Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and
+LAPBC710.
+
+Link: https://github.com/thesofproject/linux/issues/5529
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/dmi-quirks.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
+index 91ab97a456fa9..5854218e1a274 100644
+--- a/drivers/soundwire/dmi-quirks.c
++++ b/drivers/soundwire/dmi-quirks.c
+@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
+ },
+ .driver_data = (void *)intel_tgl_bios,
+ },
++ {
++ /*
++ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County'
++ * LAPBC510 and LAPBC710)
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"),
++ },
++ .driver_data = (void *)intel_tgl_bios,
++ },
+ {
+ /* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 40680d7bd2ba00d39fa78a9b96efc6240f751bf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Feb 2026 13:40:29 +0000
+Subject: sparc: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ]
+
+Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros").
+
+glibc-2.42 drops the legacy termio struct, but the ioctls.h header still
+defines some TC* constants in terms of termio (via sizeof). Hardcode the
+values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h
+index 7fd2f5873c9e7..a8bbdf9877a41 100644
+--- a/arch/sparc/include/uapi/asm/ioctls.h
++++ b/arch/sparc/include/uapi/asm/ioctls.h
+@@ -5,10 +5,10 @@
+ #include <asm/ioctl.h>
+
+ /* Big T */
+-#define TCGETA _IOR('T', 1, struct termio)
+-#define TCSETA _IOW('T', 2, struct termio)
+-#define TCSETAW _IOW('T', 3, struct termio)
+-#define TCSETAF _IOW('T', 4, struct termio)
++#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */
++#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */
++#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */
++#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */
+ #define TCSBRK _IO('T', 5)
+ #define TCXONC _IO('T', 6)
+ #define TCFLSH _IO('T', 7)
+--
+2.51.0
+
--- /dev/null
+From 111943969e7629851b38dfef7ed33d752f36f2db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jan 2026 15:47:52 +0100
+Subject: sparc: Synchronize user stack on fork and clone
+
+From: Andreas Larsson <andreas@gaisler.com>
+
+[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ]
+
+Flush all uncommitted user windows before calling the generic syscall
+handlers for clone, fork, and vfork.
+
+Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the
+arch-specific syscall wrappers for these syscalls will attempt to flush
+all windows (including user windows).
+
+In the window overflow trap handlers on both SPARC{32|64},
+if the window can't be stored (i.e due to MMU related faults) the routine
+backups the user window and increments a thread counter (wsaved).
+
+By adding a synchronization point after the flush attempt, when fault
+handling is enabled, any uncommitted user windows will be flushed.
+
+Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394
+Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++--------------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
+index 0442ab00518d3..7d69877511fac 100644
+--- a/arch/sparc/kernel/process.c
++++ b/arch/sparc/kernel/process.c
+@@ -17,14 +17,18 @@
+
+ asmlinkage long sparc_fork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+ struct kernel_clone_args args = {
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs)
+
+ asmlinkage long sparc_vfork(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
++ unsigned long orig_i1;
+ long ret;
+-
+ struct kernel_clone_args args = {
+ .flags = CLONE_VFORK | CLONE_VM,
+ .exit_signal = SIGCHLD,
+- /* Reuse the parent's stack for the child. */
+- .stack = regs->u_regs[UREG_FP],
+ };
+
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ /* Reuse the parent's stack for the child. */
++ args.stack = regs->u_regs[UREG_FP];
++
+ ret = kernel_clone(&args);
+
+ /* If we get an error and potentially restart the system
+@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs)
+
+ asmlinkage long sparc_clone(struct pt_regs *regs)
+ {
+- unsigned long orig_i1 = regs->u_regs[UREG_I1];
+- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ unsigned long orig_i1;
++ unsigned int flags;
+ long ret;
++ struct kernel_clone_args args = {0};
+
+- struct kernel_clone_args args = {
+- .flags = (flags & ~CSIGNAL),
+- .exit_signal = (flags & CSIGNAL),
+- .tls = regs->u_regs[UREG_I3],
+- };
++ synchronize_user_stack();
++
++ orig_i1 = regs->u_regs[UREG_I1];
++ flags = lower_32_bits(regs->u_regs[UREG_I0]);
++ args.flags = (flags & ~CSIGNAL);
++ args.exit_signal = (flags & CSIGNAL);
++ args.tls = regs->u_regs[UREG_I3];
+
+ #ifdef CONFIG_COMPAT
+ if (test_thread_flag(TIF_32BIT)) {
+--
+2.51.0
+
--- /dev/null
+From 8c2c878fa0a8f6a2e9c0c15e869f8f3f98c629ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:01 -0500
+Subject: spi-geni-qcom: initialize mode related registers to 0
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ]
+
+setup_fifo_params assumes these will be zero, it won't write these
+registers if the initial mode is zero.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 6a3b41dbfa701..f163d724b43f1 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -710,6 +710,12 @@ static int spi_geni_init(struct spi_geni_master *mas)
+ case 0:
+ mas->cur_xfer_mode = GENI_SE_FIFO;
+ geni_se_select_mode(se, GENI_SE_FIFO);
++ /* setup_fifo_params assumes that these registers start with a zero value */
++ writel(0, se->base + SE_SPI_LOOPBACK);
++ writel(0, se->base + SE_SPI_DEMUX_SEL);
++ writel(0, se->base + SE_SPI_CPHA);
++ writel(0, se->base + SE_SPI_CPOL);
++ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV);
+ ret = 0;
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From 4166688480442d48cc21a4be95b039f9e6fa7934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:00 -0500
+Subject: spi-geni-qcom: use xfer->bits_per_word for can_dma()
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit fb2bbe3838728f572485706677590e4fc41eec5c ]
+
+mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word
+when can_dma() is called. Use the right value instead.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index f163d724b43f1..37a20652fd2e7 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -548,10 +548,10 @@ static u32 get_xfer_len_in_words(struct spi_transfer *xfer,
+ {
+ u32 len;
+
+- if (!(mas->cur_bits_per_word % MIN_WORD_LEN))
+- len = xfer->len * BITS_PER_BYTE / mas->cur_bits_per_word;
++ if (!(xfer->bits_per_word % MIN_WORD_LEN))
++ len = xfer->len * BITS_PER_BYTE / xfer->bits_per_word;
+ else
+- len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1);
++ len = xfer->len / (xfer->bits_per_word / BITS_PER_BYTE + 1);
+ len &= TRANS_LEN_MSK;
+
+ return len;
+@@ -571,7 +571,7 @@ static bool geni_can_dma(struct spi_controller *ctlr,
+ return true;
+
+ len = get_xfer_len_in_words(xfer, mas);
+- fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / mas->cur_bits_per_word;
++ fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / xfer->bits_per_word;
+
+ if (len > fifo_size)
+ return true;
+--
+2.51.0
+
--- /dev/null
+From beb02e829f7c743b8944084984d24ed4bc00bc54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 18:18:01 +0100
+Subject: spi: spi-mem: Limit octal DTR constraints to octal DTR situations
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9 ]
+
+In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is
+considered requiring a duplicated command opcode. This is wrong as this
+constraint only applies to octal DTR operations (8D-8D-8D).
