--- /dev/null
+From 69314b68f9b8067ce64ca0290be43772c384e415 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 338e1f44906a9..0ecc47e273140 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -635,6 +635,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"),
+ },
+ },
++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++ {
++ .callback = video_detect_force_native,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++ },
++ },
+ { },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 6d20d13f3510495c122944cce8bda2509f494bca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 13c67f58e9052..5a2081ee37f55 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ * Delete the operands on the previous walkstate operand stack
+ * (they were copied to new objects)
+ */
+- for (i = 0; i < obj_desc->method.param_count; i++) {
+- acpi_ut_remove_reference(this_walk_state->operands[i]);
+- this_walk_state->operands[i] = NULL;
+- }
+-
+- /* Clear the operand stack */
+-
+- this_walk_state->num_operands = 0;
++ acpi_ds_clear_operands(this_walk_state);
+
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+--
+2.51.0
+
--- /dev/null
+From 800775bf32b667402d0dcc8c771df04aa8da2b94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index fb98440c0bd4c..325512148c7b8 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -315,6 +315,8 @@ static inline __attribute__ ((const)) int fls(unsigned long x)
+ */
+ static inline __attribute__ ((const)) int __fls(unsigned long x)
+ {
++ if (__builtin_constant_p(x))
++ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ /* FLS insn has exactly same semantics as the API */
+ return __builtin_arc_fls(x);
+ }
+--
+2.51.0
+
--- /dev/null
+From 8c5e8851db1991a9c4069e11dbe516f4fcfa27dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index e3aca0dc7d9c6..f97b0f1a4eab2 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1031,7 +1031,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ u32 pass, void *image)
+ {
+- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ proglen, pass, image, current->comm, task_pid_nr(current));
+
+ if (image)
+--
+2.51.0
+
--- /dev/null
+From ccf27983b5da8b099d4a913d28fd9071d48ed858 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 1a86a4e7e3443..d948ab2720a76 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+
+ static inline void pit_timer_enable(void)
+ {
+- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_timer_disable(void)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
++ writel(0, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_irq_acknowledge(void)
+ {
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+
+ static u64 notrace pit_read_sched_clock(void)
+ {
+- return ~__raw_readl(clksrc_base + PITCVAL);
++ return ~readl(clksrc_base + PITCVAL);
+ }
+
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ /* set the max load value and start the clock source counter */
+- __raw_writel(0, clksrc_base + PITTCTRL);
+- __raw_writel(~0UL, clksrc_base + PITLDVAL);
+- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++ writel(0, clksrc_base + PITTCTRL);
++ writel(~0UL, clksrc_base + PITLDVAL);
++ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+
+ sched_clock_register(pit_read_sched_clock, 32, rate);
+ return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ * hardware requirement.
+ */
+ pit_timer_disable();
+- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
++ writel(delta - 1, clkevt_base + PITLDVAL);
+ pit_timer_enable();
+
+ return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(0, clkevt_base + PITTCTRL);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+
+ BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ cycle_per_jiffy = clk_rate / (HZ);
+
+ /* enable the pit module */
+- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++ writel(~PITMCR_MDIS, timer_base + PITMCR);
+
+ ret = pit_clocksource_init(clk_rate);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From fda9e8248bb61793e40923ed1b5e1fd2e1a38272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index 182a4dbca0952..7197b0daabea2 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -955,6 +955,9 @@ static void __exit longhaul_exit(void)
+ struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ int i;
+
++ if (unlikely(!policy))
++ return;
++
+ for (i = 0; i < numscales; i++) {
+ if (mults[i] == maxmult) {
+ struct cpufreq_freqs freqs;
+--
+2.51.0
+
--- /dev/null
+From f3bd740e5d9284de9bba34773f4f30c10288cd16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 83af15f77f66f..1c1fa6ac9244a 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -576,8 +576,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++ unsigned int cpu = dev->cpu;
+ int i, ret;
+
++ if (per_cpu(cpuidle_devices, cpu)) {
++ pr_info("CPU%d: cpuidle device already registered\n", cpu);
++ return -EEXIST;
++ }
++
+ if (!try_module_get(drv->owner))
+ return -EINVAL;
+
+@@ -589,7 +595,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ }
+
+- per_cpu(cpuidle_devices, dev->cpu) = dev;
++ per_cpu(cpuidle_devices, cpu) = dev;
+ list_add(&dev->device_list, &cpuidle_detected_devices);
+
+ ret = cpuidle_coupled_register_device(dev);
+--
+2.51.0
+
--- /dev/null
+From 253c4265932236204fe197111cfe675b4f035e25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 10c7b6295b02e..9fb389fa17817 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1065,6 +1065,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ },
+ .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ },
++ {
++ .ident = "Dell OptiPlex 7040",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++ },
++ },
+ {
+ .ident = "Dell Precision",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 5c9b31446c5021ee481b8de9e1396315833b2c25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index b17deec1c5d4d..06c5087a439d7 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ msi_alloc_info_t *info = args;
+ struct v2m_data *v2m = NULL, *tmp;
+- int hwirq, offset, i, err = 0;
++ int hwirq, i, err = 0;
++ unsigned long offset;
++ unsigned long align_mask = nr_irqs - 1;
+
+ spin_lock(&v2m_lock);
+ list_for_each_entry(tmp, &v2m_nodes, entry) {
+- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+- get_count_order(nr_irqs));
+- if (offset >= 0) {
++ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++ nr_irqs, align_mask, align_off);
++ if (offset < tmp->nr_spis) {
+ v2m = tmp;
++ bitmap_set(v2m->bm, offset, nr_irqs);
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From e128e41bb7a24fb77d80f8e4a374bb7c4f296198 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index e24ab362e51a9..7b8483f8d6f4f 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -369,7 +369,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ card->next_request = h_memstick_set_rw_addr;
+ memstick_new_req(card->host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ return card->current_mrq.error;
+ }
+@@ -403,7 +405,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+
+ card->next_request = h_memstick_read_dev_id;
+ memstick_new_req(host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ if (card->current_mrq.error)
+ goto err_out;
+--
+2.51.0
+
--- /dev/null
+From ae38d08f4ed324ec099e4d1e2c1323093c5fdac8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index 3419814d016b5..6e6a466c7d8c9 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ DA9063_PAGE_SEL_BUF_SIZE,
+ };
+
++enum da9063_page_sel_msgs {
++ DA9063_PAGE_SEL_MSG = 0,
++ DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+- DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+- DA9063_PAGED_READ_MSG_REG_SEL,
++ DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ DA9063_PAGED_READ_MSG_DATA,
+ DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ (page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+
+ /* Write reg address, page selection */
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++ xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++ xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++ xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++ xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++ ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++ if (ret < 0) {
++ dev_err(&client->dev, "Page switch failed: %d\n", ret);
++ return ret;
++ }
++
++ if (ret != DA9063_PAGE_SEL_CNT) {
++ dev_err(&client->dev, "Page switch failed to complete\n");
++ return -EIO;
++ }
+
+ /* Select register address */
+ xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+--
+2.51.0
+
--- /dev/null
+From 2ea5be1e18a5ee8cd2e1f824f69917581558b805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+ 739 | mfd_devs, n_devs,
+ | ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+ 459 | const struct mfd_cell *mfd_devs;
+ | ^
+ | = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index 4ed6ad8ce0020..e3b7048de0c66 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -436,7 +436,7 @@ int madera_dev_init(struct madera *madera)
+ struct device *dev = madera->dev;
+ unsigned int hwid;
+ int (*patch_fn)(struct madera *) = NULL;
+- const struct mfd_cell *mfd_devs;
++ const struct mfd_cell *mfd_devs = NULL;
+ int n_devs = 0;
+ int i, ret;
+
+@@ -642,7 +642,7 @@ int madera_dev_init(struct madera *madera)
+ goto err_reset;
+ }
+
+- if (!n_devs) {
++ if (!n_devs || !mfd_devs) {
+ dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ madera->type_name);
+ ret = -ENODEV;
+--
+2.51.0
+
--- /dev/null
+From 6c8fb400f3c37f19d85bb6137f45f000d6a57c16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index cd2f45257dc16..d52bb3ea7fb6f 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From 6ffe64c19ba673e332a324e2d816465d0df43c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 7f758fb60c1fa..70ca3fe4e99ee 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1494,6 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ int stmpe_remove(struct stmpe *stmpe)
+ {
++ if (stmpe->domain)
++ irq_domain_remove(stmpe->domain);
++
+ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+--
+2.51.0
+
--- /dev/null
+From f913b9d8adf90b6f9b24d6864cc81f9e4cc941ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock: 50000000 Hz
+actual clock: 200000000 Hz
+
+After the fix:
+clock: 50000000 Hz
+actual clock: 50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index a15b44ca87d35..c0acb309e3243 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -183,7 +183,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ clk &= ~0xff;
+ }
+
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++ clock = clk & CLK_CTL_DIV_MASK;
++ if (clock != 0xff)
++ host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ usleep_range(10000, 11000);
+
+--
+2.51.0
+
--- /dev/null
+From 427daae05ddd6e836f21fd755a0024bbace6db8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 183617d56b446..c900525b52516 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -78,6 +78,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH BIT(16)
+ #define CORE_HC_SELECT_IN_EN BIT(18)
++#define CORE_HC_SELECT_IN_SDR50 (4 << 19)
+ #define CORE_HC_SELECT_IN_HS400 (6 << 19)
+ #define CORE_HC_SELECT_IN_MASK (7 << 19)
+
+@@ -1113,6 +1114,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ struct mmc_ios *ios = &host->mmc->ios;
+
++ if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING)
++ return true;
++
+ /*
+ * Tuning is required for SDR104, HS200 and HS400 cards and
+ * if clock frequency is greater than 100MHz in these modes.
+@@ -1181,6 +1186,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ struct mmc_ios ios = host->mmc->ios;
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++ const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++ u32 config;
+
+ if (!sdhci_msm_is_tuning_needed(host)) {
+ msm_host->use_cdr = false;
+@@ -1197,6 +1204,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ */
+ msm_host->tuning_done = 0;
+
++ if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++ config &= ~CORE_HC_SELECT_IN_MASK;
++ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++ }
++
+ /*
+ * For HS400 tuning in HS200 timing requires:
+ * - select MCLK/2 in VENDOR_SPEC
+--
+2.51.0
+
--- /dev/null
+From abcdedf62ec36d28f5338ba04ea22d9537382149 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index f49e98c2e31db..635ec11c9a6fc 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3042,11 +3042,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+
+ ++ctrl->ctrl.nr_reconnects;
+
+- if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++ spin_lock_irqsave(&ctrl->rport->lock, flags);
++ if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENODEV;
++ }
+
+- if (nvme_fc_ctlr_active_on_rport(ctrl))
++ if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENOTUNIQ;
++ }
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+
+ dev_info(ctrl->ctrl.device,
+ "NVME-FC{%d}: create association : host wwpn 0x%016llx "
+--
+2.51.0
+
--- /dev/null
+From 9dc4f6267baf07f99821eb969ba76134e25e768d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 22fd7ebd5cf3f..9485737638b3c 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -586,8 +586,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+ case PIN_CONFIG_BIAS_PULL_UP:
+- if (arg)
++ if (arg) {
+ pcs_pinconf_clear_bias(pctldev, pin);
++ data = pcs->read(pcs->base + offset);
++ }
+ fallthrough;
+ case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ data &= ~func->conf[i].mask;
+--
+2.51.0
+
--- /dev/null
+From c215bfbcb81a7592b26fcb25b75ed5cd0fdfddd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index fb5fd6841ef39..d63878bc2d5f9 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -73,7 +73,7 @@ int main(int argc, char **argv)
+
+ /* Let's try detach it before it was ever attached */
+ ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+- if (ret != -1 || errno != ENOENT) {
++ if (ret != -ENOENT) {
+ printf("bpf_prog_detach2 not attached should fail: %m\n");
+ return 1;
+ }
+--
+2.51.0
+
x86-boot-compile-boot-code-with-std-gnu11-too.patch
arch-back-to-std-gnu89-in-v5.18.patch
tracing-fix-declaration-after-statement-warning.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
--- /dev/null
+From 6ad1a7d8decec911d3d92c00fa0f2d2ea07e6fa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index 28c19bcb2f205..d2d62d2b378b4 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -709,7 +709,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ if (IS_ERR_OR_NULL(ptable))
+ return SMEM_ITEM_COUNT;
+
+- info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ return SMEM_ITEM_COUNT;
+
+--
+2.51.0
+
--- /dev/null
+From 82accbe0ec50bce22a53065beef6d3fde7552bfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index c1aa7815bd6ec..f7f1a73a52f3a 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++ {
++ .name = "tsensor-cpu1",
++ .offset = 0x084,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu2",
++ .offset = 0x088,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-common",
++ .offset = 0x08c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu0",
++ .offset = 0x098,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "xusb-pad-calibration",
++ .offset = 0x0f0,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu3",
++ .offset = 0x12c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-gpu",
++ .offset = 0x154,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem0",
++ .offset = 0x158,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem1",
++ .offset = 0x15c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-pllx",
++ .offset = 0x160,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ },
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++ {
++ .nvmem_name = "fuse",
++ .cell_name = "xusb-pad-calibration",
++ .dev_id = "7009f000.padctl",
++ .con_id = "calibration",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-common",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "common",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu2",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu2",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu3",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu3",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-gpu",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "gpu",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-pllx",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "pllx",
++ },
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ .read = tegra30_fuse_read,
+ .size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ .init = tegra30_fuse_init,
+ .speedo_init = tegra114_init_speedo_data,
+ .info = &tegra114_fuse_info,
++ .lookups = tegra114_fuse_lookups,
++ .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++ .cells = tegra114_fuse_cells,
++ .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ .soc_attr_group = &tegra_soc_attr_group,
+ };
+ #endif
+--
+2.51.0
+
--- /dev/null
+From d0b5a0c160b3b47449523a25b05e8b537a223ec1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index 30695172a508f..bf2ba4c8595ba 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -229,7 +229,7 @@ static int pruss_probe(struct platform_device *pdev)
+ pruss->mem_regions[i].pa = res.start;
+ pruss->mem_regions[i].size = resource_size(&res);
+
+- dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++ dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ mem_names[i], &pruss->mem_regions[i].pa,
+ pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ }
+--
+2.51.0
+
--- /dev/null
+From e4fad11809f45b66a6b3608d4ba1994f3cb80795 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 89fccb9da1b8e..556118c931092 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -409,7 +409,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ int i;
+ u8 b;
+
+- dev_info(&spi->dev, " spi_msg@%pK\n", msg);
++ dev_info(&spi->dev, " spi_msg@%p\n", msg);
+ if (msg->status)
+ dev_info(&spi->dev, " status: %i\n",
+ msg->status);
+@@ -419,15 +419,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ msg->actual_length);
+
+ list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer);
++ dev_info(&spi->dev, " spi_transfer@%p\n", xfer);
+ dev_info(&spi->dev, " len: %i\n", xfer->len);
+- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf);
++ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf);
+ if (dump_data && xfer->tx_buf)
+ spi_test_print_hex_dump(" TX: ",
+ xfer->tx_buf,
+ xfer->len);
+
+- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf);
++ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf);
+ if (dump_data && xfer->rx_buf)
+ spi_test_print_hex_dump(" RX: ",
+ xfer->rx_buf,
+@@ -521,7 +521,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ /* if still not found then something has modified too much */
+ /* we could list the "closest" transfer here... */
+ dev_err(&spi->dev,
+- "loopback strangeness - rx changed outside of allowed range at: %pK\n",
++ "loopback strangeness - rx changed outside of allowed range at: %p\n",
+ addr);
+ /* do not return, only set ret,
+ * so that we list all addresses
+@@ -659,7 +659,7 @@ static int spi_test_translate(struct spi_device *spi,
+ }
+
+ dev_err(&spi->dev,
+- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ *ptr, *ptr + len,
+ RX(0), RX(SPI_TEST_MAX_SIZE),
+ TX(0), TX(SPI_TEST_MAX_SIZE));
+--
+2.51.0
+
--- /dev/null
+From 6a6fbacc3e4074db474464c8963c953097e5eed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index e6de0e80b793e..7f205464a0c7a 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -894,7 +894,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+
+ if (!teedesc || !teedesc->name || !teedesc->ops ||
+ !teedesc->ops->get_version || !teedesc->ops->open ||
+- !teedesc->ops->release || !pool)
++ !teedesc->ops->release)
+ return ERR_PTR(-EINVAL);
+
+ teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From 9c460523092b3edc5a8dc24a3dc63d64a5396363 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ char value[SYSFS_PATH_MAX];
+ int bytes_written;
++ int len;
+
+ if (cpuidle_state_count(cpu) <= idlestate)
+ return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ idlestate_value_files[IDLESTATE_DISABLE]))
+ return -2;
+
+- snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+
+ bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+- value, sizeof(disable));
++ value, len);
+ if (bytes_written)
+ return 0;
+ return -3;
+--
+2.51.0
+
--- /dev/null
+From 46a21cc85c2ab03f7a96945c4b6d24b7086833ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 60917e32ec853..5c93546fc689b 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1077,13 +1077,18 @@ int update_hwp_request_pkg(int pkg)
+
+ int enable_hwp_on_cpu(int cpu)
+ {
+- unsigned long long msr;
++ unsigned long long old_msr, new_msr;
++
++ get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++ if (old_msr & 1)
++ return 0; /* already enabled */
+
+- get_msr(cpu, MSR_PM_ENABLE, &msr);
+- put_msr(cpu, MSR_PM_ENABLE, 1);
++ new_msr = old_msr | 1;
++ put_msr(cpu, MSR_PM_ENABLE, new_msr);
+
+ if (verbose)
+- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From deb1992ec0e164e7d893b5f1ad168c2e406f348a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 1c80aa498d543..60917e32ec853 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -627,7 +627,7 @@ void cmdline(int argc, char **argv)
+ */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+- FILE *filep = fopen(path, "r");
++ FILE *filep = fopen(path, mode);
+
+ if (!filep)
+ err(1, "%s: open failed", path);
+@@ -641,7 +641,7 @@ void err_on_hypervisor(void)
+ char *buffer;
+
+ /* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+- cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++ cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+
+ buffer = malloc(4096);
+ if (!buffer) {
+--
+2.51.0
+
--- /dev/null
+From 8f2b369f7f41640a65efe67dea393aaecba8b8ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 5c93546fc689b..702b5882cfce4 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -862,8 +863,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+ * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+ * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+ * so we don't have to touch that.)
+ */
+@@ -918,6 +921,8 @@ int update_sysfs(int cpu)
+ if (update_hwp_max)
+ update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+
++ hwp_limits_done_via_sysfs = 1;
++
+ return 0;
+ }
+
+@@ -996,10 +1001,10 @@ int update_hwp_request(int cpu)
+ if (debug)
+ print_hwp_request(cpu, &req, "old: ");
+
+- if (update_hwp_min)
++ if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ req.hwp_min = req_update.hwp_min;
+
+- if (update_hwp_max)
++ if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ req.hwp_max = req_update.hwp_max;
+
+ if (update_hwp_desired)
+--
+2.51.0
+
--- /dev/null
+From 2f7c8ec31c6a1b1c8381fd6016cba60eb19c1807 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 1ea2c1f311261..4f2a9fab8ae88 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2242,6 +2242,13 @@ static void handle_swbp(struct pt_regs *regs)
+
+ handler_chain(uprobe, regs);
+
++ /*
++ * If user decided to take execution elsewhere, it makes little sense
++ * to execute the original instruction, so let's skip it.
++ */
++ if (instruction_pointer(regs) != bp_vaddr)
++ goto out;
++
+ if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 7a013e7d31a953abaf4617293c35c9c99fab1325 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index e94932c69f540..80a4b12563c6f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -21,7 +21,7 @@
+ #define LP855X_DEVICE_CTRL 0x01
+ #define LP855X_EEPROM_START 0xA0
+ #define LP855X_EEPROM_END 0xA7
+-#define LP8556_EPROM_START 0xA0
++#define LP8556_EPROM_START 0x98
+ #define LP8556_EPROM_END 0xAF
+
+ /* LP8555/7 Registers */
+--
+2.51.0
+
--- /dev/null
+From bae91285ee30facfed50779a6f8f0278784df27f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index 6290ed84c5950..04228582a1f56 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -138,15 +138,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ th = &tm->handlers[cur_handler];
+
+ guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++ /*
++ * Print an error message if handler_address is NULL, the parse of VA also
++ * can be skipped.
++ */
++ if (unlikely(!handler_info->handler_address)) {
++ pr_info("Skipping handler with NULL address for GUID: %pUL",
++ (guid_t *)handler_info->handler_guid);
++ continue;
++ }
++
+ th->handler_addr =
+ (void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ /*
+- * Print a warning message if handler_addr is zero which is not expected to
+- * ever happen.
++ * Print a warning message and skip the parse of VA if handler_addr is zero
++ * which is not expected to ever happen.
+ */
+- if (unlikely(!th->handler_addr))
++ if (unlikely(!th->handler_addr)) {
+ pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ &th->guid, handler_info->handler_address);
++ continue;
++ }
+
+ th->static_data_buffer_addr =
+ efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+--
+2.51.0
+
--- /dev/null
+From 24d6c9d1c75a44cbcd6719bf71814241b93ac62a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 2393cd993b3cb..151c57c7bb3a4 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -789,6 +789,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ "PNP0D80", /* Windows-compatible System Power Management Controller */
+ "INT33BD", /* Intel Baytrail Mailbox Device */
++ "INTC10DE", /* Intel CVS LNL */
++ "INTC10E0", /* Intel CVS ARL */
+ "LATT2021", /* Lattice FW Update Client Driver */
+ NULL
+ };
+--
+2.51.0
+
--- /dev/null
+From 69ec1b6a3ef14be3fbb14cce11af568bd92151ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 338e1f44906a9..0ecc47e273140 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -635,6 +635,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"),
+ },
+ },
++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++ {
++ .callback = video_detect_force_native,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++ },
++ },
+ { },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 0aaf89578756821b2d1f5e65bd27dc8e3da1be3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 132ab74935be8..9aa7a24777e95 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ * Delete the operands on the previous walkstate operand stack
+ * (they were copied to new objects)
+ */
+- for (i = 0; i < obj_desc->method.param_count; i++) {
+- acpi_ut_remove_reference(this_walk_state->operands[i]);
+- this_walk_state->operands[i] = NULL;
+- }
+-
+- /* Clear the operand stack */
+-
+- this_walk_state->num_operands = 0;
++ acpi_ds_clear_operands(this_walk_state);
+
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+--
+2.51.0
+
--- /dev/null
+From 20029d42a9af020d13d4bf34f380224e1768acc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index a7daaf64ae344..ff4c0f3bae52c 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+ */
+ static inline __attribute__ ((const)) int __fls(unsigned long x)
+ {
++ if (__builtin_constant_p(x))
++ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ /* FLS insn has exactly same semantics as the API */
+ return __builtin_arc_fls(x);
+ }
+--
+2.51.0
+
--- /dev/null
+From eaa21f3135a63c626f5a2fcf649cfd2d8d0e5e8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 7d8294d0d7173..dc49c8eb00fd6 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1090,7 +1090,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ u32 pass, void *image)
+ {
+- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ proglen, pass, image, current->comm, task_pid_nr(current));
+
+ if (image)
+--
+2.51.0
+
--- /dev/null
+From 7af0d82659ed29925a02d667da369cfe53692993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+
+ static inline void pit_timer_enable(void)
+ {
+- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_timer_disable(void)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
++ writel(0, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_irq_acknowledge(void)
+ {
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+
+ static u64 notrace pit_read_sched_clock(void)
+ {
+- return ~__raw_readl(clksrc_base + PITCVAL);
++ return ~readl(clksrc_base + PITCVAL);
+ }
+
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ /* set the max load value and start the clock source counter */
+- __raw_writel(0, clksrc_base + PITTCTRL);
+- __raw_writel(~0UL, clksrc_base + PITLDVAL);
+- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++ writel(0, clksrc_base + PITTCTRL);
++ writel(~0UL, clksrc_base + PITLDVAL);
++ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+
+ sched_clock_register(pit_read_sched_clock, 32, rate);
+ return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ * hardware requirement.
+ */
+ pit_timer_disable();
+- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
++ writel(delta - 1, clkevt_base + PITLDVAL);
+ pit_timer_enable();
+
+ return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(0, clkevt_base + PITTCTRL);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+
+ BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ cycle_per_jiffy = clk_rate / (HZ);
+
+ /* enable the pit module */
+- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++ writel(~PITMCR_MDIS, timer_base + PITMCR);
+
+ ret = pit_clocksource_init(clk_rate);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From c0fb3b36e61c8757930f43f039e45d5b2628a57c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index c538a153ee828..f116a1d555490 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)
+ struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ int i;
+
++ if (unlikely(!policy))
++ return;
++
+ for (i = 0; i < numscales; i++) {
+ if (mults[i] == maxmult) {
+ struct cpufreq_freqs freqs;
+--
+2.51.0
+
--- /dev/null
+From 87cd54593cdee84f542a0cb6431f473ce137c1e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index ef2ea1b12cd84..e371d6972f8d9 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -597,8 +597,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++ unsigned int cpu = dev->cpu;
+ int i, ret;
+
++ if (per_cpu(cpuidle_devices, cpu)) {
++ pr_info("CPU%d: cpuidle device already registered\n", cpu);
++ return -EEXIST;
++ }
++
+ if (!try_module_get(drv->owner))
+ return -EINVAL;
+
+@@ -610,7 +616,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ }
+
+- per_cpu(cpuidle_devices, dev->cpu) = dev;
++ per_cpu(cpuidle_devices, cpu) = dev;
+ list_add(&dev->device_list, &cpuidle_detected_devices);
+
+ ret = cpuidle_coupled_register_device(dev);
+--
+2.51.0
+
--- /dev/null
+From bdb477dcab3b246438dfb8cf77473280fa8a80ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 597cbb4391bdc..ff0209c92a755 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1030,6 +1030,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ },
+ .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ },
++ {
++ .ident = "Dell OptiPlex 7040",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++ },
++ },
+ {
+ .ident = "Dell Precision",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 9ea044602b33b80354e0fd03abb805bdec2b1a44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index e35357c48b8e6..b2ef2ada4bfe2 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -15,6 +15,7 @@
+ #include <linux/mutex.h>
+ #include <linux/of_device.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+
+ /*
+ * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -30,8 +31,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC 0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC 0x14 /* RW */
+
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT 5
+
++#define SBTSI_TEMP_EXT_RANGE_ADJ 49000
++
+ #define SBTSI_TEMP_MIN 0
+ #define SBTSI_TEMP_MAX 255875
+
+@@ -39,6 +54,8 @@
+ struct sbtsi_data {
+ struct i2c_client *client;
+ struct mutex lock;
++ bool ext_range_mode;
++ bool read_order;
+ };
+
+ /*
+@@ -75,23 +92,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ struct sbtsi_data *data = dev_get_drvdata(dev);
+ s32 temp_int, temp_dec;
+- int err;
+
+ switch (attr) {
+ case hwmon_temp_input:
+- /*
+- * ReadOrder bit specifies the reading order of integer and
+- * decimal part of CPU temp for atomic reads. If bit == 0,
+- * reading integer part triggers latching of the decimal part,
+- * so integer part should be read first. If bit == 1, read
+- * order should be reversed.
+- */
+- err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+- if (err < 0)
+- return err;
+-
+ mutex_lock(&data->lock);
+- if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++ if (data->read_order) {
+ temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ } else {
+@@ -123,6 +128,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ return temp_dec;
+
+ *val = sbtsi_reg_to_mc(temp_int, temp_dec);
++ if (data->ext_range_mode)
++ *val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+
+ return 0;
+ }
+@@ -147,6 +154,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ return -EINVAL;
+ }
+
++ if (data->ext_range_mode)
++ val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+
+@@ -205,6 +214,7 @@ static int sbtsi_probe(struct i2c_client *client,
+ struct device *dev = &client->dev;
+ struct device *hwmon_dev;
+ struct sbtsi_data *data;
++ int err;
+
+ data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ if (!data)
+@@ -213,8 +223,14 @@ static int sbtsi_probe(struct i2c_client *client,
+ data->client = client;
+ mutex_init(&data->lock);
+
+- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+- NULL);
++ err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++ if (err < 0)
++ return err;
++ data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++ data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++ hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++ &sbtsi_chip_info, NULL);
+
+ return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From 57030f856f31de251641d7ec10dda376c07b9b2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index 9d99b19cd21b6..4d12f1b0a5394 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ msi_alloc_info_t *info = args;
+ struct v2m_data *v2m = NULL, *tmp;
+- int hwirq, offset, i, err = 0;
++ int hwirq, i, err = 0;
++ unsigned long offset;
++ unsigned long align_mask = nr_irqs - 1;
+
+ spin_lock(&v2m_lock);
+ list_for_each_entry(tmp, &v2m_nodes, entry) {
+- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+- get_count_order(nr_irqs));
+- if (offset >= 0) {
++ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++ nr_irqs, align_mask, align_off);
++ if (offset < tmp->nr_spis) {
+ v2m = tmp;
++ bitmap_set(v2m->bm, offset, nr_irqs);
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From dbd8544bbcb5da1f62385955841665556876d160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 9a2acf5c40143..fc9e6db3bb72b 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ card->next_request = h_memstick_set_rw_addr;
+ memstick_new_req(card->host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ return card->current_mrq.error;
+ }
+@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+
+ card->next_request = h_memstick_read_dev_id;
+ memstick_new_req(host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ if (card->current_mrq.error)
+ goto err_out;
+--
+2.51.0
+
--- /dev/null
+From 570f82fb17244cf627c5cc0942c792ff12f4d064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index 4b7f707b7952c..be7c2229d5510 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ DA9063_PAGE_SEL_BUF_SIZE,
+ };
+
++enum da9063_page_sel_msgs {
++ DA9063_PAGE_SEL_MSG = 0,
++ DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+- DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+- DA9063_PAGED_READ_MSG_REG_SEL,
++ DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ DA9063_PAGED_READ_MSG_DATA,
+ DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ (page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+
+ /* Write reg address, page selection */
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++ xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++ xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++ xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++ xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++ ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++ if (ret < 0) {
++ dev_err(&client->dev, "Page switch failed: %d\n", ret);
++ return ret;
++ }
++
++ if (ret != DA9063_PAGE_SEL_CNT) {
++ dev_err(&client->dev, "Page switch failed to complete\n");
++ return -EIO;
++ }
+
+ /* Select register address */
+ xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+--
+2.51.0
+
--- /dev/null
+From 7581698d304311406c972614aeb0e69b3cbf59b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+ 739 | mfd_devs, n_devs,
+ | ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+ 459 | const struct mfd_cell *mfd_devs;
+ | ^
+ | = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index a2abc0094def7..87797d77c9f0c 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -457,7 +457,7 @@ int madera_dev_init(struct madera *madera)
+ struct device *dev = madera->dev;
+ unsigned int hwid;
+ int (*patch_fn)(struct madera *) = NULL;
+- const struct mfd_cell *mfd_devs;
++ const struct mfd_cell *mfd_devs = NULL;
+ int n_devs = 0;
+ int i, ret;
+
+@@ -671,7 +671,7 @@ int madera_dev_init(struct madera *madera)
+ goto err_reset;
+ }
+
+- if (!n_devs) {
++ if (!n_devs || !mfd_devs) {
+ dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ madera->type_name);
+ ret = -ENODEV;
+--
+2.51.0
+
--- /dev/null
+From 912d4cf4db7459e3a722199b24edccb6394a5aaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index cd2f45257dc16..d52bb3ea7fb6f 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From d38e1c5525ba03e567e59d0192bda14aa545ad21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 743afbe4e99b7..0c4e49716ee1c 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1498,6 +1498,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ int stmpe_remove(struct stmpe *stmpe)
+ {
++ if (stmpe->domain)
++ irq_domain_remove(stmpe->domain);
++
+ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+--
+2.51.0
+
--- /dev/null
+From c0d4a79923ad0495fd4059ca6c484c0871e5fd17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock: 50000000 Hz
+actual clock: 200000000 Hz
+
+After the fix:
+clock: 50000000 Hz
+actual clock: 50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 9ea9bc250543f..2b5dc342d30ab 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -193,7 +193,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ clk &= ~0xff;
+ }
+
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++ clock = clk & CLK_CTL_DIV_MASK;
++ if (clock != 0xff)
++ host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ usleep_range(10000, 11000);
+
+--
+2.51.0
+
--- /dev/null
+From 113f07f6d78e6bfcac1b1b1a38c5b392be928bfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 8fb2ba20e221b..b4c785393be3c 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -79,6 +79,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH BIT(16)
+ #define CORE_HC_SELECT_IN_EN BIT(18)
++#define CORE_HC_SELECT_IN_SDR50 (4 << 19)
+ #define CORE_HC_SELECT_IN_HS400 (6 << 19)
+ #define CORE_HC_SELECT_IN_MASK (7 << 19)
+
+@@ -1129,6 +1130,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ struct mmc_ios *ios = &host->mmc->ios;
+
++ if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING)
++ return true;
++
+ /*
+ * Tuning is required for SDR104, HS200 and HS400 cards and
+ * if clock frequency is greater than 100MHz in these modes.
+@@ -1197,6 +1202,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ struct mmc_ios ios = host->mmc->ios;
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++ const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++ u32 config;
+
+ if (!sdhci_msm_is_tuning_needed(host)) {
+ msm_host->use_cdr = false;
+@@ -1213,6 +1220,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ */
+ msm_host->tuning_done = 0;
+
++ if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++ config &= ~CORE_HC_SELECT_IN_MASK;
++ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++ }
++
+ /*
+ * For HS400 tuning in HS200 timing requires:
+ * - select MCLK/2 in VENDOR_SPEC
+--
+2.51.0
+
--- /dev/null
+From 31e7bd053aa926ec61a247a3283889a5de1a557f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index ebe8c2f147a33..8a9cb7709b32d 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3039,11 +3039,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+
+ ++ctrl->ctrl.nr_reconnects;
+
+- if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++ spin_lock_irqsave(&ctrl->rport->lock, flags);
++ if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENODEV;
++ }
+
+- if (nvme_fc_ctlr_active_on_rport(ctrl))
++ if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENOTUNIQ;
++ }
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+
+ dev_info(ctrl->ctrl.device,
+ "NVME-FC{%d}: create association : host wwpn 0x%016llx "
+--
+2.51.0
+
--- /dev/null
+From 691183c54064b2c9a62a25bea856864c94c61697 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 4c4b528b89ebe..80e0dc60a9205 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++ int terminating;
++
++ terminating = atomic_xchg(&assoc->terminating, 1);
++
++ /* if already terminating, do nothing */
++ if (terminating)
++ return;
++
+ nvmet_fc_tgtport_get(assoc->tgtport);
+ if (!queue_work(nvmet_wq, &assoc->del_work))
+ nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ unsigned long flags;
+- int i, terminating;
+-
+- terminating = atomic_xchg(&assoc->terminating, 1);
+-
+- /* if already terminating, do nothing */
+- if (terminating)
+- return;
++ int i;
+
+ spin_lock_irqsave(&tgtport->lock, flags);
+ list_del_rcu(&assoc->a_list);
+--
+2.51.0
+
--- /dev/null
+From 6402554aec92ae39efe342a3ee6ef3d72f200582 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 28f3fabc72e30..a72911e8ea82d 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -588,8 +588,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+ case PIN_CONFIG_BIAS_PULL_UP:
+- if (arg)
++ if (arg) {
+ pcs_pinconf_clear_bias(pctldev, pin);
++ data = pcs->read(pcs->base + offset);
++ }
+ fallthrough;
+ case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ data &= ~func->conf[i].mask;
+--
+2.51.0
+
--- /dev/null
+From fa22995cd383bc4b01d7560e5fe184b943c81f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22
+[ 8.151974] Hardware name: ALE AMB (DT)
+[ 8.155828] Call trace:
+[ 8.158292] dump_backtrace+0x0/0x1d4
+[ 8.161960] show_stack+0x18/0x6c
+[ 8.165280] dump_stack+0xcc/0x128
+[ 8.168687] sysfs_warn_dup+0x60/0x7c
+[ 8.172353] sysfs_do_create_link_sd+0xf0/0x100
+[ 8.176886] sysfs_create_link+0x20/0x40
+[ 8.180816] device_add+0x270/0x7a4
+[ 8.184311] __power_supply_register+0x304/0x560
+[ 8.188930] devm_power_supply_register+0x54/0xa0
+[ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger]
+[ 8.198183] i2c_device_probe+0x2dc/0x2f4
+[ 8.202196] really_probe+0xf0/0x510
+[ 8.205774] driver_probe_device+0xfc/0x160
+[ 8.209960] device_driver_attach+0xc0/0xcc
+[ 8.214146] __driver_attach+0xc0/0x170
+[ 8.218002] bus_for_each_dev+0x74/0xd4
+[ 8.221862] driver_attach+0x24/0x30
+[ 8.225444] bus_add_driver+0x148/0x250
+[ 8.229283] driver_register+0x78/0x130
+[ 8.233140] i2c_register_driver+0x4c/0xe0
+[ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger]
+[ 8.242424] do_one_initcall+0x50/0x1b0
+[ 8.242434] do_init_module+0x44/0x230
+[ 8.242438] load_module+0x2200/0x27c0
+[ 8.242442] __do_sys_finit_module+0xa8/0x11c
+[ 8.242447] __arm64_sys_finit_module+0x20/0x30
+[ 8.242457] el0_svc_common.constprop.0+0x64/0x154
+[ 8.242464] do_el0_svc+0x24/0x8c
+[ 8.242474] el0_svc+0x10/0x20
+[ 8.242481] el0_sync_handler+0x108/0x114
+[ 8.242485] el0_sync+0x180/0x1c0
+[ 8.243847] sbs-charger 20-0009: Failed to register power supply
+[ 8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index bc927c0ddd343..7dfed22fbce3b 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+
+-static const struct power_supply_desc sbs_desc = {
+- .name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ .type = POWER_SUPPLY_TYPE_MAINS,
+ .properties = sbs_properties,
+ .num_properties = ARRAY_SIZE(sbs_properties),
+@@ -166,9 +165,20 @@ static int sbs_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+ struct power_supply_config psy_cfg = {};
++ struct power_supply_desc *sbs_desc;
+ struct sbs_info *chip;
+ int ret, val;
+
++ sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++ sizeof(*sbs_desc), GFP_KERNEL);
++ if (!sbs_desc)
++ return -ENOMEM;
++
++ sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++ dev_name(&client->dev));
++ if (!sbs_desc->name)
++ return -ENOMEM;
++
+ chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ if (!chip)
+ return -ENOMEM;
+@@ -192,7 +202,7 @@ static int sbs_probe(struct i2c_client *client,
+ return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ chip->last_state = val;
+
+- chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++ chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ if (IS_ERR(chip->power_supply))
+ return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ "Failed to register power supply\n");
+--
+2.51.0
+
--- /dev/null
+From 22c0b27982d77b5b79e57278d328f51c1ae08910 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index fb5fd6841ef39..d63878bc2d5f9 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -73,7 +73,7 @@ int main(int argc, char **argv)
+
+ /* Let's try detach it before it was ever attached */
+ ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+- if (ret != -1 || errno != ENOENT) {
++ if (ret != -ENOENT) {
+ printf("bpf_prog_detach2 not attached should fail: %m\n");
+ return 1;
+ }
+--
+2.51.0
+
x86-boot-compile-boot-code-with-std-gnu11-too.patch
arch-back-to-std-gnu89-in-v5.18.patch
revert-docs-process-howto-replace-c89-with-c11.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
--- /dev/null
+From 54d0b53249fa6fad9caa4d2690bdb62b0fb410f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ { "AST2620", 0x05010203 },
+ { "AST2605", 0x05030103 },
+ { "AST2625", 0x05030403 },
++ /* AST2700 */
++ { "AST2750", 0x06000003 },
++ { "AST2700", 0x06000103 },
++ { "AST2720", 0x06000203 },
+ };
+
+ static const char *siliconid_to_name(u32 siliconid)
+--
+2.51.0
+
--- /dev/null
+From 54bf9b87e3221bc62dd090e5e8679f7c532fadc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index 4fb5aeeb08439..ec01cae7ffc8a 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -710,7 +710,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ if (IS_ERR_OR_NULL(ptable))
+ return SMEM_ITEM_COUNT;
+
+- info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ return SMEM_ITEM_COUNT;
+
+--
+2.51.0
+
--- /dev/null
+From 8d4471231acb0d9c5c6eb78daf571ddc46c18428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index b071d433d74f8..bfc8d39ae9efd 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++ {
++ .name = "tsensor-cpu1",
++ .offset = 0x084,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu2",
++ .offset = 0x088,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-common",
++ .offset = 0x08c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu0",
++ .offset = 0x098,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "xusb-pad-calibration",
++ .offset = 0x0f0,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu3",
++ .offset = 0x12c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-gpu",
++ .offset = 0x154,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem0",
++ .offset = 0x158,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem1",
++ .offset = 0x15c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-pllx",
++ .offset = 0x160,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ },
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++ {
++ .nvmem_name = "fuse",
++ .cell_name = "xusb-pad-calibration",
++ .dev_id = "7009f000.padctl",
++ .con_id = "calibration",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-common",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "common",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu2",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu2",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu3",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu3",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-gpu",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "gpu",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-pllx",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "pllx",
++ },
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ .read = tegra30_fuse_read,
+ .size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ .init = tegra30_fuse_init,
+ .speedo_init = tegra114_init_speedo_data,
+ .info = &tegra114_fuse_info,
++ .lookups = tegra114_fuse_lookups,
++ .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++ .cells = tegra114_fuse_cells,
++ .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ .soc_attr_group = &tegra_soc_attr_group,
+ .clk_suspend_on = false,
+ };
+--
+2.51.0
+
--- /dev/null
+From 1e033b1b61704c0f6bf13e9dee04305145f0d6b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index b36779309e49b..84f992320c4d8 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -270,7 +270,7 @@ static int pruss_probe(struct platform_device *pdev)
+ pruss->mem_regions[i].pa = res.start;
+ pruss->mem_regions[i].size = resource_size(&res);
+
+- dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++ dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ mem_names[i], &pruss->mem_regions[i].pa,
+ pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ }
+--
+2.51.0
+
--- /dev/null
+From b4be84e5a172b158fdb56305515d3dfda06fcddf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 89fccb9da1b8e..556118c931092 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -409,7 +409,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ int i;
+ u8 b;
+
+- dev_info(&spi->dev, " spi_msg@%pK\n", msg);
++ dev_info(&spi->dev, " spi_msg@%p\n", msg);
+ if (msg->status)
+ dev_info(&spi->dev, " status: %i\n",
+ msg->status);
+@@ -419,15 +419,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ msg->actual_length);
+
+ list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer);
++ dev_info(&spi->dev, " spi_transfer@%p\n", xfer);
+ dev_info(&spi->dev, " len: %i\n", xfer->len);
+- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf);
++ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf);
+ if (dump_data && xfer->tx_buf)
+ spi_test_print_hex_dump(" TX: ",
+ xfer->tx_buf,
+ xfer->len);
+
+- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf);
++ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf);
+ if (dump_data && xfer->rx_buf)
+ spi_test_print_hex_dump(" RX: ",
+ xfer->rx_buf,
+@@ -521,7 +521,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ /* if still not found then something has modified too much */
+ /* we could list the "closest" transfer here... */
+ dev_err(&spi->dev,
+- "loopback strangeness - rx changed outside of allowed range at: %pK\n",
++ "loopback strangeness - rx changed outside of allowed range at: %p\n",
+ addr);
+ /* do not return, only set ret,
+ * so that we list all addresses
+@@ -659,7 +659,7 @@ static int spi_test_translate(struct spi_device *spi,
+ }
+
+ dev_err(&spi->dev,
+- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ *ptr, *ptr + len,
+ RX(0), RX(SPI_TEST_MAX_SIZE),
+ TX(0), TX(SPI_TEST_MAX_SIZE));
+--
+2.51.0
+
--- /dev/null
+From 05691b56d48374ab760b47e5c58b94524397e984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index a7e89c229fc51..f10089fadaf07 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -895,7 +895,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+
+ if (!teedesc || !teedesc->name || !teedesc->ops ||
+ !teedesc->ops->get_version || !teedesc->ops->open ||
+- !teedesc->ops->release || !pool)
++ !teedesc->ops->release)
+ return ERR_PTR(-EINVAL);
+
+ teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From e5b56d16ad9c7e5157c75a41b948b887a5550300 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 3f7d0c0c50676..0e29365e23a59 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -48,7 +48,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ if (numwritten < 1) {
+ perror(path);
+ close(fd);
+- return -1;
++ return 0;
+ }
+
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From 666989a9bae6ad66b987064e76ddf55c219d02ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ char value[SYSFS_PATH_MAX];
+ int bytes_written;
++ int len;
+
+ if (cpuidle_state_count(cpu) <= idlestate)
+ return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ idlestate_value_files[IDLESTATE_DISABLE]))
+ return -2;
+
+- snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+
+ bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+- value, sizeof(disable));
++ value, len);
+ if (bytes_written)
+ return 0;
+ return -3;
+--
+2.51.0
+
--- /dev/null
+From 30eaa2158130352a1278fbc70ebd732c11e082b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+
+ int enable_hwp_on_cpu(int cpu)
+ {
+- unsigned long long msr;
++ unsigned long long old_msr, new_msr;
++
++ get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++ if (old_msr & 1)
++ return 0; /* already enabled */
+
+- get_msr(cpu, MSR_PM_ENABLE, &msr);
+- put_msr(cpu, MSR_PM_ENABLE, 1);
++ new_msr = old_msr | 1;
++ put_msr(cpu, MSR_PM_ENABLE, new_msr);
+
+ if (verbose)
+- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 32552f05bd24a2ec526e433780a3b5c8f0c9f639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+ */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+- FILE *filep = fopen(path, "r");
++ FILE *filep = fopen(path, mode);
+
+ if (!filep)
+ err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ char *buffer;
+
+ /* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+- cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++ cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+
+ buffer = malloc(4096);
+ if (!buffer) {
+--
+2.51.0
+
--- /dev/null
+From 230bf30df838dc4c0ff22d1f7bdd98a7b02ace17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+ * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+ * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+ * so we don't have to touch that.)
+ */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ if (update_hwp_max)
+ update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+
++ hwp_limits_done_via_sysfs = 1;
++
+ return 0;
+ }
+
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ if (debug)
+ print_hwp_request(cpu, &req, "old: ");
+
+- if (update_hwp_min)
++ if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ req.hwp_min = req_update.hwp_min;
+
+- if (update_hwp_max)
++ if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ req.hwp_max = req_update.hwp_max;
+
+ if (update_hwp_desired)
+--
+2.51.0
+
--- /dev/null
+From 3a1e3fc1619d19dd4b3ebfca53705be5f7f31da9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index b37a6bde8a915..4e6ada6a11c7e 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2241,6 +2241,13 @@ static void handle_swbp(struct pt_regs *regs)
+
+ handler_chain(uprobe, regs);
+
++ /*
++ * If user decided to take execution elsewhere, it makes little sense
++ * to execute the original instruction, so let's skip it.
++ */
++ if (instruction_pointer(regs) != bp_vaddr)
++ goto out;
++
+ if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 5e01a89d74394ca1eeb01b6f9dc8ad11a0d49976 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index e94932c69f540..80a4b12563c6f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -21,7 +21,7 @@
+ #define LP855X_DEVICE_CTRL 0x01
+ #define LP855X_EEPROM_START 0xA0
+ #define LP855X_EEPROM_END 0xA7
+-#define LP8556_EPROM_START 0xA0
++#define LP8556_EPROM_START 0x98
+ #define LP8556_EPROM_END 0xAF
+
+ /* LP8555/7 Registers */
+--
+2.51.0
+
--- /dev/null
+From 069d465ae71ef51caa1af89491cbfc5550fbc9cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index be9c70806b620..640e3fecd62d0 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -556,6 +556,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"),
+ },
+ },
++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++ {
++ .callback = video_detect_force_native,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++ },
++ },
+ { },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 1e8720795b3be9684afa83415b8276e3c8be7e0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 203e9ee47fdb8..998bed6e54066 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ * Delete the operands on the previous walkstate operand stack
+ * (they were copied to new objects)
+ */
+- for (i = 0; i < obj_desc->method.param_count; i++) {
+- acpi_ut_remove_reference(this_walk_state->operands[i]);
+- this_walk_state->operands[i] = NULL;
+- }
+-
+- /* Clear the operand stack */
+-
+- this_walk_state->num_operands = 0;
++ acpi_ds_clear_operands(this_walk_state);
+
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+--
+2.51.0
+
--- /dev/null
+From e5d28a9341a807ee2025699db3319562d3e0dcea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 50eb3f64a77c3..7d6afe5cdb7ac 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -371,6 +371,8 @@ static inline __attribute__ ((const)) int fls(unsigned long x)
+ */
+ static inline __attribute__ ((const)) int __fls(unsigned long x)
+ {
++ if (__builtin_constant_p(x))
++ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ /* FLS insn has exactly same semantics as the API */
+ return __builtin_arc_fls(x);
+ }
+--
+2.51.0
+
--- /dev/null
+From 31c584e30ab4c6156863dd56f87a13490a9c36e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 0bec300b2e516..41ec70a74b2e0 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -980,7 +980,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ u32 pass, void *image)
+ {
+- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ proglen, pass, image, current->comm, task_pid_nr(current));
+
+ if (image)
+--
+2.51.0
+
--- /dev/null
+From 03af67533006266a69cbc342a36a47c0ab8d913f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index fef0bb4e0c8c3..c37afdfb477f0 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+
+ static inline void pit_timer_enable(void)
+ {
+- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_timer_disable(void)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
++ writel(0, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_irq_acknowledge(void)
+ {
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+
+ static u64 notrace pit_read_sched_clock(void)
+ {
+- return ~__raw_readl(clksrc_base + PITCVAL);
++ return ~readl(clksrc_base + PITCVAL);
+ }
+
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ /* set the max load value and start the clock source counter */
+- __raw_writel(0, clksrc_base + PITTCTRL);
+- __raw_writel(~0UL, clksrc_base + PITLDVAL);
+- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++ writel(0, clksrc_base + PITTCTRL);
++ writel(~0UL, clksrc_base + PITLDVAL);
++ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+
+ sched_clock_register(pit_read_sched_clock, 32, rate);
+ return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ * hardware requirement.
+ */
+ pit_timer_disable();
+- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
++ writel(delta - 1, clkevt_base + PITLDVAL);
+ pit_timer_enable();
+
+ return 0;
+@@ -132,8 +132,8 @@ static struct irqaction pit_timer_irq = {
+
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(0, clkevt_base + PITTCTRL);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+
+ BUG_ON(setup_irq(irq, &pit_timer_irq));
+
+@@ -189,7 +189,7 @@ static int __init pit_timer_init(struct device_node *np)
+ cycle_per_jiffy = clk_rate / (HZ);
+
+ /* enable the pit module */
+- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++ writel(~PITMCR_MDIS, timer_base + PITMCR);
+
+ ret = pit_clocksource_init(clk_rate);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From 8237e79d7662cf192b55296953a28ff9895a8761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index 92d92e67ae0a1..a9887011f1fa1 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -956,6 +956,9 @@ static void __exit longhaul_exit(void)
+ struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ int i;
+
++ if (unlikely(!policy))
++ return;
++
+ for (i = 0; i < numscales; i++) {
+ if (mults[i] == maxmult) {
+ struct cpufreq_freqs freqs;
+--
+2.51.0
+
--- /dev/null
+From 0a1f216893df27d1227239a3f612c2102a25c6db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 785e7a07bb291..51d0f5e88ebcf 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1016,6 +1016,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ },
+ .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ },
++ {
++ .ident = "Dell OptiPlex 7040",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++ },
++ },
+ {
+ .ident = "Dell Precision",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From c57fb31d421aabfa168c231068aa1a4f5f004cd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index 2468b285c77c2..1a209869b7f5b 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -178,14 +178,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ msi_alloc_info_t *info = args;
+ struct v2m_data *v2m = NULL, *tmp;
+- int hwirq, offset, i, err = 0;
++ int hwirq, i, err = 0;
++ unsigned long offset;
++ unsigned long align_mask = nr_irqs - 1;
+
+ spin_lock(&v2m_lock);
+ list_for_each_entry(tmp, &v2m_nodes, entry) {
+- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+- get_count_order(nr_irqs));
+- if (offset >= 0) {
++ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++ nr_irqs, align_mask, align_off);
++ if (offset < tmp->nr_spis) {
+ v2m = tmp;
++ bitmap_set(v2m->bm, offset, nr_irqs);
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From ed378ef33a0f415a9ce56656224a1c4c72da3b23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index e24ab362e51a9..7b8483f8d6f4f 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -369,7 +369,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ card->next_request = h_memstick_set_rw_addr;
+ memstick_new_req(card->host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ return card->current_mrq.error;
+ }
+@@ -403,7 +405,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+
+ card->next_request = h_memstick_read_dev_id;
+ memstick_new_req(host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ if (card->current_mrq.error)
+ goto err_out;
+--
+2.51.0
+
--- /dev/null
+From 3953639791c6ade0199f030793b23f157d6bf12d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+ 739 | mfd_devs, n_devs,
+ | ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+ 459 | const struct mfd_cell *mfd_devs;
+ | ^
+ | = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index 29540cbf75934..bfd116f5a58d0 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -431,7 +431,7 @@ int madera_dev_init(struct madera *madera)
+ struct device *dev = madera->dev;
+ unsigned int hwid;
+ int (*patch_fn)(struct madera *) = NULL;
+- const struct mfd_cell *mfd_devs;
++ const struct mfd_cell *mfd_devs = NULL;
+ int n_devs = 0;
+ int i, ret;
+
+@@ -616,7 +616,7 @@ int madera_dev_init(struct madera *madera)
+ goto err_reset;
+ }
+
+- if (!n_devs) {
++ if (!n_devs || !mfd_devs) {
+ dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ madera->type_name);
+ ret = -ENODEV;
+--
+2.51.0
+
--- /dev/null
+From a2942308d06b3cf5b9927b0eb6bc90967fbe9969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index cd2f45257dc16..d52bb3ea7fb6f 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From 75a6a273eb0cea252f0b1bb1f1c9b65ff7079109 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 7f758fb60c1fa..70ca3fe4e99ee 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1494,6 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ int stmpe_remove(struct stmpe *stmpe)
+ {
++ if (stmpe->domain)
++ irq_domain_remove(stmpe->domain);
++
+ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+--
+2.51.0
+
--- /dev/null
+From cf695cf3d89b83e1fb10ad40e5dac4eba4a20547 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock: 50000000 Hz
+actual clock: 200000000 Hz
+
+After the fix:
+clock: 50000000 Hz
+actual clock: 50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 23fd93407eced..0a79b718cf17c 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -185,7 +185,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ clk &= ~0xff;
+ }
+
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++ clock = clk & CLK_CTL_DIV_MASK;
++ if (clock != 0xff)
++ host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ usleep_range(10000, 11000);
+
+--
+2.51.0
+
--- /dev/null
+From 0f7d7a86d77d3c38a1e0899fc3ba84d992722b5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 5e6f6c951fd4e..23dda8b2b7f03 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -63,6 +63,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN (1 << 15)
+ #define CORE_IO_PAD_PWR_SWITCH (1 << 16)
+ #define CORE_HC_SELECT_IN_EN BIT(18)
++#define CORE_HC_SELECT_IN_SDR50 (4 << 19)
+ #define CORE_HC_SELECT_IN_HS400 (6 << 19)
+ #define CORE_HC_SELECT_IN_MASK (7 << 19)
+
+@@ -1034,6 +1035,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ struct mmc_ios *ios = &host->mmc->ios;
+
++ if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING)
++ return true;
++
+ /*
+ * Tuning is required for SDR104, HS200 and HS400 cards and
+ * if clock frequency is greater than 100MHz in these modes.
+@@ -1102,6 +1107,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ struct mmc_ios ios = host->mmc->ios;
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++ const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++ u32 config;
+
+ if (!sdhci_msm_is_tuning_needed(host)) {
+ msm_host->use_cdr = false;
+@@ -1118,6 +1125,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ */
+ msm_host->tuning_done = 0;
+
++ if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++ config &= ~CORE_HC_SELECT_IN_MASK;
++ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++ }
++
+ /*
+ * For HS400 tuning in HS200 timing requires:
+ * - select MCLK/2 in VENDOR_SPEC
+--
+2.51.0
+
--- /dev/null
+From 65e0e1cdce00d23745d49b6d017331a36bae202d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index fb5fd6841ef39..d63878bc2d5f9 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -73,7 +73,7 @@ int main(int argc, char **argv)
+
+ /* Let's try detach it before it was ever attached */
+ ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+- if (ret != -1 || errno != ENOENT) {
++ if (ret != -ENOENT) {
+ printf("bpf_prog_detach2 not attached should fail: %m\n");
+ return 1;
+ }
+--
+2.51.0
+
serial-8250_dw-use-devm_clk_get_optional-to-get-the-input-clock.patch
serial-8250_dw-use-devm_add_action_or_reset.patch
serial-8250_dw-handle-reset-control-deassert-error.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
--- /dev/null
+From f250d5ec745127e5085f61711754f10a03efdde1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index 28c19bcb2f205..d2d62d2b378b4 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -709,7 +709,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ if (IS_ERR_OR_NULL(ptable))
+ return SMEM_ITEM_COUNT;
+
+- info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ return SMEM_ITEM_COUNT;
+
+--
+2.51.0
+
--- /dev/null
+From dde373a8d6dffbc13ddf06900dad5203f20437ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 0f571ff132377..3edcb5bf59f79 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -403,7 +403,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ int i;
+ u8 b;
+
+- dev_info(&spi->dev, " spi_msg@%pK\n", msg);
++ dev_info(&spi->dev, " spi_msg@%p\n", msg);
+ if (msg->status)
+ dev_info(&spi->dev, " status: %i\n",
+ msg->status);
+@@ -413,15 +413,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ msg->actual_length);
+
+ list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer);
++ dev_info(&spi->dev, " spi_transfer@%p\n", xfer);
+ dev_info(&spi->dev, " len: %i\n", xfer->len);
+- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf);
++ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf);
+ if (dump_data && xfer->tx_buf)
+ spi_test_print_hex_dump(" TX: ",
+ xfer->tx_buf,
+ xfer->len);
+
+- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf);
++ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf);
+ if (dump_data && xfer->rx_buf)
+ spi_test_print_hex_dump(" RX: ",
+ xfer->rx_buf,
+@@ -514,7 +514,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ /* if still not found then something has modified too much */
+ /* we could list the "closest" transfer here... */
+ dev_err(&spi->dev,
+- "loopback strangeness - rx changed outside of allowed range at: %pK\n",
++ "loopback strangeness - rx changed outside of allowed range at: %p\n",
+ addr);
+ /* do not return, only set ret,
+ * so that we list all addresses
+@@ -652,7 +652,7 @@ static int spi_test_translate(struct spi_device *spi,
+ }
+
+ dev_err(&spi->dev,
+- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ *ptr, *ptr + len,
+ RX(0), RX(SPI_TEST_MAX_SIZE),
+ TX(0), TX(SPI_TEST_MAX_SIZE));
+--
+2.51.0
+
--- /dev/null
+From b3c6cd880835ef1a80238d4e40d5e65adccd0bc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index 357944bc73b19..28cbe4613ed91 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -722,7 +722,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+
+ if (!teedesc || !teedesc->name || !teedesc->ops ||
+ !teedesc->ops->get_version || !teedesc->ops->open ||
+- !teedesc->ops->release || !pool)
++ !teedesc->ops->release)
+ return ERR_PTR(-EINVAL);
+
+ teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From 14bd691a70c308564da24564d556739b9dc72a22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ char value[SYSFS_PATH_MAX];
+ int bytes_written;
++ int len;
+
+ if (cpuidle_state_count(cpu) <= idlestate)
+ return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ idlestate_value_files[IDLESTATE_DISABLE]))
+ return -2;
+
+- snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+
+ bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+- value, sizeof(disable));
++ value, len);
+ if (bytes_written)
+ return 0;
+ return -3;
+--
+2.51.0
+
--- /dev/null
+From 1bcdaf761ce66e497c355af141ada7ca9fcc23ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 165eb4da8a644..0cb17e13c002b 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1024,13 +1024,18 @@ int update_hwp_request_pkg(int pkg)
+
+ int enable_hwp_on_cpu(int cpu)
+ {
+- unsigned long long msr;
++ unsigned long long old_msr, new_msr;
++
++ get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++ if (old_msr & 1)
++ return 0; /* already enabled */
+
+- get_msr(cpu, MSR_PM_ENABLE, &msr);
+- put_msr(cpu, MSR_PM_ENABLE, 1);
++ new_msr = old_msr | 1;
++ put_msr(cpu, MSR_PM_ENABLE, new_msr);
+
+ if (verbose)
+- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From d2a9f888c59f1d9539fb5ccf8aead7182ad20b24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0cb17e13c002b..c878e2e1cabea 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -809,8 +810,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+ * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+ * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+ * so we don't have to touch that.)