+
+Narrow the application of this constraint to the concerned bus
+interface.
+
+Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2,
+4} would benefit from this check either as there is only in octal DTR
+mode that a single clock edge would be enough to transmit the full
+opcode.
+
+Make sure the constraint of expecting two bytes for the command is
+applied to the relevant bus interface.
+
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index c581aa5fbf7cf..e5c4da4c94557 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -175,8 +175,19 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,
+ if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16))
+ return false;
+
+- if (op->cmd.nbytes != 2)
+- return false;
++ /* Extra 8D-8D-8D limitations */
++ if (op->cmd.dtr && op->cmd.buswidth == 8) {
++ if (op->cmd.nbytes != 2)
++ return false;
++
++ if ((op->addr.nbytes % 2) ||
++ (op->dummy.nbytes % 2) ||
++ (op->data.nbytes % 2)) {
++ dev_err(&ctlr->dev,
++ "Even byte numbers not allowed in octal DTR operations\n");
++ return false;
++ }
++ }
+ } else {
+ if (op->cmd.nbytes != 1)
+ return false;
+--
+2.51.0
+
--- /dev/null
+From eafd26196a3f8944aa9ac218aa6a53f5355f2db8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jan 2026 20:30:04 +0800
+Subject: spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
+
+From: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+
+[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ]
+
+spi_mem_dirmap_create() may reconfigure controller-wide settings,
+which can interfere with concurrent transfers to other devices
+sharing the same SPI controller but using different chip selects.
+
+Wrap the ->dirmap_create() callback with spi_mem_access_start() and
+spi_mem_access_end() to serialize access and prevent cross-CS
+interference during dirmap creation.
+
+This patch has been verified on a setup where a SPI TPM is connected
+to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1
+of the same controller. Without this patch, spi_mem_dirmap_create()
+for the SPI NOR flash interferes with ongoing SPI TPM data transfers,
+resulting in failure to create the TPM device. This was tested on an
+ASPEED AST2700 EVB.
+
+Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index e5c4da4c94557..932992b06022b 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -601,9 +601,18 @@ spi_mem_dirmap_create(struct spi_mem *mem,
+
+ desc->mem = mem;
+ desc->info = *info;
+- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create)
++ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) {
++ ret = spi_mem_access_start(mem);
++ if (ret) {
++ kfree(desc);
++ return ERR_PTR(ret);
++ }
++
+ ret = ctlr->mem_ops->dirmap_create(desc);
+
++ spi_mem_access_end(mem);
++ }
++
+ if (ret) {
+ desc->nodirmap = true;
+ if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
+--
+2.51.0
+
--- /dev/null
+From 0e23ef8ef9eaf3bf03c29602fd125f481e191b7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 11:48:28 +0100
+Subject: spi: stm32: fix Overrun issue at < 8bpw
+
+From: Deepak Kumar <deepak.kumar01@st.com>
+
+[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ]
+
+When SPI communication is suspended by hardware automatically, it could
+happen that few bits of next frame are already clocked out due to
+internal synchronization delay.
+
+To achieve a safe suspension, we need to ensure that each word must be
+at least 8 SPI clock cycles long. That's why, if bpw is less than 8
+bits, we need to use midi to reach 8 SPI clock cycles at least.
+
+This will ensure that each word achieve safe suspension and prevent
+overrun condition.
+
+Signed-off-by: Deepak Kumar <deepak.kumar01@st.com>
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 211d9c76665bc..96ee0e8456f4c 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1507,11 +1507,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, u32 len)
+ cfg2_clrb |= STM32H7_SPI_CFG2_MIDI;
+ if ((len > 1) && (spi->cur_midi > 0)) {
+ u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed);
+- u32 midi = min_t(u32,
+- DIV_ROUND_UP(spi->cur_midi, sck_period_ns),
+- FIELD_GET(STM32H7_SPI_CFG2_MIDI,
+- STM32H7_SPI_CFG2_MIDI));
++ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns);
+
++ if ((spi->cur_bpw + midi) < 8)
++ midi = 8 - spi->cur_bpw;
++
++ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI));
+
+ dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n",
+ sck_period_ns, midi, midi * sck_period_ns);
+--
+2.51.0
+
--- /dev/null
+From e56ae32fc66f43966364e03469e9f1a0a0afa575 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 14:47:12 +0530
+Subject: staging: rtl8723bs: fix memory leak on failure path
+
+From: Diksha Kumari <dikshakdevgan@gmail.com>
+
+[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ]
+
+cfg80211_inform_bss_frame() may return NULL on failure. In that case,
+the allocated buffer 'buf' is not freed and the function returns early,
+leading to potential memory leak.
+Fix this by ensuring that 'buf' is freed on both success and failure paths.
+
+Signed-off-by: Diksha Kumari <dikshakdevgan@gmail.com>
+Reviewed-by: Mukesh Kumar Chaurasiya <mkchauras@linux.ibm.com>
+Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+index af155fca39b8c..f23aeb58d041d 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -316,9 +316,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl
+ len, notify_signal, GFP_ATOMIC);
+
+ if (unlikely(!bss))
+- goto exit;
++ goto free_buf;
+
+ cfg80211_put_bss(wiphy, bss);
++free_buf:
+ kfree(buf);
+
+ exit:
+--
+2.51.0
+
--- /dev/null
+From 963084e0b8a7b1614b732b033baa32ea3957906c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:27:28 +0800
+Subject: staging: rtl8723bs: fix missing status update on sdio_alloc_irq()
+ failure
+
+From: Liang Jie <liangjie@lixiang.com>
+
+[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ]
+
+The return value of sdio_alloc_irq() was not stored in status.
+If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds,
+status remains _SUCCESS and the error path skips resource cleanup,
+while rtw_drv_init() still returns success.
+
+Store the return value of sdio_alloc_irq() in status and reuse the
+existing error handling which relies on status.
+
+Reviewed-by: fanggeng <fanggeng@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+index 4904314845242..335e6002df70f 100644
+--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+@@ -380,7 +380,8 @@ static int rtw_drv_init(
+ if (status != _SUCCESS)
+ goto free_if1;
+
+- if (sdio_alloc_irq(dvobj) != _SUCCESS)
++ status = sdio_alloc_irq(dvobj);
++ if (status != _SUCCESS)
+ goto free_if1;
+
+ rtw_ndev_notifier_register();
+--
+2.51.0
+
--- /dev/null
+From 78bb128948593b0d8b229dc79a13eae3a4e74e87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Feb 2026 08:23:15 +0000
+Subject: thermal: int340x: Fix sysfs group leak on DLVR registration failure
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ]
+
+When DLVR sysfs group creation fails in proc_thermal_rfim_add(),
+the function returns immediately without cleaning up the FIVR group
+that may have been created earlier.
+
+Add proper error unwinding to remove the FIVR group before returning
+failure.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../thermal/intel/int340x_thermal/processor_thermal_rfim.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+index 546b70434004c..8bcac4adb9ece 100644
+--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+@@ -348,8 +348,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc
+
+ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DLVR) {
+ ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group);
+- if (ret)
++ if (ret) {
++ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR)
++ sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group);
+ return ret;
++ }
+ }
+
+ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) {
+--
+2.51.0
+
--- /dev/null
+From 4d258ce58fc2fcaaf05101d7d23bfde9a03f17cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 17:47:45 +0530
+Subject: tools/power cpupower: Reset errno before strtoull()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ]
+
+cpuidle_state_get_one_value() never cleared errno before calling
+strtoull(), so a prior ERANGE caused every cpuidle counter read to
+return zero. Reset errno to 0 before the conversion so each sysfs read
+is evaluated independently.
+
+Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index c15d0de12357f..e7b8c56638370 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -148,6 +148,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu,
+ if (len == 0)
+ return 0;
+
++ errno = 0;
+ value = strtoull(linebuf, &endp, 0);
+
+ if (endp == linebuf || errno == ERANGE)
+--
+2.51.0
+
--- /dev/null
+From 13ca0f679e4b4bfa428b6640bbe157b75479d5eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Feb 2026 23:48:10 -0800
+Subject: tracing: Fix false sharing in hwlat get_sample()
+
+From: Colin Lord <clord@mykolab.com>
+
+[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ]
+
+The get_sample() function in the hwlat tracer assumes the caller holds
+hwlat_data.lock, but this is not actually happening. The result is
+unprotected data access to hwlat_data, and in per-cpu mode can result in
+false sharing which may show up as false positive latency events.
+
+The specific case of false sharing observed was primarily between
+hwlat_data.sample_width and hwlat_data.count. These are separated by
+just 8B and are therefore likely to share a cache line. When one thread
+modifies count, the cache line is in a modified state so when other
+threads read sample_width in the main latency detection loop, they fetch
+the modified cache line. On some systems, the fetch itself may be slow
+enough to count as a latency event, which could set up a self
+reinforcing cycle of latency events as each event increments count which
+then causes more latency events, continuing the cycle.
+
+The other result of the unprotected data access is that hwlat_data.count
+can end up with duplicate or missed values, which was observed on some
+systems in testing.
+
+Convert hwlat_data.count to atomic64_t so it can be safely modified
+without locking, and prevent false sharing by pulling sample_width into
+a local variable.