+ */
+@@ -865,6 +868,8 @@ int update_sysfs(int cpu)
+ if (update_hwp_max)
+ update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+
++ hwp_limits_done_via_sysfs = 1;
++
+ return 0;
+ }
+
+@@ -943,10 +948,10 @@ int update_hwp_request(int cpu)
+ if (debug)
+ print_hwp_request(cpu, &req, "old: ");
+
+- if (update_hwp_min)
++ if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ req.hwp_min = req_update.hwp_min;
+
+- if (update_hwp_max)
++ if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ req.hwp_max = req_update.hwp_max;
+
+ if (update_hwp_desired)
+--
+2.51.0
+
--- /dev/null
+From f6513f0dc8e981ebdaba0e4899f1dfcbcd719b50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 6285674412f25..2b809bc849dd6 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2248,6 +2248,13 @@ static void handle_swbp(struct pt_regs *regs)
+
+ handler_chain(uprobe, regs);
+
++ /*
++ * If user decided to take execution elsewhere, it makes little sense
++ * to execute the original instruction, so let's skip it.
++ */
++ if (instruction_pointer(regs) != bp_vaddr)
++ goto out;
++
+ if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 8b96750acbdd77d46a59ef4e4701abe5664a9794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index e94932c69f540..80a4b12563c6f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -21,7 +21,7 @@
+ #define LP855X_DEVICE_CTRL 0x01
+ #define LP855X_EEPROM_START 0xA0
+ #define LP855X_EEPROM_END 0xA7
+-#define LP8556_EPROM_START 0xA0
++#define LP8556_EPROM_START 0x98
+ #define LP8556_EPROM_END 0xAF
+
+ /* LP8555/7 Registers */
+--
+2.51.0
+
--- /dev/null
+From 2cfee25e169e0d6505be17d6d7b9ccdf505734a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index 215ca8d60616f..22225bcda6f4c 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ th = &tm->handlers[cur_handler];
+
+ guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++ /*
++ * Print an error message if handler_address is NULL, the parse of VA also
++ * can be skipped.
++ */
++ if (unlikely(!handler_info->handler_address)) {
++ pr_info("Skipping handler with NULL address for GUID: %pUL",
++ (guid_t *)handler_info->handler_guid);
++ continue;
++ }
++
+ th->handler_addr =
+ (void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ /*
+- * Print a warning message if handler_addr is zero which is not expected to
+- * ever happen.
++ * Print a warning message and skip the parse of VA if handler_addr is zero
++ * which is not expected to ever happen.
+ */
+- if (unlikely(!th->handler_addr))
++ if (unlikely(!th->handler_addr)) {
+ pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ &th->guid, handler_info->handler_address);
++ continue;
++ }
+
+ th->static_data_buffer_addr =
+ efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+--
+2.51.0
+
--- /dev/null
+From 14c5a43948bc8d90414986e940d89403ba8ca682 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 293cdf486fd81..9e8f38e525893 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -785,6 +785,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ "PNP0D80", /* Windows-compatible System Power Management Controller */
+ "INT33BD", /* Intel Baytrail Mailbox Device */
++ "INTC10DE", /* Intel CVS LNL */
++ "INTC10E0", /* Intel CVS ARL */
+ "LATT2021", /* Lattice FW Update Client Driver */
+ NULL
+ };
+--
+2.51.0
+
--- /dev/null
+From 1dc03b4f4970524f38794c8b9d402200059d9db0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 05fd1ec8de14e..c5ad377558645 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ * Delete the operands on the previous walkstate operand stack
+ * (they were copied to new objects)
+ */
+- for (i = 0; i < obj_desc->method.param_count; i++) {
+- acpi_ut_remove_reference(this_walk_state->operands[i]);
+- this_walk_state->operands[i] = NULL;
+- }
+-
+- /* Clear the operand stack */
+-
+- this_walk_state->num_operands = 0;
++ acpi_ds_clear_operands(this_walk_state);
+
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+--
+2.51.0
+
--- /dev/null
+From 56a81d91eb81a4a3e12daa7648efa1bcf60716e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index f5a936496f060..24981bba974d3 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+ */
+ static inline __attribute__ ((const)) unsigned long __fls(unsigned long x)
+ {
++ if (__builtin_constant_p(x))
++ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ /* FLS insn has exactly same semantics as the API */
+ return __builtin_arc_fls(x);
+ }
+--
+2.51.0
+
--- /dev/null
+From 86acb64e88099802060afc2d63db9d59640ce77f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:49 -0700
+Subject: bpf: Clear pfmemalloc flag when freeing all fragments
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
+
+It is possible for bpf_xdp_adjust_tail() to free all fragments. The
+kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not
+XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when
+building sk_buff from xdp_buff since all readers of xdp_buff->flags
+use the flag only when there are fragments. Clear the
+XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xdp.h | 5 +++++
+ net/core/filter.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/net/xdp.h b/include/net/xdp.h
+index 55dbc68bfffce..8a0a69f691595 100644
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -110,6 +110,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp)
+ xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC;
+ }
+
++static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp)
++{
++ xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC;
++}
++
+ static __always_inline void
+ xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
+ {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 9b4254feefccd..786064ac889a1 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4118,6 +4118,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)
+
+ if (unlikely(!sinfo->nr_frags)) {
+ xdp_buff_clear_frags_flag(xdp);
++ xdp_buff_clear_frag_pfmemalloc(xdp);
+ xdp->data_end -= offset;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ce7f5ad421bda113989dd87416e014f6791f1188 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index f3ef1a8965bb2..bbdae97d50c42 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1082,7 +1082,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ u32 pass, void *image)
+ {
+- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ proglen, pass, image, current->comm, task_pid_nr(current));
+
+ if (image)
+--
+2.51.0
+
--- /dev/null
+From afc64c045edabdaa19d03f2163d73df655bbfa7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:38:47 -0700
+Subject: bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
+
+From: Tom Stellard <tstellar@redhat.com>
+
+[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
+
+This fixes the build with -Werror -Wall.
+
+btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 71 | info.func_info = ptr_to_u64(&finfo);
+ | ^~~~~
+
+prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 2294 | info.func_info = ptr_to_u64(&func_info);
+ |
+
+v2:
+ - Initialize instead of using memset.
+
+Signed-off-by: Tom Stellard <tstellar@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 2 +-
+ tools/bpf/bpftool/prog.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 19924b6ce796f..56100ad2fa0d2 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,
+ __u32 info_len = sizeof(info);
+ const char *prog_name = NULL;
+ struct btf *prog_btf = NULL;
+- struct bpf_func_info finfo;
++ struct bpf_func_info finfo = {};
+ __u32 finfo_rec_size;
+ char prog_str[1024];
+ int err;
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 1c3dc1dae23f6..e158e010266d5 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2104,7 +2104,7 @@ static void profile_print_readings(void)
+
+ static char *profile_target_name(int tgt_fd)
+ {
+- struct bpf_func_info func_info;
++ struct bpf_func_info func_info = {};
+ struct bpf_prog_info info = {};
+ __u32 info_len = sizeof(info);
+ const struct btf_type *t;
+--
+2.51.0
+
--- /dev/null
+From a404cd1b5557ae4ac8da73faa243e689d30fb71c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+
+ static inline void pit_timer_enable(void)
+ {
+- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_timer_disable(void)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
++ writel(0, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_irq_acknowledge(void)
+ {
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+
+ static u64 notrace pit_read_sched_clock(void)
+ {
+- return ~__raw_readl(clksrc_base + PITCVAL);
++ return ~readl(clksrc_base + PITCVAL);
+ }
+
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ /* set the max load value and start the clock source counter */
+- __raw_writel(0, clksrc_base + PITTCTRL);
+- __raw_writel(~0UL, clksrc_base + PITLDVAL);
+- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++ writel(0, clksrc_base + PITTCTRL);
++ writel(~0UL, clksrc_base + PITLDVAL);
++ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+
+ sched_clock_register(pit_read_sched_clock, 32, rate);
+ return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ * hardware requirement.
+ */
+ pit_timer_disable();
+- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
++ writel(delta - 1, clkevt_base + PITLDVAL);
+ pit_timer_enable();
+
+ return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(0, clkevt_base + PITTCTRL);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+
+ BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ cycle_per_jiffy = clk_rate / (HZ);
+
+ /* enable the pit module */
+- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++ writel(~PITMCR_MDIS, timer_base + PITMCR);
+
+ ret = pit_clocksource_init(clk_rate);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From f0bbcea0a286e32605e66dfd2c50423732263f76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index 3e000e1a75c6c..9b6ec68753dde 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)
+ struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ int i;
+
++ if (unlikely(!policy))
++ return;
++
+ for (i = 0; i < numscales; i++) {
+ if (mults[i] == maxmult) {
+ struct cpufreq_freqs freqs;
+--
+2.51.0
+
--- /dev/null
+From b6d014090d652bf2103b3e8b1c41b59659598e6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 6eceb19882430..fdd25271106a3 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -602,8 +602,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++ unsigned int cpu = dev->cpu;
+ int i, ret;
+
++ if (per_cpu(cpuidle_devices, cpu)) {
++ pr_info("CPU%d: cpuidle device already registered\n", cpu);
++ return -EEXIST;
++ }
++
+ if (!try_module_get(drv->owner))
+ return -EINVAL;
+
+@@ -615,7 +621,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ }
+
+- per_cpu(cpuidle_devices, dev->cpu) = dev;
++ per_cpu(cpuidle_devices, cpu) = dev;
+ list_add(&dev->device_list, &cpuidle_detected_devices);
+
+ ret = cpuidle_coupled_register_device(dev);
+--
+2.51.0
+
--- /dev/null
+From a9dd4b673e4c71c5c2086817ba46928cb7aa5e32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:51:54 +0530
+Subject: futex: Don't leak robust_list pointer on exec race
+
+From: Pranav Tyagi <pranav.tyagi03@gmail.com>
+
+[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
+
+sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
+to check if the calling task is allowed to access another task's
+robust_list pointer. This check is racy against a concurrent exec() in the
+target process.
+
+During exec(), a task may transition from a non-privileged binary to a
+privileged one (e.g., setuid binary) and its credentials/memory mappings
+may change. If get_robust_list() performs ptrace_may_access() before
+this transition, it may erroneously allow access to sensitive information
+after the target becomes privileged.
+
+A racy access allows an attacker to exploit a window during which
+ptrace_may_access() passes before a target process transitions to a
+privileged state via exec().
+
+For example, consider a non-privileged task T that is about to execute a
+setuid-root binary. An attacker task A calls get_robust_list(T) while T
+is still unprivileged. Since ptrace_may_access() checks permissions
+based on current credentials, it succeeds. However, if T begins exec
+immediately afterwards, it becomes privileged and may change its memory
+mappings. Because get_robust_list() proceeds to access T->robust_list
+without synchronizing with exec() it may read user-space pointers from a
+now-privileged process.
+
+This violates the intended post-exec access restrictions and could
+expose sensitive memory addresses or be used as a primitive in a larger
+exploit chain. Consequently, the race can lead to unauthorized
+disclosure of information across privilege boundaries and poses a
+potential security risk.
+
+Take a read lock on signal->exec_update_lock prior to invoking
+ptrace_may_access() and accessing the robust_list/compat_robust_list.
+This ensures that the target task's exec state remains stable during the
+check, allowing for consistent and synchronized validation of
+credentials.
+
+Suggested-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/
+Link: https://github.com/KSPP/linux/issues/119
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/syscalls.c | 106 +++++++++++++++++++++-------------------
+ 1 file changed, 56 insertions(+), 50 deletions(-)
+
+diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
+index a8074079b09e8..48feaa545b3c7 100644
+--- a/kernel/futex/syscalls.c
++++ b/kernel/futex/syscalls.c
+@@ -40,6 +40,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ return 0;
+ }
+
++static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat)
++{
++#ifdef CONFIG_COMPAT
++ if (compat)
++ return p->compat_robust_list;
++#endif
++ return p->robust_list;
++}
++
++static void __user *futex_get_robust_list_common(int pid, bool compat)
++{
++ struct task_struct *p = current;
++ void __user *head;
++ int ret;
++
++ scoped_guard(rcu) {
++ if (pid) {
++ p = find_task_by_vpid(pid);
++ if (!p)
++ return (void __user *)ERR_PTR(-ESRCH);
++ }
++ get_task_struct(p);
++ }
++
++ /*
++ * Hold exec_update_lock to serialize with concurrent exec()
++ * so ptrace_may_access() is checked against stable credentials
++ */
++ ret = down_read_killable(&p->signal->exec_update_lock);
++ if (ret)
++ goto err_put;
++
++ ret = -EPERM;
++ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
++ goto err_unlock;
++
++ head = futex_task_robust_list(p, compat);
++
++ up_read(&p->signal->exec_update_lock);
++ put_task_struct(p);
++
++ return head;
++
++err_unlock:
++ up_read(&p->signal->exec_update_lock);
++err_put:
++ put_task_struct(p);
++ return (void __user *)ERR_PTR(ret);
++}
++
+ /**
+ * sys_get_robust_list() - Get the robust-futex list head of a task
+ * @pid: pid of the process [zero for current task]
+@@ -50,36 +100,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ struct robust_list_head __user * __user *, head_ptr,
+ size_t __user *, len_ptr)
+ {
+- struct robust_list_head __user *head;
+- unsigned long ret;
+- struct task_struct *p;
+-
+- rcu_read_lock();
+-
+- ret = -ESRCH;
+- if (!pid)
+- p = current;
+- else {
+- p = find_task_by_vpid(pid);
+- if (!p)
+- goto err_unlock;
+- }
+-
+- ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+- goto err_unlock;
++ struct robust_list_head __user *head = futex_get_robust_list_common(pid, false);
+
+- head = p->robust_list;
+- rcu_read_unlock();
++ if (IS_ERR(head))
++ return PTR_ERR(head);
+
+ if (put_user(sizeof(*head), len_ptr))
+ return -EFAULT;
+ return put_user(head, head_ptr);
+-
+-err_unlock:
+- rcu_read_unlock();
+-
+- return ret;
+ }
+
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+@@ -322,36 +350,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+ compat_uptr_t __user *, head_ptr,
+ compat_size_t __user *, len_ptr)
+ {
+- struct compat_robust_list_head __user *head;
+- unsigned long ret;
+- struct task_struct *p;
+-
+- rcu_read_lock();
+-
+- ret = -ESRCH;
+- if (!pid)
+- p = current;
+- else {
+- p = find_task_by_vpid(pid);
+- if (!p)
+- goto err_unlock;
+- }
+-
+- ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+- goto err_unlock;
++ struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true);
+
+- head = p->compat_robust_list;
+- rcu_read_unlock();
++ if (IS_ERR(head))
++ return PTR_ERR(head);
+
+ if (put_user(sizeof(*head), len_ptr))
+ return -EFAULT;
+ return put_user(ptr_to_compat(head), head_ptr);
+-
+-err_unlock:
+- rcu_read_unlock();
+-
+- return ret;
+ }
+ #endif /* CONFIG_COMPAT */
+
+--
+2.51.0
+
--- /dev/null
+From 57616bd5c321285050399e4ace2e99a3bc7e88c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 21:26:56 +0200
+Subject: hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
+
+From: Ben Copeland <ben.copeland@linaro.org>
+
+[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
+
+Some motherboards require more time to acquire the ACPI mutex,
+causing "Failed to acquire mutex" messages to appear in the kernel log.
+Increase the timeout from 500ms to 800ms to accommodate these cases.
+
+Signed-off-by: Ben Copeland <ben.copeland@linaro.org>
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index 6f20b55f41f2e..c9222c83ba240 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -49,7 +49,7 @@ static char *mutex_path_override;
+ */
+ #define ASUS_EC_MAX_BANK 3
+
+-#define ACPI_LOCK_DELAY_MS 500
++#define ACPI_LOCK_DELAY_MS 800
+
+ /* ACPI mutex for locking access to the EC for the firmware */
+ #define ASUS_HW_ACCESS_MUTEX_ASMX "\\AMW0.ASMX"
+--
+2.51.0
+
--- /dev/null
+From a9065612701cf69075ac0e06aef91dbc93b82df3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index dbcb8f362061d..e13d545fbc570 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1158,6 +1158,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ },
+ .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ },
++ {
++ .ident = "Dell OptiPlex 7040",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++ },
++ },
+ {
+ .ident = "Dell Precision",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From a04508345d67366da0664897f7c5caaf2b72a26a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index e35357c48b8e6..b2ef2ada4bfe2 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -15,6 +15,7 @@
+ #include <linux/mutex.h>
+ #include <linux/of_device.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+
+ /*
+ * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -30,8 +31,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC 0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC 0x14 /* RW */
+
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT 5
+
++#define SBTSI_TEMP_EXT_RANGE_ADJ 49000
++
+ #define SBTSI_TEMP_MIN 0
+ #define SBTSI_TEMP_MAX 255875
+
+@@ -39,6 +54,8 @@
+ struct sbtsi_data {
+ struct i2c_client *client;
+ struct mutex lock;
++ bool ext_range_mode;
++ bool read_order;
+ };
+
+ /*
+@@ -75,23 +92,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ struct sbtsi_data *data = dev_get_drvdata(dev);
+ s32 temp_int, temp_dec;
+- int err;
+
+ switch (attr) {
+ case hwmon_temp_input:
+- /*
+- * ReadOrder bit specifies the reading order of integer and
+- * decimal part of CPU temp for atomic reads. If bit == 0,
+- * reading integer part triggers latching of the decimal part,
+- * so integer part should be read first. If bit == 1, read
+- * order should be reversed.
+- */
+- err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+- if (err < 0)
+- return err;
+-
+ mutex_lock(&data->lock);
+- if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++ if (data->read_order) {
+ temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ } else {
+@@ -123,6 +128,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ return temp_dec;
+
+ *val = sbtsi_reg_to_mc(temp_int, temp_dec);
++ if (data->ext_range_mode)
++ *val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+
+ return 0;
+ }
+@@ -147,6 +154,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ return -EINVAL;
+ }
+
++ if (data->ext_range_mode)
++ val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+
+@@ -205,6 +214,7 @@ static int sbtsi_probe(struct i2c_client *client,
+ struct device *dev = &client->dev;
+ struct device *hwmon_dev;
+ struct sbtsi_data *data;
++ int err;
+
+ data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ if (!data)
+@@ -213,8 +223,14 @@ static int sbtsi_probe(struct i2c_client *client,
+ data->client = client;
+ mutex_init(&data->lock);
+
+- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+- NULL);
++ err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++ if (err < 0)
++ return err;
++ data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++ data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++ hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++ &sbtsi_chip_info, NULL);
+
+ return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From c89450c7ff83f19b8be31d63e29f6d3a60769e44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:02:49 +0200
+Subject: hwmon: sy7636a: add alias
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
+
+Add module alias to have it autoloaded.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sy7636a-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
+index 6dd9c2a0f0e03..9fabd60e9a970 100644
+--- a/drivers/hwmon/sy7636a-hwmon.c
++++ b/drivers/hwmon/sy7636a-hwmon.c
+@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);
+
+ MODULE_DESCRIPTION("SY7636A sensor driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:sy7636a-temperature");
+--
+2.51.0
+
--- /dev/null
+From 5c899965c63649701359d30cdce8400ae4bf7d4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index c04f2481068bb..8aa28dfea6342 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -178,14 +178,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ msi_alloc_info_t *info = args;
+ struct v2m_data *v2m = NULL, *tmp;
+- int hwirq, offset, i, err = 0;
++ int hwirq, i, err = 0;
++ unsigned long offset;
++ unsigned long align_mask = nr_irqs - 1;
+
+ spin_lock(&v2m_lock);
+ list_for_each_entry(tmp, &v2m_nodes, entry) {
+- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+- get_count_order(nr_irqs));
+- if (offset >= 0) {
++ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++ nr_irqs, align_mask, align_off);
++ if (offset < tmp->nr_spis) {
+ v2m = tmp;
++ bitmap_set(v2m->bm, offset, nr_irqs);
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From a1d17761d67ee3af5782385056f0ee679159bf80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:40 +0800
+Subject: irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ
+ controller
+
+From: Ming Wang <wangming01@loongson.cn>
+
+[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
+
+On certain Loongson platforms, drivers attempting to request a legacy
+ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The
+virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
+
+This issue does not affect ACPI-enumerated devices described in DSDT,
+as their interrupts are properly mapped via the GSI translation path.
+This indicates the LPC irqdomain itself is functional but is not correctly
+handling direct VIRQ-to-HWIRQ mappings.
+
+The root cause is the use of irq_domain_create_linear(). This API sets
+up a domain for dynamic, on-demand mapping, typically triggered by a GSI
+request. It does not pre-populate the mappings for the legacy VIRQ range
+(0-15). Consequently, if no ACPI device claims a specific GSI
+(e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to
+the LPC domain. A direct call to request_irq(4, ...) then fails because
+the kernel cannot resolve this VIRQ to a hardware interrupt managed by
+the LPC controller.
+
+The PCH-LPC interrupt controller is an i8259-compatible legacy device
+that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to
+support legacy drivers.
+
+Fix this by replacing irq_domain_create_linear() with
+irq_domain_create_legacy(). This API is specifically designed for such
+controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ
+mapping for the entire legacy range (0-15) immediately upon domain
+creation. This ensures that any VIRQ in this range is always resolvable,
+making direct calls to request_irq() for legacy IRQs function correctly.
+
+Signed-off-by: Ming Wang <wangming01@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c
+index bf2324910a75c..c11c645cce525 100644
+--- a/drivers/irqchip/irq-loongson-pch-lpc.c
++++ b/drivers/irqchip/irq-loongson-pch-lpc.c
+@@ -176,8 +176,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent,
+ goto iounmap_base;
+ }
+
+- priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT,
+- &pch_lpc_domain_ops, priv);
++ /*
++ * The LPC interrupt controller is a legacy i8259-compatible device,
++ * which requires a static 1:1 mapping for IRQs 0-15.
++ * Use irq_domain_create_legacy to establish this static mapping early.
++ */
++ priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0,
++ &pch_lpc_domain_ops, priv);
+ if (!priv->lpc_domain) {
+ pr_err("Failed to create IRQ domain\n");
+ goto free_irq_handle;
+--
+2.51.0
+
--- /dev/null
+From 96aae9707f89767cccf80b8d9f7afd09eb0c8077 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:26:32 +0800
+Subject: irqchip/sifive-plic: Respect mask state when setting affinity
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
+
+plic_set_affinity() always calls plic_irq_enable(), which clears up the
+priority setting even the interrupt is only masked. This unmasks the
+interrupt unexpectly.
+
+Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid
+changing the priority setting.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Nam Cao <namcao@linutronix.de> # VisionFive 2
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com
+Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 164c3e71ea70c..36de764ee2b61 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -172,12 +172,14 @@ static int plic_set_affinity(struct irq_data *d,
+ if (cpu >= nr_cpu_ids)
+ return -EINVAL;
+
+- plic_irq_disable(d);
++ /* Invalidate the original routing entry */
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+
++ /* Setting the new routing entry if irq is enabled */
+ if (!irqd_irq_disabled(d))
+- plic_irq_enable(d);
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+
+ return IRQ_SET_MASK_OK_DONE;
+ }
+--
+2.51.0
+
--- /dev/null
+From a523ac18e1b85446a8b8f682a139188b771bffc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 9a2acf5c40143..fc9e6db3bb72b 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ card->next_request = h_memstick_set_rw_addr;
+ memstick_new_req(card->host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ return card->current_mrq.error;
+ }
+@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+
+ card->next_request = h_memstick_read_dev_id;
+ memstick_new_req(host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ if (card->current_mrq.error)
+ goto err_out;
+--
+2.51.0
+
--- /dev/null
+From bb6cb26a59e79d86cab51270fbed3ad5e540f4dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index 343ed6e96d87e..6e48348cff054 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ DA9063_PAGE_SEL_BUF_SIZE,
+ };
+
++enum da9063_page_sel_msgs {
++ DA9063_PAGE_SEL_MSG = 0,
++ DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+- DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+- DA9063_PAGED_READ_MSG_REG_SEL,
++ DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ DA9063_PAGED_READ_MSG_DATA,
+ DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ (page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+
+ /* Write reg address, page selection */
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++ xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++ xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++ xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++ xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++ ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++ if (ret < 0) {
++ dev_err(&client->dev, "Page switch failed: %d\n", ret);
++ return ret;
++ }
++
++ if (ret != DA9063_PAGE_SEL_CNT) {
++ dev_err(&client->dev, "Page switch failed to complete\n");
++ return -EIO;
++ }
+
+ /* Select register address */
+ xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+--
+2.51.0
+
--- /dev/null
+From 6498908c6a3387fb72ff835b81487a0ea8a2b423 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+ 739 | mfd_devs, n_devs,
+ | ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+ 459 | const struct mfd_cell *mfd_devs;
+ | ^
+ | = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index a2abc0094def7..87797d77c9f0c 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -457,7 +457,7 @@ int madera_dev_init(struct madera *madera)
+ struct device *dev = madera->dev;
+ unsigned int hwid;
+ int (*patch_fn)(struct madera *) = NULL;
+- const struct mfd_cell *mfd_devs;
++ const struct mfd_cell *mfd_devs = NULL;
+ int n_devs = 0;
+ int i, ret;
+
+@@ -671,7 +671,7 @@ int madera_dev_init(struct madera *madera)
+ goto err_reset;
+ }
+
+- if (!n_devs) {
++ if (!n_devs || !mfd_devs) {
+ dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ madera->type_name);
+ ret = -ENODEV;
+--
+2.51.0
+
--- /dev/null
+From f69bb977ccacb215d38a6b33c74f0dc26d8103d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index 4d55494a97c4b..8c36b7d122856 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From b37b3064b8a4bf624894fa06b86c142d110acdb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index aef29221d7c12..a23b3816eee37 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ void stmpe_remove(struct stmpe *stmpe)
+ {
++ if (stmpe->domain)
++ irq_domain_remove(stmpe->domain);
++
+ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+--
+2.51.0
+
--- /dev/null
+From 1ce73f97c0258be78f0810d204255c97c97fa06e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock: 50000000 Hz
+actual clock: 200000000 Hz
+
+After the fix:
+clock: 50000000 Hz
+actual clock: 50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index d0a15645a0b8f..37c81cc076553 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ clk &= ~0xff;
+ }
+
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++ clock = clk & CLK_CTL_DIV_MASK;
++ if (clock != 0xff)
++ host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ usleep_range(10000, 11000);
+
+--
+2.51.0
+
--- /dev/null
+From ec34251414e95058cb2dcd8841b65fcf13d2289b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index f507fa491c58f..996ab8c760d35 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -79,6 +79,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH BIT(16)
+ #define CORE_HC_SELECT_IN_EN BIT(18)
++#define CORE_HC_SELECT_IN_SDR50 (4 << 19)
+ #define CORE_HC_SELECT_IN_HS400 (6 << 19)
+ #define CORE_HC_SELECT_IN_MASK (7 << 19)
+
+@@ -1129,6 +1130,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ struct mmc_ios *ios = &host->mmc->ios;
+
++ if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING)
++ return true;
++
+ /*
+ * Tuning is required for SDR104, HS200 and HS400 cards and
+ * if clock frequency is greater than 100MHz in these modes.
+@@ -1197,6 +1202,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ struct mmc_ios ios = host->mmc->ios;
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++ const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++ u32 config;
+
+ if (!sdhci_msm_is_tuning_needed(host)) {
+ msm_host->use_cdr = false;
+@@ -1213,6 +1220,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ */
+ msm_host->tuning_done = 0;
+
++ if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++ config &= ~CORE_HC_SELECT_IN_MASK;
++ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++ }
++
+ /*
+ * For HS400 tuning in HS200 timing requires:
+ * - select MCLK/2 in VENDOR_SPEC
+--
+2.51.0
+
--- /dev/null
+From b51ffba43121c5119d738ca647cdeefba8bb19d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 2b0f15de77111..786715e9eeb93 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3048,11 +3048,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+
+ ++ctrl->ctrl.nr_reconnects;
+
+- if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++ spin_lock_irqsave(&ctrl->rport->lock, flags);
++ if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENODEV;
++ }
+
+- if (nvme_fc_ctlr_active_on_rport(ctrl))
++ if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENOTUNIQ;
++ }
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+
+ dev_info(ctrl->ctrl.device,
+ "NVME-FC{%d}: create association : host wwpn 0x%016llx "
+--
+2.51.0
+
--- /dev/null
+From 345c414a5f05f5d02cd3bcb040745b3b9d53e455 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:52:11 +1000
+Subject: nvme: Use non zero KATO for persistent discovery connections
+
+From: Alistair Francis <alistair.francis@wdc.com>
+
+[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
+
+The NVMe Base Specification 2.1 states that:
+
+"""
+A host requests an explicit persistent connection ... by specifying a
+non-zero Keep Alive Timer value in the Connect command.
+"""
+
+As such if we are starting a persistent connection to a discovery
+controller and the KATO is currently 0 we need to update KATO to a non
+zero value to avoid continuous timeouts on the target.
+
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 7d3759f875b23..938af571dc13e 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -5131,8 +5131,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
+ * checking that they started once before, hence are reconnecting back.
+ */
+ if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+- nvme_discovery_ctrl(ctrl))
++ nvme_discovery_ctrl(ctrl)) {
++ if (!ctrl->kato) {
++ nvme_stop_keep_alive(ctrl);
++ ctrl->kato = NVME_DEFAULT_KATO;
++ nvme_start_keep_alive(ctrl);
++ }
+ nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
++ }
+
+ if (ctrl->queue_count > 1) {
+ nvme_queue_scan(ctrl);
+--
+2.51.0
+
--- /dev/null
+From 3a4235cb954e7f4017af5b8b6a1939abff796984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index a15e764bae35b..188b9f1bdaca1 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++ int terminating;
++
++ terminating = atomic_xchg(&assoc->terminating, 1);
++
++ /* if already terminating, do nothing */
++ if (terminating)
++ return;
++
+ nvmet_fc_tgtport_get(assoc->tgtport);
+ if (!queue_work(nvmet_wq, &assoc->del_work))
+ nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ unsigned long flags;
+- int i, terminating;
+-
+- terminating = atomic_xchg(&assoc->terminating, 1);
+-
+- /* if already terminating, do nothing */
+- if (terminating)
+- return;
++ int i;
+
+ spin_lock_irqsave(&tgtport->lock, flags);
+ list_del_rcu(&assoc->a_list);
+--
+2.51.0
+
--- /dev/null
+From 688a8a6e212285cff401386f75cfdc7ec06b9a15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 28f3fabc72e30..a72911e8ea82d 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -588,8 +588,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+ case PIN_CONFIG_BIAS_PULL_UP:
+- if (arg)
++ if (arg) {
+ pcs_pinconf_clear_bias(pctldev, pin);
++ data = pcs->read(pcs->base + offset);
++ }
+ fallthrough;
+ case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ data &= ~func->conf[i].mask;
+--
+2.51.0
+
--- /dev/null
+From 9c143fd97fda4508c905350d3c6514cc9fe69cd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22
+[ 8.151974] Hardware name: ALE AMB (DT)
+[ 8.155828] Call trace:
+[ 8.158292] dump_backtrace+0x0/0x1d4
+[ 8.161960] show_stack+0x18/0x6c
+[ 8.165280] dump_stack+0xcc/0x128
+[ 8.168687] sysfs_warn_dup+0x60/0x7c
+[ 8.172353] sysfs_do_create_link_sd+0xf0/0x100
+[ 8.176886] sysfs_create_link+0x20/0x40
+[ 8.180816] device_add+0x270/0x7a4
+[ 8.184311] __power_supply_register+0x304/0x560
+[ 8.188930] devm_power_supply_register+0x54/0xa0
+[ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger]
+[ 8.198183] i2c_device_probe+0x2dc/0x2f4
+[ 8.202196] really_probe+0xf0/0x510
+[ 8.205774] driver_probe_device+0xfc/0x160
+[ 8.209960] device_driver_attach+0xc0/0xcc
+[ 8.214146] __driver_attach+0xc0/0x170
+[ 8.218002] bus_for_each_dev+0x74/0xd4
+[ 8.221862] driver_attach+0x24/0x30
+[ 8.225444] bus_add_driver+0x148/0x250
+[ 8.229283] driver_register+0x78/0x130
+[ 8.233140] i2c_register_driver+0x4c/0xe0
+[ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger]
+[ 8.242424] do_one_initcall+0x50/0x1b0
+[ 8.242434] do_init_module+0x44/0x230
+[ 8.242438] load_module+0x2200/0x27c0
+[ 8.242442] __do_sys_finit_module+0xa8/0x11c
+[ 8.242447] __arm64_sys_finit_module+0x20/0x30
+[ 8.242457] el0_svc_common.constprop.0+0x64/0x154
+[ 8.242464] do_el0_svc+0x24/0x8c
+[ 8.242474] el0_svc+0x10/0x20
+[ 8.242481] el0_sync_handler+0x108/0x114
+[ 8.242485] el0_sync+0x180/0x1c0
+[ 8.243847] sbs-charger 20-0009: Failed to register power supply
+[ 8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index bc927c0ddd343..7dfed22fbce3b 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+
+-static const struct power_supply_desc sbs_desc = {
+- .name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ .type = POWER_SUPPLY_TYPE_MAINS,
+ .properties = sbs_properties,
+ .num_properties = ARRAY_SIZE(sbs_properties),
+@@ -166,9 +165,20 @@ static int sbs_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+ struct power_supply_config psy_cfg = {};
++ struct power_supply_desc *sbs_desc;
+ struct sbs_info *chip;
+ int ret, val;
+
++ sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++ sizeof(*sbs_desc), GFP_KERNEL);
++ if (!sbs_desc)
++ return -ENOMEM;
++
++ sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++ dev_name(&client->dev));
++ if (!sbs_desc->name)
++ return -ENOMEM;
++
+ chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ if (!chip)
+ return -ENOMEM;
+@@ -192,7 +202,7 @@ static int sbs_probe(struct i2c_client *client,
+ return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ chip->last_state = val;
+
+- chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++ chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ if (IS_ERR(chip->power_supply))
+ return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ "Failed to register power supply\n");
+--
+2.51.0
+
--- /dev/null
+From 1bc55d27e505a664f093e490e4f2819ca9689bef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index 4694422aa76c3..88e4aeab21b7b 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -74,7 +74,7 @@ int main(int argc, char **argv)
+
+ /* Let's try detach it before it was ever attached */
+ ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+- if (ret != -1 || errno != ENOENT) {
++ if (ret != -ENOENT) {
+ printf("bpf_prog_detach2 not attached should fail: %m\n");
+ return 1;
+ }
+--
+2.51.0
+
--- /dev/null
+From ca3d5a5a0aa08f12538d477daeb705fc10892da3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:48:30 -0300
+Subject: selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
+
+Currently, even if some subtests fails, the end result will still yield
+"ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are
+any failures.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xsk.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
+index 4e3ec38cbe68c..09788b847e89b 100755
+--- a/tools/testing/selftests/bpf/test_xsk.sh
++++ b/tools/testing/selftests/bpf/test_xsk.sh
+@@ -206,4 +206,6 @@ done
+
+ if [ $failures -eq 0 ]; then
+ echo "All tests successful!"
++else
++ exit 1
+ fi
+--
+2.51.0
+
block-open-code-__generic_file_write_iter-for-blkdev-writes.patch
block-fix-race-between-set_blocksize-and-read-paths.patch
nilfs2-fix-deadlock-warnings-caused-by-lock-dependency-in-init_nilfs.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+irqchip-sifive-plic-respect-mask-state-when-setting-.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+hwmon-sy7636a-add-alias.patch
+irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+futex-don-t-leak-robust_list-pointer-on-exec-race.patch
+spi-rpc-if-add-resume-support-for-rz-g3e.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
+nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
--- /dev/null
+From 80204d715b948239fc5e7a03a1157396fbd5d90c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ { "AST2620", 0x05010203 },
+ { "AST2605", 0x05030103 },
+ { "AST2625", 0x05030403 },
++ /* AST2700 */
++ { "AST2750", 0x06000003 },
++ { "AST2700", 0x06000103 },
++ { "AST2720", 0x06000203 },
+ };
+
+ static const char *siliconid_to_name(u32 siliconid)
+--
+2.51.0
+
--- /dev/null
+From 8f3217732292e56ea88f1b5c979ba805520a4740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index af8d90efd91fa..e4e6c6d69bf55 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -810,7 +810,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ if (IS_ERR_OR_NULL(ptable))
+ return SMEM_ITEM_COUNT;
+
+- info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ return SMEM_ITEM_COUNT;
+
+--
+2.51.0
+
--- /dev/null
+From a33b90f3941b1bf87a148d8a6cc74f9d178ad053 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index f01d8a2547b6d..01f212057ee34 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++ {
++ .name = "tsensor-cpu1",
++ .offset = 0x084,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu2",
++ .offset = 0x088,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-common",
++ .offset = 0x08c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu0",
++ .offset = 0x098,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "xusb-pad-calibration",
++ .offset = 0x0f0,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu3",
++ .offset = 0x12c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-gpu",
++ .offset = 0x154,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem0",
++ .offset = 0x158,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem1",
++ .offset = 0x15c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-pllx",
++ .offset = 0x160,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ },
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++ {
++ .nvmem_name = "fuse",
++ .cell_name = "xusb-pad-calibration",
++ .dev_id = "7009f000.padctl",
++ .con_id = "calibration",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-common",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "common",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu2",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu2",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu3",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu3",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-gpu",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "gpu",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-pllx",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "pllx",
++ },
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ .read = tegra30_fuse_read,
+ .size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ .init = tegra30_fuse_init,
+ .speedo_init = tegra114_init_speedo_data,
+ .info = &tegra114_fuse_info,
++ .lookups = tegra114_fuse_lookups,
++ .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++ .cells = tegra114_fuse_cells,
++ .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ .soc_attr_group = &tegra_soc_attr_group,
+ .clk_suspend_on = false,
+ };
+--
+2.51.0
+
--- /dev/null
+From d415fab1e2458e602df4ad1f0a883e59f06ee916 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index 6882c86b3ce54..dd5d4675d26f4 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -270,7 +270,7 @@ static int pruss_probe(struct platform_device *pdev)
+ pruss->mem_regions[i].pa = res.start;
+ pruss->mem_regions[i].size = resource_size(&res);
+
+- dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++ dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ mem_names[i], &pruss->mem_regions[i].pa,
+ pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ }
+--
+2.51.0
+
--- /dev/null
+From 9bd557945981565694ce551ec5a8c6c8b6784745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index ab29ae463f677..c011a67ce2108 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -436,7 +436,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ int i;
+ u8 b;
+
+- dev_info(&spi->dev, " spi_msg@%pK\n", msg);
++ dev_info(&spi->dev, " spi_msg@%p\n", msg);
+ if (msg->status)
+ dev_info(&spi->dev, " status: %i\n",
+ msg->status);
+@@ -446,15 +446,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ msg->actual_length);
+
+ list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer);
++ dev_info(&spi->dev, " spi_transfer@%p\n", xfer);
+ dev_info(&spi->dev, " len: %i\n", xfer->len);
+- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf);
++ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf);
+ if (dump_data && xfer->tx_buf)
+ spi_test_print_hex_dump(" TX: ",
+ xfer->tx_buf,
+ xfer->len);
+
+- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf);
++ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf);
+ if (dump_data && xfer->rx_buf)
+ spi_test_print_hex_dump(" RX: ",
+ xfer->rx_buf,
+@@ -548,7 +548,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ /* if still not found then something has modified too much */
+ /* we could list the "closest" transfer here... */
+ dev_err(&spi->dev,
+- "loopback strangeness - rx changed outside of allowed range at: %pK\n",
++ "loopback strangeness - rx changed outside of allowed range at: %p\n",
+ addr);
+ /* do not return, only set ret,
+ * so that we list all addresses
+@@ -686,7 +686,7 @@ static int spi_test_translate(struct spi_device *spi,
+ }
+
+ dev_err(&spi->dev,
+- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ *ptr, *ptr + len,
+ RX(0), RX(SPI_TEST_MAX_SIZE),
+ TX(0), TX(SPI_TEST_MAX_SIZE));
+--
+2.51.0
+
--- /dev/null
+From 48b267c1743800dae4cf4faf1539dfd5e68327d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 12:26:46 +0100
+Subject: spi: rpc-if: Add resume support for RZ/G3E
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
+
+On RZ/G3E using PSCI, s2ram powers down the SoC. After resume,
+reinitialize the hardware for SPI operations.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rpc-if.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
+index ec0904faf3a10..b294ac56470a0 100644
+--- a/drivers/spi/spi-rpc-if.c
++++ b/drivers/spi/spi-rpc-if.c
+@@ -195,6 +195,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev)
+ {
+ struct spi_controller *ctlr = dev_get_drvdata(dev);
+
++ rpcif_hw_init(dev, false);
++
+ return spi_controller_resume(ctlr);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9dfac632da1dbd1f09563b86fe304f74efcb9025 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index a9a893bc19fa4..a2feea6e16f38 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+
+ if (!teedesc || !teedesc->name || !teedesc->ops ||
+ !teedesc->ops->get_version || !teedesc->ops->open ||
+- !teedesc->ops->release || !pool)
++ !teedesc->ops->release)
+ return ERR_PTR(-EINVAL);
+
+ teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From 41be47fb391d5e97a149d04c415da2446aa0af96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 3f7d0c0c50676..0e29365e23a59 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -48,7 +48,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ if (numwritten < 1) {
+ perror(path);
+ close(fd);
+- return -1;
++ return 0;
+ }
+
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From 61f741267d2116d552c5fe49887ce774a63f612e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ char value[SYSFS_PATH_MAX];
+ int bytes_written;
++ int len;
+
+ if (cpuidle_state_count(cpu) <= idlestate)
+ return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ idlestate_value_files[IDLESTATE_DISABLE]))
+ return -2;
+
+- snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+
+ bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+- value, sizeof(disable));
++ value, len);
+ if (bytes_written)
+ return 0;
+ return -3;
+--
+2.51.0
+
--- /dev/null
+From 60ebec3c03c4c4a6f2214b5f1c346e30532430ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+
+ int enable_hwp_on_cpu(int cpu)
+ {
+- unsigned long long msr;
++ unsigned long long old_msr, new_msr;
++
++ get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++ if (old_msr & 1)
++ return 0; /* already enabled */
+
+- get_msr(cpu, MSR_PM_ENABLE, &msr);
+- put_msr(cpu, MSR_PM_ENABLE, 1);
++ new_msr = old_msr | 1;
++ put_msr(cpu, MSR_PM_ENABLE, new_msr);
+
+ if (verbose)
+- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 535ac5b91c7b995e76973f83f4e8d5a011504ab9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+ */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+- FILE *filep = fopen(path, "r");
++ FILE *filep = fopen(path, mode);
+
+ if (!filep)
+ err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ char *buffer;
+
+ /* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+- cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++ cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+
+ buffer = malloc(4096);
+ if (!buffer) {
+--
+2.51.0
+
--- /dev/null
+From 2b962397a00aec62e69041422c0322e9a7770167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+ * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+ * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+ * so we don't have to touch that.)
+ */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ if (update_hwp_max)
+ update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+
++ hwp_limits_done_via_sysfs = 1;
++
+ return 0;
+ }
+
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ if (debug)
+ print_hwp_request(cpu, &req, "old: ");
+
+- if (update_hwp_min)
++ if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ req.hwp_min = req_update.hwp_min;
+
+- if (update_hwp_max)
++ if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ req.hwp_max = req_update.hwp_max;
+
+ if (update_hwp_desired)
+--
+2.51.0
+
--- /dev/null
+From 6e475e9cdfcdee190bd27b838dafece68e8ff77d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 4c8fc82fc27a0..29c0e7c6a6d24 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2248,6 +2248,13 @@ static void handle_swbp(struct pt_regs *regs)
+
+ handler_chain(uprobe, regs);
+
++ /*
++ * If user decided to take execution elsewhere, it makes little sense
++ * to execute the original instruction, so let's skip it.
++ */
++ if (instruction_pointer(regs) != bp_vaddr)
++ goto out;
++
+ if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From dd6043b798ccf2caa453d38e9d002743b9cf1c9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index bd0bdeae23a4f..7e6d252313b7d 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -22,7 +22,7 @@
+ #define LP855X_DEVICE_CTRL 0x01
+ #define LP855X_EEPROM_START 0xA0
+ #define LP855X_EEPROM_END 0xA7
+-#define LP8556_EPROM_START 0xA0
++#define LP8556_EPROM_START 0x98
+ #define LP8556_EPROM_END 0xAF
+
+ /* LP8555/7 Registers */
+--
+2.51.0
+
--- /dev/null
+From 1ef2a397c14159d5dd55b6c33b669edc47a3bb2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index be033bbb126a4..6792d4385eee4 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ th = &tm->handlers[cur_handler];
+
+ guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++ /*
++ * Print an error message if handler_address is NULL, the parse of VA also
++ * can be skipped.
++ */
++ if (unlikely(!handler_info->handler_address)) {
++ pr_info("Skipping handler with NULL address for GUID: %pUL",
++ (guid_t *)handler_info->handler_guid);
++ continue;
++ }
++
+ th->handler_addr =
+ (void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ /*
+- * Print a warning message if handler_addr is zero which is not expected to
+- * ever happen.
++ * Print a warning message and skip the parse of VA if handler_addr is zero
++ * which is not expected to ever happen.
+ */
+- if (unlikely(!th->handler_addr))
++ if (unlikely(!th->handler_addr)) {
+ pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ &th->guid, handler_info->handler_address);
++ continue;
++ }
+
+ th->static_data_buffer_addr =
+ efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+--
+2.51.0
+
--- /dev/null
+From 9aa8de2093749d57cce0236276a526593d2d1c9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 14:52:22 +0000
+Subject: ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
+
+From: Sam van Kampen <sam@tehsvk.net>
+
+[ Upstream commit 3a351de0d9c86e23b9eca25838b19468aab02f38 ]
+
+Just like the other Vivobooks here, the N6506CU has its keyboard IRQ
+described as ActiveLow in the DSDT, which the kernel overrides to
+EdgeHigh, causing the internal keyboard not to work.
+
+Add the N6506CU to the irq1_level_low_skip_override[] quirk table to fix
+this.
+
+Signed-off-by: Sam van Kampen <sam@tehsvk.net>
+Link: https://patch.msgid.link/20250829145221.2294784-2-sam@tehsvk.net
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 7d59c6c9185fc..4937032490689 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -510,6 +510,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "N6506M"),
+ },
+ },
++ {
++ /* Asus Vivobook Pro N6506CU* */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "N6506CU"),
++ },
++ },
+ {
+ /* LG Electronics 17U70P */
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 9f49189a395132049c73753e7c9f319b76d61352 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 7ecc401fb97f9..4ef94d06365fc 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -847,6 +847,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ "PNP0D80", /* Windows-compatible System Power Management Controller */
+ "INT33BD", /* Intel Baytrail Mailbox Device */
++ "INTC10DE", /* Intel CVS LNL */
++ "INTC10E0", /* Intel CVS ARL */
+ "LATT2021", /* Lattice FW Update Client Driver */
+ NULL
+ };
+--
+2.51.0
+
--- /dev/null
+From 5712954e19fda55c914aedc28399bd3948ce0ce4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 15:08:15 +0800
+Subject: ACPI: SPCR: Support Precise Baud Rate field
+
+From: Chen Pei <cp0613@linux.alibaba.com>
+
+[ Upstream commit 4d330fe54145ecfbb657ac01a554fdedf3c1927e ]
+
+The Microsoft Serial Port Console Redirection (SPCR) specification
+revision 1.09 comprises additional field: Precise Baud Rate [1].
+
+It is used to describe non-traditional baud rates (such as those
+used by high-speed UARTs).
+
+It contains a specific non-zero baud rate which overrides the value
+of the Configured Baud Rate field. If this field is zero or not
+present, Configured Baud Rate is used.
+
+Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table [1]
+Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
+Link: https://patch.msgid.link/20250913070815.16758-1-cp0613@linux.alibaba.com
+[ rjw: Corrected typo in the subject ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/spcr.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
+index cd36a97b0ea2c..fa12e740386de 100644
+--- a/drivers/acpi/spcr.c
++++ b/drivers/acpi/spcr.c
+@@ -146,7 +146,15 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
+ goto done;
+ }
+
+- switch (table->baud_rate) {
++ /*
++ * SPCR 1.09 defines Precise Baud Rate Filed contains a specific
++ * non-zero baud rate which overrides the value of the Configured
++ * Baud Rate field. If this field is zero or not present, Configured
++ * Baud Rate is used.
++ */
++ if (table->precise_baudrate)
++ baud_rate = table->precise_baudrate;
++ else switch (table->baud_rate) {
+ case 0:
+ /*
+ * SPCR 1.04 defines 0 as a preconfigured state of UART.
+--
+2.51.0
+
--- /dev/null
+From 32135ced6bbe5a39a5a7558fc0b046b3d4e9ce61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:49:46 +0530
+Subject: ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 149139ddcb99583fdec8d1eaf7dada41e5896101 ]
+
+Since str_obj is allocated by ACPICA in acpi_evaluate_object_typed(),
+it should be free with ACPI_FREE() rather than with kfree(), so use
+the former instead of the latter for freeing it.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Link: https://patch.msgid.link/20250822061946.472594-1-kaushlendra.kumar@intel.com
+[ rjw: Subject and changelog rewrite ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/device_sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
+index 3961fc47152c0..cd199fbe4dc90 100644
+--- a/drivers/acpi/device_sysfs.c
++++ b/drivers/acpi/device_sysfs.c
+@@ -464,7 +464,7 @@ static ssize_t description_show(struct device *dev,
+
+ buf[result++] = '\n';
+
+- kfree(str_obj);
++ ACPI_FREE(str_obj);
+
+ return result;
+ }
+--
+2.51.0
+
--- /dev/null
+From 60ca94998c6f25875996b62c13e35f3bc88af329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index d507d5e084354..4cf74f173c785 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -948,6 +948,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"),
+ },
+ },
++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++ {
++ .callback = video_detect_force_native,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++ },
++ },
+ { },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 891c77aa3a5de5c386dbab9711fc5316c1597ccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index a232746d150a7..dc53a5d700671 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ * Delete the operands on the previous walkstate operand stack
+ * (they were copied to new objects)
+ */
+- for (i = 0; i < obj_desc->method.param_count; i++) {
+- acpi_ut_remove_reference(this_walk_state->operands[i]);
+- this_walk_state->operands[i] = NULL;
+- }
+-
+- /* Clear the operand stack */
+-
+- this_walk_state->num_operands = 0;
++ acpi_ds_clear_operands(this_walk_state);
+
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+--
+2.51.0
+
--- /dev/null
+From b73d94b38d1e69cc82501f06efebb3299ce4150d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index f5a936496f060..24981bba974d3 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+ */
+ static inline __attribute__ ((const)) unsigned long __fls(unsigned long x)
+ {
++ if (__builtin_constant_p(x))
++ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ /* FLS insn has exactly same semantics as the API */
+ return __builtin_arc_fls(x);
+ }
+--
+2.51.0
+
--- /dev/null
+From 62eddc7a3ac5961056daf048fcb524517a48457e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:19:46 +0300
+Subject: ARM: tegra: p880: set correct touchscreen clipping
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonas Schwöbel <jonasschwoebel@yahoo.de>
+
+[ Upstream commit b49a73a08100ab139e07cfa7ca36e9b15787d0ab ]
+
+Existing touchscreen clipping is too small and causes problems with
+touchscreen accuracy.
+
+Signed-off-by: Jonas Schwöbel <jonasschwoebel@yahoo.de>
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts b/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
+index 2f7754fd42a16..c6ef0a20c19f3 100644
+--- a/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
++++ b/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
+@@ -108,8 +108,8 @@
+ i2c@7000c400 {
+ touchscreen@20 {
+ rmi4-f11@11 {
+- syna,clip-x-high = <1110>;
+- syna,clip-y-high = <1973>;
++ syna,clip-x-high = <1440>;
++ syna,clip-y-high = <2560>;
+
+ touchscreen-inverted-y;
+ };
+--
+2.51.0
+
--- /dev/null
+From f1ecd97174b3c7bb56050053144233edc1ec138e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:31 +0300
+Subject: ARM: tegra: transformer-20: add missing magnetometer interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit cca41614d15ce2bbc2c661362d3eafe53c9990af ]
+
+Add missing interrupt to magnetometer node.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index e118809dc6d98..676ed51aa2cee 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -502,6 +502,9 @@
+ compatible = "asahi-kasei,ak8974";
+ reg = <0xe>;
+
++ interrupt-parent = <&gpio>;
++ interrupts = <TEGRA_GPIO(N, 5) IRQ_TYPE_EDGE_RISING>;
++
+ avdd-supply = <&vdd_3v3_sys>;
+ dvdd-supply = <&vdd_1v8_sys>;
+
+--
+2.51.0
+
--- /dev/null
+From 9b30985eb79954f6ca0bdb4d218b2a04f83a737f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:32 +0300
+Subject: ARM: tegra: transformer-20: fix audio-codec interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 3f973d78d176768fa7456def97f0b9824235024f ]
+
+Correct audio-codec interrupt should be PX3 while PX1 is used for external
+microphone detection.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index 676ed51aa2cee..f0e7284fa7c36 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -518,7 +518,7 @@
+ reg = <0x1a>;
+
+ interrupt-parent = <&gpio>;
+- interrupts = <TEGRA_GPIO(X, 1) IRQ_TYPE_EDGE_BOTH>;
++ interrupts = <TEGRA_GPIO(X, 3) IRQ_TYPE_EDGE_BOTH>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+--
+2.51.0
+
--- /dev/null
+From 252621e58d38a7210a28922336c3788f27b1804e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:18 +0200
+Subject: arm64: zynqmp: Disable coresight by default
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 0e3f9140ad04dca9a6a93dd6a6decdc53fd665ca ]
+
+When secure-boot mode of bootloader is enabled, the registers of
+coresight are not permitted to access that's why disable it by default.
+
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/7e308b8efe977c4912079b4d1b1ab3d24908559e.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index b1b31dcf6291b..e2ad5fb2cb0a4 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -450,6 +450,7 @@
+ reg = <0x0 0xfec10000 0x0 0x1000>;
+ clock-names = "apb_pclk";
+ cpu = <&cpu0>;
++ status = "disabled";
+ };
+
+ cpu1_debug: debug@fed10000 {
+@@ -457,6 +458,7 @@
+ reg = <0x0 0xfed10000 0x0 0x1000>;
+ clock-names = "apb_pclk";
+ cpu = <&cpu1>;
++ status = "disabled";
+ };
+
+ cpu2_debug: debug@fee10000 {
+@@ -464,6 +466,7 @@
+ reg = <0x0 0xfee10000 0x0 0x1000>;
+ clock-names = "apb_pclk";
+ cpu = <&cpu2>;
++ status = "disabled";
+ };
+
+ cpu3_debug: debug@fef10000 {
+@@ -471,6 +474,7 @@
+ reg = <0x0 0xfef10000 0x0 0x1000>;
+ clock-names = "apb_pclk";
+ cpu = <&cpu3>;
++ status = "disabled";
+ };
+
+ /* GDMA */
+--
+2.51.0
+
--- /dev/null
+From 58cb303afb558251b79ecb70ed6bade45cb518f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:19 +0200
+Subject: arm64: zynqmp: Revert usb node drive strength and slew rate for
+ zcu106
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+
+[ Upstream commit 767ecf9da7b31e5c0c22c273001cb2784705fe8c ]
+
+On a few zcu106 boards USB devices (Dell MS116 USB Optical Mouse, Dell USB
+Entry Keyboard) are not enumerated on linux boot due to commit
+'b8745e7eb488 ("arm64: zynqmp: Fix usb node drive strength and slew
+rate")'.
+
+To fix it as a workaround revert to working version and then investigate
+at board level why drive strength from 12mA to 4mA and slew from fast to
+slow is not working.
+
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/85a70cb014ec1f07972fccb60b875596eeaa6b5c.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+index 7beedd730f940..9dd63cc384e6e 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+@@ -808,8 +808,8 @@
+ pins = "MIO54", "MIO56", "MIO57", "MIO58", "MIO59",
+ "MIO60", "MIO61", "MIO62", "MIO63";
+ bias-disable;
+- drive-strength = <4>;
+- slew-rate = <SLEW_RATE_SLOW>;
++ drive-strength = <12>;
++ slew-rate = <SLEW_RATE_FAST>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From f1be6bbf8078f5c9154248764968555bc01e6317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 15:55:20 +0800
+Subject: blk-cgroup: fix possible deadlock while configuring policy
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 5d726c4dbeeddef612e6bed27edd29733f4d13af ]
+
+Following deadlock can be triggered easily by lockdep:
+
+WARNING: possible circular locking dependency detected
+6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted
+------------------------------------------------------
+check/1334 is trying to acquire lock:
+ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180
+
+but task is already holding lock:
+ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}:
+ blk_queue_enter+0x40b/0x470
+ blkg_conf_prep+0x7b/0x3c0
+ tg_set_limit+0x10a/0x3e0
+ cgroup_file_write+0xc6/0x420
+ kernfs_fop_write_iter+0x189/0x280
+ vfs_write+0x256/0x490
+ ksys_write+0x83/0x190
+ __x64_sys_write+0x21/0x30
+ x64_sys_call+0x4608/0x4630
+ do_syscall_64+0xdb/0x6b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+-> #1 (&q->rq_qos_mutex){+.+.}-{4:4}:
+ __mutex_lock+0xd8/0xf50
+ mutex_lock_nested+0x2b/0x40
+ wbt_init+0x17e/0x280
+ wbt_enable_default+0xe9/0x140
+ blk_register_queue+0x1da/0x2e0
+ __add_disk+0x38c/0x5d0
+ add_disk_fwnode+0x89/0x250
+ device_add_disk+0x18/0x30
+ virtblk_probe+0x13a3/0x1800
+ virtio_dev_probe+0x389/0x610
+ really_probe+0x136/0x620
+ __driver_probe_device+0xb3/0x230
+ driver_probe_device+0x2f/0xe0
+ __driver_attach+0x158/0x250
+ bus_for_each_dev+0xa9/0x130
+ driver_attach+0x26/0x40
+ bus_add_driver+0x178/0x3d0
+ driver_register+0x7d/0x1c0
+ __register_virtio_driver+0x2c/0x60
+ virtio_blk_init+0x6f/0xe0
+ do_one_initcall+0x94/0x540
+ kernel_init_freeable+0x56a/0x7b0
+ kernel_init+0x2b/0x270
+ ret_from_fork+0x268/0x4c0
+ ret_from_fork_asm+0x1a/0x30
+
+-> #0 (&q->sysfs_lock){+.+.}-{4:4}:
+ __lock_acquire+0x1835/0x2940
+ lock_acquire+0xf9/0x450
+ __mutex_lock+0xd8/0xf50
+ mutex_lock_nested+0x2b/0x40
+ blk_unregister_queue+0x53/0x180
+ __del_gendisk+0x226/0x690
+ del_gendisk+0xba/0x110
+ sd_remove+0x49/0xb0 [sd_mod]
+ device_remove+0x87/0xb0
+ device_release_driver_internal+0x11e/0x230
+ device_release_driver+0x1a/0x30
+ bus_remove_device+0x14d/0x220
+ device_del+0x1e1/0x5a0
+ __scsi_remove_device+0x1ff/0x2f0
+ scsi_remove_device+0x37/0x60
+ sdev_store_delete+0x77/0x100
+ dev_attr_store+0x1f/0x40
+ sysfs_kf_write+0x65/0x90
+ kernfs_fop_write_iter+0x189/0x280
+ vfs_write+0x256/0x490
+ ksys_write+0x83/0x190
+ __x64_sys_write+0x21/0x30
+ x64_sys_call+0x4608/0x4630
+ do_syscall_64+0xdb/0x6b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+other info that might help us debug this:
+
+Chain exists of:
+ &q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&q->q_usage_counter(queue)#3);
+ lock(&q->rq_qos_mutex);
+ lock(&q->q_usage_counter(queue)#3);
+ lock(&q->sysfs_lock);
+
+Root cause is that queue_usage_counter is grabbed with rq_qos_mutex
+held in blkg_conf_prep(), while queue should be freezed before
+rq_qos_mutex from other context.