+
+One system this was tested on was a dual socket server with 32 CPUs on
+each numa node. With settings of 1us threshold, 1000us width, and
+2000us window, this change reduced the number of latency events from
+500 per second down to approximately 1 event per minute. Some machines
+tested did not exhibit measurable latency from the false sharing.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com
+Signed-off-by: Colin Lord <clord@mykolab.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_hwlat.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
+index 3bd6071441ade..bc437b6ce8969 100644
+--- a/kernel/trace/trace_hwlat.c
++++ b/kernel/trace/trace_hwlat.c
+@@ -102,9 +102,9 @@ struct hwlat_sample {
+ /* keep the global state somewhere. */
+ static struct hwlat_data {
+
+- struct mutex lock; /* protect changes */
++ struct mutex lock; /* protect changes */
+
+- u64 count; /* total since reset */
++ atomic64_t count; /* total since reset */
+
+ u64 sample_window; /* total sampling window (on+off) */
+ u64 sample_width; /* active sampling portion of window */
+@@ -195,8 +195,7 @@ void trace_hwlat_callback(bool enter)
+ * get_sample - sample the CPU TSC and look for likely hardware latencies
+ *
+ * Used to repeatedly capture the CPU TSC (or similar), looking for potential
+- * hardware-induced latency. Called with interrupts disabled and with
+- * hwlat_data.lock held.
++ * hardware-induced latency. Called with interrupts disabled.
+ */
+ static int get_sample(void)
+ {
+@@ -206,6 +205,7 @@ static int get_sample(void)
+ time_type start, t1, t2, last_t2;
+ s64 diff, outer_diff, total, last_total = 0;
+ u64 sample = 0;
++ u64 sample_width = READ_ONCE(hwlat_data.sample_width);
+ u64 thresh = tracing_thresh;
+ u64 outer_sample = 0;
+ int ret = -1;
+@@ -269,7 +269,7 @@ static int get_sample(void)
+ if (diff > sample)
+ sample = diff; /* only want highest value */
+
+- } while (total <= hwlat_data.sample_width);
++ } while (total <= sample_width);
+
+ barrier(); /* finish the above in the view for NMIs */
+ trace_hwlat_callback_enabled = false;
+@@ -287,8 +287,7 @@ static int get_sample(void)
+ if (kdata->nmi_total_ts)
+ do_div(kdata->nmi_total_ts, NSEC_PER_USEC);
+
+- hwlat_data.count++;
+- s.seqnum = hwlat_data.count;
++ s.seqnum = atomic64_inc_return(&hwlat_data.count);
+ s.duration = sample;
+ s.outer_duration = outer_sample;
+ s.nmi_total_ts = kdata->nmi_total_ts;
+@@ -837,7 +836,7 @@ static int hwlat_tracer_init(struct trace_array *tr)
+
+ hwlat_trace = tr;
+
+- hwlat_data.count = 0;
++ atomic64_set(&hwlat_data.count, 0);
+ tr->max_latency = 0;
+ save_tracing_thresh = tracing_thresh;
+
+--
+2.51.0
+
--- /dev/null
+From d4bbfb7b0147bd5523e5e14e68c32834e8b7ad1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Dec 2025 17:48:48 +0000
+Subject: usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
+
+From: Benson Leung <bleung@chromium.org>
+
+[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ]
+
+ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated
+using whichever pdo is in the last position of the src_pdos array, presuming
+it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current
+helpers are used on that last pdo.
+
+However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and
+for PPS) may exist, and are always at the end of the array if they do.
+In the event one of these more advanced chargers are attached the helpers for
+fixed return mangled values.
+
+Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger
+with PPS support:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=13400000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=5790000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS
+APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect.
+
+Instead, enumerate through the src_pdos and filter just for Fixed PDOs for
+now, and find the one with the highest voltage and current respectively.
+
+After, from the same charger:
+POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_CHARGE_TYPE=Standard
+POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MIN=5000000
+POWER_SUPPLY_VOLTAGE_MAX=20000000
+POWER_SUPPLY_VOLTAGE_NOW=20000000
+POWER_SUPPLY_CURRENT_MAX=4000000
+POWER_SUPPLY_CURRENT_NOW=3250000
+
+Signed-off-by: Benson Leung <bleung@chromium.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c
+index c80c23d3384e8..3fc524190baf6 100644
+--- a/drivers/usb/typec/ucsi/psy.c
++++ b/drivers/usb/typec/ucsi/psy.c
+@@ -87,15 +87,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_voltage = 0;
+
+ switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_fixed_voltage(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_voltage = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_voltage = pdo_fixed_voltage(pdo) * 1000;
++ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage
++ : max_voltage;
+ }
++ val->intval = max_voltage;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0:
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+@@ -143,6 +148,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+ union power_supply_propval *val)
+ {
+ u32 pdo;
++ int max_current = 0;
+
+ if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) {
+ val->intval = 0;
+@@ -151,12 +157,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+
+ switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) {
+ case UCSI_CONSTAT_PWR_OPMODE_PD:
+- if (con->num_pdos > 0) {
+- pdo = con->src_pdos[con->num_pdos - 1];
+- val->intval = pdo_max_current(pdo) * 1000;
+- } else {
+- val->intval = 0;
++ for (int i = 0; i < con->num_pdos; i++) {
++ int pdo_current = 0;
++
++ pdo = con->src_pdos[i];
++ if (pdo_type(pdo) == PDO_TYPE_FIXED)
++ pdo_current = pdo_max_current(pdo) * 1000;
++ max_current = (pdo_current > max_current) ? pdo_current
++ : max_current;
+ }
++ val->intval = max_current;
+ break;
+ case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
+ val->intval = UCSI_TYPEC_1_5_CURRENT * 1000;
+--
+2.51.0
+
--- /dev/null
+From 2678ee24870ff0a5bba0d972424b5bdf231af258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 12:27:03 +0530
+Subject: vhost: fix caching attributes of MMIO regions by setting them
+ explicitly
+
+From: Kommula Shiva Shankar <kshankar@marvell.com>
+
+[ Upstream commit 5145b277309f3818e2db507f525d19ac3b910922 ]
+
+Explicitly set non-cached caching attributes for MMIO regions.