+
+The blk_queue_enter() from blkg_conf_prep() is used to protect against
+policy deactivation, which is already protected with blkcg_mutex, hence
+convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile,
+consider that blkcg_mutex is held after queue is freezed from policy
+deactivation, also convert blkg_alloc() to use GFP_NOIO.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 643d6bf66522e..5a5525d10a5e5 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -847,14 +847,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ disk = ctx->bdev->bd_disk;
+ q = disk->queue;
+
+- /*
+- * blkcg_deactivate_policy() requires queue to be frozen, we can grab
+- * q_usage_counter to prevent concurrent with blkcg_deactivate_policy().
+- */
+- ret = blk_queue_enter(q, 0);
+- if (ret)
+- goto fail;
+-
++ /* Prevent concurrent with blkcg_deactivate_policy() */
++ mutex_lock(&q->blkcg_mutex);
+ spin_lock_irq(&q->queue_lock);
+
+ if (!blkcg_policy_enabled(q, pol)) {
+@@ -884,16 +878,16 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ /* Drop locks to do new blkg allocation with GFP_KERNEL. */
+ spin_unlock_irq(&q->queue_lock);
+
+- new_blkg = blkg_alloc(pos, disk, GFP_KERNEL);
++ new_blkg = blkg_alloc(pos, disk, GFP_NOIO);
+ if (unlikely(!new_blkg)) {
+ ret = -ENOMEM;
+- goto fail_exit_queue;
++ goto fail_exit;
+ }
+
+ if (radix_tree_preload(GFP_KERNEL)) {
+ blkg_free(new_blkg);
+ ret = -ENOMEM;
+- goto fail_exit_queue;
++ goto fail_exit;
+ }
+
+ spin_lock_irq(&q->queue_lock);
+@@ -921,7 +915,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ goto success;
+ }
+ success:
+- blk_queue_exit(q);
++ mutex_unlock(&q->blkcg_mutex);
+ ctx->blkg = blkg;
+ return 0;
+
+@@ -929,9 +923,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ radix_tree_preload_end();
+ fail_unlock:
+ spin_unlock_irq(&q->queue_lock);
+-fail_exit_queue:
+- blk_queue_exit(q);
+-fail:
++fail_exit:
++ mutex_unlock(&q->blkcg_mutex);
+ /*
+ * If queue was bypassing, we should retry. Do so after a
+ * short msleep(). It isn't strictly necessary but queue
+--
+2.51.0
+
--- /dev/null
+From c78c54a7646104684d441860a89fb2a93a31c0c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:49 -0700
+Subject: bpf: Clear pfmemalloc flag when freeing all fragments
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
+
+It is possible for bpf_xdp_adjust_tail() to free all fragments. The
+kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not
+XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when
+building sk_buff from xdp_buff since all readers of xdp_buff->flags
+use the flag only when there are fragments. Clear the
+XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xdp.h | 5 +++++
+ net/core/filter.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/net/xdp.h b/include/net/xdp.h
+index e6770dd40c917..b80953f0affb0 100644
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -113,6 +113,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp)
+ xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC;
+ }
+
++static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp)
++{
++ xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC;
++}
++
+ static __always_inline void
+ xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
+ {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index fef4d85fee008..89ed625e14744 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4223,6 +4223,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)
+
+ if (unlikely(!sinfo->nr_frags)) {
+ xdp_buff_clear_frags_flag(xdp);
++ xdp_buff_clear_frag_pfmemalloc(xdp);
+ xdp->data_end -= offset;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9ecaf7e0437c537c0577a4ddcd120a59165f93bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 03:26:17 +0000
+Subject: bpf: Do not limit bpf_cgroup_from_id to current's namespace
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit 2c895133950646f45e5cf3900b168c952c8dbee8 ]
+
+The bpf_cgroup_from_id kfunc relies on cgroup_get_from_id to obtain the
+cgroup corresponding to a given cgroup ID. This helper can be called in
+a lot of contexts where the current thread can be random. A recent
+example was its use in sched_ext's ops.tick(), to obtain the root cgroup
+pointer. Since the current task can be whatever random user space task
+preempted by the timer tick, this makes the behavior of the helper
+unreliable.
+
+Refactor out __cgroup_get_from_id as the non-namespace aware version of
+cgroup_get_from_id, and change bpf_cgroup_from_id to make use of it.
+
+There is no compatibility breakage here, since changing the namespace
+against which the lookup is being done to the root cgroup namespace only
+permits a wider set of lookups to succeed now. The cgroup IDs across
+namespaces are globally unique, and thus don't need to be retranslated.
+
+Reported-by: Dan Schatzberg <dschatzberg@meta.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20250915032618.1551762-2-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cgroup.h | 1 +
+ kernel/bpf/helpers.c | 2 +-
+ kernel/cgroup/cgroup.c | 24 ++++++++++++++++++++----
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index fc1324ed597d6..2a510dbbfe623 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -631,6 +631,7 @@ static inline void cgroup_kthread_ready(void)
+ }
+
+ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen);
++struct cgroup *__cgroup_get_from_id(u64 id);
+ struct cgroup *cgroup_get_from_id(u64 id);
+ #else /* !CONFIG_CGROUPS */
+
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index a0bf39b7359aa..db4739951702e 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -2455,7 +2455,7 @@ __bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid)
+ {
+ struct cgroup *cgrp;
+
+- cgrp = cgroup_get_from_id(cgid);
++ cgrp = __cgroup_get_from_id(cgid);
+ if (IS_ERR(cgrp))
+ return NULL;
+ return cgrp;
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 5fc2801ee921c..b8cde3d1cb7bc 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -6343,15 +6343,15 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen)
+ }
+
+ /*
+- * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * __cgroup_get_from_id : get the cgroup associated with cgroup id
+ * @id: cgroup id
+ * On success return the cgrp or ERR_PTR on failure
+- * Only cgroups within current task's cgroup NS are valid.
++ * There are no cgroup NS restrictions.
+ */
+-struct cgroup *cgroup_get_from_id(u64 id)
++struct cgroup *__cgroup_get_from_id(u64 id)
+ {
+ struct kernfs_node *kn;
+- struct cgroup *cgrp, *root_cgrp;
++ struct cgroup *cgrp;
+
+ kn = kernfs_find_and_get_node_by_id(cgrp_dfl_root.kf_root, id);
+ if (!kn)
+@@ -6373,6 +6373,22 @@ struct cgroup *cgroup_get_from_id(u64 id)
+
+ if (!cgrp)
+ return ERR_PTR(-ENOENT);
++ return cgrp;
++}
++
++/*
++ * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * @id: cgroup id
++ * On success return the cgrp or ERR_PTR on failure
++ * Only cgroups within current task's cgroup NS are valid.
++ */
++struct cgroup *cgroup_get_from_id(u64 id)
++{
++ struct cgroup *cgrp, *root_cgrp;
++
++ cgrp = __cgroup_get_from_id(id);
++ if (IS_ERR(cgrp))
++ return cgrp;
+
+ root_cgrp = current_cgns_cgroup_dfl();
+ if (!cgroup_is_descendant(cgrp, root_cgrp)) {
+--
+2.51.0
+
--- /dev/null
+From 813982b278a6233b3930dcdb2f824ac011f2039a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 0477254bc2d30..aef18f0e9450e 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1263,7 +1263,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ u32 pass, void *image)
+ {
+- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ proglen, pass, image, current->comm, task_pid_nr(current));
+
+ if (image)
+--
+2.51.0
+
--- /dev/null
+From cd5fa58a99fd09cc4a4d4b288f01d3f38031b736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:18:06 +0200
+Subject: bpf: Use tnums for JEQ/JNE is_branch_taken logic
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit f41345f47fb267a9c95ca710c33448f8d0d81d83 ]
+
+In the following toy program (reg states minimized for readability), R0
+and R1 always have different values at instruction 6. This is obvious
+when reading the program but cannot be guessed from ranges alone as
+they overlap (R0 in [0; 0xc0000000], R1 in [1024; 0xc0000400]).
+
+ 0: call bpf_get_prandom_u32#7 ; R0_w=scalar()
+ 1: w0 = w0 ; R0_w=scalar(var_off=(0x0; 0xffffffff))
+ 2: r0 >>= 30 ; R0_w=scalar(var_off=(0x0; 0x3))
+ 3: r0 <<= 30 ; R0_w=scalar(var_off=(0x0; 0xc0000000))
+ 4: r1 = r0 ; R1_w=scalar(var_off=(0x0; 0xc0000000))
+ 5: r1 += 1024 ; R1_w=scalar(var_off=(0x400; 0xc0000000))
+ 6: if r1 != r0 goto pc+1
+
+Looking at tnums however, we can deduce that R1 is always different from
+R0 because their tnums don't agree on known bits. This patch uses this
+logic to improve is_scalar_branch_taken in case of BPF_JEQ and BPF_JNE.
+
+This change has a tiny impact on complexity, which was measured with
+the Cilium complexity CI test. That test covers 72 programs with
+various build and load time configurations for a total of 970 test
+cases. For 80% of test cases, the patch has no impact. On the other
+test cases, the patch decreases complexity by only 0.08% on average. In
+the best case, the verifier needs to walk 3% less instructions and, in
+the worst case, 1.5% more. Overall, the patch has a small positive
+impact, especially for our largest programs.
+
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/be3ee70b6e489c49881cb1646114b1d861b5c334.1755694147.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/tnum.h | 3 +++
+ kernel/bpf/tnum.c | 8 ++++++++
+ kernel/bpf/verifier.c | 4 ++++
+ 3 files changed, 15 insertions(+)
+
+diff --git a/include/linux/tnum.h b/include/linux/tnum.h
+index 3c13240077b87..191baf3a8d832 100644
+--- a/include/linux/tnum.h
++++ b/include/linux/tnum.h
+@@ -49,6 +49,9 @@ struct tnum tnum_xor(struct tnum a, struct tnum b);
+ /* Multiply two tnums, return @a * @b */
+ struct tnum tnum_mul(struct tnum a, struct tnum b);
+
++/* Return true if the known bits of both tnums have the same value */
++bool tnum_overlap(struct tnum a, struct tnum b);
++
+ /* Return a tnum representing numbers satisfying both @a and @b */
+ struct tnum tnum_intersect(struct tnum a, struct tnum b);
+
+diff --git a/kernel/bpf/tnum.c b/kernel/bpf/tnum.c
+index 9dbc31b25e3d0..8e6d0ac713731 100644
+--- a/kernel/bpf/tnum.c
++++ b/kernel/bpf/tnum.c
+@@ -138,6 +138,14 @@ struct tnum tnum_mul(struct tnum a, struct tnum b)
+ return tnum_add(TNUM(acc_v, 0), acc_m);
+ }
+
++bool tnum_overlap(struct tnum a, struct tnum b)
++{
++ u64 mu;
++
++ mu = ~a.mask & ~b.mask;
++ return (a.value & mu) == (b.value & mu);
++}
++
+ /* Note that if a and b disagree - i.e. one has a 'known 1' where the other has
+ * a 'known 0' - this will return a 'known 1' for that bit.
+ */
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 709151d33e5e4..218c238d61398 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -14772,6 +14772,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta
+ */
+ if (tnum_is_const(t1) && tnum_is_const(t2))
+ return t1.value == t2.value;
++ if (!tnum_overlap(t1, t2))
++ return 0;
+ /* non-overlapping ranges */
+ if (umin1 > umax2 || umax1 < umin2)
+ return 0;
+@@ -14796,6 +14798,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta
+ */
+ if (tnum_is_const(t1) && tnum_is_const(t2))
+ return t1.value != t2.value;
++ if (!tnum_overlap(t1, t2))
++ return 1;
+ /* non-overlapping ranges */
+ if (umin1 > umax2 || umax1 < umin2)
+ return 1;
+--
+2.51.0
+
--- /dev/null
+From 86078ae3096fc090675d53d2c9462a0720c797fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 07:11:07 +0100
+Subject: bpftool: Add CET-aware symbol matching for x86_64 architectures
+
+From: Yuan Chen <chenyuan@kylinos.cn>
+
+[ Upstream commit 6417ca85305ecaffef13cf9063ac35da8fba8500 ]
+
+Adjust symbol matching logic to account for Control-flow Enforcement
+Technology (CET) on x86_64 systems. CET prefixes functions with
+a 4-byte 'endbr' instruction, shifting the actual hook entry point to
+symbol + 4.
+
+Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/20250829061107.23905-3-chenyuan_fl@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/link.c | 54 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 50 insertions(+), 4 deletions(-)
+
+diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
+index 5cd503b763d72..9ce15febc6f25 100644
+--- a/tools/bpf/bpftool/link.c
++++ b/tools/bpf/bpftool/link.c
+@@ -282,11 +282,52 @@ get_addr_cookie_array(__u64 *addrs, __u64 *cookies, __u32 count)
+ return data;
+ }
+
++static bool is_x86_ibt_enabled(void)
++{
++#if defined(__x86_64__)
++ struct kernel_config_option options[] = {
++ { "CONFIG_X86_KERNEL_IBT", },
++ };
++ char *values[ARRAY_SIZE(options)] = { };
++ bool ret;
++
++ if (read_kernel_config(options, ARRAY_SIZE(options), values, NULL))
++ return false;
++
++ ret = !!values[0];
++ free(values[0]);
++ return ret;
++#else
++ return false;
++#endif
++}
++
++static bool
++symbol_matches_target(__u64 sym_addr, __u64 target_addr, bool is_ibt_enabled)
++{
++ if (sym_addr == target_addr)
++ return true;
++
++ /*
++ * On x86_64 architectures with CET (Control-flow Enforcement Technology),
++ * function entry points have a 4-byte 'endbr' instruction prefix.
++ * This causes kprobe hooks to target the address *after* 'endbr'
++ * (symbol address + 4), preserving the CET instruction.
++ * Here we check if the symbol address matches the hook target address
++ * minus 4, indicating a CET-enabled function entry point.
++ */
++ if (is_ibt_enabled && sym_addr == target_addr - 4)
++ return true;
++
++ return false;
++}
++
+ static void
+ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
+ {
+ struct addr_cookie *data;
+ __u32 i, j = 0;
++ bool is_ibt_enabled;
+
+ jsonw_bool_field(json_wtr, "retprobe",
+ info->kprobe_multi.flags & BPF_F_KPROBE_MULTI_RETURN);
+@@ -306,11 +347,13 @@ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
+ if (!dd.sym_count)
+ goto error;
+
++ is_ibt_enabled = is_x86_ibt_enabled();
+ for (i = 0; i < dd.sym_count; i++) {
+- if (dd.sym_mapping[i].address != data[j].addr)
++ if (!symbol_matches_target(dd.sym_mapping[i].address,
++ data[j].addr, is_ibt_enabled))
+ continue;
+ jsonw_start_object(json_wtr);
+- jsonw_uint_field(json_wtr, "addr", dd.sym_mapping[i].address);
++ jsonw_uint_field(json_wtr, "addr", (unsigned long)data[j].addr);
+ jsonw_string_field(json_wtr, "func", dd.sym_mapping[i].name);
+ /* Print null if it is vmlinux */
+ if (dd.sym_mapping[i].module[0] == '\0') {
+@@ -716,6 +759,7 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)
+ {
+ struct addr_cookie *data;
+ __u32 i, j = 0;
++ bool is_ibt_enabled;
+
+ if (!info->kprobe_multi.count)
+ return;
+@@ -739,12 +783,14 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)
+ if (!dd.sym_count)
+ goto error;
+
++ is_ibt_enabled = is_x86_ibt_enabled();
+ printf("\n\t%-16s %-16s %s", "addr", "cookie", "func [module]");
+ for (i = 0; i < dd.sym_count; i++) {
+- if (dd.sym_mapping[i].address != data[j].addr)
++ if (!symbol_matches_target(dd.sym_mapping[i].address,
++ data[j].addr, is_ibt_enabled))
+ continue;
+ printf("\n\t%016lx %-16llx %s",
+- dd.sym_mapping[i].address, data[j].cookie, dd.sym_mapping[i].name);
++ (unsigned long)data[j].addr, data[j].cookie, dd.sym_mapping[i].name);
+ if (dd.sym_mapping[i].module[0] != '\0')
+ printf(" [%s] ", dd.sym_mapping[i].module);
+ else
+--
+2.51.0
+
--- /dev/null
+From 51abe127425cf4766bdb411ae6500f30188ec305 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:38:47 -0700
+Subject: bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
+
+From: Tom Stellard <tstellar@redhat.com>
+
+[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
+
+This fixes the build with -Werror -Wall.
+
+btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 71 | info.func_info = ptr_to_u64(&finfo);
+ | ^~~~~
+
+prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 2294 | info.func_info = ptr_to_u64(&func_info);
+ |
+
+v2:
+ - Initialize instead of using memset.
+
+Signed-off-by: Tom Stellard <tstellar@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 2 +-
+ tools/bpf/bpftool/prog.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 527fe867a8fbd..93995275c7f66 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,
+ __u32 info_len = sizeof(info);
+ const char *prog_name = NULL;
+ struct btf *prog_btf = NULL;
+- struct bpf_func_info finfo;
++ struct bpf_func_info finfo = {};
+ __u32 finfo_rec_size;
+ char prog_str[1024];
+ int err;
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 52ffb74ae4e89..6e095a3afc046 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2207,7 +2207,7 @@ static void profile_print_readings(void)
+
+ static char *profile_target_name(int tgt_fd)
+ {
+- struct bpf_func_info func_info;
++ struct bpf_func_info func_info = {};
+ struct bpf_prog_info info = {};
+ __u32 info_len = sizeof(info);
+ const struct btf_type *t;
+--
+2.51.0
+
--- /dev/null
+From eb0b90797d77251bec96d458390dd5da846af677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 04:03:27 -0400
+Subject: clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+
+[ Upstream commit c445bffbf28f721e05d0ce06895045fc62aaff7c ]
+
+During normal operation the timers are reprogrammed including an
+interrupt acknowledgement. This has no effect as the whole timer
+is setup from scratch afterwards. Especially in an interrupt this
+has already been done by rttm_timer_interrupt().
+
+Change the behaviour as follows:
+
+- Use rttm_disable_timer() during reprogramming
+- Keep rttm_stop_timer() for all other use cases.
+
+Downstream has already tested and confirmed a patch. See
+https://github.com/openwrt/openwrt/pull/19468
+https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Stephen Howell <howels@allthatwemight.be>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20250804080328.2609287-4-markus.stockhausen@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-rtl-otto.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clocksource/timer-rtl-otto.c b/drivers/clocksource/timer-rtl-otto.c
+index 8be45a11fb8b6..24c4aa6a30131 100644
+--- a/drivers/clocksource/timer-rtl-otto.c
++++ b/drivers/clocksource/timer-rtl-otto.c
+@@ -147,7 +147,7 @@ static int rttm_next_event(unsigned long delta, struct clock_event_device *clkev
+
+ RTTM_DEBUG(to->of_base.base);
+ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+- rttm_stop_timer(to->of_base.base);
++ rttm_disable_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, delta);
+ rttm_start_timer(to, RTTM_CTRL_COUNTER);
+
+@@ -160,7 +160,7 @@ static int rttm_state_oneshot(struct clock_event_device *clkevt)
+
+ RTTM_DEBUG(to->of_base.base);
+ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+- rttm_stop_timer(to->of_base.base);
++ rttm_disable_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ rttm_start_timer(to, RTTM_CTRL_COUNTER);
+
+@@ -173,7 +173,7 @@ static int rttm_state_periodic(struct clock_event_device *clkevt)
+
+ RTTM_DEBUG(to->of_base.base);
+ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_TIMER);
+- rttm_stop_timer(to->of_base.base);
++ rttm_disable_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ rttm_start_timer(to, RTTM_CTRL_TIMER);
+
+--
+2.51.0
+
--- /dev/null
+From 71e3c7caf6a0681fdc8fbb874d5bd0da31b7aec2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 04:03:25 -0400
+Subject: clocksource/drivers/timer-rtl-otto: Work around dying timers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+
+[ Upstream commit e7a25106335041aeca4fdf50a84804c90142c886 ]
+
+The OpenWrt distribution has switched from kernel longterm 6.6 to
+6.12. Reports show that devices with the Realtek Otto switch platform
+die during operation and are rebooted by the watchdog. Sorting out
+other possible reasons the Otto timer is to blame. The platform
+currently consists of 4 targets with different hardware revisions.
+It is not 100% clear which devices and revisions are affected.
+
+Analysis shows:
+
+A more aggressive sched/deadline handling leads to more timer starts
+with small intervals. This increases the bug chances. See
+https://marc.info/?l=linux-kernel&m=175276556023276&w=2
+
+Focusing on the real issue a hardware limitation on some devices was
+found. There is a minimal chance that a timer ends without firing an
+interrupt if it is reprogrammed within the 5us before its expiration
+time. Work around this issue by introducing a bounce() function. It
+restarts the timer directly before the normal restart functions as
+follows:
+
+- Stop timer
+- Restart timer with a slow frequency.
+- Target time will be >5us
+- The subsequent normal restart is outside the critical window
+
+Downstream has already tested and confirmed a patch. See
+https://github.com/openwrt/openwrt/pull/19468
+https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Stephen Howell <howels@allthatwemight.be>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20250804080328.2609287-2-markus.stockhausen@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-rtl-otto.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clocksource/timer-rtl-otto.c b/drivers/clocksource/timer-rtl-otto.c
+index 8a3068b36e752..8be45a11fb8b6 100644
+--- a/drivers/clocksource/timer-rtl-otto.c
++++ b/drivers/clocksource/timer-rtl-otto.c
+@@ -38,6 +38,7 @@
+ #define RTTM_BIT_COUNT 28
+ #define RTTM_MIN_DELTA 8
+ #define RTTM_MAX_DELTA CLOCKSOURCE_MASK(28)
++#define RTTM_MAX_DIVISOR GENMASK(15, 0)
+
+ /*
+ * Timers are derived from the LXB clock frequency. Usually this is a fixed
+@@ -112,6 +113,22 @@ static irqreturn_t rttm_timer_interrupt(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
++static void rttm_bounce_timer(void __iomem *base, u32 mode)
++{
++ /*
++ * When a running timer has less than ~5us left, a stop/start sequence
++ * might fail. While the details are unknown the most evident effect is
++ * that the subsequent interrupt will not be fired.
++ *
++ * As a workaround issue an intermediate restart with a very slow
++ * frequency of ~3kHz keeping the target counter (>=8). So the follow
++ * up restart will always be issued outside the critical window.
++ */
++
++ rttm_disable_timer(base);
++ rttm_enable_timer(base, mode, RTTM_MAX_DIVISOR);
++}
++
+ static void rttm_stop_timer(void __iomem *base)
+ {
+ rttm_disable_timer(base);
+@@ -129,6 +146,7 @@ static int rttm_next_event(unsigned long delta, struct clock_event_device *clkev
+ struct timer_of *to = to_timer_of(clkevt);
+
+ RTTM_DEBUG(to->of_base.base);
++ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+ rttm_stop_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, delta);
+ rttm_start_timer(to, RTTM_CTRL_COUNTER);
+@@ -141,6 +159,7 @@ static int rttm_state_oneshot(struct clock_event_device *clkevt)
+ struct timer_of *to = to_timer_of(clkevt);
+
+ RTTM_DEBUG(to->of_base.base);
++ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+ rttm_stop_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ rttm_start_timer(to, RTTM_CTRL_COUNTER);
+@@ -153,6 +172,7 @@ static int rttm_state_periodic(struct clock_event_device *clkevt)
+ struct timer_of *to = to_timer_of(clkevt);
+
+ RTTM_DEBUG(to->of_base.base);
++ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_TIMER);
+ rttm_stop_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ rttm_start_timer(to, RTTM_CTRL_TIMER);
+--
+2.51.0
+
--- /dev/null
+From 3cc1f3042aac83fb4ea86f9123dec69d56d6c322 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+
+ static inline void pit_timer_enable(void)
+ {
+- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_timer_disable(void)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
++ writel(0, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_irq_acknowledge(void)
+ {
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+
+ static u64 notrace pit_read_sched_clock(void)
+ {
+- return ~__raw_readl(clksrc_base + PITCVAL);
++ return ~readl(clksrc_base + PITCVAL);
+ }
+
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ /* set the max load value and start the clock source counter */
+- __raw_writel(0, clksrc_base + PITTCTRL);
+- __raw_writel(~0UL, clksrc_base + PITLDVAL);
+- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++ writel(0, clksrc_base + PITTCTRL);
++ writel(~0UL, clksrc_base + PITLDVAL);
++ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+
+ sched_clock_register(pit_read_sched_clock, 32, rate);
+ return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ * hardware requirement.
+ */
+ pit_timer_disable();
+- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
++ writel(delta - 1, clkevt_base + PITLDVAL);
+ pit_timer_enable();
+
+ return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(0, clkevt_base + PITTCTRL);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+
+ BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ cycle_per_jiffy = clk_rate / (HZ);
+
+ /* enable the pit module */
+- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++ writel(~PITMCR_MDIS, timer_base + PITMCR);
+
+ ret = pit_clocksource_init(clk_rate);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From b6438fe683e444cd40d820aab31ebb053389928b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index bd6fe8638d399..02767c1f9edef 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -954,6 +954,9 @@ static void __exit longhaul_exit(void)
+ struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ int i;
+
++ if (unlikely(!policy))
++ return;
++
+ for (i = 0; i < numscales; i++) {
+ if (mults[i] == maxmult) {
+ struct cpufreq_freqs freqs;
+--
+2.51.0
+
--- /dev/null
+From dcaed5ecaaab85f1363a28252eb329be9eb525e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:06:55 -0700
+Subject: cpufreq: ondemand: Update the efficient idle check for Intel extended
+ Families
+
+From: Sohil Mehta <sohil.mehta@intel.com>
+
+[ Upstream commit 7f3cfb7943d27a7b61bdac8db739cf0bdc28e87d ]
+
+IO time is considered busy by default for modern Intel processors. The
+current check covers recent Family 6 models but excludes the brand new
+Families 18 and 19.
+
+According to Arjan van de Ven, the model check was mainly due to a lack
+of testing on systems before INTEL_CORE2_MEROM. He suggests considering
+all Intel processors as having an efficient idle.
+
+Extend the IO busy classification to all Intel processors starting with
+Family 6, including Family 15 (Pentium 4s) and upcoming Families 18/19.
+
+Use an x86 VFM check and move the function to the header file to avoid
+using arch-specific #ifdefs in the C file.
+
+Signed-off-by: Sohil Mehta <sohil.mehta@intel.com>
+Link: https://patch.msgid.link/20250908230655.2562440-1-sohil.mehta@intel.com
+[ rjw: Added empty line after #include ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq_ondemand.c | 25 +------------------------
+ drivers/cpufreq/cpufreq_ondemand.h | 23 +++++++++++++++++++++++
+ 2 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
+index 0e65d37c92311..a6ecc203f7b7f 100644
+--- a/drivers/cpufreq/cpufreq_ondemand.c
++++ b/drivers/cpufreq/cpufreq_ondemand.c
+@@ -29,29 +29,6 @@ static struct od_ops od_ops;
+
+ static unsigned int default_powersave_bias;
+
+-/*
+- * Not all CPUs want IO time to be accounted as busy; this depends on how
+- * efficient idling at a higher frequency/voltage is.
+- * Pavel Machek says this is not so for various generations of AMD and old
+- * Intel systems.
+- * Mike Chan (android.com) claims this is also not true for ARM.
+- * Because of this, whitelist specific known (series) of CPUs by default, and
+- * leave all others up to the user.
+- */
+-static int should_io_be_busy(void)
+-{
+-#if defined(CONFIG_X86)
+- /*
+- * For Intel, Core 2 (model 15) and later have an efficient idle.
+- */
+- if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+- boot_cpu_data.x86 == 6 &&
+- boot_cpu_data.x86_model >= 15)
+- return 1;
+-#endif
+- return 0;
+-}
+-
+ /*
+ * Find right freq to be set now with powersave_bias on.
+ * Returns the freq_hi to be used right now and will set freq_hi_delay_us,
+@@ -377,7 +354,7 @@ static int od_init(struct dbs_data *dbs_data)
+ dbs_data->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
+ dbs_data->ignore_nice_load = 0;
+ tuners->powersave_bias = default_powersave_bias;
+- dbs_data->io_is_busy = should_io_be_busy();
++ dbs_data->io_is_busy = od_should_io_be_busy();
+
+ dbs_data->tuners = tuners;
+ return 0;
+diff --git a/drivers/cpufreq/cpufreq_ondemand.h b/drivers/cpufreq/cpufreq_ondemand.h
+index 1af8e5c4b86fd..2ca8f1aaf2e34 100644
+--- a/drivers/cpufreq/cpufreq_ondemand.h
++++ b/drivers/cpufreq/cpufreq_ondemand.h
+@@ -24,3 +24,26 @@ static inline struct od_policy_dbs_info *to_dbs_info(struct policy_dbs_info *pol
+ struct od_dbs_tuners {
+ unsigned int powersave_bias;
+ };
++
++#ifdef CONFIG_X86
++#include <asm/cpu_device_id.h>
++
++/*
++ * Not all CPUs want IO time to be accounted as busy; this depends on
++ * how efficient idling at a higher frequency/voltage is.
++ *
++ * Pavel Machek says this is not so for various generations of AMD and
++ * old Intel systems. Mike Chan (android.com) claims this is also not
++ * true for ARM.
++ *
++ * Because of this, select a known series of Intel CPUs (Family 6 and
++ * later) by default, and leave all others up to the user.
++ */
++static inline bool od_should_io_be_busy(void)
++{
++ return (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
++ boot_cpu_data.x86_vfm >= INTEL_PENTIUM_PRO);
++}
++#else
++static inline bool od_should_io_be_busy(void) { return false; }
++#endif
+--
+2.51.0
+
--- /dev/null
+From c1b71c118e8c62e7666a23381aea17f0b31186c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:03:31 +0530
+Subject: cpufreq: ti: Add support for AM62D2
+
+From: Paresh Bhagat <p-bhagat@ti.com>
+
+[ Upstream commit b5af45302ebc141662b2b60c713c9202e88c943c ]
+
+Add support for TI K3 AM62D2 SoC to read speed and revision values
+from hardware and pass to OPP layer. AM62D shares the same configuations
+as AM62A so use existing am62a7_soc_data.
+
+Signed-off-by: Paresh Bhagat <p-bhagat@ti.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/ti-cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
+index ba621ce1cdda6..190e30b1c5532 100644
+--- a/drivers/cpufreq/ti-cpufreq.c
++++ b/drivers/cpufreq/ti-cpufreq.c
+@@ -308,6 +308,7 @@ static const struct soc_device_attribute k3_cpufreq_soc[] = {
+ { .family = "AM62X", .revision = "SR1.0" },
+ { .family = "AM62AX", .revision = "SR1.0" },
+ { .family = "AM62PX", .revision = "SR1.0" },
++ { .family = "AM62DX", .revision = "SR1.0" },
+ { /* sentinel */ }
+ };
+
+@@ -453,6 +454,7 @@ static const struct of_device_id ti_cpufreq_of_match[] __maybe_unused = {
+ { .compatible = "ti,omap36xx", .data = &omap36xx_soc_data, },
+ { .compatible = "ti,am625", .data = &am625_soc_data, },
+ { .compatible = "ti,am62a7", .data = &am62a7_soc_data, },
++ { .compatible = "ti,am62d2", .data = &am62a7_soc_data, },
+ { .compatible = "ti,am62p5", .data = &am62p5_soc_data, },
+ /* legacy */
+ { .compatible = "ti,omap3430", .data = &omap34xx_soc_data, },
+--
+2.51.0
+
--- /dev/null
+From 30841c61bbf186cc6647bd6afd407bb5f6b72932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 9e418aec17550..0e1bbc966135d 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -631,8 +631,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++ unsigned int cpu = dev->cpu;
+ int i, ret;
+
++ if (per_cpu(cpuidle_devices, cpu)) {
++ pr_info("CPU%d: cpuidle device already registered\n", cpu);
++ return -EEXIST;
++ }
++
+ if (!try_module_get(drv->owner))
+ return -EINVAL;
+
+@@ -644,7 +650,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ }
+
+- per_cpu(cpuidle_devices, dev->cpu) = dev;
++ per_cpu(cpuidle_devices, cpu) = dev;
+ list_add(&dev->device_list, &cpuidle_detected_devices);
+
+ ret = cpuidle_coupled_register_device(dev);
+--
+2.51.0
+
--- /dev/null
+From 1b5e3579bfdd8c570c8221a702ad62dbd239656e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 12:09:52 +0900
+Subject: firewire: ohci: move self_id_complete tracepoint after validating
+ register
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 696968262aeee51e1c0529c3c060ddd180702e02 ]
+
+The value of OHCI1394_SelfIDCount register includes an error-indicating
+bit. It is safer to place the tracepoint probe after validating the
+register value.
+
+Link: https://lore.kernel.org/r/20250823030954.268412-2-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firewire/ohci.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 7ee55c2804ded..90fcab1f65bcd 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -2060,6 +2060,9 @@ static void bus_reset_work(struct work_struct *work)
+ ohci_notice(ohci, "self ID receive error\n");
+ return;
+ }
++
++ trace_self_id_complete(ohci->card.index, reg, ohci->self_id, has_be_header_quirk(ohci));
++
+ /*
+ * The count in the SelfIDCount register is the number of
+ * bytes in the self ID receive buffer. Since we also receive
+@@ -2228,15 +2231,8 @@ static irqreturn_t irq_handler(int irq, void *data)
+ if (event & OHCI1394_busReset)
+ reg_write(ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);
+
+- if (event & OHCI1394_selfIDComplete) {
+- if (trace_self_id_complete_enabled()) {
+- u32 reg = reg_read(ohci, OHCI1394_SelfIDCount);
+-
+- trace_self_id_complete(ohci->card.index, reg, ohci->self_id,
+- has_be_header_quirk(ohci));
+- }
++ if (event & OHCI1394_selfIDComplete)
+ queue_work(selfid_workqueue, &ohci->bus_reset_work);
+- }
+
+ if (event & OHCI1394_RQPkt)
+ tasklet_schedule(&ohci->ar_request_ctx.tasklet);
+--
+2.51.0
+
--- /dev/null
+From c1de1166be07b60c5866dbeb06d709dda5735930 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:14:51 +0530
+Subject: firmware: qcom: scm: preserve assign_mem() error return value
+
+From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+
+[ Upstream commit 121fcf3c871181edce0708a49d2397cedd6ad21f ]
+
+When qcom_scm_assign_mem() fails, the error value is currently being
+overwritten after it is logged, resulting in the loss of the original
+error code. Fix this by retaining and returning the original error value
+as intended.
+
+Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250807124451.2623019-1-mukesh.ojha@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index 23aefbf6fca58..1da16bc79391c 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -1093,7 +1093,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ if (ret) {
+ dev_err(__scm->dev,
+ "Assign memory protection call failed %d\n", ret);
+- return -EINVAL;
++ return ret;
+ }
+
+ *srcvm = next_vm;
+--
+2.51.0
+
--- /dev/null
+From 3a76727ae7729218bb719f56725021970fe8437d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 18:28:03 +0500
+Subject: firmware: qcom: tzmem: disable sc7180 platform
+
+From: Nikita Travkin <nikita@trvn.ru>
+
+[ Upstream commit 3cc9a8cadaf66e1a53e5fee48f8bcdb0a3fd5075 ]
+
+When SHM bridge is enabled, assigning RMTFS memory causes the calling
+core to hang if the system is running in EL1.
+
+Disable SHM bridge on sc7180 devices to avoid that hang.
+
+Signed-off-by: Nikita Travkin <nikita@trvn.ru>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250721-sc7180-shm-hang-v1-1-99ad9ffeb5b4@trvn.ru
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_tzmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/qcom/qcom_tzmem.c b/drivers/firmware/qcom/qcom_tzmem.c
+index 92b3651782355..f8fef622e48fe 100644
+--- a/drivers/firmware/qcom/qcom_tzmem.c
++++ b/drivers/firmware/qcom/qcom_tzmem.c
+@@ -76,6 +76,7 @@ static bool qcom_tzmem_using_shm_bridge;
+
+ /* List of machines that are known to not support SHM bridge correctly. */
+ static const char *const qcom_tzmem_blacklist[] = {
++ "qcom,sc7180", /* hang in rmtfs memory assignment */
+ "qcom,sc8180x",
+ "qcom,sdm670", /* failure in GPU firmware loading */
+ "qcom,sdm845", /* reset in rmtfs memory assignment */
+--
+2.51.0
+
--- /dev/null
+From 8a9b1c9131015dadc23e0a091d78086a0c8462e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:51:54 +0530
+Subject: futex: Don't leak robust_list pointer on exec race
+
+From: Pranav Tyagi <pranav.tyagi03@gmail.com>
+
+[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
+
+sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
+to check if the calling task is allowed to access another task's
+robust_list pointer. This check is racy against a concurrent exec() in the
+target process.
+
+During exec(), a task may transition from a non-privileged binary to a
+privileged one (e.g., setuid binary) and its credentials/memory mappings
+may change. If get_robust_list() performs ptrace_may_access() before
+this transition, it may erroneously allow access to sensitive information
+after the target becomes privileged.
+
+A racy access allows an attacker to exploit a window during which
+ptrace_may_access() passes before a target process transitions to a
+privileged state via exec().
+
+For example, consider a non-privileged task T that is about to execute a
+setuid-root binary. An attacker task A calls get_robust_list(T) while T
+is still unprivileged. Since ptrace_may_access() checks permissions
+based on current credentials, it succeeds. However, if T begins exec
+immediately afterwards, it becomes privileged and may change its memory
+mappings. Because get_robust_list() proceeds to access T->robust_list
+without synchronizing with exec() it may read user-space pointers from a
+now-privileged process.
+
+This violates the intended post-exec access restrictions and could
+expose sensitive memory addresses or be used as a primitive in a larger
+exploit chain. Consequently, the race can lead to unauthorized
+disclosure of information across privilege boundaries and poses a
+potential security risk.
+
+Take a read lock on signal->exec_update_lock prior to invoking
+ptrace_may_access() and accessing the robust_list/compat_robust_list.
+This ensures that the target task's exec state remains stable during the
+check, allowing for consistent and synchronized validation of
+credentials.
+
+Suggested-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/
+Link: https://github.com/KSPP/linux/issues/119
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/syscalls.c | 106 +++++++++++++++++++++-------------------
+ 1 file changed, 56 insertions(+), 50 deletions(-)
+
+diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
+index 4b6da9116aa6c..880c9bf2f3150 100644
+--- a/kernel/futex/syscalls.c
++++ b/kernel/futex/syscalls.c
+@@ -39,6 +39,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ return 0;
+ }
+
++static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat)
++{
++#ifdef CONFIG_COMPAT
++ if (compat)
++ return p->compat_robust_list;
++#endif
++ return p->robust_list;
++}
++
++static void __user *futex_get_robust_list_common(int pid, bool compat)
++{
++ struct task_struct *p = current;
++ void __user *head;
++ int ret;
++
++ scoped_guard(rcu) {
++ if (pid) {
++ p = find_task_by_vpid(pid);
++ if (!p)
++ return (void __user *)ERR_PTR(-ESRCH);
++ }
++ get_task_struct(p);
++ }
++
++ /*
++ * Hold exec_update_lock to serialize with concurrent exec()
++ * so ptrace_may_access() is checked against stable credentials
++ */
++ ret = down_read_killable(&p->signal->exec_update_lock);
++ if (ret)
++ goto err_put;
++
++ ret = -EPERM;
++ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
++ goto err_unlock;
++
++ head = futex_task_robust_list(p, compat);
++
++ up_read(&p->signal->exec_update_lock);
++ put_task_struct(p);
++
++ return head;
++
++err_unlock:
++ up_read(&p->signal->exec_update_lock);
++err_put:
++ put_task_struct(p);
++ return (void __user *)ERR_PTR(ret);
++}
++
+ /**
+ * sys_get_robust_list() - Get the robust-futex list head of a task
+ * @pid: pid of the process [zero for current task]
+@@ -49,36 +99,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ struct robust_list_head __user * __user *, head_ptr,
+ size_t __user *, len_ptr)
+ {
+- struct robust_list_head __user *head;
+- unsigned long ret;
+- struct task_struct *p;
+-
+- rcu_read_lock();
+-
+- ret = -ESRCH;
+- if (!pid)
+- p = current;
+- else {
+- p = find_task_by_vpid(pid);
+- if (!p)
+- goto err_unlock;
+- }
+-
+- ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+- goto err_unlock;
++ struct robust_list_head __user *head = futex_get_robust_list_common(pid, false);
+
+- head = p->robust_list;
+- rcu_read_unlock();
++ if (IS_ERR(head))
++ return PTR_ERR(head);
+
+ if (put_user(sizeof(*head), len_ptr))
+ return -EFAULT;
+ return put_user(head, head_ptr);
+-
+-err_unlock:
+- rcu_read_unlock();
+-
+- return ret;
+ }
+
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+@@ -455,36 +483,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+ compat_uptr_t __user *, head_ptr,
+ compat_size_t __user *, len_ptr)
+ {
+- struct compat_robust_list_head __user *head;
+- unsigned long ret;
+- struct task_struct *p;
+-
+- rcu_read_lock();
+-
+- ret = -ESRCH;
+- if (!pid)
+- p = current;
+- else {
+- p = find_task_by_vpid(pid);
+- if (!p)
+- goto err_unlock;
+- }
+-
+- ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+- goto err_unlock;
++ struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true);
+
+- head = p->compat_robust_list;
+- rcu_read_unlock();
++ if (IS_ERR(head))
++ return PTR_ERR(head);
+
+ if (put_user(sizeof(*head), len_ptr))
+ return -EFAULT;
+ return put_user(ptr_to_compat(head), head_ptr);
+-
+-err_unlock:
+- rcu_read_unlock();
+-
+- return ret;
+ }
+ #endif /* CONFIG_COMPAT */
+
+--
+2.51.0
+
--- /dev/null
+From 4f4bd7124a9a16eb9ea56565e4ba018c13d474ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 21:26:56 +0200
+Subject: hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
+
+From: Ben Copeland <ben.copeland@linaro.org>
+
+[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
+
+Some motherboards require more time to acquire the ACPI mutex,
+causing "Failed to acquire mutex" messages to appear in the kernel log.
+Increase the timeout from 500ms to 800ms to accommodate these cases.
+
+Signed-off-by: Ben Copeland <ben.copeland@linaro.org>
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index fdc157c7394d9..483dfb806cc51 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -49,7 +49,7 @@ static char *mutex_path_override;
+ */
+ #define ASUS_EC_MAX_BANK 3
+
+-#define ACPI_LOCK_DELAY_MS 500
++#define ACPI_LOCK_DELAY_MS 800
+
+ /* ACPI mutex for locking access to the EC for the firmware */
+ #define ASUS_HW_ACCESS_MUTEX_ASMX "\\AMW0.ASMX"
+--
+2.51.0
+
--- /dev/null
+From a0a2d968cd62ee37f98b67c5454c03f990cb7d4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:33 +0200
+Subject: hwmon: (dell-smm) Remove Dell Precision 490 custom config data
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit ddb61e737f04e3c6c8299c1e00bf17a42a7f05cf ]
+
+It turns out the second fan on the Dell Precision 490 does not
+really support I8K_FAN_TURBO. Setting the fan state to 3 enables
+automatic fan control, just like on the other two fans.
+The reason why this was misinterpreted as turbo mode was that
+the second fan normally spins faster in automatic mode than
+in the previous fan states. Yet when in state 3, the fan speed
+reacts to heat exposure, exposing the automatic mode setting.
+
+Link: https://github.com/lm-sensors/lm-sensors/pull/383
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-2-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index b043fbd15c9da..f73f461937482 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1324,7 +1324,6 @@ struct i8k_config_data {
+
+ enum i8k_configs {
+ DELL_LATITUDE_D520,
+- DELL_PRECISION_490,
+ DELL_STUDIO,
+ DELL_XPS,
+ };
+@@ -1334,10 +1333,6 @@ static const struct i8k_config_data i8k_config_data[] __initconst = {
+ .fan_mult = 1,
+ .fan_max = I8K_FAN_TURBO,
+ },
+- [DELL_PRECISION_490] = {
+- .fan_mult = 1,
+- .fan_max = I8K_FAN_TURBO,
+- },
+ [DELL_STUDIO] = {
+ .fan_mult = 1,
+ .fan_max = I8K_FAN_HIGH,
+@@ -1357,15 +1352,6 @@ static const struct dmi_system_id i8k_config_dmi_table[] __initconst = {
+ },
+ .driver_data = (void *)&i8k_config_data[DELL_LATITUDE_D520],
+ },
+- {
+- .ident = "Dell Precision 490",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME,
+- "Precision WorkStation 490"),
+- },
+- .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+- },
+ {
+ .ident = "Dell Studio",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 9cb78ef2dcedc74d0d609da7e4175d40c44bd77e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 02:04:41 +0800
+Subject: hwmon: (k10temp) Add device ID for Strix Halo
+
+From: Rong Zhang <i@rong.moe>
+
+[ Upstream commit e5d1e313d7b6272d6dfda983906d99f97ad9062b ]
+
+The device ID of Strix Halo Data Fabric Function 3 has been in the tree
+since commit 0e640f0a47d8 ("x86/amd_nb: Add new PCI IDs for AMD family
+0x1a"), but is somehow missing from k10temp_id_table.
+
+Add it so that it works out of the box.
+
+Tested on Beelink GTR9 Pro Mini PC.
+
+Signed-off-by: Rong Zhang <i@rong.moe>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250823180443.85512-1-i@rong.moe
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index c457ba4706197..ccf0e9e853acd 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -551,6 +551,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ {}
+--
+2.51.0
+
--- /dev/null
+From d84edc9012995d8096998ba5587fd98f8f4c9ab6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 00:15:43 +0000
+Subject: hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
+
+From: Avadhut Naik <avadhut.naik@amd.com>
+
+[ Upstream commit f116af2eb51ed9df24911537fda32a033f1c58da ]
+
+Add thermal info support for newer AMD Family 1Ah-based models.
+
+Signed-off-by: Avadhut Naik <avadhut.naik@amd.com>
+Link: https://lore.kernel.org/r/20250729001644.257645-1-avadhut.naik@amd.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 7dc19c5d62ac3..c457ba4706197 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -84,6 +84,13 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+ */
+ #define AMD_I3255_STR "3255"
+
++/*
++ * PCI Device IDs for AMD's Family 1Ah-based SOCs.
++ * Defining locally as IDs are not shared.
++ */
++#define PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3 0x12cb
++#define PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3 0x127b
++
+ struct k10temp_data {
+ struct pci_dev *pdev;
+ void (*read_htcreg)(struct pci_dev *pdev, u32 *regval);
+@@ -542,7 +549,9 @@ static const struct pci_device_id k10temp_id_table[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ {}
+ };
+--
+2.51.0
+
--- /dev/null
+From aed085899a40271acc87a6148472ecbd9acf9fce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 06:32:28 -0400
+Subject: hwmon: (lenovo-ec-sensors) Update P8 supprt
+
+From: David Ober <dober6023@gmail.com>
+
+[ Upstream commit 43c056ac85b60232861005765153707f1b0354b6 ]
+
+This fixes differences for the P8 system that was initially set to
+the same thermal values as the P7, also adds in the PSU sensor for
+all of the supported systems
+
+Signed-off-by: David Ober <dober@lenovo.com>
+Signed-off-by: David Ober <dober6023@gmail.com>
+Link: https://lore.kernel.org/r/20250807103228.10465-1-dober6023@gmail.com
+[groeck: Update subject]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lenovo-ec-sensors.c | 34 +++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwmon/lenovo-ec-sensors.c b/drivers/hwmon/lenovo-ec-sensors.c
+index 143fb79713f7d..8681bbf6665b1 100644
+--- a/drivers/hwmon/lenovo-ec-sensors.c
++++ b/drivers/hwmon/lenovo-ec-sensors.c
+@@ -66,7 +66,7 @@ enum systems {
+ LENOVO_P8,
+ };
+
+-static int px_temp_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
++static int px_temp_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 31, 32};
+
+ static const char * const lenovo_px_ec_temp_label[] = {
+ "CPU1",
+@@ -84,9 +84,29 @@ static const char * const lenovo_px_ec_temp_label[] = {
+ "PCI_Z3",
+ "PCI_Z4",
+ "AMB",
++ "PSU1",
++ "PSU2",
+ };
+
+-static int gen_temp_map[] = {0, 2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
++static int p8_temp_map[] = {0, 1, 2, 8, 9, 13, 14, 15, 16, 17, 19, 20, 33};
++
++static const char * const lenovo_p8_ec_temp_label[] = {
++ "CPU1",
++ "CPU_DIMM_BANK1",
++ "CPU_DIMM_BANK2",
++ "M2_Z2R",
++ "M2_Z3R",
++ "DIMM_RIGHT",
++ "DIMM_LEFT",
++ "PCI_Z1",
++ "PCI_Z2",
++ "PCI_Z3",
++ "AMB",
++ "REAR_VR",
++ "PSU",
++};
++
++static int gen_temp_map[] = {0, 2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 31};
+
+ static const char * const lenovo_gen_ec_temp_label[] = {
+ "CPU1",
+@@ -101,6 +121,7 @@ static const char * const lenovo_gen_ec_temp_label[] = {
+ "PCI_Z3",
+ "PCI_Z4",
+ "AMB",
++ "PSU",
+ };
+
+ static int px_fan_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
+@@ -293,6 +314,8 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_px[] = {
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL),
+ HWMON_CHANNEL_INFO(fan,
+ HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -327,6 +350,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p8[] = {
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL),
+ HWMON_CHANNEL_INFO(fan,
+ HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -359,6 +383,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p7[] = {
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL),
+ HWMON_CHANNEL_INFO(fan,
+ HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -388,6 +413,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p5[] = {
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL),
+ HWMON_CHANNEL_INFO(fan,
+ HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -545,9 +571,9 @@ static int lenovo_ec_probe(struct platform_device *pdev)
+ break;
+ case 3:
+ ec_data->fan_labels = p8_ec_fan_label;
+- ec_data->temp_labels = lenovo_gen_ec_temp_label;
++ ec_data->temp_labels = lenovo_p8_ec_temp_label;
+ ec_data->fan_map = p8_fan_map;
+- ec_data->temp_map = gen_temp_map;
++ ec_data->temp_map = p8_temp_map;
+ lenovo_ec_chip_info.info = lenovo_ec_hwmon_info_p8;
+ break;
+ default:
+--
+2.51.0
+
--- /dev/null
+From 65ef876a18d99c1d0409cbd558b158d1d3152bc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index 3c839f56c4603..a6c439e376ff7 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+
+ /*
+ * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -29,8 +30,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC 0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC 0x14 /* RW */
+
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT 5
+
++#define SBTSI_TEMP_EXT_RANGE_ADJ 49000
++
+ #define SBTSI_TEMP_MIN 0
+ #define SBTSI_TEMP_MAX 255875
+
+@@ -38,6 +53,8 @@
+ struct sbtsi_data {
+ struct i2c_client *client;
+ struct mutex lock;
++ bool ext_range_mode;
++ bool read_order;
+ };
+
+ /*
+@@ -74,23 +91,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ struct sbtsi_data *data = dev_get_drvdata(dev);
+ s32 temp_int, temp_dec;
+- int err;
+
+ switch (attr) {
+ case hwmon_temp_input:
+- /*
+- * ReadOrder bit specifies the reading order of integer and
+- * decimal part of CPU temp for atomic reads. If bit == 0,
+- * reading integer part triggers latching of the decimal part,
+- * so integer part should be read first. If bit == 1, read
+- * order should be reversed.
+- */
+- err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+- if (err < 0)
+- return err;
+-
+ mutex_lock(&data->lock);
+- if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++ if (data->read_order) {
+ temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ } else {
+@@ -122,6 +127,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ return temp_dec;
+
+ *val = sbtsi_reg_to_mc(temp_int, temp_dec);
++ if (data->ext_range_mode)
++ *val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+
+ return 0;
+ }
+@@ -146,6 +153,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ return -EINVAL;
+ }
+
++ if (data->ext_range_mode)
++ val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+
+@@ -203,6 +212,7 @@ static int sbtsi_probe(struct i2c_client *client)
+ struct device *dev = &client->dev;
+ struct device *hwmon_dev;
+ struct sbtsi_data *data;
++ int err;
+
+ data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ if (!data)
+@@ -211,8 +221,14 @@ static int sbtsi_probe(struct i2c_client *client)
+ data->client = client;
+ mutex_init(&data->lock);
+
+- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+- NULL);
++ err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++ if (err < 0)
++ return err;
++ data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++ data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++ hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++ &sbtsi_chip_info, NULL);
+
+ return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From 6064c18733a4ff905931c9b2839fb1a24b2ba957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:02:49 +0200
+Subject: hwmon: sy7636a: add alias
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
+
+Add module alias to have it autoloaded.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sy7636a-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
+index ed110884786b4..a12fc0ce70e76 100644
+--- a/drivers/hwmon/sy7636a-hwmon.c
++++ b/drivers/hwmon/sy7636a-hwmon.c
+@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);
+
+ MODULE_DESCRIPTION("SY7636A sensor driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:sy7636a-temperature");
+--
+2.51.0
+
--- /dev/null
+From 88c7456f4f4cc88cd6db330486853123a194f4d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 16:17:32 +0300
+Subject: i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit d515503f3c8a8475b2f78782534aad09722904e1 ]
+
+Add I3C controller PCI IDs on Intel Wildcat Lake-U.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250808131732.1213227-1-jarkko.nikula@linux.intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
+index c6c3a3ec11eae..08e6cbdf89cea 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
++++ b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
+@@ -124,6 +124,9 @@ static void mipi_i3c_hci_pci_remove(struct pci_dev *pci)
+ }
+
+ static const struct pci_device_id mipi_i3c_hci_pci_devices[] = {
++ /* Wildcat Lake-U */
++ { PCI_VDEVICE(INTEL, 0x4d7c), (kernel_ulong_t)&intel_info},
++ { PCI_VDEVICE(INTEL, 0x4d6f), (kernel_ulong_t)&intel_info},
+ /* Panther Lake-H */
+ { PCI_VDEVICE(INTEL, 0xe37c), (kernel_ulong_t)&intel_info},
+ { PCI_VDEVICE(INTEL, 0xe36f), (kernel_ulong_t)&intel_info},
+--
+2.51.0
+
--- /dev/null
+From dec3e0c243355695cd200438ea08a51d33c97a33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 15:40:57 +0100
+Subject: io_uring/zctx: check chained notif contexts
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit ab3ea6eac5f45669b091309f592c4ea324003053 ]
+
+Send zc only links ubuf_info for requests coming from the same context.
+There are some ambiguous syz reports, so let's check the assumption on
+notification completion.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/fd527d8638203fe0f1c5ff06ff2e1d8fd68f831b.1755179962.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/notif.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/io_uring/notif.c b/io_uring/notif.c
+index d4cf5a1328e63..f50964c7dab82 100644
+--- a/io_uring/notif.c
++++ b/io_uring/notif.c
+@@ -14,10 +14,15 @@ static const struct ubuf_info_ops io_ubuf_ops;
+ static void io_notif_tw_complete(struct io_kiocb *notif, struct io_tw_state *ts)
+ {
+ struct io_notif_data *nd = io_notif_to_data(notif);
++ struct io_ring_ctx *ctx = notif->ctx;
++
++ lockdep_assert_held(&ctx->uring_lock);
+
+ do {
+ notif = cmd_to_io_kiocb(nd);
+
++ if (WARN_ON_ONCE(ctx != notif->ctx))
++ return;
+ lockdep_assert(refcount_read(&nd->uarg.refcnt) == 0);
+
+ if (unlikely(nd->zc_report) && (nd->zc_copied || !nd->zc_used))
+--
+2.51.0
+
--- /dev/null
+From dee879a99924da1b9c582a9fa7a1a745b8523956 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index a1e370d0200f1..b5479c552b776 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -156,14 +156,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ msi_alloc_info_t *info = args;
+ struct v2m_data *v2m = NULL, *tmp;
+- int hwirq, offset, i, err = 0;
++ int hwirq, i, err = 0;
++ unsigned long offset;
++ unsigned long align_mask = nr_irqs - 1;
+
+ spin_lock(&v2m_lock);
+ list_for_each_entry(tmp, &v2m_nodes, entry) {
+- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+- get_count_order(nr_irqs));
+- if (offset >= 0) {
++ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++ nr_irqs, align_mask, align_off);
++ if (offset < tmp->nr_spis) {
+ v2m = tmp;
++ bitmap_set(v2m->bm, offset, nr_irqs);
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From ef33e9963b1daa03f7d06f79a48045352e6de35b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:40 +0800
+Subject: irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ
+ controller
+
+From: Ming Wang <wangming01@loongson.cn>
+
+[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
+
+On certain Loongson platforms, drivers attempting to request a legacy
+ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The
+virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
+
+This issue does not affect ACPI-enumerated devices described in DSDT,
+as their interrupts are properly mapped via the GSI translation path.
+This indicates the LPC irqdomain itself is functional but is not correctly
+handling direct VIRQ-to-HWIRQ mappings.
+
+The root cause is the use of irq_domain_create_linear(). This API sets
+up a domain for dynamic, on-demand mapping, typically triggered by a GSI
+request. It does not pre-populate the mappings for the legacy VIRQ range
+(0-15). Consequently, if no ACPI device claims a specific GSI
+(e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to
+the LPC domain. A direct call to request_irq(4, ...) then fails because
+the kernel cannot resolve this VIRQ to a hardware interrupt managed by
+the LPC controller.