+Default write-back mode can cause CPU to cache device memory,
+causing invalid reads and unpredictable behavior.
+
+Invalid read and write issues were observed on ARM64 when mapping the
+notification area to userspace via mmap.
+
+Signed-off-by: Kommula Shiva Shankar <kshankar@marvell.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Message-Id: <20260102065703.656255-1-kshankar@marvell.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index c29a195a0175c..f4da76fa235ea 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -1424,6 +1424,7 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma)
+ if (vma->vm_end - vma->vm_start != notify.size)
+ return -ENOTSUPP;
+
++ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);
+ vma->vm_ops = &vhost_vdpa_vm_ops;
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 91be1b29c4bb7e3275b130a100a0d6eb7f423ec2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jan 2026 08:35:45 +0100
+Subject: virt: vbox: uapi: Mark inner unions in packed structs as packed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ]
+
+The unpacked unions within a packed struct generates alignment warnings
+on clang for 32-bit ARM:
+
+./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)'
+ and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed,
+ which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+ 239 | } u;
+ | ^
+
+./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to
+ 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
+ being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+
+With the recent changes to compile-test the UAPI headers in more cases,
+these warning in combination with CONFIG_WERROR breaks the build.
+
+Fix the warnings.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Tested-by: Nicolas Schier <nsc@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/vbox_vmmdev_types.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
+index f8a8d6b3c5219..436678d4fb24f 100644
+--- a/include/uapi/linux/vbox_vmmdev_types.h
++++ b/include/uapi/linux/vbox_vmmdev_types.h
+@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 {
+ /** Relative to the request header. */
+ __u32 offset;
+ } page_list;
+- } u;
++ } __packed u;
+ } __packed;
+ VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
+
+@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 {
+ union {
+ __u64 phys_addr;
+ __u64 linear_addr;
+- } u;
++ } __packed u;
+ } __packed pointer;
+ struct {
+ /** Size of the buffer described by the page list. */
+--
+2.51.0
+
--- /dev/null
+From 1587c10c52e00c6675c56a2f389ff235fc580955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Feb 2026 17:34:00 +0100
+Subject: vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ]
+
+The gcc-16.0.1 snapshot produces a false-positive warning that turns
+into a build failure with CONFIG_WERROR:
+
+In file included from arch/x86/include/asm/string.h:6,
+ from net/vmw_vsock/vmci_transport.c:10:
+In function 'vmci_transport_packet_init',
+ inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2:
+arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull]
+ 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy'
+net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
+ 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ | ^~~~~~
+
+This seems relatively harmless, and it so far the only instance of this
+warning I have found. The __vmci_transport_send_control_pkt function
+is called either with wait=NULL or with one of the type values that
+pass 'wait' into memcpy() here, but not from the same caller.
+
+Replacing the memcpy with a struct assignment is otherwise the same
+but avoids the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Bryan Tan <bryan-bt.tan@broadcom.com>
+Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 7eccd6708d664..aca3132689cf1 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt,
+
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
+ case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
+- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
++ pkt->u.wait = *wait;
+ break;
+
+ case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
+--
+2.51.0
+
--- /dev/null
+From 234735917b65564d577264b7623337332376649f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Nov 2025 22:24:33 +0200
+Subject: watchdog: imx7ulp_wdt: handle the nowayout option
+
+From: Oleksandr Suvorov <cryosay@gmail.com>
+
+[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ]
+
+The module parameter `nowayout` indicates whether the watchdog should ever
+be allowed to stop, but the driver currently ignores this option.
+
+Pass the `nowayout` parameter to the watchdog core by setting the
+WDOG_NO_WAY_OUT flag accordingly.
+
+Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/imx7ulp_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c
+index c703586c6e5f0..b6797845a48fb 100644
+--- a/drivers/watchdog/imx7ulp_wdt.c
++++ b/drivers/watchdog/imx7ulp_wdt.c
+@@ -342,6 +342,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev)
+ watchdog_stop_on_reboot(wdog);
+ watchdog_stop_on_unregister(wdog);
+ watchdog_set_drvdata(wdog, imx7ulp_wdt);
++ watchdog_set_nowayout(wdog, nowayout);
+
+ imx7ulp_wdt->hw = of_device_get_match_data(dev);
+ ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate);
+--
+2.51.0
+
--- /dev/null
+From e81507abddd3a390ae4b5697ae6c88210b9fc730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jan 2026 17:56:11 +0000
+Subject: wifi: ath10k: fix lock protection in
+ ath10k_wmi_event_peer_sta_ps_state_chg()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ]
+
+ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to
+assert that ar->data_lock should be held by the caller, but neither
+ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock
+before calling this function.
+
+The field arsta->peer_ps_state is documented as protected by
+ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable,
+ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock.
+
+Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update,
+and remove the lockdep_assert_held() to be aligned with new locking,
+following the pattern used by other WMI event handlers in the driver.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu
+[removed excess blank line]
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index c7c96d210061d..ee41f45b3426c 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5283,8 +5283,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ struct ath10k_sta *arsta;
+ u8 peer_addr[ETH_ALEN];
+
+- lockdep_assert_held(&ar->data_lock);
+-
+ ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data;
+ ether_addr_copy(peer_addr, ev->peer_macaddr.addr);
+
+@@ -5299,7 +5297,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
+ }
+
+ arsta = (struct ath10k_sta *)sta->drv_priv;
++ spin_lock_bh(&ar->data_lock);
+ arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state);
++ spin_unlock_bh(&ar->data_lock);
+
+ exit:
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From 6a1c5990b7bd3160e28dd38ffe3eb1413cc477b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Jan 2026 17:00:34 -0800
+Subject: wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
+
+From: Ross Vandegrift <ross@kallisti.us>
+
+[ Upstream commit 4015b1972763d7d513172276e51439f37e622a92 ]
+
+Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added
+to the appropriate quirk list. I've tested this patch on top of 6.18.2,
+it fixes the issue for me on 21D4
+
+Mark Pearson provided the other product IDs covering the second Z16 Gen1
+and both Z13 Gen1 identifiers. They share the same firmware, and folks
+in the bugzilla report do indeed see the problem on Z13.
+
+[1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196
+
+Signed-off-by: Ross Vandegrift <ross@kallisti.us>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Tested-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
+index 355424baeedde..9eb8887f84e7e 100644
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -789,6 +789,34 @@ static const struct dmi_system_id ath11k_pm_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "21F9"),
+ },
+ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z13 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D2"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z13 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D3"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z16 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D4"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = { /* Z16 G1 */
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21D5"),
++ },
++ },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 702f59b1e36a48e74841aa2db176c281b4801947 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 15:36:24 +0800
+Subject: wifi: ath12k: fix preferred hardware mode calculation
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 7f852de0003219c431a6f2ffd951fd82a4673660 ]
+
+For single pdev device like WCN7850/QCC2072, preferred_hw_mode is
+initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends
+supported modes to host, each mode is compared with the initial one
+and if the priority of the new mode is higher, update the parameter
+and store mode capability.
+
+For WCN7850, this does not result in issue, as one of the supported
+mode indeed has a higher priority. However the only available mode of
+QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the
+comparison, hence mode capability is not stored. Subsequently driver
+initialization fails.
+
+Fix it by accepting a mode with the same priority.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
+
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
+index 7e400a0e0eb11..fe920ecd25baf 100644
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
++++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -3804,7 +3804,7 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc,
+
+ pref = soc->wmi_ab.preferred_hw_mode;
+
+- if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) {
++ if (ath12k_hw_mode_pri_map[mode] <= ath12k_hw_mode_pri_map[pref]) {
+ svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps;
+ soc->wmi_ab.preferred_hw_mode = mode;
+ }
+--
+2.51.0
+
--- /dev/null
+From afe52c5c5a0613d1d05c380957e939060c910676 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:30:05 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il3945_store_measurement()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ]
+
+il3945_store_measurement() calls il3945_get_measurement() which internally
+calls il_send_cmd_sync() without holding il->mutex. However,
+il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that
+callers must hold this lock.
+
+Other sysfs store functions in the same file properly acquire the mutex:
+- il3945_store_flags() acquires mutex at 3945-mac.c:3110
+- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144
+
+Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call
+in the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 9eaf5ec133f9e..5d61cebbdc400 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3262,7 +3262,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
+
+ D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n",
+ type, params.channel, buf);
++ mutex_lock(&il->mutex);
+ il3945_get_measurement(il, ¶ms, type);
++ mutex_unlock(&il->mutex);
+
+ return count;
+ }
+--
+2.51.0
+
--- /dev/null
+From 734cbabd0e800442174b88ceeaa4138823d0431e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jan 2026 19:40:39 +0000
+Subject: wifi: iwlegacy: add missing mutex protection in
+ il4965_store_tx_power()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ]
+
+il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex.
+However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating
+that callers must hold this lock.
+
+All other callers of il_set_tx_power() properly acquire the mutex:
+- il_bg_scan_completed() acquires mutex at common.c:1683
+- il_mac_config() acquires mutex at common.c:5006
+- il3945_commit_rxon() and il4965_commit_rxon() are called via work
+ queues that hold the mutex (like il4965_bg_alive_start)
+
+Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in
+the sysfs store function to fix the missing lock protection.
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 75118e2406191..b345fa2256341 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4612,7 +4612,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr,
+ if (ret)
+ IL_INFO("%s is not in decimal form.\n", buf);
+ else {
++ mutex_lock(&il->mutex);
+ ret = il_set_tx_power(il, val, false);
++ mutex_unlock(&il->mutex);
+ if (ret)
+ IL_ERR("failed setting tx power (0x%08x).\n", ret);
+ else
+--
+2.51.0
+
--- /dev/null
+From 720eae6154ce7178d8753c5fb8ff99509290f21c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:02:15 +0200
+Subject: wifi: iwlwifi: mvm: check the validity of noa_len
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d ]
+
+Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using
+its value to determine the noa_len, which is later used for the NoA
+attribute.
+
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index 9c97691e60384..60472c89fca38 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -1722,6 +1722,20 @@ void iwl_mvm_probe_resp_data_notif(struct iwl_mvm *mvm,
+
+ mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
++ /*
++ * len_low should be 2 + n*13 (where n is the number of descriptors.
++ * 13 is the size of a NoA descriptor). We can have either one or two
++ * descriptors.
++ */
++ if (IWL_FW_CHECK(mvm, notif->noa_active &&
++ notif->noa_attr.len_low != 2 +
++ sizeof(struct ieee80211_p2p_noa_desc) &&
++ notif->noa_attr.len_low != 2 +
++ sizeof(struct ieee80211_p2p_noa_desc) * 2,
++ "Invalid noa_attr.len_low (%d)\n",
++ notif->noa_attr.len_low))
++ return;
++
+ new_data = kzalloc(sizeof(*new_data), GFP_KERNEL);
+ if (!new_data)
+ return;
+--
+2.51.0
+
--- /dev/null
+From b130a0faf3795c2e244c2df9588eeadca38b02ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Dec 2025 16:58:06 +0100
+Subject: wifi: libertas: fix WARNING in usb_tx_block
+
+From: Szymon Wilczek <swilczek.lx@gmail.com>
+
+[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ]
+
+The function usb_tx_block() submits cardp->tx_urb without ensuring that
+any previous transmission on this URB has completed. If a second call
+occurs while the URB is still active (e.g. during rapid firmware loading),
+usb_submit_urb() detects the active state and triggers a warning:
+'URB submitted while active'.