+
+The PCH-LPC interrupt controller is an i8259-compatible legacy device
+that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to
+support legacy drivers.
+
+Fix this by replacing irq_domain_create_linear() with
+irq_domain_create_legacy(). This API is specifically designed for such
+controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ
+mapping for the entire legacy range (0-15) immediately upon domain
+creation. This ensures that any VIRQ in this range is always resolvable,
+making direct calls to request_irq() for legacy IRQs function correctly.
+
+Signed-off-by: Ming Wang <wangming01@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c
+index 2d4c3ec128b8f..912bf50a5c7ca 100644
+--- a/drivers/irqchip/irq-loongson-pch-lpc.c
++++ b/drivers/irqchip/irq-loongson-pch-lpc.c
+@@ -200,8 +200,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent,
+ goto iounmap_base;
+ }
+
+- priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT,
+- &pch_lpc_domain_ops, priv);
++ /*
++ * The LPC interrupt controller is a legacy i8259-compatible device,
++ * which requires a static 1:1 mapping for IRQs 0-15.
++ * Use irq_domain_create_legacy to establish this static mapping early.
++ */
++ priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0,
++ &pch_lpc_domain_ops, priv);
+ if (!priv->lpc_domain) {
+ pr_err("Failed to create IRQ domain\n");
+ goto free_irq_handle;
+--
+2.51.0
+
--- /dev/null
+From 9416e01a380e0dc5204692f6c6c3aa45aa366a4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:26:32 +0800
+Subject: irqchip/sifive-plic: Respect mask state when setting affinity
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
+
+plic_set_affinity() always calls plic_irq_enable(), which clears up the
+priority setting even the interrupt is only masked. This unmasks the
+interrupt unexpectly.
+
+Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid
+changing the priority setting.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Nam Cao <namcao@linutronix.de> # VisionFive 2
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com
+Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 9c4af7d588463..c0cf4fed13e09 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -179,12 +179,14 @@ static int plic_set_affinity(struct irq_data *d,
+ if (cpu >= nr_cpu_ids)
+ return -EINVAL;
+
+- plic_irq_disable(d);
++ /* Invalidate the original routing entry */
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+
++ /* Setting the new routing entry if irq is enabled */
+ if (!irqd_irq_disabled(d))
+- plic_irq_enable(d);
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+
+ return IRQ_SET_MASK_OK_DONE;
+ }
+--
+2.51.0
+
--- /dev/null
+From 64659efd5bf927de0ca48ee480a566960061b5a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 05:31:27 +0000
+Subject: libbpf: Fix USDT SIB argument handling causing unrecognized register
+ error
+
+From: Jiawei Zhao <phoenix500526@163.com>
+
+[ Upstream commit 758acb9ccfdbf854b55abaceaf1f3f229cde3d19 ]
+
+On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB)
+addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation
+in libbpf cannot parse this format, causing `bpf_program__attach_usdt()`
+to fail with -ENOENT (unrecognized register).
+
+This patch fixes this by implementing the necessary changes:
+- add correct handling for SIB-addressed arguments in `bpf_usdt_arg`.
+- add adaptive support to `__bpf_usdt_arg_type` and
+ `__bpf_usdt_arg_spec` to represent SIB addressing parameters.
+
+Signed-off-by: Jiawei Zhao <phoenix500526@163.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250827053128.1301287-2-phoenix500526@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/usdt.bpf.h | 44 ++++++++++++++++++++++++++--
+ tools/lib/bpf/usdt.c | 62 ++++++++++++++++++++++++++++++++++++----
+ 2 files changed, 99 insertions(+), 7 deletions(-)
+
+diff --git a/tools/lib/bpf/usdt.bpf.h b/tools/lib/bpf/usdt.bpf.h
+index b811f754939f0..3e59a7704534b 100644
+--- a/tools/lib/bpf/usdt.bpf.h
++++ b/tools/lib/bpf/usdt.bpf.h
+@@ -34,13 +34,32 @@ enum __bpf_usdt_arg_type {
+ BPF_USDT_ARG_CONST,
+ BPF_USDT_ARG_REG,
+ BPF_USDT_ARG_REG_DEREF,
++ BPF_USDT_ARG_SIB,
+ };
+
++/*
++ * This struct layout is designed specifically to be backwards/forward
++ * compatible between libbpf versions for ARG_CONST, ARG_REG, and
++ * ARG_REG_DEREF modes. ARG_SIB requires libbpf v1.7+.
++ */
+ struct __bpf_usdt_arg_spec {
+ /* u64 scalar interpreted depending on arg_type, see below */
+ __u64 val_off;
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+ /* arg location case, see bpf_usdt_arg() for details */
+- enum __bpf_usdt_arg_type arg_type;
++ enum __bpf_usdt_arg_type arg_type: 8;
++ /* index register offset within struct pt_regs */
++ __u16 idx_reg_off: 12;
++ /* scale factor for index register (1, 2, 4, or 8) */
++ __u16 scale_bitshift: 4;
++ /* reserved for future use, keeps reg_off offset stable */
++ __u8 __reserved: 8;
++#else
++ __u8 __reserved: 8;
++ __u16 idx_reg_off: 12;
++ __u16 scale_bitshift: 4;
++ enum __bpf_usdt_arg_type arg_type: 8;
++#endif
+ /* offset of referenced register within struct pt_regs */
+ short reg_off;
+ /* whether arg should be interpreted as signed value */
+@@ -117,7 +136,7 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
+ {
+ struct __bpf_usdt_spec *spec;
+ struct __bpf_usdt_arg_spec *arg_spec;
+- unsigned long val;
++ unsigned long val, idx;
+ int err, spec_id;
+
+ *res = 0;
+@@ -170,6 +189,27 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
+ return err;
+ #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+ val >>= arg_spec->arg_bitshift;
++#endif
++ break;
++ case BPF_USDT_ARG_SIB:
++ /* Arg is in memory addressed by SIB (Scale-Index-Base) mode
++ * (e.g., "-1@-96(%rbp,%rax,8)" in USDT arg spec). We first
++ * fetch the base register contents and the index register
++ * contents from pt_regs. Then we calculate the final address
++ * as base + (index * scale) + offset, and do a user-space
++ * probe read to fetch the argument value.
++ */
++ err = bpf_probe_read_kernel(&val, sizeof(val), (void *)ctx + arg_spec->reg_off);
++ if (err)
++ return err;
++ err = bpf_probe_read_kernel(&idx, sizeof(idx), (void *)ctx + arg_spec->idx_reg_off);
++ if (err)
++ return err;
++ err = bpf_probe_read_user(&val, sizeof(val), (void *)(val + (idx << arg_spec->scale_bitshift) + arg_spec->val_off));
++ if (err)
++ return err;
++#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
++ val >>= arg_spec->arg_bitshift;
+ #endif
+ break;
+ default:
+diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
+index 6ff28e7bf5e3d..76e7c5bf0cb2d 100644
+--- a/tools/lib/bpf/usdt.c
++++ b/tools/lib/bpf/usdt.c
+@@ -199,12 +199,23 @@ enum usdt_arg_type {
+ USDT_ARG_CONST,
+ USDT_ARG_REG,
+ USDT_ARG_REG_DEREF,
++ USDT_ARG_SIB,
+ };
+
+ /* should match exactly struct __bpf_usdt_arg_spec from usdt.bpf.h */
+ struct usdt_arg_spec {
+ __u64 val_off;
+- enum usdt_arg_type arg_type;
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
++ enum usdt_arg_type arg_type: 8;
++ __u16 idx_reg_off: 12;
++ __u16 scale_bitshift: 4;
++ __u8 __reserved: 8; /* keep reg_off offset stable */
++#else
++ __u8 __reserved: 8; /* keep reg_off offset stable */
++ __u16 idx_reg_off: 12;
++ __u16 scale_bitshift: 4;
++ enum usdt_arg_type arg_type: 8;
++#endif
+ short reg_off;
+ bool arg_signed;
+ char arg_bitshift;
+@@ -1281,11 +1292,51 @@ static int calc_pt_regs_off(const char *reg_name)
+
+ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec *arg, int *arg_sz)
+ {
+- char reg_name[16];
+- int len, reg_off;
+- long off;
++ char reg_name[16] = {0}, idx_reg_name[16] = {0};
++ int len, reg_off, idx_reg_off, scale = 1;
++ long off = 0;
++
++ if (sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^,] , %d ) %n",
++ arg_sz, &off, reg_name, idx_reg_name, &scale, &len) == 5 ||
++ sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^,] , %d ) %n",
++ arg_sz, reg_name, idx_reg_name, &scale, &len) == 4 ||
++ sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^)] ) %n",
++ arg_sz, &off, reg_name, idx_reg_name, &len) == 4 ||
++ sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^)] ) %n",
++ arg_sz, reg_name, idx_reg_name, &len) == 3
++ ) {
++ /*
++ * Scale Index Base case:
++ * 1@-96(%rbp,%rax,8)
++ * 1@(%rbp,%rax,8)
++ * 1@-96(%rbp,%rax)
++ * 1@(%rbp,%rax)
++ */
++ arg->arg_type = USDT_ARG_SIB;
++ arg->val_off = off;
+
+- if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n", arg_sz, &off, reg_name, &len) == 3) {
++ reg_off = calc_pt_regs_off(reg_name);
++ if (reg_off < 0)
++ return reg_off;
++ arg->reg_off = reg_off;
++
++ idx_reg_off = calc_pt_regs_off(idx_reg_name);
++ if (idx_reg_off < 0)
++ return idx_reg_off;
++ arg->idx_reg_off = idx_reg_off;
++
++ /* validate scale factor and set fields directly */
++ switch (scale) {
++ case 1: arg->scale_bitshift = 0; break;
++ case 2: arg->scale_bitshift = 1; break;
++ case 4: arg->scale_bitshift = 2; break;
++ case 8: arg->scale_bitshift = 3; break;
++ default:
++ pr_warn("usdt: invalid SIB scale %d, expected 1, 2, 4, 8\n", scale);
++ return -EINVAL;
++ }
++ } else if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n",
++ arg_sz, &off, reg_name, &len) == 3) {
+ /* Memory dereference case, e.g., -4@-20(%rbp) */
+ arg->arg_type = USDT_ARG_REG_DEREF;
+ arg->val_off = off;
+@@ -1304,6 +1355,7 @@ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec
+ } else if (sscanf(arg_str, " %d @ %%%15s %n", arg_sz, reg_name, &len) == 2) {
+ /* Register read case, e.g., -4@%eax */
+ arg->arg_type = USDT_ARG_REG;
++ /* register read has no memory offset */
+ arg->val_off = 0;
+
+ reg_off = calc_pt_regs_off(reg_name);
+--
+2.51.0
+
--- /dev/null
+From 6e2a0bd6c44e2b779602eabbc237208e25732a10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 2fcc40aa96340..b9459c53c3ed3 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -366,7 +366,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ card->next_request = h_memstick_set_rw_addr;
+ memstick_new_req(card->host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ return card->current_mrq.error;
+ }
+@@ -400,7 +402,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+
+ card->next_request = h_memstick_read_dev_id;
+ memstick_new_req(host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ if (card->current_mrq.error)
+ goto err_out;
+--
+2.51.0
+
--- /dev/null
+From 8dfe5d5260f0e1b5a8848775b362e30ebd0a09a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 16:21:13 +0200
+Subject: mfd: core: Increment of_node's refcount before linking it to the
+ platform device
+
+From: Bastien Curutchet <bastien.curutchet@bootlin.com>
+
+[ Upstream commit 5f4bbee069836e51ed0b6d7e565a292f070ababc ]
+
+When an MFD device is added, a platform_device is allocated. If this
+device is linked to a DT description, the corresponding OF node is linked
+to the new platform device but the OF node's refcount isn't incremented.
+As of_node_put() is called during the platform device release, it leads
+to a refcount underflow.
+
+Call of_node_get() to increment the OF node's refcount when the node is
+linked to the newly created platform device.
+
+Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
+Link: https://lore.kernel.org/r/20250820-mfd-refcount-v1-1-6dcb5eb41756@bootlin.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mfd-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index 76bd316a50afc..7d14a1e7631ee 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -131,6 +131,7 @@ static int mfd_match_of_node_to_dev(struct platform_device *pdev,
+ of_entry->np = np;
+ list_add_tail(&of_entry->list, &mfd_of_node_list);
+
++ of_node_get(np);
+ device_set_node(&pdev->dev, of_fwnode_handle(np));
+ #endif
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 2c56d5a3c1bcac6690db2ea58f0dc3a627c78c29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index c6235cd0dbdc4..1ec9ab56442df 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ DA9063_PAGE_SEL_BUF_SIZE,
+ };
+
++enum da9063_page_sel_msgs {
++ DA9063_PAGE_SEL_MSG = 0,
++ DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+- DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+- DA9063_PAGED_READ_MSG_REG_SEL,
++ DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ DA9063_PAGED_READ_MSG_DATA,
+ DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ (page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+
+ /* Write reg address, page selection */
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++ xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++ xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++ xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++ xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++ ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++ if (ret < 0) {
++ dev_err(&client->dev, "Page switch failed: %d\n", ret);
++ return ret;
++ }
++
++ if (ret != DA9063_PAGE_SEL_CNT) {
++ dev_err(&client->dev, "Page switch failed to complete\n");
++ return -EIO;
++ }
+
+ /* Select register address */
+ xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+--
+2.51.0
+
--- /dev/null
+From 41baa6818d9dea7a5f6ed3244d60e99573da4302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:29:36 +0300
+Subject: mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit c91a0e4e549d0457c61f2199fcd84d699400bee1 ]
+
+Add Intel Wildcat Lake PCI IDs.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20250915112936.10696-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 1d8cdc4d5819b..5b1c13fb23468 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -367,6 +367,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x4b79), (kernel_ulong_t)&ehl_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x4b7a), (kernel_ulong_t)&ehl_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x4b7b), (kernel_ulong_t)&ehl_i2c_info },
++ /* WCL */
++ { PCI_VDEVICE(INTEL, 0x4d25), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x4d26), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x4d27), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x4d30), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x4d46), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x4d50), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d51), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d52), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x4d78), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d79), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d7a), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d7b), (kernel_ulong_t)&ehl_i2c_info },
+ /* JSL */
+ { PCI_VDEVICE(INTEL, 0x4da8), (kernel_ulong_t)&spt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x4da9), (kernel_ulong_t)&spt_uart_info },
+--
+2.51.0
+
--- /dev/null
+From 8f61a5793e6ade4cd98496d28d1f64c48d53a8fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+ 739 | mfd_devs, n_devs,
+ | ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+ 459 | const struct mfd_cell *mfd_devs;
+ | ^
+ | = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index bdbd5bfc97145..2f74a8c644a32 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -456,7 +456,7 @@ int madera_dev_init(struct madera *madera)
+ struct device *dev = madera->dev;
+ unsigned int hwid;
+ int (*patch_fn)(struct madera *) = NULL;
+- const struct mfd_cell *mfd_devs;
++ const struct mfd_cell *mfd_devs = NULL;
+ int n_devs = 0;
+ int i, ret;
+
+@@ -670,7 +670,7 @@ int madera_dev_init(struct madera *madera)
+ goto err_reset;
+ }
+
+- if (!n_devs) {
++ if (!n_devs || !mfd_devs) {
+ dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ madera->type_name);
+ ret = -ENODEV;
+--
+2.51.0
+
--- /dev/null
+From cf5c6b84888c5c96965b572aad044a4c9afddd0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index fe018bedab983..7e2ca39758825 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -137,3 +137,4 @@ module_exit(stmpe_exit);
+
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From 40ba6e0c8eb6db97b1c980af17eff937e6c24f39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 9c3cf58457a7d..be6a84a3062cc 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ void stmpe_remove(struct stmpe *stmpe)
+ {
++ if (stmpe->domain)
++ irq_domain_remove(stmpe->domain);
++
+ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+--
+2.51.0
+
--- /dev/null
+From cc2d9ab1b3d07900c8792cc27b1260f184bafd35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock: 50000000 Hz
+actual clock: 200000000 Hz
+
+After the fix:
+clock: 50000000 Hz
+actual clock: 50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 6ebb3d1eeb4d6..73e9c50968e1d 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ clk &= ~0xff;
+ }
+
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++ clock = clk & CLK_CTL_DIV_MASK;
++ if (clock != 0xff)
++ host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ usleep_range(10000, 11000);
+
+--
+2.51.0
+
--- /dev/null
+From 182a9bcc76310de9da5dbeecbc0e66384661afec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index c2144a3efb308..74234ee5f6089 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -81,6 +81,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH BIT(16)
+ #define CORE_HC_SELECT_IN_EN BIT(18)
++#define CORE_HC_SELECT_IN_SDR50 (4 << 19)
+ #define CORE_HC_SELECT_IN_HS400 (6 << 19)
+ #define CORE_HC_SELECT_IN_MASK (7 << 19)
+
+@@ -1133,6 +1134,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ struct mmc_ios *ios = &host->mmc->ios;
+
++ if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING)
++ return true;
++
+ /*
+ * Tuning is required for SDR104, HS200 and HS400 cards and
+ * if clock frequency is greater than 100MHz in these modes.
+@@ -1201,6 +1206,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ struct mmc_ios ios = host->mmc->ios;
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++ const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++ u32 config;
+
+ if (!sdhci_msm_is_tuning_needed(host)) {
+ msm_host->use_cdr = false;
+@@ -1217,6 +1224,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ */
+ msm_host->tuning_done = 0;
+
++ if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++ config &= ~CORE_HC_SELECT_IN_MASK;
++ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++ }
++
+ /*
+ * For HS400 tuning in HS200 timing requires:
+ * - select MCLK/2 in VENDOR_SPEC
+--
+2.51.0
+
--- /dev/null
+From 676ac6ac091c1fa943ca996f66f74cad1f5ab897 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 7c13a400071e6..57c9491233860 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3026,11 +3026,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+
+ ++ctrl->ctrl.nr_reconnects;
+
+- if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++ spin_lock_irqsave(&ctrl->rport->lock, flags);
++ if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENODEV;
++ }
+
+- if (nvme_fc_ctlr_active_on_rport(ctrl))
++ if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENOTUNIQ;
++ }
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+
+ dev_info(ctrl->ctrl.device,
+ "NVME-FC{%d}: create association : host wwpn 0x%016llx "
+--
+2.51.0
+
--- /dev/null
+From 823e144acf7093c9d269aef950724d8fd5efebfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:52:11 +1000
+Subject: nvme: Use non zero KATO for persistent discovery connections
+
+From: Alistair Francis <alistair.francis@wdc.com>
+
+[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
+
+The NVMe Base Specification 2.1 states that:
+
+"""
+A host requests an explicit persistent connection ... by specifying a
+non-zero Keep Alive Timer value in the Connect command.
+"""
+
+As such if we are starting a persistent connection to a discovery
+controller and the KATO is currently 0 we need to update KATO to a non
+zero value to avoid continuous timeouts on the target.
+
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 24d82d35041b5..a3b9f8ea235f7 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4740,8 +4740,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
+ * checking that they started once before, hence are reconnecting back.
+ */
+ if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+- nvme_discovery_ctrl(ctrl))
++ nvme_discovery_ctrl(ctrl)) {
++ if (!ctrl->kato) {
++ nvme_stop_keep_alive(ctrl);
++ ctrl->kato = NVME_DEFAULT_KATO;
++ nvme_start_keep_alive(ctrl);
++ }
+ nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
++ }
+
+ if (ctrl->queue_count > 1) {
+ nvme_queue_scan(ctrl);
+--
+2.51.0
+
--- /dev/null
+From a5a68bcc431114320e8c215adea5a78bb1058eb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 0ade23610ae64..67767e926b1bb 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1088,6 +1088,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++ int terminating;
++
++ terminating = atomic_xchg(&assoc->terminating, 1);
++
++ /* if already terminating, do nothing */
++ if (terminating)
++ return;
++
+ nvmet_fc_tgtport_get(assoc->tgtport);
+ if (!queue_work(nvmet_wq, &assoc->del_work))
+ nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1214,13 +1222,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ unsigned long flags;
+- int i, terminating;
+-
+- terminating = atomic_xchg(&assoc->terminating, 1);
+-
+- /* if already terminating, do nothing */
+- if (terminating)
+- return;
++ int i;
+
+ spin_lock_irqsave(&tgtport->lock, flags);
+ list_del_rcu(&assoc->a_list);
+--
+2.51.0
+
--- /dev/null
+From 78a2b751e66acecb4d25979a8f65bfe6b26e2787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:59:17 +0200
+Subject: pinctrl: keembay: release allocated memory in detach path
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit aae7a2876c3b39d07aa7655ea082af8e7862f3a5 ]
+
+Unlike all the other allocations in this driver, the memory for storing
+the pin function descriptions allocated with kcalloc() and later resized
+with krealloc() is never freed. Use devres like elsewhere to handle
+that. While at it - replace krealloc() with more suitable
+devm_krealloc_array().
+
+Note: the logic in this module is pretty convoluted and could probably
+use some revisiting, we should probably be able to calculate the exact
+amount of memory needed in advance or even skip the allocation
+altogether and just add each function to the radix tree separately.
+
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-keembay.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-keembay.c b/drivers/pinctrl/pinctrl-keembay.c
+index b693f4787044c..b1124d3e50bff 100644
+--- a/drivers/pinctrl/pinctrl-keembay.c
++++ b/drivers/pinctrl/pinctrl-keembay.c
+@@ -1606,7 +1606,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ * being part of 8 (hw maximum) globally unique muxes.
+ */
+ kpc->nfuncs = 0;
+- keembay_funcs = kcalloc(kpc->npins * 8, sizeof(*keembay_funcs), GFP_KERNEL);
++ keembay_funcs = devm_kcalloc(kpc->dev, kpc->npins * 8,
++ sizeof(*keembay_funcs), GFP_KERNEL);
+ if (!keembay_funcs)
+ return -ENOMEM;
+
+@@ -1637,7 +1638,9 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ }
+
+ /* Reallocate memory based on actual number of functions */
+- new_funcs = krealloc(keembay_funcs, kpc->nfuncs * sizeof(*new_funcs), GFP_KERNEL);
++ new_funcs = devm_krealloc_array(kpc->dev, keembay_funcs,
++ kpc->nfuncs, sizeof(*new_funcs),
++ GFP_KERNEL);
+ if (!new_funcs) {
+ kfree(keembay_funcs);
+ return -ENOMEM;
+--
+2.51.0
+
--- /dev/null
+From fbbe0e3da405e3c355407b027d16892627fb284b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 2ec599e383e4b..1df0a00ae1ee8 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -589,8 +589,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ /* 4 parameters */
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+ case PIN_CONFIG_BIAS_PULL_UP:
+- if (arg)
++ if (arg) {
+ pcs_pinconf_clear_bias(pctldev, pin);
++ data = pcs->read(pcs->base + offset);
++ }
+ fallthrough;
+ case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ data &= ~func->conf[i].mask;
+--
+2.51.0
+
--- /dev/null
+From 282dbc64ea2dc5f754536356cd5ff6b19ec897b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:01:22 +0200
+Subject: pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 442816f97a4f84cb321d3359177a3b9b0ce48a60 ]
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,pmgr-pwrstate" anymore [1]. Use
+"apple,t8103-pmgr-pwrstate" as base compatible as it is the SoC the
+driver and bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Signed-off-by: Janne Grunau <j@jannau.net>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/apple/pmgr-pwrstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pmdomain/apple/pmgr-pwrstate.c b/drivers/pmdomain/apple/pmgr-pwrstate.c
+index 9467235110f46..82c33cf727a82 100644
+--- a/drivers/pmdomain/apple/pmgr-pwrstate.c
++++ b/drivers/pmdomain/apple/pmgr-pwrstate.c
+@@ -306,6 +306,7 @@ static int apple_pmgr_ps_probe(struct platform_device *pdev)
+ }
+
+ static const struct of_device_id apple_pmgr_ps_of_match[] = {
++ { .compatible = "apple,t8103-pmgr-pwrstate" },
+ { .compatible = "apple,pmgr-pwrstate" },
+ {}
+ };
+--
+2.51.0
+
--- /dev/null
+From 3666d5671aa74a7b04217c74942466f8239cb7d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:22:09 +0200
+Subject: power: supply: qcom_battmgr: add OOI chemistry
+
+From: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+
+[ Upstream commit fee0904441325d83e7578ca457ec65a9d3f21264 ]
+
+The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this
+update the detection and return the appropriate type.
+
+Signed-off-by: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index c2037b58fbcdf..dd89104cb1672 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -978,7 +978,8 @@ static void qcom_battmgr_sc8280xp_strcpy(char *dest, const char *src)
+
+ static unsigned int qcom_battmgr_sc8280xp_parse_technology(const char *chemistry)
+ {
+- if (!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN))
++ if ((!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN)) ||
++ (!strncmp(chemistry, "OOI", BATTMGR_CHEMISTRY_LEN)))
+ return POWER_SUPPLY_TECHNOLOGY_LION;
+ if (!strncmp(chemistry, "LIP", BATTMGR_CHEMISTRY_LEN))
+ return POWER_SUPPLY_TECHNOLOGY_LIPO;
+--
+2.51.0
+
--- /dev/null
+From 343384a01557cd2ef22424dcf021f764aacb4601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 11:18:51 +0800
+Subject: power: supply: qcom_battmgr: handle charging state change
+ notifications
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 41307ec7df057239aae3d0f089cc35a0d735cdf8 ]
+
+The X1E80100 battery management firmware sends a notification with
+code 0x83 when the battery charging state changes, such as switching
+between fast charge, taper charge, end of charge, or any other error
+charging states.
+
+The same notification code is used with bit[8] set when charging stops
+because the charge control end threshold is reached. Additionally,
+a 2-bit value is included in bit[10:9] with the same code to indicate
+the charging source capability, which is determined by the calculated
+power from voltage and current readings from PDOs: 2 means a strong
+charger over 60W, 1 indicates a weak charger, and 0 means there is no
+charging source.
+
+These 3-MSB [10:8] in the notification code is not much useful for now,
+hence just ignore them and trigger a power supply change event whenever
+0x83 notification code is received. This helps to eliminate the unknown
+notification error messages.
+
+Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Closes: https://lore.kernel.org/all/r65idyc4of5obo6untebw4iqfj2zteiggnnzabrqtlcinvtddx@xc4aig5abesu/
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index dd89104cb1672..f8bea732ba7f2 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -29,8 +29,9 @@ enum qcom_battmgr_variant {
+ #define NOTIF_BAT_PROPERTY 0x30
+ #define NOTIF_USB_PROPERTY 0x32
+ #define NOTIF_WLS_PROPERTY 0x34
+-#define NOTIF_BAT_INFO 0x81
+ #define NOTIF_BAT_STATUS 0x80
++#define NOTIF_BAT_INFO 0x81
++#define NOTIF_BAT_CHARGING_STATE 0x83
+
+ #define BATTMGR_BAT_INFO 0x9
+
+@@ -943,12 +944,14 @@ static void qcom_battmgr_notification(struct qcom_battmgr *battmgr,
+ }
+
+ notification = le32_to_cpu(msg->notification);
++ notification &= 0xff;
+ switch (notification) {
+ case NOTIF_BAT_INFO:
+ battmgr->info.valid = false;
+ fallthrough;
+ case NOTIF_BAT_STATUS:
+ case NOTIF_BAT_PROPERTY:
++ case NOTIF_BAT_CHARGING_STATE:
+ power_supply_changed(battmgr->bat_psy);
+ break;
+ case NOTIF_USB_PROPERTY:
+--
+2.51.0
+
--- /dev/null
+From 7f27c6560d9fca7636d03584c78a8ba3d31e16a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22
+[ 8.151974] Hardware name: ALE AMB (DT)
+[ 8.155828] Call trace:
+[ 8.158292] dump_backtrace+0x0/0x1d4
+[ 8.161960] show_stack+0x18/0x6c
+[ 8.165280] dump_stack+0xcc/0x128
+[ 8.168687] sysfs_warn_dup+0x60/0x7c
+[ 8.172353] sysfs_do_create_link_sd+0xf0/0x100
+[ 8.176886] sysfs_create_link+0x20/0x40
+[ 8.180816] device_add+0x270/0x7a4
+[ 8.184311] __power_supply_register+0x304/0x560
+[ 8.188930] devm_power_supply_register+0x54/0xa0
+[ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger]
+[ 8.198183] i2c_device_probe+0x2dc/0x2f4
+[ 8.202196] really_probe+0xf0/0x510
+[ 8.205774] driver_probe_device+0xfc/0x160
+[ 8.209960] device_driver_attach+0xc0/0xcc
+[ 8.214146] __driver_attach+0xc0/0x170
+[ 8.218002] bus_for_each_dev+0x74/0xd4
+[ 8.221862] driver_attach+0x24/0x30
+[ 8.225444] bus_add_driver+0x148/0x250
+[ 8.229283] driver_register+0x78/0x130
+[ 8.233140] i2c_register_driver+0x4c/0xe0
+[ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger]
+[ 8.242424] do_one_initcall+0x50/0x1b0
+[ 8.242434] do_init_module+0x44/0x230
+[ 8.242438] load_module+0x2200/0x27c0
+[ 8.242442] __do_sys_finit_module+0xa8/0x11c
+[ 8.242447] __arm64_sys_finit_module+0x20/0x30
+[ 8.242457] el0_svc_common.constprop.0+0x64/0x154
+[ 8.242464] do_el0_svc+0x24/0x8c
+[ 8.242474] el0_svc+0x10/0x20
+[ 8.242481] el0_sync_handler+0x108/0x114
+[ 8.242485] el0_sync+0x180/0x1c0
+[ 8.243847] sbs-charger 20-0009: Failed to register power supply
+[ 8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index ab3f095d90ea7..0ae7264491997 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+
+-static const struct power_supply_desc sbs_desc = {
+- .name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ .type = POWER_SUPPLY_TYPE_MAINS,
+ .properties = sbs_properties,
+ .num_properties = ARRAY_SIZE(sbs_properties),
+@@ -165,9 +164,20 @@ static const struct power_supply_desc sbs_desc = {
+ static int sbs_probe(struct i2c_client *client)
+ {
+ struct power_supply_config psy_cfg = {};
++ struct power_supply_desc *sbs_desc;
+ struct sbs_info *chip;
+ int ret, val;
+
++ sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++ sizeof(*sbs_desc), GFP_KERNEL);
++ if (!sbs_desc)
++ return -ENOMEM;
++
++ sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++ dev_name(&client->dev));
++ if (!sbs_desc->name)
++ return -ENOMEM;
++
+ chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ if (!chip)
+ return -ENOMEM;
+@@ -191,7 +201,7 @@ static int sbs_probe(struct i2c_client *client)
+ return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ chip->last_state = val;
+
+- chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++ chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ if (IS_ERR(chip->power_supply))
+ return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ "Failed to register power supply\n");
+--
+2.51.0
+
--- /dev/null
+From 85c49a4fbe707a5144e2bfa30ec9faee9a56e921 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 12:36:01 +0200
+Subject: pwm: pca9685: Use bulk write to atomicially update registers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit de5855613263b426ee697dd30224322f2e634dec ]
+
+The output of a PWM channel is configured by four register values. Write
+them in a single i2c transaction to ensure glitch free updates.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/bfa8c0267c9ec059d0d77f146998d564654c75ca.1753784092.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-pca9685.c | 46 ++++++++++++++++++++++++---------------
+ 1 file changed, 29 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index 1298b29183e55..e1b60756bb485 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -62,6 +62,8 @@
+ #define MODE1_SUB2 BIT(2)
+ #define MODE1_SUB1 BIT(3)
+ #define MODE1_SLEEP BIT(4)
++#define MODE1_AI BIT(5)
++
+ #define MODE2_INVRT BIT(4)
+ #define MODE2_OUTDRV BIT(2)
+
+@@ -132,6 +134,19 @@ static int pca9685_write_reg(struct pwm_chip *chip, unsigned int reg, unsigned i
+ return err;
+ }
+
++static int pca9685_write_4reg(struct pwm_chip *chip, unsigned int reg, u8 val[4])
++{
++ struct pca9685 *pca = to_pca(chip);
++ struct device *dev = pwmchip_parent(chip);
++ int err;
++
++ err = regmap_bulk_write(pca->regmap, reg, val, 4);
++ if (err)
++ dev_err(dev, "regmap_write to register 0x%x failed: %pe\n", reg, ERR_PTR(err));
++
++ return err;
++}
++
+ /* Helper function to set the duty cycle ratio to duty/4096 (e.g. duty=2048 -> 50%) */
+ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned int duty)
+ {
+@@ -144,12 +159,10 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned in
+ return;
+ } else if (duty >= PCA9685_COUNTER_RANGE) {
+ /* Set the full ON bit and clear the full OFF bit */
+- pca9685_write_reg(chip, REG_ON_H(channel), LED_FULL);
+- pca9685_write_reg(chip, REG_OFF_H(channel), 0);
++ pca9685_write_4reg(chip, REG_ON_L(channel), (u8[4]){ 0, LED_FULL, 0, 0 });
+ return;
+ }
+
+-
+ if (pwm->state.usage_power && channel < PCA9685_MAXCHAN) {
+ /*
+ * If usage_power is set, the pca9685 driver will phase shift
+@@ -164,12 +177,9 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned in
+
+ off = (on + duty) % PCA9685_COUNTER_RANGE;
+
+- /* Set ON time (clears full ON bit) */
+- pca9685_write_reg(chip, REG_ON_L(channel), on & 0xff);
+- pca9685_write_reg(chip, REG_ON_H(channel), (on >> 8) & 0xf);
+- /* Set OFF time (clears full OFF bit) */
+- pca9685_write_reg(chip, REG_OFF_L(channel), off & 0xff);
+- pca9685_write_reg(chip, REG_OFF_H(channel), (off >> 8) & 0xf);
++ /* implicitly clear full ON and full OFF bit */
++ pca9685_write_4reg(chip, REG_ON_L(channel),
++ (u8[4]){ on & 0xff, (on >> 8) & 0xf, off & 0xff, (off >> 8) & 0xf });
+ }
+
+ static unsigned int pca9685_pwm_get_duty(struct pwm_chip *chip, int channel)
+@@ -543,9 +553,8 @@ static int pca9685_pwm_probe(struct i2c_client *client)
+
+ mutex_init(&pca->lock);
+
+- ret = pca9685_read_reg(chip, PCA9685_MODE2, ®);
+- if (ret)
+- return ret;
++ /* clear MODE2_OCH */
++ reg = 0;
+
+ if (device_property_read_bool(&client->dev, "invert"))
+ reg |= MODE2_INVRT;
+@@ -561,16 +570,19 @@ static int pca9685_pwm_probe(struct i2c_client *client)
+ if (ret)
+ return ret;
+
+- /* Disable all LED ALLCALL and SUBx addresses to avoid bus collisions */
++ /*
++ * Disable all LED ALLCALL and SUBx addresses to avoid bus collisions,
++ * enable Auto-Increment.
++ */
+ pca9685_read_reg(chip, PCA9685_MODE1, ®);
+ reg &= ~(MODE1_ALLCALL | MODE1_SUB1 | MODE1_SUB2 | MODE1_SUB3);
++ reg |= MODE1_AI;
+ pca9685_write_reg(chip, PCA9685_MODE1, reg);
+
+ /* Reset OFF/ON registers to POR default */
+- pca9685_write_reg(chip, PCA9685_ALL_LED_OFF_L, 0);
+- pca9685_write_reg(chip, PCA9685_ALL_LED_OFF_H, LED_FULL);
+- pca9685_write_reg(chip, PCA9685_ALL_LED_ON_L, 0);
+- pca9685_write_reg(chip, PCA9685_ALL_LED_ON_H, LED_FULL);
++ ret = pca9685_write_4reg(chip, PCA9685_ALL_LED_ON_L, (u8[]){ 0, LED_FULL, 0, LED_FULL });
++ if (ret < 0)
++ return dev_err_probe(&client->dev, ret, "Failed to reset ON/OFF registers\n");
+
+ chip->ops = &pca9685_pwm_ops;
+
+--
+2.51.0
+
--- /dev/null
+From d82090c19a70c4d9e0145cc45dd338c02fe5431a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:22:44 +0800
+Subject: riscv: bpf: Fix uninitialized symbol 'retval_off'
+
+From: Chenghao Duan <duanchenghao@kylinos.cn>
+
+[ Upstream commit d0bf7cd5df18466d969bb60e8890b74cf96081ca ]
+
+In the __arch_prepare_bpf_trampoline() function, retval_off is only
+meaningful when save_ret is true, so the current logic is correct.
+However, in the original logic, retval_off is only initialized under
+certain conditions; for example, in the fmod_ret logic, the compiler is
+not aware that the flags of the fmod_ret program (prog) have set
+BPF_TRAMP_F_CALL_ORIG, which results in an uninitialized symbol
+compilation warning.
+
+So initialize retval_off unconditionally to fix it.
+
+Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
+Reviewed-by: Pu Lehui <pulehui@huawei.com>
+Link: https://lore.kernel.org/r/20250922062244.822937-2-duanchenghao@kylinos.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp64.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
+index 497945aa3e2c4..5895c1b2be203 100644
+--- a/arch/riscv/net/bpf_jit_comp64.c
++++ b/arch/riscv/net/bpf_jit_comp64.c
+@@ -906,10 +906,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ stack_size += 16;
+
+ save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
+- if (save_ret) {
++ if (save_ret)
+ stack_size += 16; /* Save both A5 (BPF R0) and A0 */
+- retval_off = stack_size;
+- }
++ retval_off = stack_size;
+
+ stack_size += nr_arg_slots * 8;
+ args_off = stack_size;
+--
+2.51.0
+
--- /dev/null
+From ea56c7c1e70003061c5f15da03034ca3869f15e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index 4694422aa76c3..88e4aeab21b7b 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -74,7 +74,7 @@ int main(int argc, char **argv)
+
+ /* Let's try detach it before it was ever attached */
+ ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+- if (ret != -1 || errno != ENOENT) {
++ if (ret != -ENOENT) {
+ printf("bpf_prog_detach2 not attached should fail: %m\n");
+ return 1;
+ }
+--
+2.51.0
+
--- /dev/null
+From b8116b887942dc74fa211b2c822f30679ad1203c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 22:52:30 +0100
+Subject: selftests/bpf: Fix flaky bpf_cookie selftest
+
+From: Mykyta Yatsenko <yatsenko@meta.com>
+
+[ Upstream commit 105eb5dc74109a9f53c2f26c9a918d9347a73595 ]
+
+bpf_cookie can fail on perf_event_open(), when it runs after the task_work
+selftest. The task_work test causes perf to lower
+sysctl_perf_event_sample_rate, and bpf_cookie uses sample_freq,
+which is validated against that sysctl. As a result,
+perf_event_open() rejects the attr if the (now tighter) limit is
+exceeded.
+
+>From perf_event_open():
+if (attr.freq) {
+ if (attr.sample_freq > sysctl_perf_event_sample_rate)
+ return -EINVAL;
+} else {
+ if (attr.sample_period & (1ULL << 63))
+ return -EINVAL;
+}
+
+Switch bpf_cookie to use sample_period, which is not checked against
+sysctl_perf_event_sample_rate.
+
+Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250925215230.265501-1-mykyta.yatsenko5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/bpf_cookie.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c b/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
+index 6befa870434bc..f97f560bafb20 100644
+--- a/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
++++ b/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
+@@ -450,8 +450,7 @@ static void pe_subtest(struct test_bpf_cookie *skel)
+ attr.size = sizeof(attr);
+ attr.type = PERF_TYPE_SOFTWARE;
+ attr.config = PERF_COUNT_SW_CPU_CLOCK;
+- attr.freq = 1;
+- attr.sample_freq = 10000;
++ attr.sample_period = 100000;
+ pfd = syscall(__NR_perf_event_open, &attr, -1, 0, -1, PERF_FLAG_FD_CLOEXEC);
+ if (!ASSERT_GE(pfd, 0, "perf_fd"))
+ goto cleanup;
+--
+2.51.0
+
--- /dev/null
+From 6119c4e4b5bc4fe83e94c0c8845f1fdf395d3a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 21:58:05 -0700
+Subject: selftests/bpf: Fix selftest verifier_arena_large failure
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 5a427fddec5e76360725a0f03df3a2a003efbe2e ]
+
+With latest llvm22, I got the following verification failure:
+
+ ...
+ ; int big_alloc2(void *ctx) @ verifier_arena_large.c:207
+ 0: (b4) w6 = 1 ; R6_w=1
+ ...
+ ; if (err) @ verifier_arena_large.c:233
+ 53: (56) if w6 != 0x0 goto pc+62 ; R6=0
+ 54: (b7) r7 = -4 ; R7_w=-4
+ 55: (18) r8 = 0x7f4000000000 ; R8_w=scalar()
+ 57: (bf) r9 = addr_space_cast(r8, 0, 1) ; R8_w=scalar() R9_w=arena
+ 58: (b4) w6 = 5 ; R6_w=5
+ ; pg = page[i]; @ verifier_arena_large.c:238
+ 59: (bf) r1 = r7 ; R1_w=-4 R7_w=-4
+ 60: (07) r1 += 4 ; R1_w=0
+ 61: (79) r2 = *(u64 *)(r9 +0) ; R2_w=scalar() R9_w=arena
+ ; if (*pg != i) @ verifier_arena_large.c:239
+ 62: (bf) r3 = addr_space_cast(r2, 0, 1) ; R2_w=scalar() R3_w=arena
+ 63: (71) r3 = *(u8 *)(r3 +0) ; R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
+ 64: (5d) if r1 != r3 goto pc+51 ; R1_w=0 R3_w=0
+ ; bpf_arena_free_pages(&arena, (void __arena *)pg, 2); @ verifier_arena_large.c:241
+ 65: (18) r1 = 0xff11000114548000 ; R1_w=map_ptr(map=arena,ks=0,vs=0)
+ 67: (b4) w3 = 2 ; R3_w=2
+ 68: (85) call bpf_arena_free_pages#72675 ;
+ 69: (b7) r1 = 0 ; R1_w=0
+ ; page[i + 1] = NULL; @ verifier_arena_large.c:243
+ 70: (7b) *(u64 *)(r8 +8) = r1
+ R8 invalid mem access 'scalar'
+ processed 61 insns (limit 1000000) max_states_per_insn 0 total_states 6 peak_states 6 mark_read 2
+ =============
+ #489/5 verifier_arena_large/big_alloc2:FAIL
+
+The main reason is that 'r8' in insn '70' is not an arena pointer.
+Further debugging at llvm side shows that llvm commit ([1]) caused
+the failure. For the original code:
+ page[i] = NULL;
+ page[i + 1] = NULL;
+the llvm transformed it to something like below at source level:
+ __builtin_memset(&page[i], 0, 16)
+Such transformation prevents llvm BPFCheckAndAdjustIR pass from
+generating proper addr_space_cast insns ([2]).
+
+Adding support in llvm BPFCheckAndAdjustIR pass should work, but
+not sure that such a pattern exists or not in real applications.
+At the same time, simply adding a memory barrier between two 'page'
+assignment can fix the issue.
+
+ [1] https://github.com/llvm/llvm-project/pull/155415
+ [2] https://github.com/llvm/llvm-project/pull/84410
+
+Cc: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20250920045805.3288551-1-yonghong.song@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/verifier_arena_large.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/progs/verifier_arena_large.c b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
+index 758b09a5eb88b..394c98227e777 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_arena_large.c
++++ b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
+@@ -142,6 +142,7 @@ int big_alloc2(void *ctx)
+ return 5;
+ bpf_arena_free_pages(&arena, (void __arena *)pg, 2);
+ page[i] = NULL;
++ barrier();
+ page[i + 1] = NULL;
+ cond_break;
+ }
+--
+2.51.0
+
--- /dev/null
+From d1165c8f176b86fcfed6a6704ed5a518305520fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:48:30 -0300
+Subject: selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
+
+Currently, even if some subtests fails, the end result will still yield
+"ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are
+any failures.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xsk.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
+index 65aafe0003db0..62db060298a4a 100755
+--- a/tools/testing/selftests/bpf/test_xsk.sh
++++ b/tools/testing/selftests/bpf/test_xsk.sh
+@@ -241,4 +241,6 @@ done
+
+ if [ $failures -eq 0 ]; then
+ echo "All tests successful!"
++else
++ exit 1
+ fi
+--
+2.51.0
+
cpuidle-governors-menu-rearrange-main-loop-in-menu_select.patch
cpuidle-governors-menu-select-polling-state-in-some-more-cases.patch
mfd-kempld-switch-back-to-earlier-init-behavior.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+cpufreq-ti-add-support-for-am62d2.patch
+bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
+firewire-ohci-move-self_id_complete-tracepoint-after.patch
+irqchip-sifive-plic-respect-mask-state-when-setting-.patch
+io_uring-zctx-check-chained-notif-contexts.patch
+acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
+selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
+thermal-intel-selftests-workload_hint-mask-unsupport.patch
+power-supply-qcom_battmgr-add-ooi-chemistry.patch
+hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
+hwmon-k10temp-add-device-id-for-strix-halo.patch
+hwmon-lenovo-ec-sensors-update-p8-supprt.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+pinctrl-keembay-release-allocated-memory-in-detach-p.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+hwmon-sy7636a-add-alias.patch
+irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
+cpufreq-ondemand-update-the-efficient-idle-check-for.patch
+arm64-zynqmp-disable-coresight-by-default.patch
+arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+arm-tegra-p880-set-correct-touchscreen-clipping.patch
+arm-tegra-transformer-20-add-missing-magnetometer-in.patch
+arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
+firmware-qcom-tzmem-disable-sc7180-platform.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
+i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
+power-supply-qcom_battmgr-handle-charging-state-chan.patch
+bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+futex-don-t-leak-robust_list-pointer-on-exec-race.patch
+selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
+spi-rpc-if-add-resume-support-for-rz-g3e.patch
+acpi-spcr-support-precise-baud-rate-field.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+clocksource-drivers-timer-rtl-otto-work-around-dying.patch
+clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
+blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
+riscv-bpf-fix-uninitialized-symbol-retval_off.patch
+bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
+nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
+hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
+mfd-core-increment-of_node-s-refcount-before-linking.patch
+mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
--- /dev/null
+From 0a2e61ff5873b76b110d0a82f48c800c017684da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ { "AST2620", 0x05010203 },
+ { "AST2605", 0x05030103 },
+ { "AST2625", 0x05030403 },
++ /* AST2700 */
++ { "AST2750", 0x06000003 },
++ { "AST2700", 0x06000103 },
++ { "AST2720", 0x06000203 },
+ };
+
+ static const char *siliconid_to_name(u32 siliconid)
+--
+2.51.0
+
--- /dev/null
+From 2002f20345bf19a4bbdbe6ec0514842f1e3c0ef4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index e4411771f482f..db77642776f93 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -892,7 +892,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ if (IS_ERR_OR_NULL(ptable))
+ return SMEM_ITEM_COUNT;
+
+- info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ return SMEM_ITEM_COUNT;
+
+--
+2.51.0
+
--- /dev/null
+From 36683c4a1daa7de6f2dfb2f7abfc1c5c766623c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index e24ab5f7d2bf1..524fa1b0cd3d6 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++ {
++ .name = "tsensor-cpu1",
++ .offset = 0x084,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu2",
++ .offset = 0x088,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-common",
++ .offset = 0x08c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu0",
++ .offset = 0x098,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "xusb-pad-calibration",
++ .offset = 0x0f0,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu3",
++ .offset = 0x12c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-gpu",
++ .offset = 0x154,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem0",
++ .offset = 0x158,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem1",
++ .offset = 0x15c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-pllx",
++ .offset = 0x160,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ },
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++ {
++ .nvmem_name = "fuse",
++ .cell_name = "xusb-pad-calibration",
++ .dev_id = "7009f000.padctl",
++ .con_id = "calibration",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-common",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "common",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu2",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu2",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu3",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu3",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-gpu",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "gpu",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-pllx",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "pllx",
++ },
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ .read = tegra30_fuse_read,
+ .size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ .init = tegra30_fuse_init,
+ .speedo_init = tegra114_init_speedo_data,
+ .info = &tegra114_fuse_info,
++ .lookups = tegra114_fuse_lookups,
++ .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++ .cells = tegra114_fuse_cells,
++ .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ .soc_attr_group = &tegra_soc_attr_group,
+ .clk_suspend_on = false,
+ };
+--
+2.51.0
+
--- /dev/null
+From 58563ef62d58fbfccec031d3a23407c86cf5fff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index 3ec758f50e248..f588153e8178d 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -449,7 +449,7 @@ static int pruss_of_setup_memories(struct device *dev, struct pruss *pruss)
+ pruss->mem_regions[i].pa = res.start;
+ pruss->mem_regions[i].size = resource_size(&res);
+
+- dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++ dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ mem_names[i], &pruss->mem_regions[i].pa,
+ pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ }
+--
+2.51.0
+
--- /dev/null
+From 67abd331bf828b9dab13239f4e609158fcbc55ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 7740f94847a88..c925cefaef448 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -446,7 +446,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ int i;
+ u8 b;
+
+- dev_info(&spi->dev, " spi_msg@%pK\n", msg);
++ dev_info(&spi->dev, " spi_msg@%p\n", msg);
+ if (msg->status)
+ dev_info(&spi->dev, " status: %i\n",
+ msg->status);
+@@ -456,15 +456,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ msg->actual_length);
+
+ list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer);
++ dev_info(&spi->dev, " spi_transfer@%p\n", xfer);
+ dev_info(&spi->dev, " len: %i\n", xfer->len);
+- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf);
++ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf);
+ if (dump_data && xfer->tx_buf)
+ spi_test_print_hex_dump(" TX: ",
+ xfer->tx_buf,
+ xfer->len);
+
+- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf);
++ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf);
+ if (dump_data && xfer->rx_buf)
+ spi_test_print_hex_dump(" RX: ",
+ xfer->rx_buf,
+@@ -558,7 +558,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ /* if still not found then something has modified too much */
+ /* we could list the "closest" transfer here... */
+ dev_err(&spi->dev,
+- "loopback strangeness - rx changed outside of allowed range at: %pK\n",
++ "loopback strangeness - rx changed outside of allowed range at: %p\n",
+ addr);
+ /* do not return, only set ret,
+ * so that we list all addresses
+@@ -696,7 +696,7 @@ static int spi_test_translate(struct spi_device *spi,
+ }
+
+ dev_err(&spi->dev,
+- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ *ptr, *ptr + len,
+ RX(0), RX(SPI_TEST_MAX_SIZE),
+ TX(0), TX(SPI_TEST_MAX_SIZE));
+--
+2.51.0
+
--- /dev/null
+From 50d018805c0f4f505c177340b45e64fb2d910f77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 12:26:46 +0100
+Subject: spi: rpc-if: Add resume support for RZ/G3E
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
+
+On RZ/G3E using PSCI, s2ram powers down the SoC. After resume,
+reinitialize the hardware for SPI operations.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rpc-if.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
+index c24dad51a0e96..43e829251af59 100644
+--- a/drivers/spi/spi-rpc-if.c
++++ b/drivers/spi/spi-rpc-if.c
+@@ -193,6 +193,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev)
+ {
+ struct spi_controller *ctlr = dev_get_drvdata(dev);
+
++ rpcif_hw_init(dev, false);
++
+ return spi_controller_resume(ctlr);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 79e60b58491a6f1f777b58ffa65be134ef445a99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index acc7998758ad8..133447f250657 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+
+ if (!teedesc || !teedesc->name || !teedesc->ops ||
+ !teedesc->ops->get_version || !teedesc->ops->open ||
+- !teedesc->ops->release || !pool)
++ !teedesc->ops->release)
+ return ERR_PTR(-EINVAL);
+
+ teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From d6ae0551e0a7243cf771f3d2d6d3991591f3d2b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:31:53 +0200
+Subject: thermal: gov_step_wise: Allow cooling level to be reduced earlier
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 2e82368359f63567862a0d438710ddffcb1ace83 ]
+
+The current behavior of the Step-wise thermal governor is to increase
+the cooling level one step at a time after trip point threshold passing
+by thermal zone temperature until the temperature stops to rise. Then,
+nothing is done until the temperature decreases below the (possibly
+updated) trip point threshold, at which point the cooling level is
+reduced straight to the applicable minimum.
+
+While this generally works, it is not in agreement with the throttling
+logic description comment in step_wise_manage() any more after some
+relatively recent changes, and in the case of passive cooling, it may
+lead to undesirable performance oscillations between high and low
+levels.
+
+For this reason, modify the governor's cooling device state selection
+function, get_target_state(), to reduce cooling by one level even if
+the temperature is still above the thermal zone threshold, but the
+temperature has started to fall down. However, ensure that the cooling
+level will remain above the applicable minimum in that case to pull
+the zone temperature further down, possibly until it falls below the
+trip threshold (which may now be equal to the low temperature of the
+trip).
+
+Doing so should help higher performance to be restored earlier in some
+cases which is desirable especially for passive trip points with
+relatively high hysteresis values.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://patch.msgid.link/1947735.tdWV9SEqCh@rafael.j.wysocki
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/gov_step_wise.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/gov_step_wise.c b/drivers/thermal/gov_step_wise.c
+index ea4bf88d37f33..b038f042ed74e 100644
+--- a/drivers/thermal/gov_step_wise.c
++++ b/drivers/thermal/gov_step_wise.c
+@@ -20,7 +20,9 @@
+ * If the temperature is higher than a trip point,
+ * a. if the trend is THERMAL_TREND_RAISING, use higher cooling
+ * state for this trip point
+- * b. if the trend is THERMAL_TREND_DROPPING, do nothing
++ * b. if the trend is THERMAL_TREND_DROPPING, use a lower cooling state
++ * for this trip point, but keep the cooling state above the applicable
++ * minimum
+ * If the temperature is lower than a trip point,
+ * a. if the trend is THERMAL_TREND_RAISING, do nothing
+ * b. if the trend is THERMAL_TREND_DROPPING, use lower cooling
+@@ -51,6 +53,17 @@ static unsigned long get_target_state(struct thermal_instance *instance,
+ if (throttle) {
+ if (trend == THERMAL_TREND_RAISING)
+ return clamp(cur_state + 1, instance->lower, instance->upper);
++
++ /*
++ * If the zone temperature is falling, the cooling level can
++ * be reduced, but it should still be above the lower state of
++ * the given thermal instance to pull the temperature further
++ * down.
++ */
++ if (trend == THERMAL_TREND_DROPPING)
++ return clamp(cur_state - 1,
++ min(instance->lower + 1, instance->upper),
++ instance->upper);
+ } else if (trend == THERMAL_TREND_DROPPING) {
+ if (cur_state <= instance->lower)
+ return THERMAL_NO_TARGET;
+--
+2.51.0
+
--- /dev/null
+From 82016eadb11ce2a83bfacc1217e282c176c0ada0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 13:15:41 -0700
+Subject: thermal: intel: selftests: workload_hint: Mask unsupported types
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 0115d063559fa6d25e41751cf455dda40aa2c856 ]
+
+The workload hint may contain some other hints which are not defined.
+So mask out unsupported types. Currently only lower 4 bits of workload
+type hints are defined.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/20250828201541.931425-1-srinivas.pandruvada@linux.intel.com
+[ rjw: Subject cleanup ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/thermal/intel/workload_hint/workload_hint_test.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c b/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
+index 217c3a641c537..ecf8b06c1ddf6 100644
+--- a/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
++++ b/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
+@@ -146,6 +146,8 @@ int main(int argc, char **argv)
+ ret = sscanf(index_str, "%d", &index);
+ if (ret < 0)
+ break;
++
++ index &= 0x0f;
+ if (index > WORKLOAD_TYPE_MAX_INDEX)
+ printf("Invalid workload type index\n");
+ else
+--
+2.51.0
+
--- /dev/null
+From 818a3f88d1f91d25d108f5418e88760d976f4c9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 7a2ef691b20e1..c2a7af89a67bb 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -55,7 +55,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ if (numwritten < 1) {
+ perror(path);
+ close(fd);
+- return -1;
++ return 0;
+ }
+
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From 93867c4db04bd1904535c75202637e184f877722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 0ecac009273ce..f2c1139adf716 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -233,6 +233,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ char value[SYSFS_PATH_MAX];
+ int bytes_written;
++ int len;
+
+ if (cpuidle_state_count(cpu) <= idlestate)
+ return -1;
+@@ -241,10 +242,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ idlestate_value_files[IDLESTATE_DISABLE]))
+ return -2;
+
+- snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+
+ bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+- value, sizeof(disable));
++ value, len);
+ if (bytes_written)
+ return 0;
+ return -3;
+--
+2.51.0
+
--- /dev/null
+From 18ded11b2ff247dc37bf0f60cab2c3995dad1854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+
+ int enable_hwp_on_cpu(int cpu)
+ {
+- unsigned long long msr;
++ unsigned long long old_msr, new_msr;
++
++ get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++ if (old_msr & 1)
++ return 0; /* already enabled */
+
+- get_msr(cpu, MSR_PM_ENABLE, &msr);
+- put_msr(cpu, MSR_PM_ENABLE, 1);
++ new_msr = old_msr | 1;
++ put_msr(cpu, MSR_PM_ENABLE, new_msr);
+
+ if (verbose)
+- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From a67903c6ccb08bb97ef61c4ec2e71e91da4578ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+ */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+- FILE *filep = fopen(path, "r");
++ FILE *filep = fopen(path, mode);
+
+ if (!filep)
+ err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ char *buffer;
+
+ /* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+- cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++ cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+
+ buffer = malloc(4096);
+ if (!buffer) {
+--
+2.51.0
+
--- /dev/null
+From 6cfad46f4f54fbbc894f915bdc6c05ebe87ed308 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+ * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+ * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+ * so we don't have to touch that.)
+ */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ if (update_hwp_max)
+ update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+
++ hwp_limits_done_via_sysfs = 1;
++
+ return 0;
+ }
+
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ if (debug)
+ print_hwp_request(cpu, &req, "old: ");
+
+- if (update_hwp_min)
++ if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ req.hwp_min = req_update.hwp_min;
+
+- if (update_hwp_max)
++ if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ req.hwp_max = req_update.hwp_max;
+
+ if (update_hwp_desired)
+--
+2.51.0
+
--- /dev/null
+From 2c3254ac3030a9aaa9ba740904b272ba3e585883 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index c00981cc6fe5b..e30c4dd345f40 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2338,6 +2338,13 @@ static void handle_swbp(struct pt_regs *regs)
+
+ handler_chain(uprobe, regs);
+
++ /*
++ * If user decided to take execution elsewhere, it makes little sense
++ * to execute the original instruction, so let's skip it.
++ */
++ if (instruction_pointer(regs) != bp_vaddr)
++ goto out;
++
+ if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From b222c990c22ed57b1f5c0e71ecc09a93995a0045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index 7075bfab59c4d..d191560ce285f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -22,7 +22,7 @@
+ #define LP855X_DEVICE_CTRL 0x01
+ #define LP855X_EEPROM_START 0xA0
+ #define LP855X_EEPROM_END 0xA7
+-#define LP8556_EPROM_START 0xA0
++#define LP8556_EPROM_START 0x98
+ #define LP8556_EPROM_END 0xAF
+
+ /* LP8555/7 Registers */
+--
+2.51.0
+
--- /dev/null
+From fe894d470079eeb5d1b312837e66daafe1f8a29e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index be033bbb126a4..6792d4385eee4 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ th = &tm->handlers[cur_handler];
+
+ guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++ /*
++ * Print an error message if handler_address is NULL, the parse of VA also
++ * can be skipped.