+
+Fix this by enforcing serialization: call usb_kill_urb() before
+submitting the new request. This ensures the URB is idle and safe to reuse.
+
+Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
+Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
+Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index 2240b4db8c036..d98c81539ba53 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb
+ goto tx_ret;
+ }
+
++ usb_kill_urb(cardp->tx_urb);
++
+ usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
+ usb_sndbulkpipe(cardp->udev,
+ cardp->ep_out),
+--
+2.51.0
+
--- /dev/null
+From 9a31f7f450b8ce10711f2bbee9ff7aabf64bae11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Nov 2025 16:50:31 +0200
+Subject: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ]
+
+rtw8822b_set_antenna() can be called from userspace when the chip is
+powered off. In that case a WARNING is triggered in
+rtw8822b_config_trx_mode() because trying to read the RF registers
+when the chip is powered off returns an unexpected value.
+
+Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when
+the chip is powered on.
+
+------------[ cut here ]------------
+write RF mode table fail
+WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1
+Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021
+RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
+Call Trace:
+ <TASK>
+ rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]
+ rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]
+ ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]
+ nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? netdev_run_todo+0x63/0x550
+ genl_family_rcv_msg_doit+0xfc/0x160
+ genl_rcv_msg+0x1aa/0x2b0
+ ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
+ ? __pfx_genl_rcv_msg+0x10/0x10
+ netlink_rcv_skb+0x59/0x110
+ genl_rcv+0x28/0x40
+ netlink_unicast+0x285/0x3c0
+ ? __alloc_skb+0xdb/0x1a0
+ netlink_sendmsg+0x20d/0x430
+ ____sys_sendmsg+0x39f/0x3d0
+ ? import_iovec+0x2f/0x40
+ ___sys_sendmsg+0x99/0xe0
+ ? refill_obj_stock+0x12e/0x240
+ __sys_sendmsg+0x8a/0xf0
+ do_syscall_64+0x81/0x970
+ ? do_syscall_64+0x81/0x970
+ ? ksys_read+0x73/0xf0
+ ? do_syscall_64+0x81/0x970
+ ? count_memcg_events+0xc2/0x190
+ ? handle_mm_fault+0x1d7/0x2d0
+ ? do_user_addr_fault+0x21a/0x690
+ ? exc_page_fault+0x7e/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+---[ end trace 0000000000000000 ]---
+
+Link: https://github.com/lwfinger/rtw88/issues/366
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+index 99318a82b43f4..e792d7c866991 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -1044,7 +1044,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev,
+ hal->antenna_tx = antenna_tx;
+ hal->antenna_rx = antenna_rx;
+
+- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags))
++ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 51fb0ddf164c7d829f381a0d78d0e82fdaa20552 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 23:09:37 +0500
+Subject: wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
+
+From: Roman Peshkichev <roman.peshkichev@gmail.com>
+
+[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ]
+
+The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter,
+while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf.
+In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0.
+
+The driver unconditionally wrote (dtim_period - 1) to
+REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This
+caused delays in broadcast/multicast traffic processing and issues with
+ad-hoc operation.
+
+Convert the function parameter to u8 to match ieee80211_bss_conf and avoid
+the underflow by writing 0 when dtim_period is 0.
+
+Link: https://github.com/lwfinger/rtw88/issues/406
+Signed-off-by: Roman Peshkichev <roman.peshkichev@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 4 ++--
+ drivers/net/wireless/realtek/rtw88/main.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index c7396ae9256b9..9a4c23163fba4 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -710,10 +710,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel)
+ }
+ EXPORT_SYMBOL(rtw_set_rx_freq_band);
+
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period)
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period)
+ {
+ rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE);
+- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1);
++ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0);
+ }
+
+ void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel,
+diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h
+index c42ef8294d59e..6e0e1c9c28f70 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -2154,7 +2154,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band)
+ }
+
+ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel);
+-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period);
++void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period);
+ void rtw_get_channel_params(struct cfg80211_chan_def *chandef,
+ struct rtw_channel_params *ch_param);
+ bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target);
+--
+2.51.0
+
--- /dev/null
+From c62c276fa26609d3b2d291bcdb0bb5f7fc0e6674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:32:04 +0800
+Subject: wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
+
+From: Hsiu-Ming Chang <cges30901@gmail.com>
+
+[ Upstream commit 77653c327e11c71c5363b18a53fbf2b92ed21da4 ]
+
+Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB
+Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105.
+
+Signed-off-by: Hsiu-Ming Chang <cges30901@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+index a019f4085e738..1f5af09aed99f 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+@@ -37,6 +37,8 @@ static const struct usb_device_id rtw_8821cu_id_table[] = {
+ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0105, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Mercusys */
+ {},
+ };
+ MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table);
+--
+2.51.0
+
--- /dev/null
+From c3120daa0cf23ee1d387a3fbabf757517d61fe0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jan 2026 16:50:35 +0800
+Subject: wifi: rtw89: pci: restore LDO setting after device resume
+
+From: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+
+[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ]
+
+The LDO (Low Dropout Regulator) setting is missing after suspend/resume
+in some platforms, and it will cause card loss. Therefore, reconfigure
+this setting to avoid it.