++ */
++ if (unlikely(!handler_info->handler_address)) {
++ pr_info("Skipping handler with NULL address for GUID: %pUL",
++ (guid_t *)handler_info->handler_guid);
++ continue;
++ }
++
+ th->handler_addr =
+ (void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ /*
+- * Print a warning message if handler_addr is zero which is not expected to
+- * ever happen.
++ * Print a warning message and skip the parse of VA if handler_addr is zero
++ * which is not expected to ever happen.
+ */
+- if (unlikely(!th->handler_addr))
++ if (unlikely(!th->handler_addr)) {
+ pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ &th->guid, handler_info->handler_address);
++ continue;
++ }
+
+ th->static_data_buffer_addr =
+ efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+--
+2.51.0
+
--- /dev/null
+From b24dd82a51172052221452dae325da57b2a61f87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 14:52:22 +0000
+Subject: ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
+
+From: Sam van Kampen <sam@tehsvk.net>
+
+[ Upstream commit 3a351de0d9c86e23b9eca25838b19468aab02f38 ]
+
+Just like the other Vivobooks here, the N6506CU has its keyboard IRQ
+described as ActiveLow in the DSDT, which the kernel overrides to
+EdgeHigh, causing the internal keyboard not to work.
+
+Add the N6506CU to the irq1_level_low_skip_override[] quirk table to fix
+this.
+
+Signed-off-by: Sam van Kampen <sam@tehsvk.net>
+Link: https://patch.msgid.link/20250829145221.2294784-2-sam@tehsvk.net
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index b1ab192d7a080..ddedb6956a0df 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -510,6 +510,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "N6506M"),
+ },
+ },
++ {
++ /* Asus Vivobook Pro N6506CU* */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "N6506CU"),
++ },
++ },
+ {
+ /* LG Electronics 17U70P */
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From eb8b2b5347a290960a9afebb6a2dd4741c93cecb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index fb1fe9f3b1a36..9865faa996b0d 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -845,6 +845,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ "PNP0D80", /* Windows-compatible System Power Management Controller */
+ "INT33BD", /* Intel Baytrail Mailbox Device */
++ "INTC10DE", /* Intel CVS LNL */
++ "INTC10E0", /* Intel CVS ARL */
+ "LATT2021", /* Lattice FW Update Client Driver */
+ NULL
+ };
+--
+2.51.0
+
--- /dev/null
+From b951d826325070caa751a40db12a545bb1065b62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 15:08:15 +0800
+Subject: ACPI: SPCR: Support Precise Baud Rate field
+
+From: Chen Pei <cp0613@linux.alibaba.com>
+
+[ Upstream commit 4d330fe54145ecfbb657ac01a554fdedf3c1927e ]
+
+The Microsoft Serial Port Console Redirection (SPCR) specification
+revision 1.09 comprises additional field: Precise Baud Rate [1].
+
+It is used to describe non-traditional baud rates (such as those
+used by high-speed UARTs).
+
+It contains a specific non-zero baud rate which overrides the value
+of the Configured Baud Rate field. If this field is zero or not
+present, Configured Baud Rate is used.
+
+Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table [1]
+Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
+Link: https://patch.msgid.link/20250913070815.16758-1-cp0613@linux.alibaba.com
+[ rjw: Corrected typo in the subject ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/spcr.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
+index cd36a97b0ea2c..fa12e740386de 100644
+--- a/drivers/acpi/spcr.c
++++ b/drivers/acpi/spcr.c
+@@ -146,7 +146,15 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
+ goto done;
+ }
+
+- switch (table->baud_rate) {
++ /*
++ * SPCR 1.09 defines Precise Baud Rate Filed contains a specific
++ * non-zero baud rate which overrides the value of the Configured
++ * Baud Rate field. If this field is zero or not present, Configured
++ * Baud Rate is used.
++ */
++ if (table->precise_baudrate)
++ baud_rate = table->precise_baudrate;
++ else switch (table->baud_rate) {
+ case 0:
+ /*
+ * SPCR 1.04 defines 0 as a preconfigured state of UART.
+--
+2.51.0
+
--- /dev/null
+From c61a8df0a60eefeb53bdfa2d4b3724a7a047bddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:49:46 +0530
+Subject: ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 149139ddcb99583fdec8d1eaf7dada41e5896101 ]
+
+Since str_obj is allocated by ACPICA in acpi_evaluate_object_typed(),
+it should be free with ACPI_FREE() rather than with kfree(), so use
+the former instead of the latter for freeing it.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Link: https://patch.msgid.link/20250822061946.472594-1-kaushlendra.kumar@intel.com
+[ rjw: Subject and changelog rewrite ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/device_sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
+index 3961fc47152c0..cd199fbe4dc90 100644
+--- a/drivers/acpi/device_sysfs.c
++++ b/drivers/acpi/device_sysfs.c
+@@ -464,7 +464,7 @@ static ssize_t description_show(struct device *dev,
+
+ buf[result++] = '\n';
+
+- kfree(str_obj);
++ ACPI_FREE(str_obj);
+
+ return result;
+ }
+--
+2.51.0
+
--- /dev/null
+From 2969e6962f4807942462eb779feeeffa5d9e2c1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index d507d5e084354..4cf74f173c785 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -948,6 +948,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"),
+ },
+ },
++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++ {
++ .callback = video_detect_force_native,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++ },
++ },
+ { },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From c929014821534a1ddd7149575762ebad77888f11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index fef6fb29ece4d..e707a70368026 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ * Delete the operands on the previous walkstate operand stack
+ * (they were copied to new objects)
+ */
+- for (i = 0; i < obj_desc->method.param_count; i++) {
+- acpi_ut_remove_reference(this_walk_state->operands[i]);
+- this_walk_state->operands[i] = NULL;
+- }
+-
+- /* Clear the operand stack */
+-
+- this_walk_state->num_operands = 0;
++ acpi_ds_clear_operands(this_walk_state);
+
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+--
+2.51.0
+
--- /dev/null
+From 25b800f641c511a369f409bb3149b7871a5956d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 5340c28713927..df894235fdbc6 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+ */
+ static inline __attribute__ ((const)) unsigned long __fls(unsigned long x)
+ {
++ if (__builtin_constant_p(x))
++ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ /* FLS insn has exactly same semantics as the API */
+ return __builtin_arc_fls(x);
+ }
+--
+2.51.0
+
--- /dev/null
+From 059cf5849f0f36013ea8f0afb12145245816bc8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:19:46 +0300
+Subject: ARM: tegra: p880: set correct touchscreen clipping
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonas Schwöbel <jonasschwoebel@yahoo.de>
+
+[ Upstream commit b49a73a08100ab139e07cfa7ca36e9b15787d0ab ]
+
+Existing touchscreen clipping is too small and causes problems with
+touchscreen accuracy.
+
+Signed-off-by: Jonas Schwöbel <jonasschwoebel@yahoo.de>
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts b/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
+index 2f7754fd42a16..c6ef0a20c19f3 100644
+--- a/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
++++ b/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
+@@ -108,8 +108,8 @@
+ i2c@7000c400 {
+ touchscreen@20 {
+ rmi4-f11@11 {
+- syna,clip-x-high = <1110>;
+- syna,clip-y-high = <1973>;
++ syna,clip-x-high = <1440>;
++ syna,clip-y-high = <2560>;
+
+ touchscreen-inverted-y;
+ };
+--
+2.51.0
+
--- /dev/null
+From 9dd4b73d5748ca6ba6743e7ad959b44e3af68cbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:31 +0300
+Subject: ARM: tegra: transformer-20: add missing magnetometer interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit cca41614d15ce2bbc2c661362d3eafe53c9990af ]
+
+Add missing interrupt to magnetometer node.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index 67764afeb0136..39008816fe5ee 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -502,6 +502,9 @@
+ compatible = "asahi-kasei,ak8974";
+ reg = <0xe>;
+
++ interrupt-parent = <&gpio>;
++ interrupts = <TEGRA_GPIO(N, 5) IRQ_TYPE_EDGE_RISING>;
++
+ avdd-supply = <&vdd_3v3_sys>;
+ dvdd-supply = <&vdd_1v8_sys>;
+
+--
+2.51.0
+
--- /dev/null
+From 6c6445d335bcf75eb2463486922ecac52c5abd68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:32 +0300
+Subject: ARM: tegra: transformer-20: fix audio-codec interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 3f973d78d176768fa7456def97f0b9824235024f ]
+
+Correct audio-codec interrupt should be PX3 while PX1 is used for external
+microphone detection.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index 39008816fe5ee..efd8838f9644f 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -518,7 +518,7 @@
+ reg = <0x1a>;
+
+ interrupt-parent = <&gpio>;
+- interrupts = <TEGRA_GPIO(X, 1) IRQ_TYPE_EDGE_BOTH>;
++ interrupts = <TEGRA_GPIO(X, 3) IRQ_TYPE_EDGE_BOTH>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+--
+2.51.0
+
--- /dev/null
+From 7785c06efc21a4cd8d329f924c1a08db320a9f6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 11:43:09 +0530
+Subject: arm64: versal-net: Update rtc calibration value
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit b60b74f82e3ed4910a5f96a412e89bdd44875842 ]
+
+As per the design specification
+"The 16-bit Seconds Calibration Value represents the number of
+Oscillator Ticks that are required to measure the largest time period
+that is less than or equal to 1 second.
+For an oscillator that is 32.768kHz, this value will be 0x7FFF."
+
+Signed-off-by: Harini T <harini.t@amd.com>
+Link: https://lore.kernel.org/r/20250710061309.25601-1-harini.t@amd.com
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/versal-net.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/versal-net.dtsi b/arch/arm64/boot/dts/xilinx/versal-net.dtsi
+index fc9f49e57385a..c037a78199670 100644
+--- a/arch/arm64/boot/dts/xilinx/versal-net.dtsi
++++ b/arch/arm64/boot/dts/xilinx/versal-net.dtsi
+@@ -556,7 +556,7 @@
+ reg = <0 0xf12a0000 0 0x100>;
+ interrupts = <0 200 4>, <0 201 4>;
+ interrupt-names = "alarm", "sec";
+- calibration = <0x8000>;
++ calibration = <0x7FFF>;
+ };
+
+ sdhci0: mmc@f1040000 {
+--
+2.51.0
+
--- /dev/null
+From 8f0bb4078b8d367d36c858907712545814f7fb1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:18 +0200
+Subject: arm64: zynqmp: Disable coresight by default
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 0e3f9140ad04dca9a6a93dd6a6decdc53fd665ca ]
+
+When secure-boot mode of bootloader is enabled, the registers of
+coresight are not permitted to access that's why disable it by default.
+
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/7e308b8efe977c4912079b4d1b1ab3d24908559e.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index e11d282462bd3..23d867c03263d 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -550,6 +550,7 @@
+ reg = <0x0 0xfec10000 0x0 0x1000>;
+ clock-names = "apb_pclk";
+ cpu = <&cpu0>;
++ status = "disabled";
+ };
+
+ cpu1_debug: debug@fed10000 {
+@@ -557,6 +558,7 @@
+ reg = <0x0 0xfed10000 0x0 0x1000>;
+ clock-names = "apb_pclk";
+ cpu = <&cpu1>;
++ status = "disabled";
+ };
+
+ cpu2_debug: debug@fee10000 {
+@@ -564,6 +566,7 @@
+ reg = <0x0 0xfee10000 0x0 0x1000>;
+ clock-names = "apb_pclk";
+ cpu = <&cpu2>;
++ status = "disabled";
+ };
+
+ cpu3_debug: debug@fef10000 {
+@@ -571,6 +574,7 @@
+ reg = <0x0 0xfef10000 0x0 0x1000>;
+ clock-names = "apb_pclk";
+ cpu = <&cpu3>;
++ status = "disabled";
+ };
+
+ /* GDMA */
+--
+2.51.0
+
--- /dev/null
+From 76331cba25c7e8102f28a95c8041f82cd6438ea0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:19 +0200
+Subject: arm64: zynqmp: Revert usb node drive strength and slew rate for
+ zcu106
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+
+[ Upstream commit 767ecf9da7b31e5c0c22c273001cb2784705fe8c ]
+
+On a few zcu106 boards USB devices (Dell MS116 USB Optical Mouse, Dell USB
+Entry Keyboard) are not enumerated on linux boot due to commit
+'b8745e7eb488 ("arm64: zynqmp: Fix usb node drive strength and slew
+rate")'.
+
+To fix it as a workaround revert to working version and then investigate
+at board level why drive strength from 12mA to 4mA and slew from fast to
+slow is not working.
+
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/85a70cb014ec1f07972fccb60b875596eeaa6b5c.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+index 7beedd730f940..9dd63cc384e6e 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+@@ -808,8 +808,8 @@
+ pins = "MIO54", "MIO56", "MIO57", "MIO58", "MIO59",
+ "MIO60", "MIO61", "MIO62", "MIO63";
+ bias-disable;
+- drive-strength = <4>;
+- slew-rate = <SLEW_RATE_SLOW>;
++ drive-strength = <12>;
++ slew-rate = <SLEW_RATE_FAST>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From eda856857ce6739e785156ae62ad6c005a28aa39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 15:55:20 +0800
+Subject: blk-cgroup: fix possible deadlock while configuring policy
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 5d726c4dbeeddef612e6bed27edd29733f4d13af ]
+
+Following deadlock can be triggered easily by lockdep:
+
+WARNING: possible circular locking dependency detected
+6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted
+------------------------------------------------------
+check/1334 is trying to acquire lock:
+ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180
+
+but task is already holding lock:
+ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}:
+ blk_queue_enter+0x40b/0x470
+ blkg_conf_prep+0x7b/0x3c0
+ tg_set_limit+0x10a/0x3e0
+ cgroup_file_write+0xc6/0x420
+ kernfs_fop_write_iter+0x189/0x280
+ vfs_write+0x256/0x490
+ ksys_write+0x83/0x190
+ __x64_sys_write+0x21/0x30
+ x64_sys_call+0x4608/0x4630
+ do_syscall_64+0xdb/0x6b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+-> #1 (&q->rq_qos_mutex){+.+.}-{4:4}:
+ __mutex_lock+0xd8/0xf50
+ mutex_lock_nested+0x2b/0x40
+ wbt_init+0x17e/0x280
+ wbt_enable_default+0xe9/0x140
+ blk_register_queue+0x1da/0x2e0
+ __add_disk+0x38c/0x5d0
+ add_disk_fwnode+0x89/0x250
+ device_add_disk+0x18/0x30
+ virtblk_probe+0x13a3/0x1800
+ virtio_dev_probe+0x389/0x610
+ really_probe+0x136/0x620
+ __driver_probe_device+0xb3/0x230
+ driver_probe_device+0x2f/0xe0
+ __driver_attach+0x158/0x250
+ bus_for_each_dev+0xa9/0x130
+ driver_attach+0x26/0x40
+ bus_add_driver+0x178/0x3d0
+ driver_register+0x7d/0x1c0
+ __register_virtio_driver+0x2c/0x60
+ virtio_blk_init+0x6f/0xe0
+ do_one_initcall+0x94/0x540
+ kernel_init_freeable+0x56a/0x7b0
+ kernel_init+0x2b/0x270
+ ret_from_fork+0x268/0x4c0
+ ret_from_fork_asm+0x1a/0x30
+
+-> #0 (&q->sysfs_lock){+.+.}-{4:4}:
+ __lock_acquire+0x1835/0x2940
+ lock_acquire+0xf9/0x450
+ __mutex_lock+0xd8/0xf50
+ mutex_lock_nested+0x2b/0x40
+ blk_unregister_queue+0x53/0x180
+ __del_gendisk+0x226/0x690
+ del_gendisk+0xba/0x110
+ sd_remove+0x49/0xb0 [sd_mod]
+ device_remove+0x87/0xb0
+ device_release_driver_internal+0x11e/0x230
+ device_release_driver+0x1a/0x30
+ bus_remove_device+0x14d/0x220
+ device_del+0x1e1/0x5a0
+ __scsi_remove_device+0x1ff/0x2f0
+ scsi_remove_device+0x37/0x60
+ sdev_store_delete+0x77/0x100
+ dev_attr_store+0x1f/0x40
+ sysfs_kf_write+0x65/0x90
+ kernfs_fop_write_iter+0x189/0x280
+ vfs_write+0x256/0x490
+ ksys_write+0x83/0x190
+ __x64_sys_write+0x21/0x30
+ x64_sys_call+0x4608/0x4630
+ do_syscall_64+0xdb/0x6b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+other info that might help us debug this:
+
+Chain exists of:
+ &q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&q->q_usage_counter(queue)#3);
+ lock(&q->rq_qos_mutex);
+ lock(&q->q_usage_counter(queue)#3);
+ lock(&q->sysfs_lock);
+
+Root cause is that queue_usage_counter is grabbed with rq_qos_mutex
+held in blkg_conf_prep(), while queue should be freezed before
+rq_qos_mutex from other context.
+
+The blk_queue_enter() from blkg_conf_prep() is used to protect against
+policy deactivation, which is already protected with blkcg_mutex, hence
+convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile,
+consider that blkcg_mutex is held after queue is freezed from policy
+deactivation, also convert blkg_alloc() to use GFP_NOIO.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 091e9623bc294..3cffb68ba5d87 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -874,14 +874,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ disk = ctx->bdev->bd_disk;
+ q = disk->queue;
+
+- /*
+- * blkcg_deactivate_policy() requires queue to be frozen, we can grab
+- * q_usage_counter to prevent concurrent with blkcg_deactivate_policy().
+- */
+- ret = blk_queue_enter(q, 0);
+- if (ret)
+- goto fail;
+-
++ /* Prevent concurrent with blkcg_deactivate_policy() */
++ mutex_lock(&q->blkcg_mutex);
+ spin_lock_irq(&q->queue_lock);
+
+ if (!blkcg_policy_enabled(q, pol)) {
+@@ -911,16 +905,16 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ /* Drop locks to do new blkg allocation with GFP_KERNEL. */
+ spin_unlock_irq(&q->queue_lock);
+
+- new_blkg = blkg_alloc(pos, disk, GFP_KERNEL);
++ new_blkg = blkg_alloc(pos, disk, GFP_NOIO);
+ if (unlikely(!new_blkg)) {
+ ret = -ENOMEM;
+- goto fail_exit_queue;
++ goto fail_exit;
+ }
+
+ if (radix_tree_preload(GFP_KERNEL)) {
+ blkg_free(new_blkg);
+ ret = -ENOMEM;
+- goto fail_exit_queue;
++ goto fail_exit;
+ }
+
+ spin_lock_irq(&q->queue_lock);
+@@ -948,7 +942,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ goto success;
+ }
+ success:
+- blk_queue_exit(q);
++ mutex_unlock(&q->blkcg_mutex);
+ ctx->blkg = blkg;
+ return 0;
+
+@@ -956,9 +950,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ radix_tree_preload_end();
+ fail_unlock:
+ spin_unlock_irq(&q->queue_lock);
+-fail_exit_queue:
+- blk_queue_exit(q);
+-fail:
++fail_exit:
++ mutex_unlock(&q->blkcg_mutex);
+ /*
+ * If queue was bypassing, we should retry. Do so after a
+ * short msleep(). It isn't strictly necessary but queue
+--
+2.51.0
+
--- /dev/null
+From ad0aa980eebb74baa1151a8f5fd3de58338dda0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 07:12:51 -0700
+Subject: block: check for valid bio while splitting
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit fec2e705729dc93de5399d8b139e4746805c3d81 ]
+
+We're already iterating every segment, so check these for a valid IO
+lengths at the same time. Individual segment lengths will not be checked
+on passthrough commands. The read/write command segments must be sized
+to the dma alignment.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-map.c | 2 +-
+ block/blk-merge.c | 21 +++++++++++++++++----
+ include/linux/bio.h | 4 ++--
+ include/linux/blkdev.h | 7 +++++++
+ 4 files changed, 27 insertions(+), 7 deletions(-)
+
+diff --git a/block/blk-map.c b/block/blk-map.c
+index 23e5d5ebe59ec..6d1268aa82715 100644
+--- a/block/blk-map.c
++++ b/block/blk-map.c
+@@ -443,7 +443,7 @@ int blk_rq_append_bio(struct request *rq, struct bio *bio)
+ int ret;
+
+ /* check that the data layout matches the hardware restrictions */
+- ret = bio_split_rw_at(bio, lim, &nr_segs, max_bytes);
++ ret = bio_split_io_at(bio, lim, &nr_segs, max_bytes, 0);
+ if (ret) {
+ /* if we would have to split the bio, copy instead */
+ if (ret > 0)
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 77488f11a9441..37864c5d287ef 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -303,25 +303,30 @@ static unsigned int bio_split_alignment(struct bio *bio,
+ }
+
+ /**
+- * bio_split_rw_at - check if and where to split a read/write bio
++ * bio_split_io_at - check if and where to split a bio
+ * @bio: [in] bio to be split
+ * @lim: [in] queue limits to split based on
+ * @segs: [out] number of segments in the bio with the first half of the sectors
+ * @max_bytes: [in] maximum number of bytes per bio
++ * @len_align_mask: [in] length alignment mask for each vector
+ *
+ * Find out if @bio needs to be split to fit the queue limits in @lim and a
+ * maximum size of @max_bytes. Returns a negative error number if @bio can't be
+ * split, 0 if the bio doesn't have to be split, or a positive sector offset if
+ * @bio needs to be split.
+ */
+-int bio_split_rw_at(struct bio *bio, const struct queue_limits *lim,
+- unsigned *segs, unsigned max_bytes)
++int bio_split_io_at(struct bio *bio, const struct queue_limits *lim,
++ unsigned *segs, unsigned max_bytes, unsigned len_align_mask)
+ {
+ struct bio_vec bv, bvprv, *bvprvp = NULL;
+ struct bvec_iter iter;
+ unsigned nsegs = 0, bytes = 0;
+
+ bio_for_each_bvec(bv, bio, iter) {
++ if (bv.bv_offset & lim->dma_alignment ||
++ bv.bv_len & len_align_mask)
++ return -EINVAL;
++
+ /*
+ * If the queue doesn't support SG gaps and adding this
+ * offset would create a gap, disallow it.
+@@ -363,8 +368,16 @@ int bio_split_rw_at(struct bio *bio, const struct queue_limits *lim,
+ * Individual bvecs might not be logical block aligned. Round down the
+ * split size so that each bio is properly block size aligned, even if
+ * we do not use the full hardware limits.
++ *
++ * It is possible to submit a bio that can't be split into a valid io:
++ * there may either be too many discontiguous vectors for the max
++ * segments limit, or contain virtual boundary gaps without having a
++ * valid block sized split. A zero byte result means one of those
++ * conditions occured.
+ */
+ bytes = ALIGN_DOWN(bytes, bio_split_alignment(bio, lim));
++ if (!bytes)
++ return -EINVAL;
+
+ /*
+ * Bio splitting may cause subtle trouble such as hang when doing sync
+@@ -374,7 +387,7 @@ int bio_split_rw_at(struct bio *bio, const struct queue_limits *lim,
+ bio_clear_polled(bio);
+ return bytes >> SECTOR_SHIFT;
+ }
+-EXPORT_SYMBOL_GPL(bio_split_rw_at);
++EXPORT_SYMBOL_GPL(bio_split_io_at);
+
+ struct bio *bio_split_rw(struct bio *bio, const struct queue_limits *lim,
+ unsigned *nr_segs)
+diff --git a/include/linux/bio.h b/include/linux/bio.h
+index 46ffac5caab78..519a1d59805f8 100644
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -322,8 +322,8 @@ static inline void bio_next_folio(struct folio_iter *fi, struct bio *bio)
+ void bio_trim(struct bio *bio, sector_t offset, sector_t size);
+ extern struct bio *bio_split(struct bio *bio, int sectors,
+ gfp_t gfp, struct bio_set *bs);
+-int bio_split_rw_at(struct bio *bio, const struct queue_limits *lim,
+- unsigned *segs, unsigned max_bytes);
++int bio_split_io_at(struct bio *bio, const struct queue_limits *lim,
++ unsigned *segs, unsigned max_bytes, unsigned len_align);
+
+ /**
+ * bio_next_split - get next @sectors from a bio, splitting if necessary
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index cc221318712e7..37fa7169fa9f4 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1872,6 +1872,13 @@ bdev_atomic_write_unit_max_bytes(struct block_device *bdev)
+ return queue_atomic_write_unit_max_bytes(bdev_get_queue(bdev));
+ }
+
++static inline int bio_split_rw_at(struct bio *bio,
++ const struct queue_limits *lim,
++ unsigned *segs, unsigned max_bytes)
++{
++ return bio_split_io_at(bio, lim, segs, max_bytes, lim->dma_alignment);
++}
++
+ #define DEFINE_IO_COMP_BATCH(name) struct io_comp_batch name = { }
+
+ #endif /* _LINUX_BLKDEV_H */
+--
+2.51.0
+
--- /dev/null
+From d001adad8234acbd11c3ab94ad6e023d6549993b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:49 -0700
+Subject: bpf: Clear pfmemalloc flag when freeing all fragments
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
+
+It is possible for bpf_xdp_adjust_tail() to free all fragments. The
+kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not
+XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when
+building sk_buff from xdp_buff since all readers of xdp_buff->flags
+use the flag only when there are fragments. Clear the
+XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xdp.h | 5 +++++
+ net/core/filter.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/net/xdp.h b/include/net/xdp.h
+index b40f1f96cb117..f288c348a6c13 100644
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -115,6 +115,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp)
+ xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC;
+ }
+
++static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp)
++{
++ xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC;
++}
++
+ static __always_inline void
+ xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
+ {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index c5cdf3b08341a..b20d5fecdbc95 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4212,6 +4212,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)
+
+ if (unlikely(!sinfo->nr_frags)) {
+ xdp_buff_clear_frags_flag(xdp);
++ xdp_buff_clear_frag_pfmemalloc(xdp);
+ xdp->data_end -= offset;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 99137a4292c54b7a26af5d28268787a683df2c47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 03:26:17 +0000
+Subject: bpf: Do not limit bpf_cgroup_from_id to current's namespace
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit 2c895133950646f45e5cf3900b168c952c8dbee8 ]
+
+The bpf_cgroup_from_id kfunc relies on cgroup_get_from_id to obtain the
+cgroup corresponding to a given cgroup ID. This helper can be called in
+a lot of contexts where the current thread can be random. A recent
+example was its use in sched_ext's ops.tick(), to obtain the root cgroup
+pointer. Since the current task can be whatever random user space task
+preempted by the timer tick, this makes the behavior of the helper
+unreliable.
+
+Refactor out __cgroup_get_from_id as the non-namespace aware version of
+cgroup_get_from_id, and change bpf_cgroup_from_id to make use of it.
+
+There is no compatibility breakage here, since changing the namespace
+against which the lookup is being done to the root cgroup namespace only
+permits a wider set of lookups to succeed now. The cgroup IDs across
+namespaces are globally unique, and thus don't need to be retranslated.
+
+Reported-by: Dan Schatzberg <dschatzberg@meta.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20250915032618.1551762-2-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cgroup.h | 1 +
+ kernel/bpf/helpers.c | 2 +-
+ kernel/cgroup/cgroup.c | 24 ++++++++++++++++++++----
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index b18fb5fcb38e2..b08c8e62881cd 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -650,6 +650,7 @@ static inline void cgroup_kthread_ready(void)
+ }
+
+ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen);
++struct cgroup *__cgroup_get_from_id(u64 id);
+ struct cgroup *cgroup_get_from_id(u64 id);
+ #else /* !CONFIG_CGROUPS */
+
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index a12f4fa444086..3eb02ce0dba3b 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -2537,7 +2537,7 @@ __bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid)
+ {
+ struct cgroup *cgrp;
+
+- cgrp = cgroup_get_from_id(cgid);
++ cgrp = __cgroup_get_from_id(cgid);
+ if (IS_ERR(cgrp))
+ return NULL;
+ return cgrp;
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 77d02f87f3f12..c62b98f027f99 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -6373,15 +6373,15 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen)
+ }
+
+ /*
+- * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * __cgroup_get_from_id : get the cgroup associated with cgroup id
+ * @id: cgroup id
+ * On success return the cgrp or ERR_PTR on failure
+- * Only cgroups within current task's cgroup NS are valid.
++ * There are no cgroup NS restrictions.
+ */
+-struct cgroup *cgroup_get_from_id(u64 id)
++struct cgroup *__cgroup_get_from_id(u64 id)
+ {
+ struct kernfs_node *kn;
+- struct cgroup *cgrp, *root_cgrp;
++ struct cgroup *cgrp;
+
+ kn = kernfs_find_and_get_node_by_id(cgrp_dfl_root.kf_root, id);
+ if (!kn)
+@@ -6403,6 +6403,22 @@ struct cgroup *cgroup_get_from_id(u64 id)
+
+ if (!cgrp)
+ return ERR_PTR(-ENOENT);
++ return cgrp;
++}
++
++/*
++ * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * @id: cgroup id
++ * On success return the cgrp or ERR_PTR on failure
++ * Only cgroups within current task's cgroup NS are valid.
++ */
++struct cgroup *cgroup_get_from_id(u64 id)
++{
++ struct cgroup *cgrp, *root_cgrp;
++
++ cgrp = __cgroup_get_from_id(id);
++ if (IS_ERR(cgrp))
++ return cgrp;
+
+ root_cgrp = current_cgns_cgroup_dfl();
+ if (!cgroup_is_descendant(cgrp, root_cgrp)) {
+--
+2.51.0
+
--- /dev/null
+From 176e48fb708bea8501e8e44088bb6dfa529b3c08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 1e7fd3ee759e0..52fecb7a1fe36 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1296,7 +1296,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ u32 pass, void *image)
+ {
+- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ proglen, pass, image, current->comm, task_pid_nr(current));
+
+ if (image)
+--
+2.51.0
+
--- /dev/null
+From af3d9a670f2fb7149fe81657e52f3af5354ec09e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:18:06 +0200
+Subject: bpf: Use tnums for JEQ/JNE is_branch_taken logic
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit f41345f47fb267a9c95ca710c33448f8d0d81d83 ]
+
+In the following toy program (reg states minimized for readability), R0
+and R1 always have different values at instruction 6. This is obvious
+when reading the program but cannot be guessed from ranges alone as
+they overlap (R0 in [0; 0xc0000000], R1 in [1024; 0xc0000400]).
+
+ 0: call bpf_get_prandom_u32#7 ; R0_w=scalar()
+ 1: w0 = w0 ; R0_w=scalar(var_off=(0x0; 0xffffffff))
+ 2: r0 >>= 30 ; R0_w=scalar(var_off=(0x0; 0x3))
+ 3: r0 <<= 30 ; R0_w=scalar(var_off=(0x0; 0xc0000000))
+ 4: r1 = r0 ; R1_w=scalar(var_off=(0x0; 0xc0000000))
+ 5: r1 += 1024 ; R1_w=scalar(var_off=(0x400; 0xc0000000))
+ 6: if r1 != r0 goto pc+1
+
+Looking at tnums however, we can deduce that R1 is always different from
+R0 because their tnums don't agree on known bits. This patch uses this
+logic to improve is_scalar_branch_taken in case of BPF_JEQ and BPF_JNE.
+
+This change has a tiny impact on complexity, which was measured with
+the Cilium complexity CI test. That test covers 72 programs with
+various build and load time configurations for a total of 970 test
+cases. For 80% of test cases, the patch has no impact. On the other
+test cases, the patch decreases complexity by only 0.08% on average. In
+the best case, the verifier needs to walk 3% less instructions and, in
+the worst case, 1.5% more. Overall, the patch has a small positive
+impact, especially for our largest programs.
+
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/be3ee70b6e489c49881cb1646114b1d861b5c334.1755694147.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/tnum.h | 3 +++
+ kernel/bpf/tnum.c | 8 ++++++++
+ kernel/bpf/verifier.c | 4 ++++
+ 3 files changed, 15 insertions(+)
+
+diff --git a/include/linux/tnum.h b/include/linux/tnum.h
+index 57ed3035cc309..0ffb77ffe0e87 100644
+--- a/include/linux/tnum.h
++++ b/include/linux/tnum.h
+@@ -51,6 +51,9 @@ struct tnum tnum_xor(struct tnum a, struct tnum b);
+ /* Multiply two tnums, return @a * @b */
+ struct tnum tnum_mul(struct tnum a, struct tnum b);
+
++/* Return true if the known bits of both tnums have the same value */
++bool tnum_overlap(struct tnum a, struct tnum b);
++
+ /* Return a tnum representing numbers satisfying both @a and @b */
+ struct tnum tnum_intersect(struct tnum a, struct tnum b);
+
+diff --git a/kernel/bpf/tnum.c b/kernel/bpf/tnum.c
+index fa353c5d550fc..d9328bbb3680b 100644
+--- a/kernel/bpf/tnum.c
++++ b/kernel/bpf/tnum.c
+@@ -143,6 +143,14 @@ struct tnum tnum_mul(struct tnum a, struct tnum b)
+ return tnum_add(TNUM(acc_v, 0), acc_m);
+ }
+
++bool tnum_overlap(struct tnum a, struct tnum b)
++{
++ u64 mu;
++
++ mu = ~a.mask & ~b.mask;
++ return (a.value & mu) == (b.value & mu);
++}
++
+ /* Note that if a and b disagree - i.e. one has a 'known 1' where the other has
+ * a 'known 0' - this will return a 'known 1' for that bit.
+ */
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index ed1457c273409..2844adf4da61a 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -15906,6 +15906,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta
+ */
+ if (tnum_is_const(t1) && tnum_is_const(t2))
+ return t1.value == t2.value;
++ if (!tnum_overlap(t1, t2))
++ return 0;
+ /* non-overlapping ranges */
+ if (umin1 > umax2 || umax1 < umin2)
+ return 0;
+@@ -15930,6 +15932,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta
+ */
+ if (tnum_is_const(t1) && tnum_is_const(t2))
+ return t1.value != t2.value;
++ if (!tnum_overlap(t1, t2))
++ return 1;
+ /* non-overlapping ranges */
+ if (umin1 > umax2 || umax1 < umin2)
+ return 1;
+--
+2.51.0
+
--- /dev/null
+From 38363fa867fbe7e039ca75eda7cc651bbcef15aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 07:11:07 +0100
+Subject: bpftool: Add CET-aware symbol matching for x86_64 architectures
+
+From: Yuan Chen <chenyuan@kylinos.cn>
+
+[ Upstream commit 6417ca85305ecaffef13cf9063ac35da8fba8500 ]
+
+Adjust symbol matching logic to account for Control-flow Enforcement
+Technology (CET) on x86_64 systems. CET prefixes functions with
+a 4-byte 'endbr' instruction, shifting the actual hook entry point to
+symbol + 4.
+
+Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/20250829061107.23905-3-chenyuan_fl@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/link.c | 54 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 50 insertions(+), 4 deletions(-)
+
+diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
+index a773e05d5ade4..bdcd717b0348f 100644
+--- a/tools/bpf/bpftool/link.c
++++ b/tools/bpf/bpftool/link.c
+@@ -282,11 +282,52 @@ get_addr_cookie_array(__u64 *addrs, __u64 *cookies, __u32 count)
+ return data;
+ }
+
++static bool is_x86_ibt_enabled(void)
++{
++#if defined(__x86_64__)
++ struct kernel_config_option options[] = {
++ { "CONFIG_X86_KERNEL_IBT", },
++ };
++ char *values[ARRAY_SIZE(options)] = { };
++ bool ret;
++
++ if (read_kernel_config(options, ARRAY_SIZE(options), values, NULL))
++ return false;
++
++ ret = !!values[0];
++ free(values[0]);
++ return ret;
++#else
++ return false;
++#endif
++}
++
++static bool
++symbol_matches_target(__u64 sym_addr, __u64 target_addr, bool is_ibt_enabled)
++{
++ if (sym_addr == target_addr)
++ return true;
++
++ /*
++ * On x86_64 architectures with CET (Control-flow Enforcement Technology),
++ * function entry points have a 4-byte 'endbr' instruction prefix.
++ * This causes kprobe hooks to target the address *after* 'endbr'
++ * (symbol address + 4), preserving the CET instruction.
++ * Here we check if the symbol address matches the hook target address
++ * minus 4, indicating a CET-enabled function entry point.
++ */
++ if (is_ibt_enabled && sym_addr == target_addr - 4)
++ return true;
++
++ return false;
++}
++
+ static void
+ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
+ {
+ struct addr_cookie *data;
+ __u32 i, j = 0;
++ bool is_ibt_enabled;
+
+ jsonw_bool_field(json_wtr, "retprobe",
+ info->kprobe_multi.flags & BPF_F_KPROBE_MULTI_RETURN);
+@@ -306,11 +347,13 @@ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
+ if (!dd.sym_count)
+ goto error;
+
++ is_ibt_enabled = is_x86_ibt_enabled();
+ for (i = 0; i < dd.sym_count; i++) {
+- if (dd.sym_mapping[i].address != data[j].addr)
++ if (!symbol_matches_target(dd.sym_mapping[i].address,
++ data[j].addr, is_ibt_enabled))
+ continue;
+ jsonw_start_object(json_wtr);
+- jsonw_uint_field(json_wtr, "addr", dd.sym_mapping[i].address);
++ jsonw_uint_field(json_wtr, "addr", (unsigned long)data[j].addr);
+ jsonw_string_field(json_wtr, "func", dd.sym_mapping[i].name);
+ /* Print null if it is vmlinux */
+ if (dd.sym_mapping[i].module[0] == '\0') {
+@@ -719,6 +762,7 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)
+ {
+ struct addr_cookie *data;
+ __u32 i, j = 0;
++ bool is_ibt_enabled;
+
+ if (!info->kprobe_multi.count)
+ return;
+@@ -742,12 +786,14 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)
+ if (!dd.sym_count)
+ goto error;
+
++ is_ibt_enabled = is_x86_ibt_enabled();
+ printf("\n\t%-16s %-16s %s", "addr", "cookie", "func [module]");
+ for (i = 0; i < dd.sym_count; i++) {
+- if (dd.sym_mapping[i].address != data[j].addr)
++ if (!symbol_matches_target(dd.sym_mapping[i].address,
++ data[j].addr, is_ibt_enabled))
+ continue;
+ printf("\n\t%016lx %-16llx %s",
+- dd.sym_mapping[i].address, data[j].cookie, dd.sym_mapping[i].name);
++ (unsigned long)data[j].addr, data[j].cookie, dd.sym_mapping[i].name);
+ if (dd.sym_mapping[i].module[0] != '\0')
+ printf(" [%s] ", dd.sym_mapping[i].module);
+ else
+--
+2.51.0
+
--- /dev/null
+From 87cb403b2fa7c787498fd0bd03071f94302b24a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:38:47 -0700
+Subject: bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
+
+From: Tom Stellard <tstellar@redhat.com>
+
+[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
+
+This fixes the build with -Werror -Wall.
+
+btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 71 | info.func_info = ptr_to_u64(&finfo);
+ | ^~~~~
+
+prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 2294 | info.func_info = ptr_to_u64(&func_info);
+ |
+
+v2:
+ - Initialize instead of using memset.
+
+Signed-off-by: Tom Stellard <tstellar@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 2 +-
+ tools/bpf/bpftool/prog.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 4e896d8a2416e..ff12628593aec 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,
+ __u32 info_len = sizeof(info);
+ const char *prog_name = NULL;
+ struct btf *prog_btf = NULL;
+- struct bpf_func_info finfo;
++ struct bpf_func_info finfo = {};
+ __u32 finfo_rec_size;
+ char prog_str[1024];
+ int err;
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 9722d841abc05..a89629a9932b5 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2262,7 +2262,7 @@ static void profile_print_readings(void)
+
+ static char *profile_target_name(int tgt_fd)
+ {
+- struct bpf_func_info func_info;
++ struct bpf_func_info func_info = {};
+ struct bpf_prog_info info = {};
+ __u32 info_len = sizeof(info);
+ const struct btf_type *t;
+--
+2.51.0
+
--- /dev/null
+From dcb2dd50fa2e1e325560d91883295c6be6830254 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 04:03:27 -0400
+Subject: clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+
+[ Upstream commit c445bffbf28f721e05d0ce06895045fc62aaff7c ]
+
+During normal operation the timers are reprogrammed including an
+interrupt acknowledgement. This has no effect as the whole timer
+is setup from scratch afterwards. Especially in an interrupt this
+has already been done by rttm_timer_interrupt().
+
+Change the behaviour as follows:
+
+- Use rttm_disable_timer() during reprogramming
+- Keep rttm_stop_timer() for all other use cases.
+
+Downstream has already tested and confirmed a patch. See
+https://github.com/openwrt/openwrt/pull/19468
+https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Stephen Howell <howels@allthatwemight.be>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20250804080328.2609287-4-markus.stockhausen@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-rtl-otto.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clocksource/timer-rtl-otto.c b/drivers/clocksource/timer-rtl-otto.c
+index 8be45a11fb8b6..24c4aa6a30131 100644
+--- a/drivers/clocksource/timer-rtl-otto.c
++++ b/drivers/clocksource/timer-rtl-otto.c
+@@ -147,7 +147,7 @@ static int rttm_next_event(unsigned long delta, struct clock_event_device *clkev
+
+ RTTM_DEBUG(to->of_base.base);
+ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+- rttm_stop_timer(to->of_base.base);
++ rttm_disable_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, delta);
+ rttm_start_timer(to, RTTM_CTRL_COUNTER);
+
+@@ -160,7 +160,7 @@ static int rttm_state_oneshot(struct clock_event_device *clkevt)
+
+ RTTM_DEBUG(to->of_base.base);
+ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+- rttm_stop_timer(to->of_base.base);
++ rttm_disable_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ rttm_start_timer(to, RTTM_CTRL_COUNTER);
+
+@@ -173,7 +173,7 @@ static int rttm_state_periodic(struct clock_event_device *clkevt)
+
+ RTTM_DEBUG(to->of_base.base);
+ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_TIMER);
+- rttm_stop_timer(to->of_base.base);
++ rttm_disable_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ rttm_start_timer(to, RTTM_CTRL_TIMER);
+
+--
+2.51.0
+
--- /dev/null
+From fbc0494f847969d81c1f087117dca462c816bedb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 04:03:25 -0400
+Subject: clocksource/drivers/timer-rtl-otto: Work around dying timers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+
+[ Upstream commit e7a25106335041aeca4fdf50a84804c90142c886 ]
+
+The OpenWrt distribution has switched from kernel longterm 6.6 to
+6.12. Reports show that devices with the Realtek Otto switch platform
+die during operation and are rebooted by the watchdog. Sorting out
+other possible reasons the Otto timer is to blame. The platform
+currently consists of 4 targets with different hardware revisions.
+It is not 100% clear which devices and revisions are affected.
+
+Analysis shows:
+
+A more aggressive sched/deadline handling leads to more timer starts
+with small intervals. This increases the bug chances. See
+https://marc.info/?l=linux-kernel&m=175276556023276&w=2
+
+Focusing on the real issue a hardware limitation on some devices was
+found. There is a minimal chance that a timer ends without firing an
+interrupt if it is reprogrammed within the 5us before its expiration
+time. Work around this issue by introducing a bounce() function. It
+restarts the timer directly before the normal restart functions as
+follows:
+
+- Stop timer
+- Restart timer with a slow frequency.
+- Target time will be >5us
+- The subsequent normal restart is outside the critical window
+
+Downstream has already tested and confirmed a patch. See
+https://github.com/openwrt/openwrt/pull/19468
+https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Stephen Howell <howels@allthatwemight.be>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20250804080328.2609287-2-markus.stockhausen@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-rtl-otto.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clocksource/timer-rtl-otto.c b/drivers/clocksource/timer-rtl-otto.c
+index 8a3068b36e752..8be45a11fb8b6 100644
+--- a/drivers/clocksource/timer-rtl-otto.c
++++ b/drivers/clocksource/timer-rtl-otto.c
+@@ -38,6 +38,7 @@
+ #define RTTM_BIT_COUNT 28
+ #define RTTM_MIN_DELTA 8
+ #define RTTM_MAX_DELTA CLOCKSOURCE_MASK(28)
++#define RTTM_MAX_DIVISOR GENMASK(15, 0)
+
+ /*
+ * Timers are derived from the LXB clock frequency. Usually this is a fixed
+@@ -112,6 +113,22 @@ static irqreturn_t rttm_timer_interrupt(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
++static void rttm_bounce_timer(void __iomem *base, u32 mode)
++{
++ /*
++ * When a running timer has less than ~5us left, a stop/start sequence
++ * might fail. While the details are unknown the most evident effect is
++ * that the subsequent interrupt will not be fired.
++ *
++ * As a workaround issue an intermediate restart with a very slow
++ * frequency of ~3kHz keeping the target counter (>=8). So the follow
++ * up restart will always be issued outside the critical window.
++ */
++
++ rttm_disable_timer(base);
++ rttm_enable_timer(base, mode, RTTM_MAX_DIVISOR);
++}
++
+ static void rttm_stop_timer(void __iomem *base)
+ {
+ rttm_disable_timer(base);
+@@ -129,6 +146,7 @@ static int rttm_next_event(unsigned long delta, struct clock_event_device *clkev
+ struct timer_of *to = to_timer_of(clkevt);
+
+ RTTM_DEBUG(to->of_base.base);
++ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+ rttm_stop_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, delta);
+ rttm_start_timer(to, RTTM_CTRL_COUNTER);
+@@ -141,6 +159,7 @@ static int rttm_state_oneshot(struct clock_event_device *clkevt)
+ struct timer_of *to = to_timer_of(clkevt);
+
+ RTTM_DEBUG(to->of_base.base);
++ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+ rttm_stop_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ rttm_start_timer(to, RTTM_CTRL_COUNTER);
+@@ -153,6 +172,7 @@ static int rttm_state_periodic(struct clock_event_device *clkevt)
+ struct timer_of *to = to_timer_of(clkevt);
+
+ RTTM_DEBUG(to->of_base.base);
++ rttm_bounce_timer(to->of_base.base, RTTM_CTRL_TIMER);
+ rttm_stop_timer(to->of_base.base);
+ rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ rttm_start_timer(to, RTTM_CTRL_TIMER);
+--
+2.51.0
+
--- /dev/null
+From 6479869240018176a7de2885fb04842036e41d49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+
+ static inline void pit_timer_enable(void)
+ {
+- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_timer_disable(void)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
++ writel(0, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_irq_acknowledge(void)
+ {
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+
+ static u64 notrace pit_read_sched_clock(void)
+ {
+- return ~__raw_readl(clksrc_base + PITCVAL);
++ return ~readl(clksrc_base + PITCVAL);
+ }
+
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ /* set the max load value and start the clock source counter */
+- __raw_writel(0, clksrc_base + PITTCTRL);
+- __raw_writel(~0UL, clksrc_base + PITLDVAL);
+- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++ writel(0, clksrc_base + PITTCTRL);
++ writel(~0UL, clksrc_base + PITLDVAL);
++ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+
+ sched_clock_register(pit_read_sched_clock, 32, rate);
+ return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ * hardware requirement.
+ */
+ pit_timer_disable();
+- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
++ writel(delta - 1, clkevt_base + PITLDVAL);
+ pit_timer_enable();
+
+ return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(0, clkevt_base + PITTCTRL);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+
+ BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ cycle_per_jiffy = clk_rate / (HZ);
+
+ /* enable the pit module */
+- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++ writel(~PITMCR_MDIS, timer_base + PITMCR);
+
+ ret = pit_clocksource_init(clk_rate);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From 5ecbee1470fd109e85897c6320f31c10aa2d6128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index ba0e08c8486a6..49e76b44468aa 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)
+ struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ int i;
+
++ if (unlikely(!policy))
++ return;
++
+ for (i = 0; i < numscales; i++) {
+ if (mults[i] == maxmult) {
+ struct cpufreq_freqs freqs;
+--
+2.51.0
+
--- /dev/null
+From 026977edc683a41e1586e298fadd49ec9f7f24ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:06:55 -0700
+Subject: cpufreq: ondemand: Update the efficient idle check for Intel extended
+ Families
+
+From: Sohil Mehta <sohil.mehta@intel.com>
+
+[ Upstream commit 7f3cfb7943d27a7b61bdac8db739cf0bdc28e87d ]
+
+IO time is considered busy by default for modern Intel processors. The
+current check covers recent Family 6 models but excludes the brand new
+Families 18 and 19.
+
+According to Arjan van de Ven, the model check was mainly due to a lack
+of testing on systems before INTEL_CORE2_MEROM. He suggests considering
+all Intel processors as having an efficient idle.
+
+Extend the IO busy classification to all Intel processors starting with
+Family 6, including Family 15 (Pentium 4s) and upcoming Families 18/19.
+
+Use an x86 VFM check and move the function to the header file to avoid
+using arch-specific #ifdefs in the C file.
+
+Signed-off-by: Sohil Mehta <sohil.mehta@intel.com>
+Link: https://patch.msgid.link/20250908230655.2562440-1-sohil.mehta@intel.com
+[ rjw: Added empty line after #include ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq_ondemand.c | 25 +------------------------
+ drivers/cpufreq/cpufreq_ondemand.h | 23 +++++++++++++++++++++++
+ 2 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
+index 0e65d37c92311..a6ecc203f7b7f 100644
+--- a/drivers/cpufreq/cpufreq_ondemand.c
++++ b/drivers/cpufreq/cpufreq_ondemand.c
+@@ -29,29 +29,6 @@ static struct od_ops od_ops;
+
+ static unsigned int default_powersave_bias;
+
+-/*
+- * Not all CPUs want IO time to be accounted as busy; this depends on how
+- * efficient idling at a higher frequency/voltage is.
+- * Pavel Machek says this is not so for various generations of AMD and old
+- * Intel systems.
+- * Mike Chan (android.com) claims this is also not true for ARM.
+- * Because of this, whitelist specific known (series) of CPUs by default, and
+- * leave all others up to the user.
+- */
+-static int should_io_be_busy(void)
+-{
+-#if defined(CONFIG_X86)
+- /*
+- * For Intel, Core 2 (model 15) and later have an efficient idle.
+- */
+- if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+- boot_cpu_data.x86 == 6 &&
+- boot_cpu_data.x86_model >= 15)
+- return 1;
+-#endif
+- return 0;
+-}
+-
+ /*
+ * Find right freq to be set now with powersave_bias on.
+ * Returns the freq_hi to be used right now and will set freq_hi_delay_us,
+@@ -377,7 +354,7 @@ static int od_init(struct dbs_data *dbs_data)
+ dbs_data->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
+ dbs_data->ignore_nice_load = 0;
+ tuners->powersave_bias = default_powersave_bias;
+- dbs_data->io_is_busy = should_io_be_busy();
++ dbs_data->io_is_busy = od_should_io_be_busy();
+
+ dbs_data->tuners = tuners;
+ return 0;
+diff --git a/drivers/cpufreq/cpufreq_ondemand.h b/drivers/cpufreq/cpufreq_ondemand.h
+index 1af8e5c4b86fd..2ca8f1aaf2e34 100644
+--- a/drivers/cpufreq/cpufreq_ondemand.h
++++ b/drivers/cpufreq/cpufreq_ondemand.h
+@@ -24,3 +24,26 @@ static inline struct od_policy_dbs_info *to_dbs_info(struct policy_dbs_info *pol
+ struct od_dbs_tuners {
+ unsigned int powersave_bias;
+ };
++
++#ifdef CONFIG_X86
++#include <asm/cpu_device_id.h>
++
++/*
++ * Not all CPUs want IO time to be accounted as busy; this depends on
++ * how efficient idling at a higher frequency/voltage is.
++ *
++ * Pavel Machek says this is not so for various generations of AMD and
++ * old Intel systems. Mike Chan (android.com) claims this is also not
++ * true for ARM.
++ *
++ * Because of this, select a known series of Intel CPUs (Family 6 and
++ * later) by default, and leave all others up to the user.
++ */
++static inline bool od_should_io_be_busy(void)
++{
++ return (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
++ boot_cpu_data.x86_vfm >= INTEL_PENTIUM_PRO);
++}
++#else
++static inline bool od_should_io_be_busy(void) { return false; }
++#endif
+--
+2.51.0
+
--- /dev/null
+From b0d8baf6abe1e27be28f62c1c4cde322edf69767 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:03:31 +0530
+Subject: cpufreq: ti: Add support for AM62D2
+
+From: Paresh Bhagat <p-bhagat@ti.com>
+
+[ Upstream commit b5af45302ebc141662b2b60c713c9202e88c943c ]
+
+Add support for TI K3 AM62D2 SoC to read speed and revision values
+from hardware and pass to OPP layer. AM62D shares the same configuations
+as AM62A so use existing am62a7_soc_data.
+
+Signed-off-by: Paresh Bhagat <p-bhagat@ti.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/ti-cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
+index 5a5147277cd0a..9a912d3093153 100644
+--- a/drivers/cpufreq/ti-cpufreq.c
++++ b/drivers/cpufreq/ti-cpufreq.c
+@@ -310,6 +310,7 @@ static const struct soc_device_attribute k3_cpufreq_soc[] = {
+ { .family = "AM62X", .revision = "SR1.0" },
+ { .family = "AM62AX", .revision = "SR1.0" },
+ { .family = "AM62PX", .revision = "SR1.0" },
++ { .family = "AM62DX", .revision = "SR1.0" },
+ { /* sentinel */ }
+ };
+
+@@ -457,6 +458,7 @@ static const struct of_device_id ti_cpufreq_of_match[] __maybe_unused = {
+ { .compatible = "ti,omap36xx", .data = &omap36xx_soc_data, },
+ { .compatible = "ti,am625", .data = &am625_soc_data, },
+ { .compatible = "ti,am62a7", .data = &am62a7_soc_data, },
++ { .compatible = "ti,am62d2", .data = &am62a7_soc_data, },
+ { .compatible = "ti,am62p5", .data = &am62p5_soc_data, },
+ /* legacy */
+ { .compatible = "ti,omap3430", .data = &omap34xx_soc_data, },
+--
+2.51.0
+
--- /dev/null
+From 9c97958068473df33005d24f1f23268061eca0c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 0835da449db8b..56132e843c991 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -635,8 +635,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++ unsigned int cpu = dev->cpu;
+ int i, ret;
+
++ if (per_cpu(cpuidle_devices, cpu)) {
++ pr_info("CPU%d: cpuidle device already registered\n", cpu);
++ return -EEXIST;
++ }
++
+ if (!try_module_get(drv->owner))
+ return -EINVAL;
+
+@@ -648,7 +654,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ }
+
+- per_cpu(cpuidle_devices, dev->cpu) = dev;
++ per_cpu(cpuidle_devices, cpu) = dev;
+ list_add(&dev->device_list, &cpuidle_detected_devices);
+
+ ret = cpuidle_coupled_register_device(dev);
+--
+2.51.0
+
--- /dev/null
+From 4ad1c602e5d35b22f31fd96f3fb4fecc74106da8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 12:09:52 +0900
+Subject: firewire: ohci: move self_id_complete tracepoint after validating
+ register
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 696968262aeee51e1c0529c3c060ddd180702e02 ]
+
+The value of OHCI1394_SelfIDCount register includes an error-indicating
+bit. It is safer to place the tracepoint probe after validating the
+register value.
+
+Link: https://lore.kernel.org/r/20250823030954.268412-2-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firewire/ohci.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 5d8301b0f3aa8..421cf87e93c1f 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -2063,6 +2063,9 @@ static void bus_reset_work(struct work_struct *work)
+ ohci_notice(ohci, "self ID receive error\n");
+ return;
+ }
++
++ trace_self_id_complete(ohci->card.index, reg, ohci->self_id, has_be_header_quirk(ohci));
++
+ /*
+ * The count in the SelfIDCount register is the number of
+ * bytes in the self ID receive buffer. Since we also receive
+@@ -2231,15 +2234,8 @@ static irqreturn_t irq_handler(int irq, void *data)
+ if (event & OHCI1394_busReset)
+ reg_write(ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);
+
+- if (event & OHCI1394_selfIDComplete) {
+- if (trace_self_id_complete_enabled()) {
+- u32 reg = reg_read(ohci, OHCI1394_SelfIDCount);
+-
+- trace_self_id_complete(ohci->card.index, reg, ohci->self_id,
+- has_be_header_quirk(ohci));
+- }
++ if (event & OHCI1394_selfIDComplete)
+ queue_work(selfid_workqueue, &ohci->bus_reset_work);
+- }
+
+ if (event & OHCI1394_RQPkt)
+ queue_work(ohci->card.async_wq, &ohci->ar_request_ctx.work);
+--
+2.51.0
+
--- /dev/null
+From 3b6888c9c6e588cc3be83eb8c9bfb364d156b8a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 21:27:00 -0300
+Subject: firmware: qcom: scm: Allow QSEECOM on Dell Inspiron 7441 / Latitude
+ 7455
+
+From: Val Packett <val@packett.cool>
+
+[ Upstream commit 30ee285f1e3cdc88ec7010abeaba0cbed800bdcd ]
+
+Allow these machines to access efivars through qseecom/uefisecapp.
+
+Signed-off-by: Val Packett <val@packett.cool>
+Reviewed-by: Laurentiu Tudor <laurentiu.tudor1@dell.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20250716003139.18543-5-val@packett.cool
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index 5243d5abbbe99..7f43f12e4e1b2 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -1994,6 +1994,8 @@ static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = {
+ { .compatible = "asus,vivobook-s15" },
+ { .compatible = "asus,zenbook-a14-ux3407qa" },
+ { .compatible = "asus,zenbook-a14-ux3407ra" },
++ { .compatible = "dell,inspiron-14-plus-7441" },
++ { .compatible = "dell,latitude-7455" },
+ { .compatible = "dell,xps13-9345" },
+ { .compatible = "hp,elitebook-ultra-g1q" },
+ { .compatible = "hp,omnibook-x14" },
+--
+2.51.0
+
--- /dev/null
+From d2d5f07f712c44212ab60bc501b3df200f03273b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:14:51 +0530
+Subject: firmware: qcom: scm: preserve assign_mem() error return value
+
+From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+
+[ Upstream commit 121fcf3c871181edce0708a49d2397cedd6ad21f ]
+
+When qcom_scm_assign_mem() fails, the error value is currently being
+overwritten after it is logged, resulting in the loss of the original
+error code. Fix this by retaining and returning the original error value
+as intended.
+
+Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250807124451.2623019-1-mukesh.ojha@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index 26cd0458aacd6..5243d5abbbe99 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -1119,7 +1119,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ if (ret) {
+ dev_err(__scm->dev,
+ "Assign memory protection call failed %d\n", ret);
+- return -EINVAL;
++ return ret;
+ }
+
+ *srcvm = next_vm;
+--
+2.51.0
+
--- /dev/null
+From b0c6a1228a8d08720c619517fe5966878b75716f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 18:28:03 +0500
+Subject: firmware: qcom: tzmem: disable sc7180 platform
+
+From: Nikita Travkin <nikita@trvn.ru>
+
+[ Upstream commit 3cc9a8cadaf66e1a53e5fee48f8bcdb0a3fd5075 ]
+
+When SHM bridge is enabled, assigning RMTFS memory causes the calling
+core to hang if the system is running in EL1.
+
+Disable SHM bridge on sc7180 devices to avoid that hang.
+
+Signed-off-by: Nikita Travkin <nikita@trvn.ru>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250721-sc7180-shm-hang-v1-1-99ad9ffeb5b4@trvn.ru
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_tzmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/qcom/qcom_tzmem.c b/drivers/firmware/qcom/qcom_tzmem.c
+index ea0a353556570..12e448669b8bd 100644
+--- a/drivers/firmware/qcom/qcom_tzmem.c
++++ b/drivers/firmware/qcom/qcom_tzmem.c
+@@ -77,6 +77,7 @@ static bool qcom_tzmem_using_shm_bridge;
+
+ /* List of machines that are known to not support SHM bridge correctly. */
+ static const char *const qcom_tzmem_blacklist[] = {
++ "qcom,sc7180", /* hang in rmtfs memory assignment */
+ "qcom,sc8180x",
+ "qcom,sdm670", /* failure in GPU firmware loading */
+ "qcom,sdm845", /* reset in rmtfs memory assignment */
+--
+2.51.0
+
--- /dev/null
+From ed0a2e2a6197e844ebef295a5f14b79fe39d6f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 14:54:53 -0500
+Subject: firmware: ti_sci: Enable abort handling of entry to LPM
+
+From: Kendall Willis <k-willis@ti.com>
+
+[ Upstream commit 0fdd3240fe5a9bf4785e40506bf86b7e16546b83 ]
+
+The PM co-processor (device manager or DM) adds the ability to abort
+entry to a low power mode by clearing the mode selection in the
+latest version of its firmware (11.01.09) [1].
+
+Enable the ti_sci driver to support the LPM abort call which clears the
+low power mode selection of the DM. This fixes an issue where failed
+system suspend attempts would cause subsequent suspends to fail.
+
+After system suspend completes, regardless of if system suspend succeeds
+or fails, the ->complete() hook in TI SCI will be called. In the
+->complete() hook, a message will be sent to the DM to clear the current
+low power mode selection. Clearing the low power mode selection
+unconditionally will not cause any error in the DM.
+
+[1] https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html
+
+Signed-off-by: Kendall Willis <k-willis@ti.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/20250819195453.1094520-1-k-willis@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/ti_sci.c | 57 +++++++++++++++++++++++++++++++++++++--
+ drivers/firmware/ti_sci.h | 3 +++
+ 2 files changed, 58 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
+index ae5fd1936ad32..49fd2ae01055d 100644
+--- a/drivers/firmware/ti_sci.c
++++ b/drivers/firmware/ti_sci.c
+@@ -2015,6 +2015,47 @@ static int ti_sci_cmd_set_latency_constraint(const struct ti_sci_handle *handle,
+ return ret;
+ }
+
++/**
++ * ti_sci_cmd_lpm_abort() - Abort entry to LPM by clearing selection of LPM to enter
++ * @dev: Device pointer corresponding to the SCI entity
++ *
++ * Return: 0 if all went well, else returns appropriate error value.
++ */
++static int ti_sci_cmd_lpm_abort(struct device *dev)
++{
++ struct ti_sci_info *info = dev_get_drvdata(dev);
++ struct ti_sci_msg_hdr *req;
++ struct ti_sci_msg_hdr *resp;
++ struct ti_sci_xfer *xfer;
++ int ret = 0;
++
++ xfer = ti_sci_get_one_xfer(info, TI_SCI_MSG_LPM_ABORT,
++ TI_SCI_FLAG_REQ_ACK_ON_PROCESSED,
++ sizeof(*req), sizeof(*resp));
++ if (IS_ERR(xfer)) {
++ ret = PTR_ERR(xfer);
++ dev_err(dev, "Message alloc failed(%d)\n", ret);
++ return ret;
++ }
++ req = (struct ti_sci_msg_hdr *)xfer->xfer_buf;
++
++ ret = ti_sci_do_xfer(info, xfer);
++ if (ret) {
++ dev_err(dev, "Mbox send fail %d\n", ret);
++ goto fail;
++ }
++
++ resp = (struct ti_sci_msg_hdr *)xfer->xfer_buf;
++
++ if (!ti_sci_is_response_ack(resp))
++ ret = -ENODEV;
++
++fail:
++ ti_sci_put_one_xfer(&info->minfo, xfer);
++
++ return ret;
++}
++
+ static int ti_sci_cmd_core_reboot(const struct ti_sci_handle *handle)
+ {
+ struct ti_sci_info *info;
+@@ -3739,11 +3780,22 @@ static int __maybe_unused ti_sci_resume_noirq(struct device *dev)
+ return 0;
+ }
+
++static void __maybe_unused ti_sci_pm_complete(struct device *dev)
++{
++ struct ti_sci_info *info = dev_get_drvdata(dev);
++
++ if (info->fw_caps & MSG_FLAG_CAPS_LPM_ABORT) {
++ if (ti_sci_cmd_lpm_abort(dev))
++ dev_err(dev, "LPM clear selection failed.\n");
++ }
++}
++
+ static const struct dev_pm_ops ti_sci_pm_ops = {
+ #ifdef CONFIG_PM_SLEEP
+ .suspend = ti_sci_suspend,
+ .suspend_noirq = ti_sci_suspend_noirq,
+ .resume_noirq = ti_sci_resume_noirq,
++ .complete = ti_sci_pm_complete,
+ #endif
+ };
+
+@@ -3876,10 +3928,11 @@ static int ti_sci_probe(struct platform_device *pdev)
+ }
+
+ ti_sci_msg_cmd_query_fw_caps(&info->handle, &info->fw_caps);
+- dev_dbg(dev, "Detected firmware capabilities: %s%s%s\n",
++ dev_dbg(dev, "Detected firmware capabilities: %s%s%s%s\n",
+ info->fw_caps & MSG_FLAG_CAPS_GENERIC ? "Generic" : "",
+ info->fw_caps & MSG_FLAG_CAPS_LPM_PARTIAL_IO ? " Partial-IO" : "",
+- info->fw_caps & MSG_FLAG_CAPS_LPM_DM_MANAGED ? " DM-Managed" : ""
++ info->fw_caps & MSG_FLAG_CAPS_LPM_DM_MANAGED ? " DM-Managed" : "",
++ info->fw_caps & MSG_FLAG_CAPS_LPM_ABORT ? " LPM-Abort" : ""
+ );
+
+ ti_sci_setup_ops(info);
+diff --git a/drivers/firmware/ti_sci.h b/drivers/firmware/ti_sci.h
+index 053387d7baa06..701c416b2e78f 100644
+--- a/drivers/firmware/ti_sci.h
++++ b/drivers/firmware/ti_sci.h
+@@ -42,6 +42,7 @@
+ #define TI_SCI_MSG_SET_IO_ISOLATION 0x0307
+ #define TI_SCI_MSG_LPM_SET_DEVICE_CONSTRAINT 0x0309
+ #define TI_SCI_MSG_LPM_SET_LATENCY_CONSTRAINT 0x030A
++#define TI_SCI_MSG_LPM_ABORT 0x0311
+
+ /* Resource Management Requests */
+ #define TI_SCI_MSG_GET_RESOURCE_RANGE 0x1500
+@@ -147,6 +148,7 @@ struct ti_sci_msg_req_reboot {
+ * MSG_FLAG_CAPS_GENERIC: Generic capability (LPM not supported)
+ * MSG_FLAG_CAPS_LPM_PARTIAL_IO: Partial IO in LPM
+ * MSG_FLAG_CAPS_LPM_DM_MANAGED: LPM can be managed by DM
++ * MSG_FLAG_CAPS_LPM_ABORT: Abort entry to LPM
+ *
+ * Response to a generic message with message type TI_SCI_MSG_QUERY_FW_CAPS
+ * providing currently available SOC/firmware capabilities. SoC that don't
+@@ -157,6 +159,7 @@ struct ti_sci_msg_resp_query_fw_caps {
+ #define MSG_FLAG_CAPS_GENERIC TI_SCI_MSG_FLAG(0)
+ #define MSG_FLAG_CAPS_LPM_PARTIAL_IO TI_SCI_MSG_FLAG(4)
+ #define MSG_FLAG_CAPS_LPM_DM_MANAGED TI_SCI_MSG_FLAG(5)
++#define MSG_FLAG_CAPS_LPM_ABORT TI_SCI_MSG_FLAG(9)
+ #define MSG_MASK_CAPS_LPM GENMASK_ULL(4, 1)
+ u64 fw_caps;
+ } __packed;
+--
+2.51.0
+
--- /dev/null
+From a88ce395258540ac2e24d87ec275c341578bcacd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:51:54 +0530
+Subject: futex: Don't leak robust_list pointer on exec race
+
+From: Pranav Tyagi <pranav.tyagi03@gmail.com>
+
+[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
+
+sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
+to check if the calling task is allowed to access another task's
+robust_list pointer. This check is racy against a concurrent exec() in the
+target process.
+
+During exec(), a task may transition from a non-privileged binary to a
+privileged one (e.g., setuid binary) and its credentials/memory mappings
+may change. If get_robust_list() performs ptrace_may_access() before
+this transition, it may erroneously allow access to sensitive information
+after the target becomes privileged.
+
+A racy access allows an attacker to exploit a window during which
+ptrace_may_access() passes before a target process transitions to a
+privileged state via exec().
+
+For example, consider a non-privileged task T that is about to execute a
+setuid-root binary. An attacker task A calls get_robust_list(T) while T
+is still unprivileged. Since ptrace_may_access() checks permissions
+based on current credentials, it succeeds. However, if T begins exec
+immediately afterwards, it becomes privileged and may change its memory
+mappings. Because get_robust_list() proceeds to access T->robust_list
+without synchronizing with exec() it may read user-space pointers from a
+now-privileged process.
+
+This violates the intended post-exec access restrictions and could
+expose sensitive memory addresses or be used as a primitive in a larger
+exploit chain. Consequently, the race can lead to unauthorized
+disclosure of information across privilege boundaries and poses a
+potential security risk.
+
+Take a read lock on signal->exec_update_lock prior to invoking
+ptrace_may_access() and accessing the robust_list/compat_robust_list.
+This ensures that the target task's exec state remains stable during the
+check, allowing for consistent and synchronized validation of
+credentials.
+
+Suggested-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/
+Link: https://github.com/KSPP/linux/issues/119
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/syscalls.c | 106 +++++++++++++++++++++-------------------
+ 1 file changed, 56 insertions(+), 50 deletions(-)
+
+diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
+index 4b6da9116aa6c..880c9bf2f3150 100644
+--- a/kernel/futex/syscalls.c
++++ b/kernel/futex/syscalls.c
+@@ -39,6 +39,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ return 0;
+ }
+
++static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat)
++{
++#ifdef CONFIG_COMPAT
++ if (compat)
++ return p->compat_robust_list;
++#endif
++ return p->robust_list;
++}
++
++static void __user *futex_get_robust_list_common(int pid, bool compat)
++{
++ struct task_struct *p = current;
++ void __user *head;
++ int ret;
++
++ scoped_guard(rcu) {
++ if (pid) {
++ p = find_task_by_vpid(pid);
++ if (!p)
++ return (void __user *)ERR_PTR(-ESRCH);
++ }
++ get_task_struct(p);
++ }
++
++ /*
++ * Hold exec_update_lock to serialize with concurrent exec()
++ * so ptrace_may_access() is checked against stable credentials
++ */
++ ret = down_read_killable(&p->signal->exec_update_lock);
++ if (ret)
++ goto err_put;
++
++ ret = -EPERM;
++ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
++ goto err_unlock;
++
++ head = futex_task_robust_list(p, compat);
++
++ up_read(&p->signal->exec_update_lock);
++ put_task_struct(p);
++
++ return head;
++
++err_unlock:
++ up_read(&p->signal->exec_update_lock);
++err_put:
++ put_task_struct(p);
++ return (void __user *)ERR_PTR(ret);
++}
++
+ /**
+ * sys_get_robust_list() - Get the robust-futex list head of a task
+ * @pid: pid of the process [zero for current task]
+@@ -49,36 +99,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ struct robust_list_head __user * __user *, head_ptr,
+ size_t __user *, len_ptr)
+ {
+- struct robust_list_head __user *head;
+- unsigned long ret;
+- struct task_struct *p;
+-
+- rcu_read_lock();
+-
+- ret = -ESRCH;
+- if (!pid)
+- p = current;
+- else {
+- p = find_task_by_vpid(pid);
+- if (!p)
+- goto err_unlock;
+- }
+-
+- ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+- goto err_unlock;
++ struct robust_list_head __user *head = futex_get_robust_list_common(pid, false);
+
+- head = p->robust_list;
+- rcu_read_unlock();
++ if (IS_ERR(head))
++ return PTR_ERR(head);
+
+ if (put_user(sizeof(*head), len_ptr))
+ return -EFAULT;
+ return put_user(head, head_ptr);
+-
+-err_unlock:
+- rcu_read_unlock();
+-
+- return ret;
+ }
+
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+@@ -455,36 +483,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+ compat_uptr_t __user *, head_ptr,
+ compat_size_t __user *, len_ptr)
+ {
+- struct compat_robust_list_head __user *head;
+- unsigned long ret;
+- struct task_struct *p;
+-
+- rcu_read_lock();
+-
+- ret = -ESRCH;
+- if (!pid)
+- p = current;
+- else {
+- p = find_task_by_vpid(pid);
+- if (!p)
+- goto err_unlock;
+- }
+-
+- ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+- goto err_unlock;
++ struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true);
+
+- head = p->compat_robust_list;
+- rcu_read_unlock();
++ if (IS_ERR(head))
++ return PTR_ERR(head);
+
+ if (put_user(sizeof(*head), len_ptr))
+ return -EFAULT;
+ return put_user(ptr_to_compat(head), head_ptr);
+-
+-err_unlock:
+- rcu_read_unlock();
+-
+- return ret;
+ }
+ #endif /* CONFIG_COMPAT */
+
+--
+2.51.0
+
--- /dev/null
+From d264322d91952528a0aef4b2b8f0fb7e09c97628 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 21:26:56 +0200
+Subject: hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
+
+From: Ben Copeland <ben.copeland@linaro.org>
+
+[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
+
+Some motherboards require more time to acquire the ACPI mutex,
+causing "Failed to acquire mutex" messages to appear in the kernel log.
+Increase the timeout from 500ms to 800ms to accommodate these cases.
+
+Signed-off-by: Ben Copeland <ben.copeland@linaro.org>
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index f43efb80aabf3..94eb02e6be326 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -49,7 +49,7 @@ static char *mutex_path_override;
+ */
+ #define ASUS_EC_MAX_BANK 3
+
+-#define ACPI_LOCK_DELAY_MS 500
++#define ACPI_LOCK_DELAY_MS 800
+
+ /* ACPI mutex for locking access to the EC for the firmware */
+ #define ASUS_HW_ACCESS_MUTEX_ASMX "\\AMW0.ASMX"
+--
+2.51.0
+
--- /dev/null
+From 2b20146208caa068d3602ff6c0ddf7269bbb9c4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 3f61b2d7935e4..5801128e16c3c 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1280,6 +1280,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7050"),
+ },
+ },
++ {
++ .ident = "Dell OptiPlex 7040",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++ },
++ },
+ {
+ .ident = "Dell Precision",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From 60133cc6197861c2deb10b191657acd99e10e55f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:33 +0200
+Subject: hwmon: (dell-smm) Remove Dell Precision 490 custom config data
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit ddb61e737f04e3c6c8299c1e00bf17a42a7f05cf ]
+
+It turns out the second fan on the Dell Precision 490 does not
+really support I8K_FAN_TURBO. Setting the fan state to 3 enables
+automatic fan control, just like on the other two fans.
+The reason why this was misinterpreted as turbo mode was that
+the second fan normally spins faster in automatic mode than
+in the previous fan states. Yet when in state 3, the fan speed
+reacts to heat exposure, exposing the automatic mode setting.
+
+Link: https://github.com/lm-sensors/lm-sensors/pull/383
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-2-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 1e2c8e2840015..3f61b2d7935e4 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1331,7 +1331,6 @@ struct i8k_config_data {
+
+ enum i8k_configs {
+ DELL_LATITUDE_D520,
+- DELL_PRECISION_490,
+ DELL_STUDIO,
+ DELL_XPS,
+ };
+@@ -1341,10 +1340,6 @@ static const struct i8k_config_data i8k_config_data[] __initconst = {
+ .fan_mult = 1,
+ .fan_max = I8K_FAN_TURBO,
+ },
+- [DELL_PRECISION_490] = {
+- .fan_mult = 1,
+- .fan_max = I8K_FAN_TURBO,
+- },
+ [DELL_STUDIO] = {
+ .fan_mult = 1,
+ .fan_max = I8K_FAN_HIGH,
+@@ -1364,15 +1359,6 @@ static const struct dmi_system_id i8k_config_dmi_table[] __initconst = {
+ },
+ .driver_data = (void *)&i8k_config_data[DELL_LATITUDE_D520],
+ },
+- {
+- .ident = "Dell Precision 490",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME,
+- "Precision WorkStation 490"),
+- },
+- .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+- },
+ {
+ .ident = "Dell Studio",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From e99f6970f43a335f5d32b2e61d9c3a39dd71a2f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 02:04:41 +0800
+Subject: hwmon: (k10temp) Add device ID for Strix Halo
+
+From: Rong Zhang <i@rong.moe>
+
+[ Upstream commit e5d1e313d7b6272d6dfda983906d99f97ad9062b ]
+
+The device ID of Strix Halo Data Fabric Function 3 has been in the tree
+since commit 0e640f0a47d8 ("x86/amd_nb: Add new PCI IDs for AMD family
+0x1a"), but is somehow missing from k10temp_id_table.
+
+Add it so that it works out of the box.
+
+Tested on Beelink GTR9 Pro Mini PC.
+
+Signed-off-by: Rong Zhang <i@rong.moe>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250823180443.85512-1-i@rong.moe
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 2f90a2e9ad496..b98d5ec72c4ff 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -565,6 +565,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ {}
+--
+2.51.0
+
--- /dev/null
+From 3239f2917bb12850de8a955f9fde35bf36dffeb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 00:15:43 +0000
+Subject: hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
+
+From: Avadhut Naik <avadhut.naik@amd.com>
+
+[ Upstream commit f116af2eb51ed9df24911537fda32a033f1c58da ]
+
+Add thermal info support for newer AMD Family 1Ah-based models.
+
+Signed-off-by: Avadhut Naik <avadhut.naik@amd.com>
+Link: https://lore.kernel.org/r/20250729001644.257645-1-avadhut.naik@amd.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index babf2413d666f..2f90a2e9ad496 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -84,6 +84,13 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+ */
+ #define AMD_I3255_STR "3255"
+
++/*
++ * PCI Device IDs for AMD's Family 1Ah-based SOCs.
++ * Defining locally as IDs are not shared.
++ */
++#define PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3 0x12cb
++#define PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3 0x127b
++
+ struct k10temp_data {
+ struct pci_dev *pdev;
+ void (*read_htcreg)(struct pci_dev *pdev, u32 *regval);
+@@ -556,7 +563,9 @@ static const struct pci_device_id k10temp_id_table[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ {}
+ };
+--
+2.51.0
+
--- /dev/null
+From 220e5c9597189e71d814e829c759364c10ae511d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 06:32:28 -0400
+Subject: hwmon: (lenovo-ec-sensors) Update P8 supprt
+
+From: David Ober <dober6023@gmail.com>
+
+[ Upstream commit 43c056ac85b60232861005765153707f1b0354b6 ]
+
+This fixes differences for the P8 system that was initially set to
+the same thermal values as the P7, also adds in the PSU sensor for
+all of the supported systems
+
+Signed-off-by: David Ober <dober@lenovo.com>
+Signed-off-by: David Ober <dober6023@gmail.com>
+Link: https://lore.kernel.org/r/20250807103228.10465-1-dober6023@gmail.com
+[groeck: Update subject]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lenovo-ec-sensors.c | 34 +++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwmon/lenovo-ec-sensors.c b/drivers/hwmon/lenovo-ec-sensors.c
+index 143fb79713f7d..8681bbf6665b1 100644
+--- a/drivers/hwmon/lenovo-ec-sensors.c
++++ b/drivers/hwmon/lenovo-ec-sensors.c
+@@ -66,7 +66,7 @@ enum systems {
+ LENOVO_P8,
+ };
+
+-static int px_temp_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
++static int px_temp_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 31, 32};
+
+ static const char * const lenovo_px_ec_temp_label[] = {
+ "CPU1",
+@@ -84,9 +84,29 @@ static const char * const lenovo_px_ec_temp_label[] = {
+ "PCI_Z3",
+ "PCI_Z4",
+ "AMB",
++ "PSU1",
++ "PSU2",
+ };
+
+-static int gen_temp_map[] = {0, 2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
++static int p8_temp_map[] = {0, 1, 2, 8, 9, 13, 14, 15, 16, 17, 19, 20, 33};
++
++static const char * const lenovo_p8_ec_temp_label[] = {
++ "CPU1",
++ "CPU_DIMM_BANK1",
++ "CPU_DIMM_BANK2",
++ "M2_Z2R",
++ "M2_Z3R",
++ "DIMM_RIGHT",
++ "DIMM_LEFT",
++ "PCI_Z1",
++ "PCI_Z2",
++ "PCI_Z3",
++ "AMB",
++ "REAR_VR",
++ "PSU",
++};
++
++static int gen_temp_map[] = {0, 2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 31};
+
+ static const char * const lenovo_gen_ec_temp_label[] = {
+ "CPU1",
+@@ -101,6 +121,7 @@ static const char * const lenovo_gen_ec_temp_label[] = {
+ "PCI_Z3",
+ "PCI_Z4",
+ "AMB",
++ "PSU",
+ };
+
+ static int px_fan_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
+@@ -293,6 +314,8 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_px[] = {
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL),
+ HWMON_CHANNEL_INFO(fan,
+ HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -327,6 +350,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p8[] = {
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL),
+ HWMON_CHANNEL_INFO(fan,
+ HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -359,6 +383,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p7[] = {
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL),
+ HWMON_CHANNEL_INFO(fan,
+ HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -388,6 +413,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p5[] = {
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL,
++ HWMON_T_INPUT | HWMON_T_LABEL,
+ HWMON_T_INPUT | HWMON_T_LABEL),
+ HWMON_CHANNEL_INFO(fan,
+ HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -545,9 +571,9 @@ static int lenovo_ec_probe(struct platform_device *pdev)
+ break;
+ case 3:
+ ec_data->fan_labels = p8_ec_fan_label;
+- ec_data->temp_labels = lenovo_gen_ec_temp_label;
++ ec_data->temp_labels = lenovo_p8_ec_temp_label;
+ ec_data->fan_map = p8_fan_map;
+- ec_data->temp_map = gen_temp_map;
++ ec_data->temp_map = p8_temp_map;
+ lenovo_ec_chip_info.info = lenovo_ec_hwmon_info_p8;
+ break;
+ default:
+--
+2.51.0
+
--- /dev/null
+From ff2b9ad475a88fe5be2c0e529730df1d9f3c8733 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index 3c839f56c4603..a6c439e376ff7 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+
+ /*
+ * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -29,8 +30,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC 0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC 0x14 /* RW */
+
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT 5
+
++#define SBTSI_TEMP_EXT_RANGE_ADJ 49000
++
+ #define SBTSI_TEMP_MIN 0
+ #define SBTSI_TEMP_MAX 255875
+
+@@ -38,6 +53,8 @@
+ struct sbtsi_data {
+ struct i2c_client *client;
+ struct mutex lock;
++ bool ext_range_mode;
++ bool read_order;
+ };
+
+ /*
+@@ -74,23 +91,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ struct sbtsi_data *data = dev_get_drvdata(dev);
+ s32 temp_int, temp_dec;
+- int err;
+
+ switch (attr) {
+ case hwmon_temp_input:
+- /*
+- * ReadOrder bit specifies the reading order of integer and
+- * decimal part of CPU temp for atomic reads. If bit == 0,
+- * reading integer part triggers latching of the decimal part,
+- * so integer part should be read first. If bit == 1, read
+- * order should be reversed.
+- */
+- err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+- if (err < 0)
+- return err;
+-
+ mutex_lock(&data->lock);
+- if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++ if (data->read_order) {
+ temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ } else {
+@@ -122,6 +127,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ return temp_dec;
+
+ *val = sbtsi_reg_to_mc(temp_int, temp_dec);
++ if (data->ext_range_mode)
++ *val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+
+ return 0;
+ }
+@@ -146,6 +153,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ return -EINVAL;
+ }
+
++ if (data->ext_range_mode)
++ val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+
+@@ -203,6 +212,7 @@ static int sbtsi_probe(struct i2c_client *client)
+ struct device *dev = &client->dev;
+ struct device *hwmon_dev;
+ struct sbtsi_data *data;
++ int err;
+
+ data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ if (!data)
+@@ -211,8 +221,14 @@ static int sbtsi_probe(struct i2c_client *client)
+ data->client = client;
+ mutex_init(&data->lock);
+
+- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+- NULL);
++ err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++ if (err < 0)
++ return err;
++ data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++ data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++ hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++ &sbtsi_chip_info, NULL);
+
+ return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From bc8a330321d4fe2d1e32b0cd6b7a305a6da6274b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:02:49 +0200
+Subject: hwmon: sy7636a: add alias
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
+
+Add module alias to have it autoloaded.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sy7636a-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
+index ed110884786b4..a12fc0ce70e76 100644
+--- a/drivers/hwmon/sy7636a-hwmon.c
++++ b/drivers/hwmon/sy7636a-hwmon.c
+@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);
+
+ MODULE_DESCRIPTION("SY7636A sensor driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:sy7636a-temperature");
+--
+2.51.0
+
--- /dev/null
+From 6acc01f60e6482f763cdf765feac949147256ab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 20:42:07 +0530
+Subject: i3c: dw: Add shutdown support to dw_i3c_master driver
+
+From: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+
+[ Upstream commit 17e163f3d7a5449fe9065030048e28c4087b24ce ]
+
+Add shutdown handler to the Synopsys DesignWare I3C master driver,
+ensuring the device is gracefully disabled during system shutdown.
+
+The shutdown handler cancels any pending hot-join work and disables
+interrupts.
+
+Signed-off-by: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+Link: https://lore.kernel.org/r/20250730151207.4113708-1-manikanta.guntupalli@amd.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/dw-i3c-master.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
+index 974122b2d20ee..9ceedf09c3b6a 100644
+--- a/drivers/i3c/master/dw-i3c-master.c
++++ b/drivers/i3c/master/dw-i3c-master.c
+@@ -1737,6 +1737,28 @@ static const struct dev_pm_ops dw_i3c_pm_ops = {
+ SET_RUNTIME_PM_OPS(dw_i3c_master_runtime_suspend, dw_i3c_master_runtime_resume, NULL)
+ };
+
++static void dw_i3c_shutdown(struct platform_device *pdev)
++{
++ struct dw_i3c_master *master = platform_get_drvdata(pdev);
++ int ret;
++
++ ret = pm_runtime_resume_and_get(master->dev);
++ if (ret < 0) {
++ dev_err(master->dev,
++ "<%s> cannot resume i3c bus master, err: %d\n",
++ __func__, ret);
++ return;
++ }
++
++ cancel_work_sync(&master->hj_work);
++
++ /* Disable interrupts */
++ writel((u32)~INTR_ALL, master->regs + INTR_STATUS_EN);
++ writel((u32)~INTR_ALL, master->regs + INTR_SIGNAL_EN);
++
++ pm_runtime_put_autosuspend(master->dev);
++}
++
+ static const struct of_device_id dw_i3c_master_of_match[] = {
+ { .compatible = "snps,dw-i3c-master-1.00a", },
+ {},
+@@ -1752,6 +1774,7 @@ MODULE_DEVICE_TABLE(acpi, amd_i3c_device_match);
+ static struct platform_driver dw_i3c_driver = {
+ .probe = dw_i3c_probe,
+ .remove = dw_i3c_remove,
++ .shutdown = dw_i3c_shutdown,
+ .driver = {
+ .name = "dw-i3c-master",
+ .of_match_table = dw_i3c_master_of_match,
+--
+2.51.0
+
--- /dev/null
+From a0c521c654bbb096b42ce7b948aff93504dc2167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 16:17:32 +0300
+Subject: i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit d515503f3c8a8475b2f78782534aad09722904e1 ]
+
+Add I3C controller PCI IDs on Intel Wildcat Lake-U.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250808131732.1213227-1-jarkko.nikula@linux.intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
+index c6c3a3ec11eae..08e6cbdf89cea 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
++++ b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
+@@ -124,6 +124,9 @@ static void mipi_i3c_hci_pci_remove(struct pci_dev *pci)
+ }
+
+ static const struct pci_device_id mipi_i3c_hci_pci_devices[] = {
++ /* Wildcat Lake-U */
++ { PCI_VDEVICE(INTEL, 0x4d7c), (kernel_ulong_t)&intel_info},
++ { PCI_VDEVICE(INTEL, 0x4d6f), (kernel_ulong_t)&intel_info},
+ /* Panther Lake-H */
+ { PCI_VDEVICE(INTEL, 0xe37c), (kernel_ulong_t)&intel_info},
+ { PCI_VDEVICE(INTEL, 0xe36f), (kernel_ulong_t)&intel_info},
+--
+2.51.0
+
--- /dev/null
+From 0bb4c46b5ec3c3c779f85bb039e37318bc8d9a05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 11:08:59 -0600
+Subject: io_uring/rsrc: respect submitter_task in io_register_clone_buffers()
+
+From: Caleb Sander Mateos <csander@purestorage.com>
+
+[ Upstream commit 2f076a453f75de691a081c89bce31b530153d53b ]
+
+io_ring_ctx's enabled with IORING_SETUP_SINGLE_ISSUER are only allowed
+a single task submitting to the ctx. Although the documentation only
+mentions this restriction applying to io_uring_enter() syscalls,
+commit d7cce96c449e ("io_uring: limit registration w/ SINGLE_ISSUER")
+extends it to io_uring_register(). Ensuring only one task interacts
+with the io_ring_ctx will be important to allow this task to avoid
+taking the uring_lock.
+There is, however, one gap in these checks: io_register_clone_buffers()
+may take the uring_lock on a second (source) io_ring_ctx, but
+__io_uring_register() only checks the current thread against the
+*destination* io_ring_ctx's submitter_task. Fail the
+IORING_REGISTER_CLONE_BUFFERS with -EEXIST if the source io_ring_ctx has
+a registered submitter_task other than the current task.
+
+Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/rsrc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
+index f75f5e43fa4aa..e1e5f0fb0f56d 100644
+--- a/io_uring/rsrc.c
++++ b/io_uring/rsrc.c
+@@ -1299,10 +1299,17 @@ int io_register_clone_buffers(struct io_ring_ctx *ctx, void __user *arg)
+ if (src_ctx != ctx) {
+ mutex_unlock(&ctx->uring_lock);
+ lock_two_rings(ctx, src_ctx);
++
++ if (src_ctx->submitter_task &&
++ src_ctx->submitter_task != current) {
++ ret = -EEXIST;
++ goto out;
++ }
+ }
+
+ ret = io_clone_buffers(ctx, src_ctx, &buf);
+
++out:
+ if (src_ctx != ctx)
+ mutex_unlock(&src_ctx->uring_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 02ecd4c135d5d184518b3951c6ad38463c3e133c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 15:28:03 +0100
+Subject: io_uring/zcrx: account niov arrays to cgroup
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 31bf77dcc3810e08bcc7d15470e92cdfffb7f7f1 ]
+
+net_iov / freelist / etc. arrays can be quite long, make sure they're
+accounted.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/zcrx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
+index 23ffc95caa427..e3953ea740c03 100644
+--- a/io_uring/zcrx.c
++++ b/io_uring/zcrx.c
+@@ -426,17 +426,17 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
+
+ ret = -ENOMEM;
+ area->nia.niovs = kvmalloc_array(nr_iovs, sizeof(area->nia.niovs[0]),
+- GFP_KERNEL | __GFP_ZERO);
++ GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+ if (!area->nia.niovs)
+ goto err;
+
+ area->freelist = kvmalloc_array(nr_iovs, sizeof(area->freelist[0]),
+- GFP_KERNEL | __GFP_ZERO);
++ GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+ if (!area->freelist)
+ goto err;
+
+ area->user_refs = kvmalloc_array(nr_iovs, sizeof(area->user_refs[0]),
+- GFP_KERNEL | __GFP_ZERO);
++ GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+ if (!area->user_refs)
+ goto err;
+
+--
+2.51.0
+
--- /dev/null
+From d1947d252a71709fa5ff98ab412df7450f10c912 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 15:27:50 +0100
+Subject: io_uring/zcrx: check all niovs filled with dma addresses
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit d7ae46b454eb05e3df0d46c2ac9c61416a4d9057 ]
+
+Add a warning if io_populate_area_dma() can't fill in all net_iovs, it
+should never happen.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/zcrx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
+index 2035c77a16357..23ffc95caa427 100644
+--- a/io_uring/zcrx.c
++++ b/io_uring/zcrx.c
+@@ -75,6 +75,9 @@ static int io_populate_area_dma(struct io_zcrx_ifq *ifq,
+ niov_idx++;
+ }
+ }
++
++ if (WARN_ON_ONCE(niov_idx != area->nia.num_niovs))
++ return -EFAULT;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 290e07a316e745624ea9ccb89a69337318ae0da4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 15:40:57 +0100
+Subject: io_uring/zctx: check chained notif contexts
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit ab3ea6eac5f45669b091309f592c4ea324003053 ]
+
+Send zc only links ubuf_info for requests coming from the same context.
+There are some ambiguous syz reports, so let's check the assumption on
+notification completion.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/fd527d8638203fe0f1c5ff06ff2e1d8fd68f831b.1755179962.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/notif.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/io_uring/notif.c b/io_uring/notif.c
+index ea9c0116cec2d..d8ba1165c9494 100644
+--- a/io_uring/notif.c
++++ b/io_uring/notif.c
+@@ -14,10 +14,15 @@ static const struct ubuf_info_ops io_ubuf_ops;
+ static void io_notif_tw_complete(struct io_kiocb *notif, io_tw_token_t tw)
+ {
+ struct io_notif_data *nd = io_notif_to_data(notif);
++ struct io_ring_ctx *ctx = notif->ctx;
++
++ lockdep_assert_held(&ctx->uring_lock);
+
+ do {
+ notif = cmd_to_io_kiocb(nd);
+
++ if (WARN_ON_ONCE(ctx != notif->ctx))
++ return;
+ lockdep_assert(refcount_read(&nd->uarg.refcnt) == 0);
+
+ if (unlikely(nd->zc_report) && (nd->zc_copied || !nd->zc_used))
+--
+2.51.0
+
--- /dev/null
+From 786c4236b0e92fe1baab6b9446985271fe936bdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index 24ef5af569fe4..8a3410c2b7b57 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -153,14 +153,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ msi_alloc_info_t *info = args;
+ struct v2m_data *v2m = NULL, *tmp;
+- int hwirq, offset, i, err = 0;
++ int hwirq, i, err = 0;
++ unsigned long offset;
++ unsigned long align_mask = nr_irqs - 1;
+
+ spin_lock(&v2m_lock);
+ list_for_each_entry(tmp, &v2m_nodes, entry) {
+- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+- get_count_order(nr_irqs));
+- if (offset >= 0) {
++ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++ nr_irqs, align_mask, align_off);
++ if (offset < tmp->nr_spis) {
+ v2m = tmp;
++ bitmap_set(v2m->bm, offset, nr_irqs);
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 971b860f97a6a4432b75742721e93b533c65c30d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:19:45 +0800
+Subject: irqchip/loongson-eiointc: Route interrupt parsed from bios table
+
+From: Bibo Mao <maobibo@loongson.cn>
+
+[ Upstream commit 7fb83eb664e9b3a0438dd28859e9f0fd49d4c165 ]
+
+Interrupt controller eiointc routes interrupts to CPU interface IP0 - IP7.
+
+It is currently hard-coded that eiointc routes interrupts to the CPU
+starting from IP1, but it should base that decision on the parent
+interrupt, which is provided by ACPI or DTS.
+
+Retrieve the parent's hardware interrupt number and store it in the
+descriptor of the eointc instance, so that the routing function can utilize
+it for the correct route settings.
+
+[ tglx: Massaged change log ]
+
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250804081946.1456573-2-maobibo@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-eiointc.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c
+index b2860eb2d32c5..baa406904de55 100644
+--- a/drivers/irqchip/irq-loongson-eiointc.c
++++ b/drivers/irqchip/irq-loongson-eiointc.c
+@@ -68,6 +68,7 @@ struct eiointc_priv {
+ struct fwnode_handle *domain_handle;
+ struct irq_domain *eiointc_domain;
+ int flags;
++ irq_hw_number_t parent_hwirq;
+ };
+
+ static struct eiointc_priv *eiointc_priv[MAX_IO_PICS];
+@@ -211,7 +212,12 @@ static int eiointc_router_init(unsigned int cpu)
+ }
+
+ for (i = 0; i < eiointc_priv[0]->vec_count / 32 / 4; i++) {
+- bit = BIT(1 + index); /* Route to IP[1 + index] */
++ /*
++ * Route to interrupt pin, relative offset used here
++ * Offset 0 means routing to IP0 and so on
++ * Every 32 vector routing to one interrupt pin
++ */
++ bit = BIT(eiointc_priv[index]->parent_hwirq - INT_HWI0);
+ data = bit | (bit << 8) | (bit << 16) | (bit << 24);
+ iocsr_write32(data, EIOINTC_REG_IPMAP + i * 4);
+ }
+@@ -495,7 +501,7 @@ int __init eiointc_acpi_init(struct irq_domain *parent,
+
+ priv->vec_count = VEC_COUNT;
+ priv->node = acpi_eiointc->node;
+-
++ priv->parent_hwirq = acpi_eiointc->cascade;
+ parent_irq = irq_create_mapping(parent, acpi_eiointc->cascade);
+
+ ret = eiointc_init(priv, parent_irq, acpi_eiointc->node_map);
+@@ -527,8 +533,9 @@ int __init eiointc_acpi_init(struct irq_domain *parent,
+ static int __init eiointc_of_init(struct device_node *of_node,
+ struct device_node *parent)
+ {
+- int parent_irq, ret;
+ struct eiointc_priv *priv;
++ struct irq_data *irq_data;
++ int parent_irq, ret;
+
+ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+@@ -544,6 +551,12 @@ static int __init eiointc_of_init(struct device_node *of_node,
+ if (ret < 0)
+ goto out_free_priv;
+
++ irq_data = irq_get_irq_data(parent_irq);
++ if (!irq_data) {
++ ret = -ENODEV;
++ goto out_free_priv;
++ }
++
+ /*
+ * In particular, the number of devices supported by the LS2K0500
+ * extended I/O interrupt vector is 128.
+@@ -552,7 +565,7 @@ static int __init eiointc_of_init(struct device_node *of_node,
+ priv->vec_count = 128;
+ else
+ priv->vec_count = VEC_COUNT;
+-
++ priv->parent_hwirq = irqd_to_hwirq(irq_data);
+ priv->node = 0;
+ priv->domain_handle = of_fwnode_handle(of_node);
+
+--
+2.51.0
+
--- /dev/null
+From 6d1850ee03915c709a73096e1fdd235bb205677f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:40 +0800
+Subject: irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ
+ controller
+
+From: Ming Wang <wangming01@loongson.cn>
+
+[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
+
+On certain Loongson platforms, drivers attempting to request a legacy
+ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The
+virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
+
+This issue does not affect ACPI-enumerated devices described in DSDT,
+as their interrupts are properly mapped via the GSI translation path.
+This indicates the LPC irqdomain itself is functional but is not correctly
+handling direct VIRQ-to-HWIRQ mappings.
+
+The root cause is the use of irq_domain_create_linear(). This API sets
+up a domain for dynamic, on-demand mapping, typically triggered by a GSI
+request. It does not pre-populate the mappings for the legacy VIRQ range
+(0-15). Consequently, if no ACPI device claims a specific GSI
+(e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to
+the LPC domain. A direct call to request_irq(4, ...) then fails because
+the kernel cannot resolve this VIRQ to a hardware interrupt managed by
+the LPC controller.
+
+The PCH-LPC interrupt controller is an i8259-compatible legacy device
+that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to
+support legacy drivers.
+
+Fix this by replacing irq_domain_create_linear() with
+irq_domain_create_legacy(). This API is specifically designed for such
+controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ
+mapping for the entire legacy range (0-15) immediately upon domain
+creation. This ensures that any VIRQ in this range is always resolvable,
+making direct calls to request_irq() for legacy IRQs function correctly.
+
+Signed-off-by: Ming Wang <wangming01@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c
+index 2d4c3ec128b8f..912bf50a5c7ca 100644
+--- a/drivers/irqchip/irq-loongson-pch-lpc.c
++++ b/drivers/irqchip/irq-loongson-pch-lpc.c
+@@ -200,8 +200,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent,
+ goto iounmap_base;
+ }
+
+- priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT,
+- &pch_lpc_domain_ops, priv);
++ /*
++ * The LPC interrupt controller is a legacy i8259-compatible device,
++ * which requires a static 1:1 mapping for IRQs 0-15.
++ * Use irq_domain_create_legacy to establish this static mapping early.
++ */
++ priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0,
++ &pch_lpc_domain_ops, priv);
+ if (!priv->lpc_domain) {
+ pr_err("Failed to create IRQ domain\n");
+ goto free_irq_handle;
+--
+2.51.0
+
--- /dev/null
+From 420279402a137293356da1e4cd89ec2212e6f4da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:26:32 +0800
+Subject: irqchip/sifive-plic: Respect mask state when setting affinity
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
+
+plic_set_affinity() always calls plic_irq_enable(), which clears up the
+priority setting even the interrupt is only masked. This unmasks the
+interrupt unexpectly.
+
+Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid
+changing the priority setting.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Nam Cao <namcao@linutronix.de> # VisionFive 2
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com
+Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 9c4af7d588463..c0cf4fed13e09 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -179,12 +179,14 @@ static int plic_set_affinity(struct irq_data *d,
+ if (cpu >= nr_cpu_ids)
+ return -EINVAL;
+
+- plic_irq_disable(d);
++ /* Invalidate the original routing entry */
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+
++ /* Setting the new routing entry if irq is enabled */
+ if (!irqd_irq_disabled(d))
+- plic_irq_enable(d);
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+
+ return IRQ_SET_MASK_OK_DONE;
+ }
+--
+2.51.0
+
--- /dev/null
+From 5ce266ab9b29bb6737f71432dfaeea8615df208c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:40:37 +0200
+Subject: kselftest/arm64: tpidr2: Switch to waitpid() over wait4()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 61a3cf7934b6da3c926cd9961860dd94eb7192ba ]
+
+wait4() is deprecated, non-standard and about to be removed from nolibc.
+
+Switch to the equivalent waitpid() call.
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Link: https://lore.kernel.org/r/20250821-nolibc-enosys-v1-6-4b63f2caaa89@weissschuh.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/abi/tpidr2.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/abi/tpidr2.c b/tools/testing/selftests/arm64/abi/tpidr2.c
+index 4c89ab0f10101..1703543fb7c76 100644
+--- a/tools/testing/selftests/arm64/abi/tpidr2.c
++++ b/tools/testing/selftests/arm64/abi/tpidr2.c
+@@ -182,16 +182,16 @@ static int write_clone_read(void)
+ }
+
+ for (;;) {
+- waiting = wait4(ret, &status, __WCLONE, NULL);
++ waiting = waitpid(ret, &status, __WCLONE);
+
+ if (waiting < 0) {
+ if (errno == EINTR)
+ continue;
+- ksft_print_msg("wait4() failed: %d\n", errno);
++ ksft_print_msg("waitpid() failed: %d\n", errno);
+ return 0;
+ }
+ if (waiting != ret) {
+- ksft_print_msg("wait4() returned wrong PID %d\n",
++ ksft_print_msg("waitpid() returned wrong PID %d\n",
+ waiting);
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From ee803ecde38d7812445434e9db7a8c57cf66c438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 09:03:38 +0200
+Subject: kunit: Enable PCI on UML without triggering WARN()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 031cdd3bc3f369553933c1b0f4cb18000162c8ff ]
+
+Various KUnit tests require PCI infrastructure to work. All normal
+platforms enable PCI by default, but UML does not. Enabling PCI from
+.kunitconfig files is problematic as it would not be portable. So in
+commit 6fc3a8636a7b ("kunit: tool: Enable virtio/PCI by default on UML")
+PCI was enabled by way of CONFIG_UML_PCI_OVER_VIRTIO=y. However
+CONFIG_UML_PCI_OVER_VIRTIO requires additional configuration of
+CONFIG_UML_PCI_OVER_VIRTIO_DEVICE_ID or will otherwise trigger a WARN() in
+virtio_pcidev_init(). However there is no one correct value for
+UML_PCI_OVER_VIRTIO_DEVICE_ID which could be used by default.
+
+This warning is confusing when debugging test failures.
+
+On the other hand, the functionality of CONFIG_UML_PCI_OVER_VIRTIO is not
+used at all, given that it is completely non-functional as indicated by
+the WARN() in question. Instead it is only used as a way to enable
+CONFIG_UML_PCI which itself is not directly configurable.
+
+Instead of going through CONFIG_UML_PCI_OVER_VIRTIO, introduce a custom
+configuration option which enables CONFIG_UML_PCI without triggering
+warnings or building dead code.
+
+Link: https://lore.kernel.org/r/20250908-kunit-uml-pci-v2-1-d8eba5f73c9d@linutronix.de
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/Kconfig | 7 +++++++
+ tools/testing/kunit/configs/arch_uml.config | 5 ++---
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/lib/kunit/Kconfig b/lib/kunit/Kconfig
+index c10ede4b1d220..1823539e96da3 100644
+--- a/lib/kunit/Kconfig
++++ b/lib/kunit/Kconfig
+@@ -106,4 +106,11 @@ config KUNIT_DEFAULT_TIMEOUT
+ If unsure, the default timeout of 300 seconds is suitable for most
+ cases.
+
++config KUNIT_UML_PCI
++ bool "KUnit UML PCI Support"
++ depends on UML
++ select UML_PCI
++ help
++ Enables the PCI subsystem on UML for use by KUnit tests.
++
+ endif # KUNIT
+diff --git a/tools/testing/kunit/configs/arch_uml.config b/tools/testing/kunit/configs/arch_uml.config
+index 54ad8972681a2..28edf816aa70e 100644
+--- a/tools/testing/kunit/configs/arch_uml.config
++++ b/tools/testing/kunit/configs/arch_uml.config
+@@ -1,8 +1,7 @@
+ # Config options which are added to UML builds by default
+
+-# Enable virtio/pci, as a lot of tests require it.
+-CONFIG_VIRTIO_UML=y
+-CONFIG_UML_PCI_OVER_VIRTIO=y
++# Enable pci, as a lot of tests require it.
++CONFIG_KUNIT_UML_PCI=y
+
+ # Enable FORTIFY_SOURCE for wider checking.
+ CONFIG_FORTIFY_SOURCE=y
+--
+2.51.0
+
--- /dev/null
+From 7bf0f5f706ef6101912a655118deef6dac95b8ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 05:31:27 +0000
+Subject: libbpf: Fix USDT SIB argument handling causing unrecognized register
+ error
+
+From: Jiawei Zhao <phoenix500526@163.com>
+
+[ Upstream commit 758acb9ccfdbf854b55abaceaf1f3f229cde3d19 ]
+
+On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB)
+addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation
+in libbpf cannot parse this format, causing `bpf_program__attach_usdt()`
+to fail with -ENOENT (unrecognized register).
+
+This patch fixes this by implementing the necessary changes:
+- add correct handling for SIB-addressed arguments in `bpf_usdt_arg`.
+- add adaptive support to `__bpf_usdt_arg_type` and
+ `__bpf_usdt_arg_spec` to represent SIB addressing parameters.
+
+Signed-off-by: Jiawei Zhao <phoenix500526@163.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250827053128.1301287-2-phoenix500526@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/usdt.bpf.h | 44 ++++++++++++++++++++++++++--
+ tools/lib/bpf/usdt.c | 62 ++++++++++++++++++++++++++++++++++++----
+ 2 files changed, 99 insertions(+), 7 deletions(-)
+
+diff --git a/tools/lib/bpf/usdt.bpf.h b/tools/lib/bpf/usdt.bpf.h
+index 2a7865c8e3fe3..43deb05a51970 100644
+--- a/tools/lib/bpf/usdt.bpf.h
++++ b/tools/lib/bpf/usdt.bpf.h
+@@ -34,13 +34,32 @@ enum __bpf_usdt_arg_type {
+ BPF_USDT_ARG_CONST,
+ BPF_USDT_ARG_REG,
+ BPF_USDT_ARG_REG_DEREF,
++ BPF_USDT_ARG_SIB,
+ };
+
++/*
++ * This struct layout is designed specifically to be backwards/forward
++ * compatible between libbpf versions for ARG_CONST, ARG_REG, and
++ * ARG_REG_DEREF modes. ARG_SIB requires libbpf v1.7+.
++ */
+ struct __bpf_usdt_arg_spec {
+ /* u64 scalar interpreted depending on arg_type, see below */
+ __u64 val_off;
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+ /* arg location case, see bpf_usdt_arg() for details */
+- enum __bpf_usdt_arg_type arg_type;
++ enum __bpf_usdt_arg_type arg_type: 8;
++ /* index register offset within struct pt_regs */
++ __u16 idx_reg_off: 12;
++ /* scale factor for index register (1, 2, 4, or 8) */
++ __u16 scale_bitshift: 4;
++ /* reserved for future use, keeps reg_off offset stable */
++ __u8 __reserved: 8;
++#else
++ __u8 __reserved: 8;
++ __u16 idx_reg_off: 12;
++ __u16 scale_bitshift: 4;
++ enum __bpf_usdt_arg_type arg_type: 8;
++#endif
+ /* offset of referenced register within struct pt_regs */
+ short reg_off;
+ /* whether arg should be interpreted as signed value */
+@@ -149,7 +168,7 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
+ {
+ struct __bpf_usdt_spec *spec;
+ struct __bpf_usdt_arg_spec *arg_spec;
+- unsigned long val;
++ unsigned long val, idx;
+ int err, spec_id;
+
+ *res = 0;
+@@ -202,6 +221,27 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
+ return err;
+ #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+ val >>= arg_spec->arg_bitshift;
++#endif
++ break;
++ case BPF_USDT_ARG_SIB:
++ /* Arg is in memory addressed by SIB (Scale-Index-Base) mode
++ * (e.g., "-1@-96(%rbp,%rax,8)" in USDT arg spec). We first
++ * fetch the base register contents and the index register
++ * contents from pt_regs. Then we calculate the final address
++ * as base + (index * scale) + offset, and do a user-space
++ * probe read to fetch the argument value.
++ */
++ err = bpf_probe_read_kernel(&val, sizeof(val), (void *)ctx + arg_spec->reg_off);
++ if (err)
++ return err;
++ err = bpf_probe_read_kernel(&idx, sizeof(idx), (void *)ctx + arg_spec->idx_reg_off);
++ if (err)
++ return err;
++ err = bpf_probe_read_user(&val, sizeof(val), (void *)(val + (idx << arg_spec->scale_bitshift) + arg_spec->val_off));
++ if (err)
++ return err;
++#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
++ val >>= arg_spec->arg_bitshift;
+ #endif
+ break;
+ default:
+diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
+index 3373b9d45ac44..867bff6b06990 100644
+--- a/tools/lib/bpf/usdt.c
++++ b/tools/lib/bpf/usdt.c
+@@ -200,12 +200,23 @@ enum usdt_arg_type {
+ USDT_ARG_CONST,
+ USDT_ARG_REG,
+ USDT_ARG_REG_DEREF,
++ USDT_ARG_SIB,
+ };
+
+ /* should match exactly struct __bpf_usdt_arg_spec from usdt.bpf.h */
+ struct usdt_arg_spec {
+ __u64 val_off;
+- enum usdt_arg_type arg_type;
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
++ enum usdt_arg_type arg_type: 8;
++ __u16 idx_reg_off: 12;
++ __u16 scale_bitshift: 4;
++ __u8 __reserved: 8; /* keep reg_off offset stable */
++#else
++ __u8 __reserved: 8; /* keep reg_off offset stable */
++ __u16 idx_reg_off: 12;
++ __u16 scale_bitshift: 4;
++ enum usdt_arg_type arg_type: 8;
++#endif
+ short reg_off;
+ bool arg_signed;
+ char arg_bitshift;
+@@ -1283,11 +1294,51 @@ static int calc_pt_regs_off(const char *reg_name)
+
+ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec *arg, int *arg_sz)
+ {
+- char reg_name[16];
+- int len, reg_off;
+- long off;
++ char reg_name[16] = {0}, idx_reg_name[16] = {0};
++ int len, reg_off, idx_reg_off, scale = 1;
++ long off = 0;
++
++ if (sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^,] , %d ) %n",
++ arg_sz, &off, reg_name, idx_reg_name, &scale, &len) == 5 ||
++ sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^,] , %d ) %n",
++ arg_sz, reg_name, idx_reg_name, &scale, &len) == 4 ||
++ sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^)] ) %n",
++ arg_sz, &off, reg_name, idx_reg_name, &len) == 4 ||
++ sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^)] ) %n",
++ arg_sz, reg_name, idx_reg_name, &len) == 3
++ ) {
++ /*
++ * Scale Index Base case:
++ * 1@-96(%rbp,%rax,8)
++ * 1@(%rbp,%rax,8)
++ * 1@-96(%rbp,%rax)
++ * 1@(%rbp,%rax)
++ */
++ arg->arg_type = USDT_ARG_SIB;
++ arg->val_off = off;
+
+- if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n", arg_sz, &off, reg_name, &len) == 3) {
++ reg_off = calc_pt_regs_off(reg_name);
++ if (reg_off < 0)
++ return reg_off;
++ arg->reg_off = reg_off;
++
++ idx_reg_off = calc_pt_regs_off(idx_reg_name);
++ if (idx_reg_off < 0)
++ return idx_reg_off;
++ arg->idx_reg_off = idx_reg_off;
++
++ /* validate scale factor and set fields directly */
++ switch (scale) {
++ case 1: arg->scale_bitshift = 0; break;
++ case 2: arg->scale_bitshift = 1; break;
++ case 4: arg->scale_bitshift = 2; break;
++ case 8: arg->scale_bitshift = 3; break;
++ default:
++ pr_warn("usdt: invalid SIB scale %d, expected 1, 2, 4, 8\n", scale);
++ return -EINVAL;
++ }
++ } else if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n",
++ arg_sz, &off, reg_name, &len) == 3) {
+ /* Memory dereference case, e.g., -4@-20(%rbp) */
+ arg->arg_type = USDT_ARG_REG_DEREF;
+ arg->val_off = off;
+@@ -1306,6 +1357,7 @@ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec
+ } else if (sscanf(arg_str, " %d @ %%%15s %n", arg_sz, reg_name, &len) == 2) {
+ /* Register read case, e.g., -4@%eax */
+ arg->arg_type = USDT_ARG_REG;
++ /* register read has no memory offset */
+ arg->val_off = 0;
+
+ reg_off = calc_pt_regs_off(reg_name);
+--
+2.51.0
+
--- /dev/null
+From 6ff53bbd73b5769eec049daa1758e207048bf65e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index e4275f8ee5db8..acafc910bbacc 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -370,7 +370,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ card->next_request = h_memstick_set_rw_addr;
+ memstick_new_req(card->host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ return card->current_mrq.error;
+ }
+@@ -404,7 +406,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+
+ card->next_request = h_memstick_read_dev_id;
+ memstick_new_req(host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ if (card->current_mrq.error)
+ goto err_out;
+--
+2.51.0
+
--- /dev/null
+From 4a71b01f863cda63c55dbba5c8cdb72fcde7b365 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 16:21:13 +0200
+Subject: mfd: core: Increment of_node's refcount before linking it to the
+ platform device
+
+From: Bastien Curutchet <bastien.curutchet@bootlin.com>
+
+[ Upstream commit 5f4bbee069836e51ed0b6d7e565a292f070ababc ]
+
+When an MFD device is added, a platform_device is allocated. If this
+device is linked to a DT description, the corresponding OF node is linked
+to the new platform device but the OF node's refcount isn't incremented.
+As of_node_put() is called during the platform device release, it leads
+to a refcount underflow.
+
+Call of_node_get() to increment the OF node's refcount when the node is
+linked to the newly created platform device.
+
+Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
+Link: https://lore.kernel.org/r/20250820-mfd-refcount-v1-1-6dcb5eb41756@bootlin.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mfd-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index 76bd316a50afc..7d14a1e7631ee 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -131,6 +131,7 @@ static int mfd_match_of_node_to_dev(struct platform_device *pdev,
+ of_entry->np = np;
+ list_add_tail(&of_entry->list, &mfd_of_node_list);
+
++ of_node_get(np);
+ device_set_node(&pdev->dev, of_fwnode_handle(np));
+ #endif
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 8691abdd3ef437beec243e96cd37f57a1fcbcf8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:45:48 +0100
+Subject: mfd: cs42l43: Move IRQ enable/disable to encompass force suspend
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 62aec8a0a5b61f149bbe518c636e38e484812499 ]
+
+As pm_runtime_force_suspend() will force the device state to suspend,
+the driver needs to ensure no IRQ handlers are currently running. If not
+those handlers may find they are now running on suspended hardware
+despite holding a PM runtime reference. disable_irq() will sync any
+currently running handlers, so move the IRQ disabling to cover the whole
+of the forced suspend state to avoid such race conditions.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250903094549.271068-6-ckeepax@opensource.cirrus.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/cs42l43.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
+index 07c8f1b8183ee..959298c8232f4 100644
+--- a/drivers/mfd/cs42l43.c
++++ b/drivers/mfd/cs42l43.c
+@@ -1151,6 +1151,8 @@ static int cs42l43_suspend(struct device *dev)
+ return ret;
+ }
+
++ disable_irq(cs42l43->irq);
++
+ ret = pm_runtime_force_suspend(dev);
+ if (ret) {
+ dev_err(cs42l43->dev, "Failed to force suspend: %d\n", ret);
+@@ -1164,8 +1166,6 @@ static int cs42l43_suspend(struct device *dev)
+ if (ret)
+ return ret;
+
+- disable_irq(cs42l43->irq);
+-
+ return 0;
+ }
+
+@@ -1196,14 +1196,14 @@ static int cs42l43_resume(struct device *dev)
+ if (ret)
+ return ret;
+
+- enable_irq(cs42l43->irq);
+-
+ ret = pm_runtime_force_resume(dev);
+ if (ret) {
+ dev_err(cs42l43->dev, "Failed to force resume: %d\n", ret);
+ return ret;
+ }
+
++ enable_irq(cs42l43->irq);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b3c9593c98898741823bee68b82968b4d5634194 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index c6235cd0dbdc4..1ec9ab56442df 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ DA9063_PAGE_SEL_BUF_SIZE,
+ };
+
++enum da9063_page_sel_msgs {
++ DA9063_PAGE_SEL_MSG = 0,
++ DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+- DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+- DA9063_PAGED_READ_MSG_REG_SEL,
++ DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ DA9063_PAGED_READ_MSG_DATA,
+ DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ (page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+
+ /* Write reg address, page selection */
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++ xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++ xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++ xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++ xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++ ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++ if (ret < 0) {
++ dev_err(&client->dev, "Page switch failed: %d\n", ret);
++ return ret;
++ }
++
++ if (ret != DA9063_PAGE_SEL_CNT) {
++ dev_err(&client->dev, "Page switch failed to complete\n");
++ return -EIO;
++ }
+
+ /* Select register address */
+ xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+--
+2.51.0
+
--- /dev/null
+From 1b9fab425045ca2475464c42e2aee0ef550d84fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:29:36 +0300
+Subject: mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit c91a0e4e549d0457c61f2199fcd84d699400bee1 ]
+
+Add Intel Wildcat Lake PCI IDs.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20250915112936.10696-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 1a5b8b13f8d0b..8d92c895d3aef 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -367,6 +367,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x4b79), (kernel_ulong_t)&ehl_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x4b7a), (kernel_ulong_t)&ehl_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x4b7b), (kernel_ulong_t)&ehl_i2c_info },
++ /* WCL */
++ { PCI_VDEVICE(INTEL, 0x4d25), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x4d26), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x4d27), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x4d30), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x4d46), (kernel_ulong_t)&tgl_spi_info },
++ { PCI_VDEVICE(INTEL, 0x4d50), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d51), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d52), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x4d78), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d79), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d7a), (kernel_ulong_t)&ehl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x4d7b), (kernel_ulong_t)&ehl_i2c_info },
+ /* JSL */
+ { PCI_VDEVICE(INTEL, 0x4da8), (kernel_ulong_t)&spt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x4da9), (kernel_ulong_t)&spt_uart_info },
+--
+2.51.0
+
--- /dev/null
+From 41e452554c9016fd101686f21de6d5dd564970b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:01:37 +0200
+Subject: mfd: macsmc: Add "apple,t8103-smc" compatible
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 9b959e525fa7e8518e57554b6e17849942938dfc ]
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,smc" anymore [1]. Use
+"apple,t8103-smc" as base compatible as it is the SoC the driver and
+bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://lore.kernel.org/r/20250828-dt-apple-t6020-v1-18-507ba4c4b98e@jannau.net
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/macsmc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/macsmc.c b/drivers/mfd/macsmc.c
+index 870c8b2028a8f..a5e0b99484830 100644
+--- a/drivers/mfd/macsmc.c
++++ b/drivers/mfd/macsmc.c
+@@ -478,6 +478,7 @@ static int apple_smc_probe(struct platform_device *pdev)
+ }
+
+ static const struct of_device_id apple_smc_of_match[] = {
++ { .compatible = "apple,t8103-smc" },
+ { .compatible = "apple,smc" },
+ {},
+ };
+--
+2.51.0
+
--- /dev/null
+From 0593f426dc9b07059406cb6b50ba9831116cde34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+ 739 | mfd_devs, n_devs,
+ | ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+ 459 | const struct mfd_cell *mfd_devs;
+ | ^
+ | = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index bdbd5bfc97145..2f74a8c644a32 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -456,7 +456,7 @@ int madera_dev_init(struct madera *madera)
+ struct device *dev = madera->dev;
+ unsigned int hwid;
+ int (*patch_fn)(struct madera *) = NULL;
+- const struct mfd_cell *mfd_devs;
++ const struct mfd_cell *mfd_devs = NULL;
+ int n_devs = 0;
+ int i, ret;
+
+@@ -670,7 +670,7 @@ int madera_dev_init(struct madera *madera)
+ goto err_reset;
+ }
+
+- if (!n_devs) {
++ if (!n_devs || !mfd_devs) {
+ dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ madera->type_name);
+ ret = -ENODEV;
+--
+2.51.0
+
--- /dev/null
+From 1a157ebb607a89bbd3c02865283cca6f27bbdf57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:07:24 +0200
+Subject: mfd: qnap-mcu: Handle errors returned from qnap_mcu_write
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit bf2de43060d528e52e372c63182a94b95c80d305 ]
+
+qnap_mcu_write can return errors and those were not checked before.