+
+Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
+index 33b2543ee4d23..1ac5d021893d3 100644
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -3856,6 +3856,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev)
+ rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1,
+ B_AX_SEL_REQ_ENTR_L1);
+ }
++ rtw89_pci_hci_ldo(rtwdev);
+ rtw89_pci_l2_hci_ldo(rtwdev);
+ rtw89_pci_filter_out(rtwdev);
+ rtw89_pci_link_cfg(rtwdev);
+--
+2.51.0
+
--- /dev/null
+From aa4a2281e121f185b668f485d031c23fa4d6610d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 10:20:13 +0800
+Subject: wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
+
+From: Chin-Yen Lee <timlee@realtek.com>
+
+[ Upstream commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b ]
+
+Some APs disconnect clients by sending a Disassociation frame
+rather than a Deauthentication frame. Since these frames use
+different reason codes in WoWLAN mode, this commit adds support
+for handling Disassociation to prevent missed disconnection events.
+
+Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/wow.c | 4 ++++
+ drivers/net/wireless/realtek/rtw89/wow.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
+index aa9efca040253..f558df21a2fd0 100644
+--- a/drivers/net/wireless/realtek/rtw89/wow.c
++++ b/drivers/net/wireless/realtek/rtw89/wow.c
+@@ -100,6 +100,10 @@ static void rtw89_wow_show_wakeup_reason(struct rtw89_dev *rtwdev)
+ reason = rtw89_read8(rtwdev, wow_reason_reg);
+
+ switch (reason) {
++ case RTW89_WOW_RSN_RX_DISASSOC:
++ wakeup.disconnect = true;
++ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx disassoc\n");
++ break;
+ case RTW89_WOW_RSN_RX_DEAUTH:
+ wakeup.disconnect = true;
+ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx deauth\n");
+diff --git a/drivers/net/wireless/realtek/rtw89/wow.h b/drivers/net/wireless/realtek/rtw89/wow.h
+index a2f7b2e3cdb4d..fd85772ccb04e 100644
+--- a/drivers/net/wireless/realtek/rtw89/wow.h
++++ b/drivers/net/wireless/realtek/rtw89/wow.h
+@@ -8,6 +8,7 @@
+ enum rtw89_wake_reason {
+ RTW89_WOW_RSN_RX_PTK_REKEY = 0x1,
+ RTW89_WOW_RSN_RX_GTK_REKEY = 0x2,
++ RTW89_WOW_RSN_RX_DISASSOC = 0x4,
+ RTW89_WOW_RSN_RX_DEAUTH = 0x8,
+ RTW89_WOW_RSN_DISCONNECT = 0x10,
+ RTW89_WOW_RSN_RX_MAGIC_PKT = 0x21,
+--
+2.51.0
+
--- /dev/null
+From 9ef87f7884fba99ff7ea857068154235f21ec8f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 12:00:08 +0800
+Subject: x86/xen/pvh: Enable PAE mode for 32-bit guest only when
+ CONFIG_X86_PAE is set
+
+From: Hou Wenlong <houwenlong.hwl@antgroup.com>
+
+[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ]
+
+The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests
+do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds
+different pagetables depending on whether CONFIG_X86_PAE is set.
+Therefore, enabling PAE mode for 32-bit KVM guests without
+CONFIG_X86_PAE being set would result in a boot failure during CR3
+loading.
+
+Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <d09ce9a134eb9cbc16928a5b316969f8ba606b81.1768017442.git.houwenlong.hwl@antgroup.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/pvh/head.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
+index fc46b4dfbd747..10deae1a30c65 100644
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -70,10 +70,12 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
+
+ mov $_pa(early_stack_end), %esp
+
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ /* Enable PAE mode. */
+ mov %cr4, %eax
+ orl $X86_CR4_PAE, %eax
+ mov %eax, %cr4
++#endif
+
+ #ifdef CONFIG_X86_64
+ /* Enable Long mode. */
+--
+2.51.0
+
--- /dev/null
+From 493a15c1c8c4714d8a905afb416b5bb77ac2a09c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 17:47:29 -0500
+Subject: xenbus: Use .freeze/.thaw to handle xenbus devices
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ]
+
+The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming
+from s3 or s2idle disconnects its PV devices during resume. The
+backends are not expecting this and do not reconnect.
+
+b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/
+resume/chkpt") changed xen_suspend()/do_suspend() from
+PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the
+suspend/resume callbacks remained.
+
+.freeze/restore are used with hiberation where Linux restarts in a new
+place in the future. .suspend/resume are useful for runtime power
+management for the duration of a boot.
+
+The current behavior of the callbacks works for an xl save/restore or
+live migration where the domain is restored/migrated to a new location
+and connecting to a not-already-connected backend.
+
+Change xenbus_pm_ops to use .freeze/thaw/restore and drop the
+.suspend/resume hook. This matches the use in drivers/xen/manage.c for
+save/restore and live migration. With .suspend/resume empty, PV devices
+are left connected during s2idle and s3, so PV devices are not changed
+and work after resume.
+
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Acked-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index fcb335bb7b187..1fdf5be193430 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev)
+ }
+
+ static const struct dev_pm_ops xenbus_pm_ops = {
+- .suspend = xenbus_dev_suspend,
+- .resume = xenbus_frontend_dev_resume,
+ .freeze = xenbus_dev_suspend,
+ .thaw = xenbus_dev_cancel,
+- .restore = xenbus_dev_resume,
++ .restore = xenbus_frontend_dev_resume,
+ };
+
+ static struct xen_bus_type xenbus_frontend = {
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