+So do that now.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20250804130726.3180806-3-heiko@sntech.de
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/qnap-mcu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/qnap-mcu.c b/drivers/mfd/qnap-mcu.c
+index 89a8a1913d42d..9d3edc3e7d93b 100644
+--- a/drivers/mfd/qnap-mcu.c
++++ b/drivers/mfd/qnap-mcu.c
+@@ -163,7 +163,11 @@ int qnap_mcu_exec(struct qnap_mcu *mcu,
+ reply->received = 0;
+ reinit_completion(&reply->done);
+
+- qnap_mcu_write(mcu, cmd_data, cmd_data_size);
++ ret = qnap_mcu_write(mcu, cmd_data, cmd_data_size);
++ if (ret < 0) {
++ mutex_unlock(&mcu->bus_lock);
++ return ret;
++ }
+
+ serdev_device_wait_until_sent(mcu->serdev, msecs_to_jiffies(QNAP_MCU_TIMEOUT_MS));
+
+--
+2.51.0
+
--- /dev/null
+From 514669c8ee0c67591967f4562d27f80204d3f641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:07:23 +0200
+Subject: mfd: qnap-mcu: Include linux/types.h in qnap-mcu.h shared header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 5e1c88679174e4bfe5d152060b06d370bd85de80 ]
+
+Relying on other components to include those basic types is unreliable
+and may cause compile errors like:
+
+../include/linux/mfd/qnap-mcu.h:13:9: error: unknown type name ‘u32’
+ 13 | u32 baud_rate;
+ | ^~~
+../include/linux/mfd/qnap-mcu.h:17:9: error: unknown type name ‘bool’
+ 17 | bool usb_led;
+ | ^~~~
+
+So make sure, the types used in the header are available.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20250804130726.3180806-2-heiko@sntech.de
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mfd/qnap-mcu.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/linux/mfd/qnap-mcu.h b/include/linux/mfd/qnap-mcu.h
+index 8d48c212fd444..42bf523f9a5b0 100644
+--- a/include/linux/mfd/qnap-mcu.h
++++ b/include/linux/mfd/qnap-mcu.h
+@@ -7,6 +7,8 @@
+ #ifndef _LINUX_QNAP_MCU_H_
+ #define _LINUX_QNAP_MCU_H_
+
++#include <linux/types.h>
++
+ struct qnap_mcu;
+
+ struct qnap_mcu_variant {
+--
+2.51.0
+
--- /dev/null
+From 7f63ddca4887c64b27dca567ee36f451eeafd85b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 18:31:20 +0300
+Subject: mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit 81a2c31257411296862487aaade98b7d9e25dc72 ]
+
+The QIXIS FPGA found on Layerscape boards such as LX2160AQDS, LS1028AQDS
+etc deals with power-on-reset timing, muxing etc. Use the simple-mfd-i2c
+as its core driver by adding its compatible string (already found in
+some dt files). By using the simple-mfd-i2c driver, any child device
+will have access to the i2c regmap created by it.
+
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Link: https://lore.kernel.org/r/20250707153120.1371719-1-ioana.ciornei@nxp.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/simple-mfd-i2c.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mfd/simple-mfd-i2c.c b/drivers/mfd/simple-mfd-i2c.c
+index 22159913bea03..f7798bd922224 100644
+--- a/drivers/mfd/simple-mfd-i2c.c
++++ b/drivers/mfd/simple-mfd-i2c.c
+@@ -99,6 +99,8 @@ static const struct of_device_id simple_mfd_i2c_of_match[] = {
+ { .compatible = "maxim,max5970", .data = &maxim_max5970},
+ { .compatible = "maxim,max5978", .data = &maxim_max5970},
+ { .compatible = "maxim,max77705-battery", .data = &maxim_mon_max77705},
++ { .compatible = "fsl,lx2160aqds-fpga" },
++ { .compatible = "fsl,ls1028aqds-fpga" },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, simple_mfd_i2c_of_match);
+--
+2.51.0
+
--- /dev/null
+From 133186d173ffd92ad1ad65d7f09fb60404689591 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index fe018bedab983..7e2ca39758825 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -137,3 +137,4 @@ module_exit(stmpe_exit);
+
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From 99989eeeda43950c906db42759f51655c9f7b292 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 819d19dc9b4a9..e1165f63aedae 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ void stmpe_remove(struct stmpe *stmpe)
+ {
++ if (stmpe->domain)
++ irq_domain_remove(stmpe->domain);
++
+ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+--
+2.51.0
+
--- /dev/null
+From 88078163a314d4c2c9a64f264d9de31bc4b3ad66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock: 50000000 Hz
+actual clock: 200000000 Hz
+
+After the fix:
+clock: 50000000 Hz
+actual clock: 50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index fb8ca03f661d7..a41291a28e9bd 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -222,7 +222,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ clk &= ~0xff;
+ }
+
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++ clock = clk & CLK_CTL_DIV_MASK;
++ if (clock != 0xff)
++ host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ usleep_range(10000, 11000);
+
+--
+2.51.0
+
--- /dev/null
+From 84f69e3d4a31b584561a277807d325a741936319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:53:54 -0500
+Subject: mmc: sdhci: Disable SD card clock before changing parameters
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Erick Shepherd <erick.shepherd@ni.com>
+
+[ Upstream commit 5f755ba95ae10fd4fa28d64345056ffc18d12c5a ]
+
+Per the SD Host Controller Simplified Specification v4.20 §3.2.3, change
+the SD card clock parameters only after first disabling the external card
+clock. Doing this fixes a spurious clock pulse on Baytrail and Apollo Lake
+SD controllers which otherwise breaks voltage switching with a specific
+Swissbit SD card. This change is limited to Intel host controllers to
+avoid an issue reported on ARM64 devices.
+
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Brad Mouring <brad.mouring@ni.com>
+Signed-off-by: Erick Shepherd <erick.shepherd@ni.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20250724185354.815888-1-erick.shepherd@ni.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-pci-core.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index 826958992dfe2..47a0a738862b5 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -679,8 +679,19 @@ static int intel_start_signal_voltage_switch(struct mmc_host *mmc,
+ return 0;
+ }
+
++static void sdhci_intel_set_clock(struct sdhci_host *host, unsigned int clock)
++{
++ u16 clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
++
++ /* Stop card clock separately to avoid glitches on clock line */
++ if (clk & SDHCI_CLOCK_CARD_EN)
++ sdhci_writew(host, clk & ~SDHCI_CLOCK_CARD_EN, SDHCI_CLOCK_CONTROL);
++
++ sdhci_set_clock(host, clock);
++}
++
+ static const struct sdhci_ops sdhci_intel_byt_ops = {
+- .set_clock = sdhci_set_clock,
++ .set_clock = sdhci_intel_set_clock,
+ .set_power = sdhci_intel_set_power,
+ .enable_dma = sdhci_pci_enable_dma,
+ .set_bus_width = sdhci_set_bus_width,
+@@ -690,7 +701,7 @@ static const struct sdhci_ops sdhci_intel_byt_ops = {
+ };
+
+ static const struct sdhci_ops sdhci_intel_glk_ops = {
+- .set_clock = sdhci_set_clock,
++ .set_clock = sdhci_intel_set_clock,
+ .set_power = sdhci_intel_set_power,
+ .enable_dma = sdhci_pci_enable_dma,
+ .set_bus_width = sdhci_set_bus_width,
+--
+2.51.0
+
--- /dev/null
+From 040398de795d1161c2a955812a11f85b4737bc2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 9d8e20dc8ca11..e7df864bdcaf6 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -81,6 +81,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH BIT(16)
+ #define CORE_HC_SELECT_IN_EN BIT(18)
++#define CORE_HC_SELECT_IN_SDR50 (4 << 19)
+ #define CORE_HC_SELECT_IN_HS400 (6 << 19)
+ #define CORE_HC_SELECT_IN_MASK (7 << 19)
+
+@@ -1133,6 +1134,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ struct mmc_ios *ios = &host->mmc->ios;
+
++ if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING)
++ return true;
++
+ /*
+ * Tuning is required for SDR104, HS200 and HS400 cards and
+ * if clock frequency is greater than 100MHz in these modes.
+@@ -1201,6 +1206,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ struct mmc_ios ios = host->mmc->ios;
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++ const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++ u32 config;
+
+ if (!sdhci_msm_is_tuning_needed(host)) {
+ msm_host->use_cdr = false;
+@@ -1217,6 +1224,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ */
+ msm_host->tuning_done = 0;
+
++ if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++ config &= ~CORE_HC_SELECT_IN_MASK;
++ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++ }
++
+ /*
+ * For HS400 tuning in HS200 timing requires:
+ * - select MCLK/2 in VENDOR_SPEC
+--
+2.51.0
+
--- /dev/null
+From d3bef6e922fefb75fbd7f542d1c9082ed87d6571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 3e12d4683ac72..03987f497a5b5 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3032,11 +3032,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+
+ ++ctrl->ctrl.nr_reconnects;
+
+- if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++ spin_lock_irqsave(&ctrl->rport->lock, flags);
++ if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENODEV;
++ }
+
+- if (nvme_fc_ctlr_active_on_rport(ctrl))
++ if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENOTUNIQ;
++ }
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+
+ dev_info(ctrl->ctrl.device,
+ "NVME-FC{%d}: create association : host wwpn 0x%016llx "
+--
+2.51.0
+
--- /dev/null
+From 83a57d79c21f7f9fa06562893c0acb523c6e3fcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:52:11 +1000
+Subject: nvme: Use non zero KATO for persistent discovery connections
+
+From: Alistair Francis <alistair.francis@wdc.com>
+
+[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
+
+The NVMe Base Specification 2.1 states that:
+
+"""
+A host requests an explicit persistent connection ... by specifying a
+non-zero Keep Alive Timer value in the Connect command.
+"""
+
+As such if we are starting a persistent connection to a discovery
+controller and the KATO is currently 0 we need to update KATO to a non
+zero value to avoid continuous timeouts on the target.
+
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 6b7493934535a..5714d49932822 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4990,8 +4990,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
+ * checking that they started once before, hence are reconnecting back.
+ */
+ if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+- nvme_discovery_ctrl(ctrl))
++ nvme_discovery_ctrl(ctrl)) {
++ if (!ctrl->kato) {
++ nvme_stop_keep_alive(ctrl);
++ ctrl->kato = NVME_DEFAULT_KATO;
++ nvme_start_keep_alive(ctrl);
++ }
+ nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
++ }
+
+ if (ctrl->queue_count > 1) {
+ nvme_queue_scan(ctrl);
+--
+2.51.0
+
--- /dev/null
+From 35b4b9a517244fb0d027373f598c88a4a052722a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 6725c34dd7c90..7d84527d5a43e 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1075,6 +1075,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++ int terminating;
++
++ terminating = atomic_xchg(&assoc->terminating, 1);
++
++ /* if already terminating, do nothing */
++ if (terminating)
++ return;
++
+ nvmet_fc_tgtport_get(assoc->tgtport);
+ if (!queue_work(nvmet_wq, &assoc->del_work))
+ nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1202,13 +1210,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ unsigned long flags;
+- int i, terminating;
+-
+- terminating = atomic_xchg(&assoc->terminating, 1);
+-
+- /* if already terminating, do nothing */
+- if (terminating)
+- return;
++ int i;
+
+ spin_lock_irqsave(&tgtport->lock, flags);
+ list_del_rcu(&assoc->a_list);
+--
+2.51.0
+
--- /dev/null
+From 8c3b5959d251d4d259bafbb6a86e149270cda3ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:59:17 +0200
+Subject: pinctrl: keembay: release allocated memory in detach path
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit aae7a2876c3b39d07aa7655ea082af8e7862f3a5 ]
+
+Unlike all the other allocations in this driver, the memory for storing
+the pin function descriptions allocated with kcalloc() and later resized
+with krealloc() is never freed. Use devres like elsewhere to handle
+that. While at it - replace krealloc() with more suitable
+devm_krealloc_array().
+
+Note: the logic in this module is pretty convoluted and could probably
+use some revisiting, we should probably be able to calculate the exact
+amount of memory needed in advance or even skip the allocation
+altogether and just add each function to the radix tree separately.
+
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-keembay.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-keembay.c b/drivers/pinctrl/pinctrl-keembay.c
+index 60cf017498b32..6aefcbc313099 100644
+--- a/drivers/pinctrl/pinctrl-keembay.c
++++ b/drivers/pinctrl/pinctrl-keembay.c
+@@ -1603,7 +1603,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ * being part of 8 (hw maximum) globally unique muxes.
+ */
+ kpc->nfuncs = 0;
+- keembay_funcs = kcalloc(kpc->npins * 8, sizeof(*keembay_funcs), GFP_KERNEL);
++ keembay_funcs = devm_kcalloc(kpc->dev, kpc->npins * 8,
++ sizeof(*keembay_funcs), GFP_KERNEL);
+ if (!keembay_funcs)
+ return -ENOMEM;
+
+@@ -1634,7 +1635,9 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ }
+
+ /* Reallocate memory based on actual number of functions */
+- new_funcs = krealloc(keembay_funcs, kpc->nfuncs * sizeof(*new_funcs), GFP_KERNEL);
++ new_funcs = devm_krealloc_array(kpc->dev, keembay_funcs,
++ kpc->nfuncs, sizeof(*new_funcs),
++ GFP_KERNEL);
+ if (!new_funcs) {
+ kfree(keembay_funcs);
+ return -ENOMEM;
+--
+2.51.0
+
--- /dev/null
+From df645a033541df5a742ad9a36e14e8c2a03ecd1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 09:40:20 +0100
+Subject: pinctrl: renesas: rzg2l: Add suspend/resume support for Schmitt
+ control registers
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 837afa592c6234be82acb5d23e0a39e9befdaa85 ]
+
+Renesas RZ/G3E supports a power-saving mode where power to most of the
+SoC components is lost, including the PIN controller. Save and restore
+the Schmitt control register contents to ensure the functionality is
+preserved after a suspend/resume cycle.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> # on RZ/G3S
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250819084022.20512-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+index 22bc5b8f65fde..289917a0e8725 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -320,6 +320,7 @@ struct rzg2l_pinctrl_pin_settings {
+ * @iolh: IOLH registers cache
+ * @pupd: PUPD registers cache
+ * @ien: IEN registers cache
++ * @smt: SMT registers cache
+ * @sd_ch: SD_CH registers cache
+ * @eth_poc: ET_POC registers cache
+ * @eth_mode: ETH_MODE register cache
+@@ -333,6 +334,7 @@ struct rzg2l_pinctrl_reg_cache {
+ u32 *iolh[2];
+ u32 *ien[2];
+ u32 *pupd[2];
++ u32 *smt;
+ u8 sd_ch[2];
+ u8 eth_poc[2];
+ u8 eth_mode;
+@@ -2719,6 +2721,10 @@ static int rzg2l_pinctrl_reg_cache_alloc(struct rzg2l_pinctrl *pctrl)
+ if (!cache->pfc)
+ return -ENOMEM;
+
++ cache->smt = devm_kcalloc(pctrl->dev, nports, sizeof(*cache->smt), GFP_KERNEL);
++ if (!cache->smt)
++ return -ENOMEM;
++
+ for (u8 i = 0; i < 2; i++) {
+ u32 n_dedicated_pins = pctrl->data->n_dedicated_pins;
+
+@@ -2980,7 +2986,7 @@ static void rzg2l_pinctrl_pm_setup_regs(struct rzg2l_pinctrl *pctrl, bool suspen
+ struct rzg2l_pinctrl_reg_cache *cache = pctrl->cache;
+
+ for (u32 port = 0; port < nports; port++) {
+- bool has_iolh, has_ien, has_pupd;
++ bool has_iolh, has_ien, has_pupd, has_smt;
+ u32 off, caps;
+ u8 pincnt;
+ u64 cfg;
+@@ -2993,6 +2999,7 @@ static void rzg2l_pinctrl_pm_setup_regs(struct rzg2l_pinctrl *pctrl, bool suspen
+ has_iolh = !!(caps & (PIN_CFG_IOLH_A | PIN_CFG_IOLH_B | PIN_CFG_IOLH_C));
+ has_ien = !!(caps & PIN_CFG_IEN);
+ has_pupd = !!(caps & PIN_CFG_PUPD);
++ has_smt = !!(caps & PIN_CFG_SMT);
+
+ if (suspend)
+ RZG2L_PCTRL_REG_ACCESS32(suspend, pctrl->base + PFC(off), cache->pfc[port]);
+@@ -3031,6 +3038,9 @@ static void rzg2l_pinctrl_pm_setup_regs(struct rzg2l_pinctrl *pctrl, bool suspen
+ cache->ien[1][port]);
+ }
+ }
++
++ if (has_smt)
++ RZG2L_PCTRL_REG_ACCESS32(suspend, pctrl->base + SMT(off), cache->smt[port]);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 22c2d6fb22eb124ef7519abe2582fd8a4985a461 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 5cda6201b60f5..8aedee2720bcb 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -589,8 +589,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ /* 4 parameters */
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+ case PIN_CONFIG_BIAS_PULL_UP:
+- if (arg)
++ if (arg) {
+ pcs_pinconf_clear_bias(pctldev, pin);
++ data = pcs->read(pcs->base + offset);
++ }
+ fallthrough;
+ case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ data &= ~func->conf[i].mask;
+--
+2.51.0
+
--- /dev/null
+From ff3f99833d5fe70ef671cb3cdd94eb20620f6bd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:01:22 +0200
+Subject: pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 442816f97a4f84cb321d3359177a3b9b0ce48a60 ]
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,pmgr-pwrstate" anymore [1]. Use
+"apple,t8103-pmgr-pwrstate" as base compatible as it is the SoC the
+driver and bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Signed-off-by: Janne Grunau <j@jannau.net>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/apple/pmgr-pwrstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pmdomain/apple/pmgr-pwrstate.c b/drivers/pmdomain/apple/pmgr-pwrstate.c
+index 9467235110f46..82c33cf727a82 100644
+--- a/drivers/pmdomain/apple/pmgr-pwrstate.c
++++ b/drivers/pmdomain/apple/pmgr-pwrstate.c
+@@ -306,6 +306,7 @@ static int apple_pmgr_ps_probe(struct platform_device *pdev)
+ }
+
+ static const struct of_device_id apple_pmgr_ps_of_match[] = {
++ { .compatible = "apple,t8103-pmgr-pwrstate" },
+ { .compatible = "apple,pmgr-pwrstate" },
+ {}
+ };
+--
+2.51.0
+
--- /dev/null
+From 266dca3fd4acdef62b5578a1489e4afa945bf0f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:22:09 +0200
+Subject: power: supply: qcom_battmgr: add OOI chemistry
+
+From: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+
+[ Upstream commit fee0904441325d83e7578ca457ec65a9d3f21264 ]
+
+The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this
+update the detection and return the appropriate type.
+
+Signed-off-by: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index 99808ea9851f6..fdb2d1b883fc5 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -982,7 +982,8 @@ static void qcom_battmgr_sc8280xp_strcpy(char *dest, const char *src)
+
+ static unsigned int qcom_battmgr_sc8280xp_parse_technology(const char *chemistry)
+ {
+- if (!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN))
++ if ((!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN)) ||
++ (!strncmp(chemistry, "OOI", BATTMGR_CHEMISTRY_LEN)))
+ return POWER_SUPPLY_TECHNOLOGY_LION;
+ if (!strncmp(chemistry, "LIP", BATTMGR_CHEMISTRY_LEN))
+ return POWER_SUPPLY_TECHNOLOGY_LIPO;
+--
+2.51.0
+
--- /dev/null
+From 4b3bc64fbdd361161a53194993258f2ad135842a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 11:18:51 +0800
+Subject: power: supply: qcom_battmgr: handle charging state change
+ notifications
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 41307ec7df057239aae3d0f089cc35a0d735cdf8 ]
+
+The X1E80100 battery management firmware sends a notification with
+code 0x83 when the battery charging state changes, such as switching
+between fast charge, taper charge, end of charge, or any other error
+charging states.
+
+The same notification code is used with bit[8] set when charging stops
+because the charge control end threshold is reached. Additionally,
+a 2-bit value is included in bit[10:9] with the same code to indicate
+the charging source capability, which is determined by the calculated
+power from voltage and current readings from PDOs: 2 means a strong
+charger over 60W, 1 indicates a weak charger, and 0 means there is no
+charging source.
+
+These 3-MSB [10:8] in the notification code is not much useful for now,
+hence just ignore them and trigger a power supply change event whenever
+0x83 notification code is received. This helps to eliminate the unknown
+notification error messages.
+
+Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Closes: https://lore.kernel.org/all/r65idyc4of5obo6untebw4iqfj2zteiggnnzabrqtlcinvtddx@xc4aig5abesu/
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index fdb2d1b883fc5..c9dc8b378aa1e 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -30,8 +30,9 @@ enum qcom_battmgr_variant {
+ #define NOTIF_BAT_PROPERTY 0x30
+ #define NOTIF_USB_PROPERTY 0x32
+ #define NOTIF_WLS_PROPERTY 0x34
+-#define NOTIF_BAT_INFO 0x81
+ #define NOTIF_BAT_STATUS 0x80
++#define NOTIF_BAT_INFO 0x81
++#define NOTIF_BAT_CHARGING_STATE 0x83
+
+ #define BATTMGR_BAT_INFO 0x9
+
+@@ -947,12 +948,14 @@ static void qcom_battmgr_notification(struct qcom_battmgr *battmgr,
+ }
+
+ notification = le32_to_cpu(msg->notification);
++ notification &= 0xff;
+ switch (notification) {
+ case NOTIF_BAT_INFO:
+ battmgr->info.valid = false;
+ fallthrough;
+ case NOTIF_BAT_STATUS:
+ case NOTIF_BAT_PROPERTY:
++ case NOTIF_BAT_CHARGING_STATE:
+ power_supply_changed(battmgr->bat_psy);
+ break;
+ case NOTIF_USB_PROPERTY:
+--
+2.51.0
+
--- /dev/null
+From e0daa27ee6dca896fd2b4462dbbe2f84c987500b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22
+[ 8.151974] Hardware name: ALE AMB (DT)
+[ 8.155828] Call trace:
+[ 8.158292] dump_backtrace+0x0/0x1d4
+[ 8.161960] show_stack+0x18/0x6c
+[ 8.165280] dump_stack+0xcc/0x128
+[ 8.168687] sysfs_warn_dup+0x60/0x7c
+[ 8.172353] sysfs_do_create_link_sd+0xf0/0x100
+[ 8.176886] sysfs_create_link+0x20/0x40
+[ 8.180816] device_add+0x270/0x7a4
+[ 8.184311] __power_supply_register+0x304/0x560
+[ 8.188930] devm_power_supply_register+0x54/0xa0
+[ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger]
+[ 8.198183] i2c_device_probe+0x2dc/0x2f4
+[ 8.202196] really_probe+0xf0/0x510
+[ 8.205774] driver_probe_device+0xfc/0x160
+[ 8.209960] device_driver_attach+0xc0/0xcc
+[ 8.214146] __driver_attach+0xc0/0x170
+[ 8.218002] bus_for_each_dev+0x74/0xd4
+[ 8.221862] driver_attach+0x24/0x30
+[ 8.225444] bus_add_driver+0x148/0x250
+[ 8.229283] driver_register+0x78/0x130
+[ 8.233140] i2c_register_driver+0x4c/0xe0
+[ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger]
+[ 8.242424] do_one_initcall+0x50/0x1b0
+[ 8.242434] do_init_module+0x44/0x230
+[ 8.242438] load_module+0x2200/0x27c0
+[ 8.242442] __do_sys_finit_module+0xa8/0x11c
+[ 8.242447] __arm64_sys_finit_module+0x20/0x30
+[ 8.242457] el0_svc_common.constprop.0+0x64/0x154
+[ 8.242464] do_el0_svc+0x24/0x8c
+[ 8.242474] el0_svc+0x10/0x20
+[ 8.242481] el0_sync_handler+0x108/0x114
+[ 8.242485] el0_sync+0x180/0x1c0
+[ 8.243847] sbs-charger 20-0009: Failed to register power supply
+[ 8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index 27764123b929e..7d5e676205805 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+
+-static const struct power_supply_desc sbs_desc = {
+- .name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ .type = POWER_SUPPLY_TYPE_MAINS,
+ .properties = sbs_properties,
+ .num_properties = ARRAY_SIZE(sbs_properties),
+@@ -165,9 +164,20 @@ static const struct power_supply_desc sbs_desc = {
+ static int sbs_probe(struct i2c_client *client)
+ {
+ struct power_supply_config psy_cfg = {};
++ struct power_supply_desc *sbs_desc;
+ struct sbs_info *chip;
+ int ret, val;
+
++ sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++ sizeof(*sbs_desc), GFP_KERNEL);
++ if (!sbs_desc)
++ return -ENOMEM;
++
++ sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++ dev_name(&client->dev));
++ if (!sbs_desc->name)
++ return -ENOMEM;
++
+ chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ if (!chip)
+ return -ENOMEM;
+@@ -191,7 +201,7 @@ static int sbs_probe(struct i2c_client *client)
+ return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ chip->last_state = val;
+
+- chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++ chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ if (IS_ERR(chip->power_supply))
+ return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ "Failed to register power supply\n");
+--
+2.51.0
+
--- /dev/null
+From 2abe0896b5a77a672d53444a9ae3aa9a40831e9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 12:36:01 +0200
+Subject: pwm: pca9685: Use bulk write to atomicially update registers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit de5855613263b426ee697dd30224322f2e634dec ]
+
+The output of a PWM channel is configured by four register values. Write
+them in a single i2c transaction to ensure glitch free updates.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/bfa8c0267c9ec059d0d77f146998d564654c75ca.1753784092.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-pca9685.c | 46 ++++++++++++++++++++++++---------------
+ 1 file changed, 29 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index 9ce75704a15f8..91f96b28ce1b5 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -61,6 +61,8 @@
+ #define MODE1_SUB2 BIT(2)
+ #define MODE1_SUB1 BIT(3)
+ #define MODE1_SLEEP BIT(4)
++#define MODE1_AI BIT(5)
++
+ #define MODE2_INVRT BIT(4)
+ #define MODE2_OUTDRV BIT(2)
+
+@@ -131,6 +133,19 @@ static int pca9685_write_reg(struct pwm_chip *chip, unsigned int reg, unsigned i
+ return err;
+ }
+
++static int pca9685_write_4reg(struct pwm_chip *chip, unsigned int reg, u8 val[4])
++{
++ struct pca9685 *pca = to_pca(chip);
++ struct device *dev = pwmchip_parent(chip);
++ int err;
++
++ err = regmap_bulk_write(pca->regmap, reg, val, 4);
++ if (err)
++ dev_err(dev, "regmap_write to register 0x%x failed: %pe\n", reg, ERR_PTR(err));
++
++ return err;
++}
++
+ /* Helper function to set the duty cycle ratio to duty/4096 (e.g. duty=2048 -> 50%) */
+ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned int duty)
+ {
+@@ -143,12 +158,10 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned in
+ return;
+ } else if (duty >= PCA9685_COUNTER_RANGE) {
+ /* Set the full ON bit and clear the full OFF bit */
+- pca9685_write_reg(chip, REG_ON_H(channel), LED_FULL);
+- pca9685_write_reg(chip, REG_OFF_H(channel), 0);
++ pca9685_write_4reg(chip, REG_ON_L(channel), (u8[4]){ 0, LED_FULL, 0, 0 });
+ return;
+ }
+
+-
+ if (pwm->state.usage_power && channel < PCA9685_MAXCHAN) {
+ /*
+ * If usage_power is set, the pca9685 driver will phase shift
+@@ -163,12 +176,9 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned in
+
+ off = (on + duty) % PCA9685_COUNTER_RANGE;
+
+- /* Set ON time (clears full ON bit) */
+- pca9685_write_reg(chip, REG_ON_L(channel), on & 0xff);
+- pca9685_write_reg(chip, REG_ON_H(channel), (on >> 8) & 0xf);
+- /* Set OFF time (clears full OFF bit) */
+- pca9685_write_reg(chip, REG_OFF_L(channel), off & 0xff);
+- pca9685_write_reg(chip, REG_OFF_H(channel), (off >> 8) & 0xf);
++ /* implicitly clear full ON and full OFF bit */
++ pca9685_write_4reg(chip, REG_ON_L(channel),
++ (u8[4]){ on & 0xff, (on >> 8) & 0xf, off & 0xff, (off >> 8) & 0xf });
+ }
+
+ static unsigned int pca9685_pwm_get_duty(struct pwm_chip *chip, int channel)
+@@ -544,9 +554,8 @@ static int pca9685_pwm_probe(struct i2c_client *client)
+
+ mutex_init(&pca->lock);
+
+- ret = pca9685_read_reg(chip, PCA9685_MODE2, ®);
+- if (ret)
+- return ret;
++ /* clear MODE2_OCH */
++ reg = 0;
+
+ if (device_property_read_bool(&client->dev, "invert"))
+ reg |= MODE2_INVRT;
+@@ -562,16 +571,19 @@ static int pca9685_pwm_probe(struct i2c_client *client)
+ if (ret)
+ return ret;
+
+- /* Disable all LED ALLCALL and SUBx addresses to avoid bus collisions */
++ /*
++ * Disable all LED ALLCALL and SUBx addresses to avoid bus collisions,
++ * enable Auto-Increment.
++ */
+ pca9685_read_reg(chip, PCA9685_MODE1, ®);
+ reg &= ~(MODE1_ALLCALL | MODE1_SUB1 | MODE1_SUB2 | MODE1_SUB3);
++ reg |= MODE1_AI;
+ pca9685_write_reg(chip, PCA9685_MODE1, reg);
+
+ /* Reset OFF/ON registers to POR default */
+- pca9685_write_reg(chip, PCA9685_ALL_LED_OFF_L, 0);
+- pca9685_write_reg(chip, PCA9685_ALL_LED_OFF_H, LED_FULL);
+- pca9685_write_reg(chip, PCA9685_ALL_LED_ON_L, 0);
+- pca9685_write_reg(chip, PCA9685_ALL_LED_ON_H, LED_FULL);
++ ret = pca9685_write_4reg(chip, PCA9685_ALL_LED_ON_L, (u8[]){ 0, LED_FULL, 0, LED_FULL });
++ if (ret < 0)
++ return dev_err_probe(&client->dev, ret, "Failed to reset ON/OFF registers\n");
+
+ chip->ops = &pca9685_pwm_ops;
+
+--
+2.51.0
+
--- /dev/null
+From 943c3ffdef77e03f12a1aeab4ed87f9a5ee462f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:22:44 +0800
+Subject: riscv: bpf: Fix uninitialized symbol 'retval_off'
+
+From: Chenghao Duan <duanchenghao@kylinos.cn>
+
+[ Upstream commit d0bf7cd5df18466d969bb60e8890b74cf96081ca ]
+
+In the __arch_prepare_bpf_trampoline() function, retval_off is only
+meaningful when save_ret is true, so the current logic is correct.
+However, in the original logic, retval_off is only initialized under
+certain conditions; for example, in the fmod_ret logic, the compiler is
+not aware that the flags of the fmod_ret program (prog) have set
+BPF_TRAMP_F_CALL_ORIG, which results in an uninitialized symbol
+compilation warning.
+
+So initialize retval_off unconditionally to fix it.
+
+Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
+Reviewed-by: Pu Lehui <pulehui@huawei.com>
+Link: https://lore.kernel.org/r/20250922062244.822937-2-duanchenghao@kylinos.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp64.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
+index f1efa4d6b27f3..bad8c47ed4a7f 100644
+--- a/arch/riscv/net/bpf_jit_comp64.c
++++ b/arch/riscv/net/bpf_jit_comp64.c
+@@ -1112,10 +1112,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ stack_size += 16;
+
+ save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
+- if (save_ret) {
++ if (save_ret)
+ stack_size += 16; /* Save both A5 (BPF R0) and A0 */
+- retval_off = stack_size;
+- }
++ retval_off = stack_size;
+
+ stack_size += nr_arg_slots * 8;
+ args_off = stack_size;
+--
+2.51.0
+
--- /dev/null
+From 0b340691cf9bfb70e32b5818c3d00d8b5593e687 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 22:12:56 -0400
+Subject: rust: kunit: allow `cfg` on `test`s
+
+From: Kaibo Ma <ent3rm4n@gmail.com>
+
+[ Upstream commit c652dc44192d96820d73a7ecd89d275ca7e4355d ]
+
+The `kunit_test` proc macro only checks for the `test` attribute
+immediately preceding a `fn`. If the function is disabled via a `cfg`,
+the generated code would result in a compile error referencing a
+non-existent function [1].
+
+This collects attributes and specifically cherry-picks `cfg` attributes
+to be duplicated inside KUnit wrapper functions such that a test function
+disabled via `cfg` compiles and is marked as skipped in KUnit correctly.
+
+Link: https://lore.kernel.org/r/20250916021259.115578-1-ent3rm4n@gmail.com
+Link: https://lore.kernel.org/rust-for-linux/CANiq72==48=69hYiDo1321pCzgn_n1_jg=ez5UYXX91c+g5JVQ@mail.gmail.com/ [1]
+Closes: https://github.com/Rust-for-Linux/linux/issues/1185
+Suggested-by: Miguel Ojeda <ojeda@kernel.org>
+Suggested-by: David Gow <davidgow@google.com>
+Signed-off-by: Kaibo Ma <ent3rm4n@gmail.com>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/kunit.rs | 7 +++++++
+ rust/macros/kunit.rs | 48 +++++++++++++++++++++++++++++++++-----------
+ 2 files changed, 43 insertions(+), 12 deletions(-)
+
+diff --git a/rust/kernel/kunit.rs b/rust/kernel/kunit.rs
+index 41efd87595d6e..32640dfc968fe 100644
+--- a/rust/kernel/kunit.rs
++++ b/rust/kernel/kunit.rs
+@@ -357,4 +357,11 @@ mod tests {
+ fn rust_test_kunit_in_kunit_test() {
+ assert!(in_kunit_test());
+ }
++
++ #[test]
++ #[cfg(not(all()))]
++ fn rust_test_kunit_always_disabled_test() {
++ // This test should never run because of the `cfg`.
++ assert!(false);
++ }
+ }
+diff --git a/rust/macros/kunit.rs b/rust/macros/kunit.rs
+index 81d18149a0cc9..b395bb0536959 100644
+--- a/rust/macros/kunit.rs
++++ b/rust/macros/kunit.rs
+@@ -5,6 +5,7 @@
+ //! Copyright (c) 2023 José Expósito <jose.exposito89@gmail.com>
+
+ use proc_macro::{Delimiter, Group, TokenStream, TokenTree};
++use std::collections::HashMap;
+ use std::fmt::Write;
+
+ pub(crate) fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
+@@ -41,20 +42,32 @@ pub(crate) fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
+ // Get the functions set as tests. Search for `[test]` -> `fn`.
+ let mut body_it = body.stream().into_iter();
+ let mut tests = Vec::new();
++ let mut attributes: HashMap<String, TokenStream> = HashMap::new();
+ while let Some(token) = body_it.next() {
+ match token {
+- TokenTree::Group(ident) if ident.to_string() == "[test]" => match body_it.next() {
+- Some(TokenTree::Ident(ident)) if ident.to_string() == "fn" => {
+- let test_name = match body_it.next() {
+- Some(TokenTree::Ident(ident)) => ident.to_string(),
+- _ => continue,
+- };
+- tests.push(test_name);
++ TokenTree::Punct(ref p) if p.as_char() == '#' => match body_it.next() {
++ Some(TokenTree::Group(g)) if g.delimiter() == Delimiter::Bracket => {
++ if let Some(TokenTree::Ident(name)) = g.stream().into_iter().next() {
++ // Collect attributes because we need to find which are tests. We also
++ // need to copy `cfg` attributes so tests can be conditionally enabled.
++ attributes
++ .entry(name.to_string())
++ .or_default()
++ .extend([token, TokenTree::Group(g)]);
++ }
++ continue;
+ }
+- _ => continue,
++ _ => (),
+ },
++ TokenTree::Ident(i) if i.to_string() == "fn" && attributes.contains_key("test") => {
++ if let Some(TokenTree::Ident(test_name)) = body_it.next() {
++ tests.push((test_name, attributes.remove("cfg").unwrap_or_default()))
++ }
++ }
++
+ _ => (),
+ }
++ attributes.clear();
+ }
+
+ // Add `#[cfg(CONFIG_KUNIT="y")]` before the module declaration.
+@@ -100,11 +113,22 @@ pub(crate) fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
+ let mut test_cases = "".to_owned();
+ let mut assert_macros = "".to_owned();
+ let path = crate::helpers::file();
+- for test in &tests {
++ let num_tests = tests.len();
++ for (test, cfg_attr) in tests {
+ let kunit_wrapper_fn_name = format!("kunit_rust_wrapper_{test}");
+- // An extra `use` is used here to reduce the length of the message.
++ // Append any `cfg` attributes the user might have written on their tests so we don't
++ // attempt to call them when they are `cfg`'d out. An extra `use` is used here to reduce
++ // the length of the assert message.
+ let kunit_wrapper = format!(
+- "unsafe extern \"C\" fn {kunit_wrapper_fn_name}(_test: *mut ::kernel::bindings::kunit) {{ use ::kernel::kunit::is_test_result_ok; assert!(is_test_result_ok({test}())); }}",
++ r#"unsafe extern "C" fn {kunit_wrapper_fn_name}(_test: *mut ::kernel::bindings::kunit)
++ {{
++ (*_test).status = ::kernel::bindings::kunit_status_KUNIT_SKIPPED;
++ {cfg_attr} {{
++ (*_test).status = ::kernel::bindings::kunit_status_KUNIT_SUCCESS;
++ use ::kernel::kunit::is_test_result_ok;
++ assert!(is_test_result_ok({test}()));
++ }}
++ }}"#,
+ );
+ writeln!(kunit_macros, "{kunit_wrapper}").unwrap();
+ writeln!(
+@@ -139,7 +163,7 @@ macro_rules! assert_eq {{
+ writeln!(
+ kunit_macros,
+ "static mut TEST_CASES: [::kernel::bindings::kunit_case; {}] = [\n{test_cases} ::kernel::kunit::kunit_case_null(),\n];",
+- tests.len() + 1
++ num_tests + 1
+ )
+ .unwrap();
+
+--
+2.51.0
+
--- /dev/null
+From 0f341401bb6516b8354fa597491f7c6abb77a3a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 14:43:37 +0530
+Subject: selftests/bpf: Fix arena_spin_lock selftest failure
+
+From: Saket Kumar Bhaskar <skb99@linux.ibm.com>
+
+[ Upstream commit a9d4e9f0e871352a48a82da11a50df7196fe567a ]
+
+For systems having CONFIG_NR_CPUS set to > 1024 in kernel config
+the selftest fails as arena_spin_lock_irqsave() returns EOPNOTSUPP.
+(eg - incase of powerpc default value for CONFIG_NR_CPUS is 8192)
+
+The selftest is skipped incase bpf program returns EOPNOTSUPP,
+with a descriptive message logged.
+
+Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
+Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
+Link: https://lore.kernel.org/r/20250913091337.1841916-1-skb99@linux.ibm.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/arena_spin_lock.c | 13 +++++++++++++
+ tools/testing/selftests/bpf/progs/arena_spin_lock.c | 5 ++++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arena_spin_lock.c b/tools/testing/selftests/bpf/prog_tests/arena_spin_lock.c
+index 0223fce4db2bc..693fd86fbde62 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arena_spin_lock.c
++++ b/tools/testing/selftests/bpf/prog_tests/arena_spin_lock.c
+@@ -40,8 +40,13 @@ static void *spin_lock_thread(void *arg)
+
+ err = bpf_prog_test_run_opts(prog_fd, &topts);
+ ASSERT_OK(err, "test_run err");
++
++ if (topts.retval == -EOPNOTSUPP)
++ goto end;
++
+ ASSERT_EQ((int)topts.retval, 0, "test_run retval");
+
++end:
+ pthread_exit(arg);
+ }
+
+@@ -63,6 +68,7 @@ static void test_arena_spin_lock_size(int size)
+ skel = arena_spin_lock__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "arena_spin_lock__open_and_load"))
+ return;
++
+ if (skel->data->test_skip == 2) {
+ test__skip();
+ goto end;
+@@ -86,6 +92,13 @@ static void test_arena_spin_lock_size(int size)
+ goto end_barrier;
+ }
+
++ if (skel->data->test_skip == 3) {
++ printf("%s:SKIP: CONFIG_NR_CPUS exceed the maximum supported by arena spinlock\n",
++ __func__);
++ test__skip();
++ goto end_barrier;
++ }
++
+ ASSERT_EQ(skel->bss->counter, repeat * nthreads, "check counter value");
+
+ end_barrier:
+diff --git a/tools/testing/selftests/bpf/progs/arena_spin_lock.c b/tools/testing/selftests/bpf/progs/arena_spin_lock.c
+index c4500c37f85e0..086b57a426cf5 100644
+--- a/tools/testing/selftests/bpf/progs/arena_spin_lock.c
++++ b/tools/testing/selftests/bpf/progs/arena_spin_lock.c
+@@ -37,8 +37,11 @@ int prog(void *ctx)
+ #if defined(ENABLE_ATOMICS_TESTS) && defined(__BPF_FEATURE_ADDR_SPACE_CAST)
+ unsigned long flags;
+
+- if ((ret = arena_spin_lock_irqsave(&lock, flags)))
++ if ((ret = arena_spin_lock_irqsave(&lock, flags))) {
++ if (ret == -EOPNOTSUPP)
++ test_skip = 3;
+ return ret;
++ }
+ if (counter != limit)
+ counter++;
+ bpf_repeat(cs_count);
+--
+2.51.0
+
--- /dev/null
+From 6abae000c05cdfb9b9a5464c089be38ff59ddfca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index 4694422aa76c3..88e4aeab21b7b 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -74,7 +74,7 @@ int main(int argc, char **argv)
+
+ /* Let's try detach it before it was ever attached */
+ ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+- if (ret != -1 || errno != ENOENT) {
++ if (ret != -ENOENT) {
+ printf("bpf_prog_detach2 not attached should fail: %m\n");
+ return 1;
+ }
+--
+2.51.0
+
--- /dev/null
+From 1de6427bfd12ecb0864a0b5566cc14df6f440526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 22:52:30 +0100
+Subject: selftests/bpf: Fix flaky bpf_cookie selftest
+
+From: Mykyta Yatsenko <yatsenko@meta.com>
+
+[ Upstream commit 105eb5dc74109a9f53c2f26c9a918d9347a73595 ]
+
+bpf_cookie can fail on perf_event_open(), when it runs after the task_work
+selftest. The task_work test causes perf to lower
+sysctl_perf_event_sample_rate, and bpf_cookie uses sample_freq,
+which is validated against that sysctl. As a result,
+perf_event_open() rejects the attr if the (now tighter) limit is
+exceeded.
+
+>From perf_event_open():
+if (attr.freq) {
+ if (attr.sample_freq > sysctl_perf_event_sample_rate)
+ return -EINVAL;
+} else {
+ if (attr.sample_period & (1ULL << 63))
+ return -EINVAL;
+}
+
+Switch bpf_cookie to use sample_period, which is not checked against
+sysctl_perf_event_sample_rate.
+
+Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250925215230.265501-1-mykyta.yatsenko5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/bpf_cookie.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c b/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
+index 4a0670c056bad..75f4dff7d0422 100644
+--- a/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
++++ b/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
+@@ -450,8 +450,7 @@ static void pe_subtest(struct test_bpf_cookie *skel)
+ attr.size = sizeof(attr);
+ attr.type = PERF_TYPE_SOFTWARE;
+ attr.config = PERF_COUNT_SW_CPU_CLOCK;
+- attr.freq = 1;
+- attr.sample_freq = 10000;
++ attr.sample_period = 100000;
+ pfd = syscall(__NR_perf_event_open, &attr, -1, 0, -1, PERF_FLAG_FD_CLOEXEC);
+ if (!ASSERT_GE(pfd, 0, "perf_fd"))
+ goto cleanup;
+--
+2.51.0
+
--- /dev/null
+From ea050ec9cc0da7c0ecb8e1981e3a9f765a32c3d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:47:04 +0800
+Subject: selftests/bpf: Fix incorrect array size calculation
+
+From: Jiayuan Chen <jiayuan.chen@linux.dev>
+
+[ Upstream commit f85981327a90c51e76f60e073cb6648b2f167226 ]
+
+The loop in bench_sockmap_prog_destroy() has two issues:
+
+1. Using 'sizeof(ctx.fds)' as the loop bound results in the number of
+ bytes, not the number of file descriptors, causing the loop to iterate
+ far more times than intended.
+
+2. The condition 'ctx.fds[0] > 0' incorrectly checks only the first fd for
+ all iterations, potentially leaving file descriptors unclosed. Change
+ it to 'ctx.fds[i] > 0' to check each fd properly.
+
+These fixes ensure correct cleanup of all file descriptors when the
+benchmark exits.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250909124721.191555-1-jiayuan.chen@linux.dev
+
+Closes: https://lore.kernel.org/bpf/aLqfWuRR9R_KTe5e@stanley.mountain/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/benchs/bench_sockmap.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/benchs/bench_sockmap.c b/tools/testing/selftests/bpf/benchs/bench_sockmap.c
+index 8ebf563a67a2b..cfc072aa7fff7 100644
+--- a/tools/testing/selftests/bpf/benchs/bench_sockmap.c
++++ b/tools/testing/selftests/bpf/benchs/bench_sockmap.c
+@@ -10,6 +10,7 @@
+ #include <argp.h>
+ #include "bench.h"
+ #include "bench_sockmap_prog.skel.h"
++#include "bpf_util.h"
+
+ #define FILE_SIZE (128 * 1024)
+ #define DATA_REPEAT_SIZE 10
+@@ -124,8 +125,8 @@ static void bench_sockmap_prog_destroy(void)
+ {
+ int i;
+
+- for (i = 0; i < sizeof(ctx.fds); i++) {
+- if (ctx.fds[0] > 0)
++ for (i = 0; i < ARRAY_SIZE(ctx.fds); i++) {
++ if (ctx.fds[i] > 0)
+ close(ctx.fds[i]);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 36e913c8d03ead9017aa615ff3a3c147cce5e0ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 21:58:05 -0700
+Subject: selftests/bpf: Fix selftest verifier_arena_large failure
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 5a427fddec5e76360725a0f03df3a2a003efbe2e ]
+
+With latest llvm22, I got the following verification failure:
+
+ ...
+ ; int big_alloc2(void *ctx) @ verifier_arena_large.c:207
+ 0: (b4) w6 = 1 ; R6_w=1
+ ...
+ ; if (err) @ verifier_arena_large.c:233
+ 53: (56) if w6 != 0x0 goto pc+62 ; R6=0
+ 54: (b7) r7 = -4 ; R7_w=-4
+ 55: (18) r8 = 0x7f4000000000 ; R8_w=scalar()
+ 57: (bf) r9 = addr_space_cast(r8, 0, 1) ; R8_w=scalar() R9_w=arena
+ 58: (b4) w6 = 5 ; R6_w=5
+ ; pg = page[i]; @ verifier_arena_large.c:238
+ 59: (bf) r1 = r7 ; R1_w=-4 R7_w=-4
+ 60: (07) r1 += 4 ; R1_w=0
+ 61: (79) r2 = *(u64 *)(r9 +0) ; R2_w=scalar() R9_w=arena
+ ; if (*pg != i) @ verifier_arena_large.c:239
+ 62: (bf) r3 = addr_space_cast(r2, 0, 1) ; R2_w=scalar() R3_w=arena
+ 63: (71) r3 = *(u8 *)(r3 +0) ; R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
+ 64: (5d) if r1 != r3 goto pc+51 ; R1_w=0 R3_w=0
+ ; bpf_arena_free_pages(&arena, (void __arena *)pg, 2); @ verifier_arena_large.c:241
+ 65: (18) r1 = 0xff11000114548000 ; R1_w=map_ptr(map=arena,ks=0,vs=0)
+ 67: (b4) w3 = 2 ; R3_w=2
+ 68: (85) call bpf_arena_free_pages#72675 ;
+ 69: (b7) r1 = 0 ; R1_w=0
+ ; page[i + 1] = NULL; @ verifier_arena_large.c:243
+ 70: (7b) *(u64 *)(r8 +8) = r1
+ R8 invalid mem access 'scalar'
+ processed 61 insns (limit 1000000) max_states_per_insn 0 total_states 6 peak_states 6 mark_read 2
+ =============
+ #489/5 verifier_arena_large/big_alloc2:FAIL
+
+The main reason is that 'r8' in insn '70' is not an arena pointer.
+Further debugging at llvm side shows that llvm commit ([1]) caused
+the failure. For the original code:
+ page[i] = NULL;
+ page[i + 1] = NULL;
+the llvm transformed it to something like below at source level:
+ __builtin_memset(&page[i], 0, 16)
+Such transformation prevents llvm BPFCheckAndAdjustIR pass from
+generating proper addr_space_cast insns ([2]).
+
+Adding support in llvm BPFCheckAndAdjustIR pass should work, but
+not sure that such a pattern exists or not in real applications.
+At the same time, simply adding a memory barrier between two 'page'
+assignment can fix the issue.
+
+ [1] https://github.com/llvm/llvm-project/pull/155415
+ [2] https://github.com/llvm/llvm-project/pull/84410
+
+Cc: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20250920045805.3288551-1-yonghong.song@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/verifier_arena_large.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/progs/verifier_arena_large.c b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
+index 9dbdf123542d3..f19e15400b3e1 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_arena_large.c
++++ b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
+@@ -240,6 +240,7 @@ int big_alloc2(void *ctx)
+ return 5;
+ bpf_arena_free_pages(&arena, (void __arena *)pg, 2);
+ page[i] = NULL;
++ barrier();
+ page[i + 1] = NULL;
+ cond_break;
+ }
+--
+2.51.0
+
--- /dev/null
+From b7d0d1bef69dd48c4b269303ae17aed18ef490db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:48:30 -0300
+Subject: selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
+
+Currently, even if some subtests fails, the end result will still yield
+"ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are
+any failures.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xsk.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
+index 65aafe0003db0..62db060298a4a 100755
+--- a/tools/testing/selftests/bpf/test_xsk.sh
++++ b/tools/testing/selftests/bpf/test_xsk.sh
+@@ -241,4 +241,6 @@ done
+
+ if [ $failures -eq 0 ]; then
+ echo "All tests successful!"
++else
++ exit 1
+ fi
+--
+2.51.0
+
--- /dev/null
+From 9499c8be493162c70ef641056286d761785ab27b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:56 -0700
+Subject: selftests: drv-net: Pull data before parsing headers
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit efec2e55bdefb889639a6e7fe1f1f2431cdddc6a ]
+
+It is possible for drivers to generate xdp packets with data residing
+entirely in fragments. To keep parsing headers using direct packet
+access, call bpf_xdp_pull_data() to pull headers into the linear data
+area.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://patch.msgid.link/20250922233356.3356453-9-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/lib/xdp_native.bpf.c | 89 +++++++++++++++----
+ 1 file changed, 74 insertions(+), 15 deletions(-)
+
+diff --git a/tools/testing/selftests/net/lib/xdp_native.bpf.c b/tools/testing/selftests/net/lib/xdp_native.bpf.c
+index 521ba38f2ddda..df4eea5c192b3 100644
+--- a/tools/testing/selftests/net/lib/xdp_native.bpf.c
++++ b/tools/testing/selftests/net/lib/xdp_native.bpf.c
+@@ -14,6 +14,8 @@
+ #define MAX_PAYLOAD_LEN 5000
+ #define MAX_HDR_LEN 64
+
++extern int bpf_xdp_pull_data(struct xdp_md *xdp, __u32 len) __ksym __weak;
++
+ enum {
+ XDP_MODE = 0,
+ XDP_PORT = 1,
+@@ -68,30 +70,57 @@ static void record_stats(struct xdp_md *ctx, __u32 stat_type)
+
+ static struct udphdr *filter_udphdr(struct xdp_md *ctx, __u16 port)
+ {
+- void *data_end = (void *)(long)ctx->data_end;
+- void *data = (void *)(long)ctx->data;
+ struct udphdr *udph = NULL;
+- struct ethhdr *eth = data;
++ void *data, *data_end;
++ struct ethhdr *eth;
++ int err;
++
++ err = bpf_xdp_pull_data(ctx, sizeof(*eth));
++ if (err)
++ return NULL;
++
++ data_end = (void *)(long)ctx->data_end;
++ data = eth = (void *)(long)ctx->data;
+
+ if (data + sizeof(*eth) > data_end)
+ return NULL;
+
+ if (eth->h_proto == bpf_htons(ETH_P_IP)) {
+- struct iphdr *iph = data + sizeof(*eth);
++ struct iphdr *iph;
++
++ err = bpf_xdp_pull_data(ctx, sizeof(*eth) + sizeof(*iph) +
++ sizeof(*udph));
++ if (err)
++ return NULL;
++
++ data_end = (void *)(long)ctx->data_end;
++ data = (void *)(long)ctx->data;
++
++ iph = data + sizeof(*eth);
+
+ if (iph + 1 > (struct iphdr *)data_end ||
+ iph->protocol != IPPROTO_UDP)
+ return NULL;
+
+- udph = (void *)eth + sizeof(*iph) + sizeof(*eth);
+- } else if (eth->h_proto == bpf_htons(ETH_P_IPV6)) {
+- struct ipv6hdr *ipv6h = data + sizeof(*eth);
++ udph = data + sizeof(*iph) + sizeof(*eth);
++ } else if (eth->h_proto == bpf_htons(ETH_P_IPV6)) {
++ struct ipv6hdr *ipv6h;
++
++ err = bpf_xdp_pull_data(ctx, sizeof(*eth) + sizeof(*ipv6h) +
++ sizeof(*udph));
++ if (err)
++ return NULL;
++
++ data_end = (void *)(long)ctx->data_end;
++ data = (void *)(long)ctx->data;
++
++ ipv6h = data + sizeof(*eth);
+
+ if (ipv6h + 1 > (struct ipv6hdr *)data_end ||
+ ipv6h->nexthdr != IPPROTO_UDP)
+ return NULL;
+
+- udph = (void *)eth + sizeof(*ipv6h) + sizeof(*eth);
++ udph = data + sizeof(*ipv6h) + sizeof(*eth);
+ } else {
+ return NULL;
+ }
+@@ -145,17 +174,34 @@ static void swap_machdr(void *data)
+
+ static int xdp_mode_tx_handler(struct xdp_md *ctx, __u16 port)
+ {
+- void *data_end = (void *)(long)ctx->data_end;
+- void *data = (void *)(long)ctx->data;
+ struct udphdr *udph = NULL;
+- struct ethhdr *eth = data;
++ void *data, *data_end;
++ struct ethhdr *eth;
++ int err;
++
++ err = bpf_xdp_pull_data(ctx, sizeof(*eth));
++ if (err)
++ return XDP_PASS;
++
++ data_end = (void *)(long)ctx->data_end;
++ data = eth = (void *)(long)ctx->data;
+
+ if (data + sizeof(*eth) > data_end)
+ return XDP_PASS;
+
+ if (eth->h_proto == bpf_htons(ETH_P_IP)) {
+- struct iphdr *iph = data + sizeof(*eth);
+- __be32 tmp_ip = iph->saddr;
++ struct iphdr *iph;
++ __be32 tmp_ip;
++
++ err = bpf_xdp_pull_data(ctx, sizeof(*eth) + sizeof(*iph) +
++ sizeof(*udph));
++ if (err)
++ return XDP_PASS;
++
++ data_end = (void *)(long)ctx->data_end;
++ data = (void *)(long)ctx->data;
++
++ iph = data + sizeof(*eth);
+
+ if (iph + 1 > (struct iphdr *)data_end ||
+ iph->protocol != IPPROTO_UDP)
+@@ -169,8 +215,10 @@ static int xdp_mode_tx_handler(struct xdp_md *ctx, __u16 port)
+ return XDP_PASS;
+
+ record_stats(ctx, STATS_RX);
++ eth = data;
+ swap_machdr((void *)eth);
+
++ tmp_ip = iph->saddr;
+ iph->saddr = iph->daddr;
+ iph->daddr = tmp_ip;
+
+@@ -178,9 +226,19 @@ static int xdp_mode_tx_handler(struct xdp_md *ctx, __u16 port)
+
+ return XDP_TX;
+
+- } else if (eth->h_proto == bpf_htons(ETH_P_IPV6)) {
+- struct ipv6hdr *ipv6h = data + sizeof(*eth);
++ } else if (eth->h_proto == bpf_htons(ETH_P_IPV6)) {
+ struct in6_addr tmp_ipv6;
++ struct ipv6hdr *ipv6h;
++
++ err = bpf_xdp_pull_data(ctx, sizeof(*eth) + sizeof(*ipv6h) +
++ sizeof(*udph));
++ if (err)
++ return XDP_PASS;
++
++ data_end = (void *)(long)ctx->data_end;
++ data = (void *)(long)ctx->data;
++
++ ipv6h = data + sizeof(*eth);
+
+ if (ipv6h + 1 > (struct ipv6hdr *)data_end ||
+ ipv6h->nexthdr != IPPROTO_UDP)
+@@ -194,6 +252,7 @@ static int xdp_mode_tx_handler(struct xdp_md *ctx, __u16 port)
+ return XDP_PASS;
+
+ record_stats(ctx, STATS_RX);
++ eth = data;
+ swap_machdr((void *)eth);
+
+ __builtin_memcpy(&tmp_ipv6, &ipv6h->saddr, sizeof(tmp_ipv6));
+--
+2.51.0
+
--- /dev/null
+From 465b042f303f1156ece10d0a2fe932c3e2617427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 18:42:52 -0600
+Subject: selftests: ublk: fix behavior when fio is not installed
+
+From: Uday Shankar <ushankar@purestorage.com>
+
+[ Upstream commit a3835a44107fcbf05f183b5e8b60a8e4605b15ea ]
+
+Some ublk selftests have strange behavior when fio is not installed.
+While most tests behave correctly (run if they don't need fio, or skip
+if they need fio), the following tests have different behavior:
+
+- test_null_01, test_null_02, test_generic_01, test_generic_02, and
+ test_generic_12 try to run fio without checking if it exists first,
+ and fail on any failure of the fio command (including "fio command
+ not found"). So these tests fail when they should skip.
+- test_stress_05 runs fio without checking if it exists first, but
+ doesn't fail on fio command failure. This test passes, but that pass
+ is misleading as the test doesn't do anything useful without fio
+ installed. So this test passes when it should skip.
+
+Fix these issues by adding _have_program fio checks to the top of all of
+these tests.
+
+Signed-off-by: Uday Shankar <ushankar@purestorage.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ublk/test_generic_01.sh | 4 ++++
+ tools/testing/selftests/ublk/test_generic_02.sh | 4 ++++
+ tools/testing/selftests/ublk/test_generic_12.sh | 4 ++++
+ tools/testing/selftests/ublk/test_null_01.sh | 4 ++++
+ tools/testing/selftests/ublk/test_null_02.sh | 4 ++++
+ tools/testing/selftests/ublk/test_stress_05.sh | 4 ++++
+ 6 files changed, 24 insertions(+)
+
+diff --git a/tools/testing/selftests/ublk/test_generic_01.sh b/tools/testing/selftests/ublk/test_generic_01.sh
+index 9227a208ba531..21a31cd5491aa 100755
+--- a/tools/testing/selftests/ublk/test_generic_01.sh
++++ b/tools/testing/selftests/ublk/test_generic_01.sh
+@@ -10,6 +10,10 @@ if ! _have_program bpftrace; then
+ exit "$UBLK_SKIP_CODE"
+ fi
+
++if ! _have_program fio; then
++ exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "sequential io order"
+
+ dev_id=$(_add_ublk_dev -t null)
+diff --git a/tools/testing/selftests/ublk/test_generic_02.sh b/tools/testing/selftests/ublk/test_generic_02.sh
+index 3e80121e3bf5e..12920768b1a08 100755
+--- a/tools/testing/selftests/ublk/test_generic_02.sh
++++ b/tools/testing/selftests/ublk/test_generic_02.sh
+@@ -10,6 +10,10 @@ if ! _have_program bpftrace; then
+ exit "$UBLK_SKIP_CODE"
+ fi
+
++if ! _have_program fio; then
++ exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "sequential io order for MQ"
+
+ dev_id=$(_add_ublk_dev -t null -q 2)
+diff --git a/tools/testing/selftests/ublk/test_generic_12.sh b/tools/testing/selftests/ublk/test_generic_12.sh
+index 7abbb00d251df..b4046201b4d99 100755
+--- a/tools/testing/selftests/ublk/test_generic_12.sh
++++ b/tools/testing/selftests/ublk/test_generic_12.sh
+@@ -10,6 +10,10 @@ if ! _have_program bpftrace; then
+ exit "$UBLK_SKIP_CODE"
+ fi
+
++if ! _have_program fio; then
++ exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "do imbalanced load, it should be balanced over I/O threads"
+
+ NTHREADS=6
+diff --git a/tools/testing/selftests/ublk/test_null_01.sh b/tools/testing/selftests/ublk/test_null_01.sh
+index a34203f726685..c2cb8f7a09fe3 100755
+--- a/tools/testing/selftests/ublk/test_null_01.sh
++++ b/tools/testing/selftests/ublk/test_null_01.sh
+@@ -6,6 +6,10 @@
+ TID="null_01"
+ ERR_CODE=0
+
++if ! _have_program fio; then
++ exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "basic IO test"
+
+ dev_id=$(_add_ublk_dev -t null)
+diff --git a/tools/testing/selftests/ublk/test_null_02.sh b/tools/testing/selftests/ublk/test_null_02.sh
+index 5633ca8766554..8accd35beb55c 100755
+--- a/tools/testing/selftests/ublk/test_null_02.sh
++++ b/tools/testing/selftests/ublk/test_null_02.sh
+@@ -6,6 +6,10 @@
+ TID="null_02"
+ ERR_CODE=0
+
++if ! _have_program fio; then
++ exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "basic IO test with zero copy"
+
+ dev_id=$(_add_ublk_dev -t null -z)
+diff --git a/tools/testing/selftests/ublk/test_stress_05.sh b/tools/testing/selftests/ublk/test_stress_05.sh
+index 566cfd90d192c..274295061042e 100755
+--- a/tools/testing/selftests/ublk/test_stress_05.sh
++++ b/tools/testing/selftests/ublk/test_stress_05.sh
+@@ -5,6 +5,10 @@
+ TID="stress_05"
+ ERR_CODE=0
+
++if ! _have_program fio; then
++ exit "$UBLK_SKIP_CODE"
++fi
++
+ run_io_and_remove()
+ {
+ local size=$1
+--
+2.51.0
+
pm-hibernate-combine-return-paths-in-power_down.patch
pm-sleep-allow-pm_restrict_gfp_mask-stacking.patch
mfd-kempld-switch-back-to-earlier-init-behavior.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+spi-spi-qpic-snand-handle-use_ecc-parameter-of-qcom_.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+mmc-sdhci-disable-sd-card-clock-before-changing-para.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+cpufreq-ti-add-support-for-am62d2.patch
+bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
+firmware-ti_sci-enable-abort-handling-of-entry-to-lp.patch
+firewire-ohci-move-self_id_complete-tracepoint-after.patch
+irqchip-sifive-plic-respect-mask-state-when-setting-.patch
+irqchip-loongson-eiointc-route-interrupt-parsed-from.patch
+io_uring-zctx-check-chained-notif-contexts.patch
+acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+arm64-versal-net-update-rtc-calibration-value.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+firmware-qcom-scm-allow-qseecom-on-dell-inspiron-744.patch
+kselftest-arm64-tpidr2-switch-to-waitpid-over-wait4.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
+selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
+thermal-intel-selftests-workload_hint-mask-unsupport.patch
+power-supply-qcom_battmgr-add-ooi-chemistry.patch
+hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
+hwmon-k10temp-add-device-id-for-strix-halo.patch
+hwmon-lenovo-ec-sensors-update-p8-supprt.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+pinctrl-renesas-rzg2l-add-suspend-resume-support-for.patch
+pinctrl-keembay-release-allocated-memory-in-detach-p.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+io_uring-rsrc-respect-submitter_task-in-io_register_.patch
+hwmon-sy7636a-add-alias.patch
+selftests-bpf-fix-incorrect-array-size-calculation.patch
+block-check-for-valid-bio-while-splitting.patch
+irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
+cpufreq-ondemand-update-the-efficient-idle-check-for.patch
+arm64-zynqmp-disable-coresight-by-default.patch
+arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+arm-tegra-p880-set-correct-touchscreen-clipping.patch
+arm-tegra-transformer-20-add-missing-magnetometer-in.patch
+arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
+firmware-qcom-tzmem-disable-sc7180-platform.patch
+soc-ti-k3-socinfo-add-information-for-am62l-sr1.1.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+kunit-enable-pci-on-uml-without-triggering-warn.patch
+selftests-bpf-fix-arena_spin_lock-selftest-failure.patch
+bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
+i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
+rust-kunit-allow-cfg-on-test-s.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+i3c-dw-add-shutdown-support-to-dw_i3c_master-driver.patch
+io_uring-zcrx-check-all-niovs-filled-with-dma-addres.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+io_uring-zcrx-account-niov-arrays-to-cgroup.patch
+pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
+power-supply-qcom_battmgr-handle-charging-state-chan.patch
+bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+futex-don-t-leak-robust_list-pointer-on-exec-race.patch
+selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
+selftests-ublk-fix-behavior-when-fio-is-not-installe.patch
+spi-rpc-if-add-resume-support-for-rz-g3e.patch
+acpi-spcr-support-precise-baud-rate-field.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+clocksource-drivers-timer-rtl-otto-work-around-dying.patch
+clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
+blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
+riscv-bpf-fix-uninitialized-symbol-retval_off.patch
+bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
+selftests-drv-net-pull-data-before-parsing-headers.patch
+nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
+hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
+tools-power-turbostat-fix-incorrect-sorting-of-pmt-t.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-simple-mfd-i2c-add-compatible-strings-for-layers.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-qnap-mcu-handle-errors-returned-from-qnap_mcu_wr.patch
+mfd-qnap-mcu-include-linux-types.h-in-qnap-mcu.h-sha.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
+mfd-macsmc-add-apple-t8103-smc-compatible.patch
+mfd-core-increment-of_node-s-refcount-before-linking.patch
+mfd-cs42l43-move-irq-enable-disable-to-encompass-for.patch
+mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
--- /dev/null
+From 994c541a2b3bb11af71ae8fe6534dc105aaef7b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ { "AST2620", 0x05010203 },
+ { "AST2605", 0x05030103 },
+ { "AST2625", 0x05030403 },
++ /* AST2700 */
++ { "AST2750", 0x06000003 },
++ { "AST2700", 0x06000103 },
++ { "AST2720", 0x06000203 },
+ };
+
+ static const char *siliconid_to_name(u32 siliconid)
+--
+2.51.0
+
--- /dev/null
+From 35f5f8e1e21b757ec36b922f6e72002d6884dabc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index cf425930539e4..c4c45f15dca4f 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -898,7 +898,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ if (IS_ERR_OR_NULL(ptable))
+ return SMEM_ITEM_COUNT;
+
+- info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ return SMEM_ITEM_COUNT;
+
+--
+2.51.0
+
--- /dev/null
+From 78b7d472472d55a445114467ae63f09d0245f430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index e24ab5f7d2bf1..524fa1b0cd3d6 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++ {
++ .name = "tsensor-cpu1",
++ .offset = 0x084,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu2",
++ .offset = 0x088,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-common",
++ .offset = 0x08c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu0",
++ .offset = 0x098,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "xusb-pad-calibration",
++ .offset = 0x0f0,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu3",
++ .offset = 0x12c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-gpu",
++ .offset = 0x154,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem0",
++ .offset = 0x158,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem1",
++ .offset = 0x15c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-pllx",
++ .offset = 0x160,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ },
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++ {
++ .nvmem_name = "fuse",
++ .cell_name = "xusb-pad-calibration",
++ .dev_id = "7009f000.padctl",
++ .con_id = "calibration",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-common",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "common",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu2",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu2",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu3",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu3",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-gpu",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "gpu",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-pllx",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "pllx",
++ },
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ .read = tegra30_fuse_read,
+ .size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ .init = tegra30_fuse_init,
+ .speedo_init = tegra114_init_speedo_data,
+ .info = &tegra114_fuse_info,
++ .lookups = tegra114_fuse_lookups,
++ .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++ .cells = tegra114_fuse_cells,
++ .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ .soc_attr_group = &tegra_soc_attr_group,
+ .clk_suspend_on = false,
+ };
+--
+2.51.0
+
--- /dev/null
+From 0d3c4c5cf868556a623d940829b685e7d17b62cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 14:15:28 -0500
+Subject: soc: ti: k3-socinfo: Add information for AM62L SR1.1
+
+From: Bryan Brattlof <bb@ti.com>
+
+[ Upstream commit 037e496038f6e4cfb3642a0ffc2db19838d564dd ]
+
+The second silicon revision for the AM62L was mainly a ROM revision
+and therefore this silicon revision is labeled SR1.1
+
+Add a new decode array to properly identify this revision as SR1.1
+
+Signed-off-by: Bryan Brattlof <bb@ti.com>
+Link: https://patch.msgid.link/20250908-62l-chipid-v1-1-9c7194148140@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/k3-socinfo.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/soc/ti/k3-socinfo.c b/drivers/soc/ti/k3-socinfo.c
+index d716be113c84f..50c170a995f90 100644
+--- a/drivers/soc/ti/k3-socinfo.c
++++ b/drivers/soc/ti/k3-socinfo.c
+@@ -66,6 +66,10 @@ static const char * const j721e_rev_string_map[] = {
+ "1.0", "1.1", "2.0",
+ };
+
++static const char * const am62lx_rev_string_map[] = {
++ "1.0", "1.1",
++};
++
+ static int
+ k3_chipinfo_partno_to_names(unsigned int partno,
+ struct soc_device_attribute *soc_dev_attr)
+@@ -92,6 +96,12 @@ k3_chipinfo_variant_to_sr(unsigned int partno, unsigned int variant,
+ soc_dev_attr->revision = kasprintf(GFP_KERNEL, "SR%s",
+ j721e_rev_string_map[variant]);
+ break;
++ case JTAG_ID_PARTNO_AM62LX:
++ if (variant >= ARRAY_SIZE(am62lx_rev_string_map))
++ goto err_unknown_variant;
++ soc_dev_attr->revision = kasprintf(GFP_KERNEL, "SR%s",
++ am62lx_rev_string_map[variant]);
++ break;
+ default:
+ variant++;
+ soc_dev_attr->revision = kasprintf(GFP_KERNEL, "SR%x.0",
+--
+2.51.0
+
--- /dev/null
+From 9035563db51e43b49adee935ca63279946099d6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index d7634bf5413a3..038576805bfa0 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -449,7 +449,7 @@ static int pruss_of_setup_memories(struct device *dev, struct pruss *pruss)
+ pruss->mem_regions[i].pa = res.start;
+ pruss->mem_regions[i].size = resource_size(&res);
+
+- dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++ dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ mem_names[i], &pruss->mem_regions[i].pa,
+ pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ }
+--
+2.51.0
+
--- /dev/null
+From 569aa8a80a90c781a3bfda6a4a079510f029a1b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 7dd92deffe3fb..e0b131aa29b62 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -446,7 +446,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ int i;
+ u8 b;
+
+- dev_info(&spi->dev, " spi_msg@%pK\n", msg);
++ dev_info(&spi->dev, " spi_msg@%p\n", msg);
+ if (msg->status)
+ dev_info(&spi->dev, " status: %i\n",
+ msg->status);
+@@ -456,15 +456,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ msg->actual_length);
+
+ list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer);
++ dev_info(&spi->dev, " spi_transfer@%p\n", xfer);
+ dev_info(&spi->dev, " len: %i\n", xfer->len);
+- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf);
++ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf);
+ if (dump_data && xfer->tx_buf)
+ spi_test_print_hex_dump(" TX: ",
+ xfer->tx_buf,
+ xfer->len);
+
+- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf);
++ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf);
+ if (dump_data && xfer->rx_buf)
+ spi_test_print_hex_dump(" RX: ",
+ xfer->rx_buf,
+@@ -558,7 +558,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ /* if still not found then something has modified too much */
+ /* we could list the "closest" transfer here... */
+ dev_err(&spi->dev,
+- "loopback strangeness - rx changed outside of allowed range at: %pK\n",
++ "loopback strangeness - rx changed outside of allowed range at: %p\n",
+ addr);
+ /* do not return, only set ret,
+ * so that we list all addresses
+@@ -696,7 +696,7 @@ static int spi_test_translate(struct spi_device *spi,
+ }
+
+ dev_err(&spi->dev,
+- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ *ptr, *ptr + len,
+ RX(0), RX(SPI_TEST_MAX_SIZE),
+ TX(0), TX(SPI_TEST_MAX_SIZE));
+--
+2.51.0
+
--- /dev/null
+From b2f8b5f76e152fdc04c69e1d10889ab10420fcb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 12:26:46 +0100
+Subject: spi: rpc-if: Add resume support for RZ/G3E
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
+
+On RZ/G3E using PSCI, s2ram powers down the SoC. After resume,
+reinitialize the hardware for SPI operations.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rpc-if.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
+index 627cffea5d5c7..300a7c10b3d40 100644
+--- a/drivers/spi/spi-rpc-if.c
++++ b/drivers/spi/spi-rpc-if.c
+@@ -207,6 +207,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev)
+ {
+ struct spi_controller *ctlr = dev_get_drvdata(dev);
+
++ rpcif_hw_init(dev, false);
++
+ return spi_controller_resume(ctlr);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a8262584421444d1864455ce2e5568a87ecc05f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 19:15:01 +0200
+Subject: spi: spi-qpic-snand: handle 'use_ecc' parameter of
+ qcom_spi_config_cw_read()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 9c45f95222beecd6a284fd1284d54dd7a772cf59 ]
+
+During raw read, neither the status of the ECC correction nor the erased
+state of the codeword gets checked by the qcom_spi_read_cw_raw() function,
+so in case of raw access reading the corresponding registers via DMA is
+superfluous.
+
+Extend the qcom_spi_config_cw_read() function to evaluate the existing
+(but actually unused) 'use_ecc' parameter, and configure reading only
+the flash status register when ECC is not used.
+
+With the change, the code gets in line with the corresponding part of
+the config_nand_cw_read() function in the qcom_nandc driver.
+
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250808-qpic-snand-handle-use_ecc-v1-1-67289fbb5e2f@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-qpic-snand.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c
+index 780abb967822a..5a247eebde4d9 100644
+--- a/drivers/spi/spi-qpic-snand.c
++++ b/drivers/spi/spi-qpic-snand.c
+@@ -494,9 +494,14 @@ qcom_spi_config_cw_read(struct qcom_nand_controller *snandc, bool use_ecc, int c
+ qcom_write_reg_dma(snandc, &snandc->regs->cmd, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
+ qcom_write_reg_dma(snandc, &snandc->regs->exec, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL);
+
+- qcom_read_reg_dma(snandc, NAND_FLASH_STATUS, 2, 0);
+- qcom_read_reg_dma(snandc, NAND_ERASED_CW_DETECT_STATUS, 1,
+- NAND_BAM_NEXT_SGL);
++ if (use_ecc) {
++ qcom_read_reg_dma(snandc, NAND_FLASH_STATUS, 2, 0);
++ qcom_read_reg_dma(snandc, NAND_ERASED_CW_DETECT_STATUS, 1,
++ NAND_BAM_NEXT_SGL);
++ } else {
++ qcom_read_reg_dma(snandc, NAND_FLASH_STATUS, 1,
++ NAND_BAM_NEXT_SGL);
++ }
+ }
+
+ static int qcom_spi_block_erase(struct qcom_nand_controller *snandc)
+--
+2.51.0
+
--- /dev/null
+From 5272e45f842886a6178c2cedf92ee2f815a9ed78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index acc7998758ad8..133447f250657 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+
+ if (!teedesc || !teedesc->name || !teedesc->ops ||
+ !teedesc->ops->get_version || !teedesc->ops->open ||
+- !teedesc->ops->release || !pool)
++ !teedesc->ops->release)
+ return ERR_PTR(-EINVAL);
+
+ teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From 7dada54e27afc26d973bbdeb9bd84d8f2b9927e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:31:53 +0200
+Subject: thermal: gov_step_wise: Allow cooling level to be reduced earlier
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 2e82368359f63567862a0d438710ddffcb1ace83 ]
+
+The current behavior of the Step-wise thermal governor is to increase
+the cooling level one step at a time after trip point threshold passing
+by thermal zone temperature until the temperature stops to rise. Then,
+nothing is done until the temperature decreases below the (possibly
+updated) trip point threshold, at which point the cooling level is
+reduced straight to the applicable minimum.
+
+While this generally works, it is not in agreement with the throttling
+logic description comment in step_wise_manage() any more after some
+relatively recent changes, and in the case of passive cooling, it may
+lead to undesirable performance oscillations between high and low
+levels.
+
+For this reason, modify the governor's cooling device state selection
+function, get_target_state(), to reduce cooling by one level even if
+the temperature is still above the thermal zone threshold, but the
+temperature has started to fall down. However, ensure that the cooling
+level will remain above the applicable minimum in that case to pull
+the zone temperature further down, possibly until it falls below the
+trip threshold (which may now be equal to the low temperature of the
+trip).
+
+Doing so should help higher performance to be restored earlier in some
+cases which is desirable especially for passive trip points with
+relatively high hysteresis values.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://patch.msgid.link/1947735.tdWV9SEqCh@rafael.j.wysocki
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/gov_step_wise.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/gov_step_wise.c b/drivers/thermal/gov_step_wise.c
+index d1bb59f1dfbd3..b7938bddd9a6a 100644
+--- a/drivers/thermal/gov_step_wise.c
++++ b/drivers/thermal/gov_step_wise.c
+@@ -20,7 +20,9 @@
+ * If the temperature is higher than a trip point,
+ * a. if the trend is THERMAL_TREND_RAISING, use higher cooling
+ * state for this trip point
+- * b. if the trend is THERMAL_TREND_DROPPING, do nothing
++ * b. if the trend is THERMAL_TREND_DROPPING, use a lower cooling state
++ * for this trip point, but keep the cooling state above the applicable
++ * minimum
+ * If the temperature is lower than a trip point,
+ * a. if the trend is THERMAL_TREND_RAISING, do nothing
+ * b. if the trend is THERMAL_TREND_DROPPING, use lower cooling
+@@ -51,6 +53,17 @@ static unsigned long get_target_state(struct thermal_instance *instance,
+ if (throttle) {
+ if (trend == THERMAL_TREND_RAISING)
+ return clamp(cur_state + 1, instance->lower, instance->upper);
++
++ /*
++ * If the zone temperature is falling, the cooling level can
++ * be reduced, but it should still be above the lower state of
++ * the given thermal instance to pull the temperature further
++ * down.
++ */
++ if (trend == THERMAL_TREND_DROPPING)
++ return clamp(cur_state - 1,
++ min(instance->lower + 1, instance->upper),
++ instance->upper);
+ } else if (trend == THERMAL_TREND_DROPPING) {
+ if (cur_state <= instance->lower)
+ return THERMAL_NO_TARGET;
+--
+2.51.0
+
--- /dev/null
+From f27c6cd3154202376e6bcaf546badfe41f88351a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 13:15:41 -0700
+Subject: thermal: intel: selftests: workload_hint: Mask unsupported types
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 0115d063559fa6d25e41751cf455dda40aa2c856 ]
+
+The workload hint may contain some other hints which are not defined.
+So mask out unsupported types. Currently only lower 4 bits of workload
+type hints are defined.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/20250828201541.931425-1-srinivas.pandruvada@linux.intel.com
+[ rjw: Subject cleanup ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/thermal/intel/workload_hint/workload_hint_test.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c b/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
+index ba58589a11454..ca2bd03154e4d 100644
+--- a/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
++++ b/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
+@@ -144,6 +144,8 @@ int main(int argc, char **argv)
+ ret = sscanf(index_str, "%d", &index);
+ if (ret < 0)
+ break;
++
++ index &= 0x0f;
+ if (index > WORKLOAD_TYPE_MAX_INDEX)
+ printf("Invalid workload type index\n");
+ else
+--
+2.51.0
+
--- /dev/null
+From c7af5235532adf49a77286cd5596fe8188a392d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index ce8dfb8e46abd..d7f7ec6f151c2 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -56,7 +56,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ if (numwritten < 1) {
+ perror(path);
+ close(fd);
+- return -1;
++ return 0;
+ }
+
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From cfa0031690f85c690b626ded5d0c72a6eac547f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 0ecac009273ce..f2c1139adf716 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -233,6 +233,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ char value[SYSFS_PATH_MAX];
+ int bytes_written;
++ int len;
+
+ if (cpuidle_state_count(cpu) <= idlestate)
+ return -1;
+@@ -241,10 +242,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ idlestate_value_files[IDLESTATE_DISABLE]))
+ return -2;
+
+- snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+
+ bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+- value, sizeof(disable));
++ value, len);
+ if (bytes_written)
+ return 0;
+ return -3;
+--
+2.51.0
+
--- /dev/null
+From aed698fc42348df0c74672f96e4da0997e36c180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 10:35:15 +0530
+Subject: tools/power turbostat: Fix incorrect sorting of PMT telemetry
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit cafb47be3f38ad81306bf894e743bebc2ccf66ab ]
+
+The pmt_telemdir_sort() comparison function was returning a boolean
+value (0 or 1) instead of the required negative, zero, or positive
+value for proper sorting. This caused unpredictable and incorrect
+ordering of telemetry directories named telem0, telem1, ..., telemN.
+Update the comparison logic to return -1, 0, or 1 based on the
+numerical value extracted from the directory name, ensuring correct
+numerical ordering when using scandir.
+
+This change improves stability and correctness when iterating PMT
+telemetry directories.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/turbostat/turbostat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 72a280e7a9d59..931bad99277fe 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -1890,7 +1890,7 @@ int pmt_telemdir_sort(const struct dirent **a, const struct dirent **b)
+ sscanf((*a)->d_name, "telem%u", &aidx);
+ sscanf((*b)->d_name, "telem%u", &bidx);
+
+- return aidx >= bidx;
++ return (aidx > bidx) ? 1 : (aidx < bidx) ? -1 : 0;
+ }
+
+ const struct dirent *pmt_diriter_next(struct pmt_diriter_t *iter)
+--
+2.51.0
+
--- /dev/null
+From 126c2f54d9d3b414fe34bac71fc92774de825e05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+
+ int enable_hwp_on_cpu(int cpu)
+ {
+- unsigned long long msr;
++ unsigned long long old_msr, new_msr;
++
++ get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++ if (old_msr & 1)
++ return 0; /* already enabled */
+
+- get_msr(cpu, MSR_PM_ENABLE, &msr);
+- put_msr(cpu, MSR_PM_ENABLE, 1);
++ new_msr = old_msr | 1;
++ put_msr(cpu, MSR_PM_ENABLE, new_msr);
+
+ if (verbose)
+- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 80f47705172a36daec72557205d45a38b099d364 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+ */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+- FILE *filep = fopen(path, "r");
++ FILE *filep = fopen(path, mode);
+
+ if (!filep)
+ err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ char *buffer;
+
+ /* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+- cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++ cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+
+ buffer = malloc(4096);
+ if (!buffer) {
+--
+2.51.0
+
--- /dev/null
+From b72fd27c0d1eb36ae41643baeaa09fd9a1e50e2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+ * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+ * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+ * so we don't have to touch that.)
+ */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ if (update_hwp_max)
+ update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+
++ hwp_limits_done_via_sysfs = 1;
++
+ return 0;
+ }
+
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ if (debug)
+ print_hwp_request(cpu, &req, "old: ");
+
+- if (update_hwp_min)
++ if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ req.hwp_min = req_update.hwp_min;
+
+- if (update_hwp_max)
++ if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ req.hwp_max = req_update.hwp_max;
+
+ if (update_hwp_desired)
+--
+2.51.0
+
--- /dev/null
+From 163794aa733505acf938b1152e2810e7decbf8c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 4b97d16f731c1..109276c68ecba 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2741,6 +2741,13 @@ static void handle_swbp(struct pt_regs *regs)
+
+ handler_chain(uprobe, regs);
+
++ /*
++ * If user decided to take execution elsewhere, it makes little sense
++ * to execute the original instruction, so let's skip it.
++ */
++ if (instruction_pointer(regs) != bp_vaddr)
++ goto out;
++
+ if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 86e50fdd0f600ff365f5d21c507c5fca5ee3e002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index 7075bfab59c4d..d191560ce285f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -22,7 +22,7 @@
+ #define LP855X_DEVICE_CTRL 0x01
+ #define LP855X_EEPROM_START 0xA0
+ #define LP855X_EEPROM_END 0xA7
+-#define LP8556_EPROM_START 0xA0
++#define LP8556_EPROM_START 0x98
+ #define LP8556_EPROM_END 0xAF
+
+ /* LP8555/7 Registers */
+--
+2.51.0
+
--- /dev/null
+From 31c4005dba57398aa22fd6a5e0e9292198d07563 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index eb8f2a1ce1388..6efaeda01d166 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ th = &tm->handlers[cur_handler];
+
+ guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++ /*
++ * Print an error message if handler_address is NULL, the parse of VA also
++ * can be skipped.
++ */
++ if (unlikely(!handler_info->handler_address)) {
++ pr_info("Skipping handler with NULL address for GUID: %pUL",
++ (guid_t *)handler_info->handler_guid);
++ continue;
++ }
++
+ th->handler_addr =
+ (void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ /*
+- * Print a warning message if handler_addr is zero which is not expected to
+- * ever happen.
++ * Print a warning message and skip the parse of VA if handler_addr is zero
++ * which is not expected to ever happen.
+ */
+- if (unlikely(!th->handler_addr))
++ if (unlikely(!th->handler_addr)) {
+ pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ &th->guid, handler_info->handler_address);
++ continue;
++ }
+
+ th->static_data_buffer_addr =
+ efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+--
+2.51.0
+
--- /dev/null
+From 9adab9b153613cb388b1e53ead98c139fc39d384 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index c0c5c5c58ae1e..5b5986e10c2d7 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -784,6 +784,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ "PNP0D80", /* Windows-compatible System Power Management Controller */
+ "INT33BD", /* Intel Baytrail Mailbox Device */
++ "INTC10DE", /* Intel CVS LNL */
++ "INTC10E0", /* Intel CVS ARL */
+ "LATT2021", /* Lattice FW Update Client Driver */
+ NULL
+ };
+--
+2.51.0
+
--- /dev/null
+From 0c1c585192f2793afc16a41a884ee491f91d47eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index a232746d150a7..dc53a5d700671 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ * Delete the operands on the previous walkstate operand stack
+ * (they were copied to new objects)
+ */
+- for (i = 0; i < obj_desc->method.param_count; i++) {
+- acpi_ut_remove_reference(this_walk_state->operands[i]);
+- this_walk_state->operands[i] = NULL;
+- }
+-
+- /* Clear the operand stack */
+-
+- this_walk_state->num_operands = 0;
++ acpi_ds_clear_operands(this_walk_state);
+
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+--
+2.51.0
+
--- /dev/null
+From cbed37fd52d4df7724e698176a0bd46d86091d60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index f5a936496f060..24981bba974d3 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+ */
+ static inline __attribute__ ((const)) unsigned long __fls(unsigned long x)
+ {
++ if (__builtin_constant_p(x))
++ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ /* FLS insn has exactly same semantics as the API */
+ return __builtin_arc_fls(x);
+ }
+--
+2.51.0
+
--- /dev/null
+From 9371ee6a79be9c41ad28a33275cf13c530cf009d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:31 +0300
+Subject: ARM: tegra: transformer-20: add missing magnetometer interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit cca41614d15ce2bbc2c661362d3eafe53c9990af ]
+
+Add missing interrupt to magnetometer node.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index a3757b7daeda4..408cec997adb3 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -502,6 +502,9 @@
+ compatible = "asahi-kasei,ak8974";
+ reg = <0xe>;
+
++ interrupt-parent = <&gpio>;
++ interrupts = <TEGRA_GPIO(N, 5) IRQ_TYPE_EDGE_RISING>;
++
+ avdd-supply = <&vdd_3v3_sys>;
+ dvdd-supply = <&vdd_1v8_sys>;
+
+--
+2.51.0
+
--- /dev/null
+From 876d5ec8dfe33857601db06f5db8e3c5f4225933 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:32 +0300
+Subject: ARM: tegra: transformer-20: fix audio-codec interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 3f973d78d176768fa7456def97f0b9824235024f ]
+
+Correct audio-codec interrupt should be PX3 while PX1 is used for external
+microphone detection.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index 408cec997adb3..071a31191ec27 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -518,7 +518,7 @@
+ reg = <0x1a>;
+
+ interrupt-parent = <&gpio>;
+- interrupts = <TEGRA_GPIO(X, 1) IRQ_TYPE_EDGE_BOTH>;
++ interrupts = <TEGRA_GPIO(X, 3) IRQ_TYPE_EDGE_BOTH>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+--
+2.51.0
+
--- /dev/null
+From f9ab3c4a98e81d9d69e0c3a378df5641ae8164a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:19 +0200
+Subject: arm64: zynqmp: Revert usb node drive strength and slew rate for
+ zcu106
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+
+[ Upstream commit 767ecf9da7b31e5c0c22c273001cb2784705fe8c ]
+
+On a few zcu106 boards USB devices (Dell MS116 USB Optical Mouse, Dell USB
+Entry Keyboard) are not enumerated on linux boot due to commit
+'b8745e7eb488 ("arm64: zynqmp: Fix usb node drive strength and slew
+rate")'.
+
+To fix it as a workaround revert to working version and then investigate
+at board level why drive strength from 12mA to 4mA and slew from fast to
+slow is not working.
+
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/85a70cb014ec1f07972fccb60b875596eeaa6b5c.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+index 50c384aa253e4..8c3f9735e563b 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+@@ -808,8 +808,8 @@
+ pins = "MIO54", "MIO56", "MIO57", "MIO58", "MIO59",
+ "MIO60", "MIO61", "MIO62", "MIO63";
+ bias-disable;
+- drive-strength = <4>;
+- slew-rate = <SLEW_RATE_SLOW>;
++ drive-strength = <12>;
++ slew-rate = <SLEW_RATE_FAST>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From a1ea974420e2643fe7668852cf5eb8b15c31ef84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 15:55:20 +0800
+Subject: blk-cgroup: fix possible deadlock while configuring policy
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 5d726c4dbeeddef612e6bed27edd29733f4d13af ]
+
+Following deadlock can be triggered easily by lockdep:
+
+WARNING: possible circular locking dependency detected
+6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted
+------------------------------------------------------
+check/1334 is trying to acquire lock:
+ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180
+
+but task is already holding lock:
+ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}:
+ blk_queue_enter+0x40b/0x470
+ blkg_conf_prep+0x7b/0x3c0
+ tg_set_limit+0x10a/0x3e0
+ cgroup_file_write+0xc6/0x420
+ kernfs_fop_write_iter+0x189/0x280
+ vfs_write+0x256/0x490
+ ksys_write+0x83/0x190
+ __x64_sys_write+0x21/0x30
+ x64_sys_call+0x4608/0x4630
+ do_syscall_64+0xdb/0x6b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+-> #1 (&q->rq_qos_mutex){+.+.}-{4:4}:
+ __mutex_lock+0xd8/0xf50
+ mutex_lock_nested+0x2b/0x40
+ wbt_init+0x17e/0x280
+ wbt_enable_default+0xe9/0x140
+ blk_register_queue+0x1da/0x2e0
+ __add_disk+0x38c/0x5d0
+ add_disk_fwnode+0x89/0x250
+ device_add_disk+0x18/0x30
+ virtblk_probe+0x13a3/0x1800
+ virtio_dev_probe+0x389/0x610
+ really_probe+0x136/0x620
+ __driver_probe_device+0xb3/0x230
+ driver_probe_device+0x2f/0xe0
+ __driver_attach+0x158/0x250
+ bus_for_each_dev+0xa9/0x130
+ driver_attach+0x26/0x40
+ bus_add_driver+0x178/0x3d0
+ driver_register+0x7d/0x1c0
+ __register_virtio_driver+0x2c/0x60
+ virtio_blk_init+0x6f/0xe0
+ do_one_initcall+0x94/0x540
+ kernel_init_freeable+0x56a/0x7b0
+ kernel_init+0x2b/0x270
+ ret_from_fork+0x268/0x4c0
+ ret_from_fork_asm+0x1a/0x30
+
+-> #0 (&q->sysfs_lock){+.+.}-{4:4}:
+ __lock_acquire+0x1835/0x2940
+ lock_acquire+0xf9/0x450
+ __mutex_lock+0xd8/0xf50
+ mutex_lock_nested+0x2b/0x40
+ blk_unregister_queue+0x53/0x180
+ __del_gendisk+0x226/0x690
+ del_gendisk+0xba/0x110
+ sd_remove+0x49/0xb0 [sd_mod]
+ device_remove+0x87/0xb0
+ device_release_driver_internal+0x11e/0x230
+ device_release_driver+0x1a/0x30
+ bus_remove_device+0x14d/0x220
+ device_del+0x1e1/0x5a0
+ __scsi_remove_device+0x1ff/0x2f0
+ scsi_remove_device+0x37/0x60
+ sdev_store_delete+0x77/0x100
+ dev_attr_store+0x1f/0x40
+ sysfs_kf_write+0x65/0x90
+ kernfs_fop_write_iter+0x189/0x280
+ vfs_write+0x256/0x490
+ ksys_write+0x83/0x190
+ __x64_sys_write+0x21/0x30
+ x64_sys_call+0x4608/0x4630
+ do_syscall_64+0xdb/0x6b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+other info that might help us debug this:
+
+Chain exists of:
+ &q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&q->q_usage_counter(queue)#3);
+ lock(&q->rq_qos_mutex);
+ lock(&q->q_usage_counter(queue)#3);
+ lock(&q->sysfs_lock);
+
+Root cause is that queue_usage_counter is grabbed with rq_qos_mutex
+held in blkg_conf_prep(), while queue should be freezed before
+rq_qos_mutex from other context.
+
+The blk_queue_enter() from blkg_conf_prep() is used to protect against
+policy deactivation, which is already protected with blkcg_mutex, hence
+convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile,
+consider that blkcg_mutex is held after queue is freezed from policy
+deactivation, also convert blkg_alloc() to use GFP_NOIO.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 64551b0aa51e6..75e9d5a9d707c 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -848,14 +848,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ disk = ctx->bdev->bd_disk;
+ q = disk->queue;
+
+- /*
+- * blkcg_deactivate_policy() requires queue to be frozen, we can grab
+- * q_usage_counter to prevent concurrent with blkcg_deactivate_policy().
+- */
+- ret = blk_queue_enter(q, 0);
+- if (ret)
+- goto fail;
+-
++ /* Prevent concurrent with blkcg_deactivate_policy() */
++ mutex_lock(&q->blkcg_mutex);
+ spin_lock_irq(&q->queue_lock);
+
+ if (!blkcg_policy_enabled(q, pol)) {
+@@ -885,16 +879,16 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ /* Drop locks to do new blkg allocation with GFP_KERNEL. */
+ spin_unlock_irq(&q->queue_lock);
+
+- new_blkg = blkg_alloc(pos, disk, GFP_KERNEL);
++ new_blkg = blkg_alloc(pos, disk, GFP_NOIO);
+ if (unlikely(!new_blkg)) {
+ ret = -ENOMEM;
+- goto fail_exit_queue;
++ goto fail_exit;
+ }
+
+ if (radix_tree_preload(GFP_KERNEL)) {
+ blkg_free(new_blkg);
+ ret = -ENOMEM;
+- goto fail_exit_queue;
++ goto fail_exit;
+ }
+
+ spin_lock_irq(&q->queue_lock);
+@@ -922,7 +916,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ goto success;
+ }
+ success:
+- blk_queue_exit(q);
++ mutex_unlock(&q->blkcg_mutex);
+ ctx->blkg = blkg;
+ return 0;
+
+@@ -930,9 +924,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ radix_tree_preload_end();
+ fail_unlock:
+ spin_unlock_irq(&q->queue_lock);
+-fail_exit_queue:
+- blk_queue_exit(q);
+-fail:
++fail_exit:
++ mutex_unlock(&q->blkcg_mutex);
+ /*
+ * If queue was bypassing, we should retry. Do so after a
+ * short msleep(). It isn't strictly necessary but queue
+--
+2.51.0
+
--- /dev/null
+From 69e7cc2912c620d6d3b14dcd434b5fb595f936eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:49 -0700
+Subject: bpf: Clear pfmemalloc flag when freeing all fragments
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
+
+It is possible for bpf_xdp_adjust_tail() to free all fragments. The
+kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not
+XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when
+building sk_buff from xdp_buff since all readers of xdp_buff->flags
+use the flag only when there are fragments. Clear the
+XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xdp.h | 5 +++++
+ net/core/filter.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/net/xdp.h b/include/net/xdp.h
+index b39ac83618a55..3d8989096b5d2 100644
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -113,6 +113,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp)
+ xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC;
+ }
+
++static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp)
++{
++ xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC;
++}
++
+ static __always_inline void
+ xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
+ {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index c2e888ea54abb..0564ee6ac8731 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4203,6 +4203,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)
+
+ if (unlikely(!sinfo->nr_frags)) {
+ xdp_buff_clear_frags_flag(xdp);
++ xdp_buff_clear_frag_pfmemalloc(xdp);
+ xdp->data_end -= offset;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From eb73e5ac70ed0a6714d2c817aec2dd2a99695d13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 03:26:17 +0000
+Subject: bpf: Do not limit bpf_cgroup_from_id to current's namespace
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit 2c895133950646f45e5cf3900b168c952c8dbee8 ]
+
+The bpf_cgroup_from_id kfunc relies on cgroup_get_from_id to obtain the
+cgroup corresponding to a given cgroup ID. This helper can be called in
+a lot of contexts where the current thread can be random. A recent
+example was its use in sched_ext's ops.tick(), to obtain the root cgroup
+pointer. Since the current task can be whatever random user space task
+preempted by the timer tick, this makes the behavior of the helper
+unreliable.
+
+Refactor out __cgroup_get_from_id as the non-namespace aware version of
+cgroup_get_from_id, and change bpf_cgroup_from_id to make use of it.
+
+There is no compatibility breakage here, since changing the namespace
+against which the lookup is being done to the root cgroup namespace only
+permits a wider set of lookups to succeed now. The cgroup IDs across
+namespaces are globally unique, and thus don't need to be retranslated.
+
+Reported-by: Dan Schatzberg <dschatzberg@meta.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20250915032618.1551762-2-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cgroup.h | 1 +
+ kernel/bpf/helpers.c | 2 +-
+ kernel/cgroup/cgroup.c | 24 ++++++++++++++++++++----
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index b307013b9c6c9..fa87b6a15082c 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -633,6 +633,7 @@ static inline void cgroup_kthread_ready(void)
+ }
+
+ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen);
++struct cgroup *__cgroup_get_from_id(u64 id);
+ struct cgroup *cgroup_get_from_id(u64 id);
+ #else /* !CONFIG_CGROUPS */
+
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index 90c281e1379ee..2cfbc48b82425 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -2276,7 +2276,7 @@ __bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid)
+ {
+ struct cgroup *cgrp;
+
+- cgrp = cgroup_get_from_id(cgid);
++ cgrp = __cgroup_get_from_id(cgid);
+ if (IS_ERR(cgrp))
+ return NULL;
+ return cgrp;
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 5135838b5899f..476be99dbcf1b 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -6220,15 +6220,15 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen)
+ }
+
+ /*
+- * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * __cgroup_get_from_id : get the cgroup associated with cgroup id
+ * @id: cgroup id
+ * On success return the cgrp or ERR_PTR on failure
+- * Only cgroups within current task's cgroup NS are valid.
++ * There are no cgroup NS restrictions.
+ */
+-struct cgroup *cgroup_get_from_id(u64 id)
++struct cgroup *__cgroup_get_from_id(u64 id)
+ {
+ struct kernfs_node *kn;
+- struct cgroup *cgrp, *root_cgrp;
++ struct cgroup *cgrp;
+
+ kn = kernfs_find_and_get_node_by_id(cgrp_dfl_root.kf_root, id);
+ if (!kn)
+@@ -6250,6 +6250,22 @@ struct cgroup *cgroup_get_from_id(u64 id)
+
+ if (!cgrp)
+ return ERR_PTR(-ENOENT);
++ return cgrp;
++}
++
++/*
++ * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * @id: cgroup id
++ * On success return the cgrp or ERR_PTR on failure
++ * Only cgroups within current task's cgroup NS are valid.
++ */
++struct cgroup *cgroup_get_from_id(u64 id)
++{
++ struct cgroup *cgrp, *root_cgrp;
++
++ cgrp = __cgroup_get_from_id(id);
++ if (IS_ERR(cgrp))
++ return cgrp;
+
+ root_cgrp = current_cgns_cgroup_dfl();
+ if (!cgroup_is_descendant(cgrp, root_cgrp)) {
+--
+2.51.0
+
--- /dev/null
+From 1f424d5766f987614994696a6e74d74071ffa672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index adf65eacade06..4ffea87e6fb64 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1065,7 +1065,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ u32 pass, void *image)
+ {
+- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ proglen, pass, image, current->comm, task_pid_nr(current));
+
+ if (image)
+--
+2.51.0
+
--- /dev/null
+From cf9e507dea74f334ecefe0ef7777d85273a2d007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:38:47 -0700
+Subject: bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
+
+From: Tom Stellard <tstellar@redhat.com>
+
+[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
+
+This fixes the build with -Werror -Wall.
+
+btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 71 | info.func_info = ptr_to_u64(&finfo);
+ | ^~~~~
+
+prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 2294 | info.func_info = ptr_to_u64(&func_info);
+ |
+
+v2:
+ - Initialize instead of using memset.
+
+Signed-off-by: Tom Stellard <tstellar@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 2 +-
+ tools/bpf/bpftool/prog.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 1b7f697146041..42c7b70f6996c 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,
+ __u32 info_len = sizeof(info);
+ const char *prog_name = NULL;
+ struct btf *prog_btf = NULL;
+- struct bpf_func_info finfo;
++ struct bpf_func_info finfo = {};
+ __u32 finfo_rec_size;
+ char prog_str[1024];
+ int err;
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 174e076e56af2..90fa7a8d0f4b3 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2203,7 +2203,7 @@ static void profile_print_readings(void)
+
+ static char *profile_target_name(int tgt_fd)
+ {
+- struct bpf_func_info func_info;
++ struct bpf_func_info func_info = {};
+ struct bpf_prog_info info = {};
+ __u32 info_len = sizeof(info);
+ const struct btf_type *t;
+--
+2.51.0
+
--- /dev/null
+From 462556d6e1140e03119476e982dab0a9b71589da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+
+ static inline void pit_timer_enable(void)
+ {
+- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_timer_disable(void)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
++ writel(0, clkevt_base + PITTCTRL);
+ }
+
+ static inline void pit_irq_acknowledge(void)
+ {
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+
+ static u64 notrace pit_read_sched_clock(void)
+ {
+- return ~__raw_readl(clksrc_base + PITCVAL);
++ return ~readl(clksrc_base + PITCVAL);
+ }
+
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ /* set the max load value and start the clock source counter */
+- __raw_writel(0, clksrc_base + PITTCTRL);
+- __raw_writel(~0UL, clksrc_base + PITLDVAL);
+- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++ writel(0, clksrc_base + PITTCTRL);
++ writel(~0UL, clksrc_base + PITLDVAL);
++ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+
+ sched_clock_register(pit_read_sched_clock, 32, rate);
+ return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ * hardware requirement.
+ */
+ pit_timer_disable();
+- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
++ writel(delta - 1, clkevt_base + PITLDVAL);
+ pit_timer_enable();
+
+ return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+- __raw_writel(0, clkevt_base + PITTCTRL);
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++ writel(0, clkevt_base + PITTCTRL);
++ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+
+ BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ cycle_per_jiffy = clk_rate / (HZ);
+
+ /* enable the pit module */
+- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++ writel(~PITMCR_MDIS, timer_base + PITMCR);
+
+ ret = pit_clocksource_init(clk_rate);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From a5f11ac9afe4e43241b75e0a7c33ab99da238b20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index 4c57c6725c134..1412d4617a04a 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)
+ struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ int i;
+
++ if (unlikely(!policy))
++ return;
++
+ for (i = 0; i < numscales; i++) {
+ if (mults[i] == maxmult) {
+ struct cpufreq_freqs freqs;
+--
+2.51.0
+
--- /dev/null
+From 9077aeec8700e49db42840cc3755c6d0527540e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 737a026ef58a3..6704d610573ad 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -634,8 +634,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++ unsigned int cpu = dev->cpu;
+ int i, ret;
+
++ if (per_cpu(cpuidle_devices, cpu)) {
++ pr_info("CPU%d: cpuidle device already registered\n", cpu);
++ return -EEXIST;
++ }
++
+ if (!try_module_get(drv->owner))
+ return -EINVAL;
+
+@@ -647,7 +653,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ }
+
+- per_cpu(cpuidle_devices, dev->cpu) = dev;
++ per_cpu(cpuidle_devices, cpu) = dev;
+ list_add(&dev->device_list, &cpuidle_detected_devices);
+
+ ret = cpuidle_coupled_register_device(dev);
+--
+2.51.0
+
--- /dev/null
+From 47402c2ce6f6188fa4d4d09e142d21907d12c9c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:51:54 +0530
+Subject: futex: Don't leak robust_list pointer on exec race
+
+From: Pranav Tyagi <pranav.tyagi03@gmail.com>
+
+[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
+
+sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
+to check if the calling task is allowed to access another task's
+robust_list pointer. This check is racy against a concurrent exec() in the
+target process.
+
+During exec(), a task may transition from a non-privileged binary to a
+privileged one (e.g., setuid binary) and its credentials/memory mappings
+may change. If get_robust_list() performs ptrace_may_access() before
+this transition, it may erroneously allow access to sensitive information
+after the target becomes privileged.
+
+A racy access allows an attacker to exploit a window during which
+ptrace_may_access() passes before a target process transitions to a
+privileged state via exec().
+
+For example, consider a non-privileged task T that is about to execute a
+setuid-root binary. An attacker task A calls get_robust_list(T) while T
+is still unprivileged. Since ptrace_may_access() checks permissions
+based on current credentials, it succeeds. However, if T begins exec
+immediately afterwards, it becomes privileged and may change its memory
+mappings. Because get_robust_list() proceeds to access T->robust_list
+without synchronizing with exec() it may read user-space pointers from a
+now-privileged process.
+
+This violates the intended post-exec access restrictions and could
+expose sensitive memory addresses or be used as a primitive in a larger
+exploit chain. Consequently, the race can lead to unauthorized
+disclosure of information across privilege boundaries and poses a
+potential security risk.
+
+Take a read lock on signal->exec_update_lock prior to invoking
+ptrace_may_access() and accessing the robust_list/compat_robust_list.
+This ensures that the target task's exec state remains stable during the
+check, allowing for consistent and synchronized validation of
+credentials.
+
+Suggested-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/
+Link: https://github.com/KSPP/linux/issues/119
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/syscalls.c | 106 +++++++++++++++++++++-------------------
+ 1 file changed, 56 insertions(+), 50 deletions(-)
+
+diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
+index a8074079b09e8..48feaa545b3c7 100644
+--- a/kernel/futex/syscalls.c
++++ b/kernel/futex/syscalls.c
+@@ -40,6 +40,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ return 0;
+ }
+
++static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat)
++{
++#ifdef CONFIG_COMPAT
++ if (compat)
++ return p->compat_robust_list;
++#endif
++ return p->robust_list;
++}
++
++static void __user *futex_get_robust_list_common(int pid, bool compat)
++{
++ struct task_struct *p = current;
++ void __user *head;
++ int ret;
++
++ scoped_guard(rcu) {
++ if (pid) {
++ p = find_task_by_vpid(pid);
++ if (!p)
++ return (void __user *)ERR_PTR(-ESRCH);
++ }
++ get_task_struct(p);
++ }
++
++ /*
++ * Hold exec_update_lock to serialize with concurrent exec()
++ * so ptrace_may_access() is checked against stable credentials
++ */
++ ret = down_read_killable(&p->signal->exec_update_lock);
++ if (ret)
++ goto err_put;
++
++ ret = -EPERM;
++ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
++ goto err_unlock;
++
++ head = futex_task_robust_list(p, compat);
++
++ up_read(&p->signal->exec_update_lock);
++ put_task_struct(p);
++
++ return head;
++
++err_unlock:
++ up_read(&p->signal->exec_update_lock);
++err_put:
++ put_task_struct(p);
++ return (void __user *)ERR_PTR(ret);
++}
++
+ /**
+ * sys_get_robust_list() - Get the robust-futex list head of a task
+ * @pid: pid of the process [zero for current task]
+@@ -50,36 +100,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ struct robust_list_head __user * __user *, head_ptr,
+ size_t __user *, len_ptr)
+ {
+- struct robust_list_head __user *head;
+- unsigned long ret;
+- struct task_struct *p;
+-
+- rcu_read_lock();
+-
+- ret = -ESRCH;
+- if (!pid)
+- p = current;
+- else {
+- p = find_task_by_vpid(pid);
+- if (!p)
+- goto err_unlock;
+- }
+-
+- ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+- goto err_unlock;
++ struct robust_list_head __user *head = futex_get_robust_list_common(pid, false);
+
+- head = p->robust_list;
+- rcu_read_unlock();
++ if (IS_ERR(head))
++ return PTR_ERR(head);
+
+ if (put_user(sizeof(*head), len_ptr))
+ return -EFAULT;
+ return put_user(head, head_ptr);
+-
+-err_unlock:
+- rcu_read_unlock();
+-
+- return ret;
+ }
+
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+@@ -322,36 +350,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+ compat_uptr_t __user *, head_ptr,
+ compat_size_t __user *, len_ptr)
+ {
+- struct compat_robust_list_head __user *head;
+- unsigned long ret;
+- struct task_struct *p;
+-
+- rcu_read_lock();
+-
+- ret = -ESRCH;
+- if (!pid)
+- p = current;
+- else {
+- p = find_task_by_vpid(pid);
+- if (!p)
+- goto err_unlock;
+- }
+-
+- ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+- goto err_unlock;
++ struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true);
+
+- head = p->compat_robust_list;
+- rcu_read_unlock();
++ if (IS_ERR(head))
++ return PTR_ERR(head);
+
+ if (put_user(sizeof(*head), len_ptr))
+ return -EFAULT;
+ return put_user(ptr_to_compat(head), head_ptr);
+-
+-err_unlock:
+- rcu_read_unlock();
+-
+- return ret;
+ }
+ #endif /* CONFIG_COMPAT */
+
+--
+2.51.0
+
--- /dev/null
+From a7e8aa2606b51670a7910d4d35702b4b2a5d2d2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 21:26:56 +0200
+Subject: hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
+
+From: Ben Copeland <ben.copeland@linaro.org>
+
+[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
+
+Some motherboards require more time to acquire the ACPI mutex,
+causing "Failed to acquire mutex" messages to appear in the kernel log.
+Increase the timeout from 500ms to 800ms to accommodate these cases.
+
+Signed-off-by: Ben Copeland <ben.copeland@linaro.org>
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index ce2f14a62754e..bc2197f1dfb7f 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -49,7 +49,7 @@ static char *mutex_path_override;
+ */
+ #define ASUS_EC_MAX_BANK 3
+
+-#define ACPI_LOCK_DELAY_MS 500
++#define ACPI_LOCK_DELAY_MS 800
+
+ /* ACPI mutex for locking access to the EC for the firmware */
+ #define ASUS_HW_ACCESS_MUTEX_ASMX "\\AMW0.ASMX"
+--
+2.51.0
+
--- /dev/null
+From a6599b26c200e2a036c4d21c351f63f12b313e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 8d94ecc3cc468..9844843bdfadc 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1158,6 +1158,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ },
+ .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ },
++ {
++ .ident = "Dell OptiPlex 7040",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++ },
++ },
+ {
+ .ident = "Dell Precision",
+ .matches = {
+--
+2.51.0
+
--- /dev/null
+From bc57df92fb55f1a88ac3ceb2210fff249f25eca0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 02:04:41 +0800
+Subject: hwmon: (k10temp) Add device ID for Strix Halo
+
+From: Rong Zhang <i@rong.moe>
+
+[ Upstream commit e5d1e313d7b6272d6dfda983906d99f97ad9062b ]
+
+The device ID of Strix Halo Data Fabric Function 3 has been in the tree
+since commit 0e640f0a47d8 ("x86/amd_nb: Add new PCI IDs for AMD family
+0x1a"), but is somehow missing from k10temp_id_table.
+
+Add it so that it works out of the box.
+
+Tested on Beelink GTR9 Pro Mini PC.
+
+Signed-off-by: Rong Zhang <i@rong.moe>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250823180443.85512-1-i@rong.moe
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 759855412e50d..dc82e33d59c5f 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -554,6 +554,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ {}
+--
+2.51.0
+
--- /dev/null
+From fb852a2e8f19401b40cf3bf1e746ccd154c080b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 00:15:43 +0000
+Subject: hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
+
+From: Avadhut Naik <avadhut.naik@amd.com>
+
+[ Upstream commit f116af2eb51ed9df24911537fda32a033f1c58da ]
+
+Add thermal info support for newer AMD Family 1Ah-based models.
+
+Signed-off-by: Avadhut Naik <avadhut.naik@amd.com>
+Link: https://lore.kernel.org/r/20250729001644.257645-1-avadhut.naik@amd.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index c906731c6c2d3..759855412e50d 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -84,6 +84,13 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+ */
+ #define AMD_I3255_STR "3255"
+
++/*
++ * PCI Device IDs for AMD's Family 1Ah-based SOCs.
++ * Defining locally as IDs are not shared.
++ */
++#define PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3 0x12cb
++#define PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3 0x127b
++
+ struct k10temp_data {
+ struct pci_dev *pdev;
+ void (*read_htcreg)(struct pci_dev *pdev, u32 *regval);
+@@ -545,7 +552,9 @@ static const struct pci_device_id k10temp_id_table[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ {}
+ };
+--
+2.51.0
+
--- /dev/null
+From 6723a7ba95cbab785d3fd14b8b9e3d5f166b08f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index dd85cf89f008a..7c49fcf864143 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+
+ /*
+ * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -29,8 +30,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC 0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC 0x14 /* RW */
+
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT 2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT 5
+
++#define SBTSI_TEMP_EXT_RANGE_ADJ 49000
++
+ #define SBTSI_TEMP_MIN 0
+ #define SBTSI_TEMP_MAX 255875
+
+@@ -38,6 +53,8 @@
+ struct sbtsi_data {
+ struct i2c_client *client;
+ struct mutex lock;
++ bool ext_range_mode;
++ bool read_order;
+ };
+
+ /*
+@@ -74,23 +91,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ struct sbtsi_data *data = dev_get_drvdata(dev);
+ s32 temp_int, temp_dec;
+- int err;
+
+ switch (attr) {
+ case hwmon_temp_input:
+- /*
+- * ReadOrder bit specifies the reading order of integer and
+- * decimal part of CPU temp for atomic reads. If bit == 0,
+- * reading integer part triggers latching of the decimal part,
+- * so integer part should be read first. If bit == 1, read
+- * order should be reversed.
+- */
+- err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+- if (err < 0)
+- return err;
+-
+ mutex_lock(&data->lock);
+- if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++ if (data->read_order) {
+ temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ } else {
+@@ -122,6 +127,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ return temp_dec;
+
+ *val = sbtsi_reg_to_mc(temp_int, temp_dec);
++ if (data->ext_range_mode)
++ *val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+
+ return 0;
+ }
+@@ -146,6 +153,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ return -EINVAL;
+ }
+
++ if (data->ext_range_mode)
++ val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+
+@@ -203,6 +212,7 @@ static int sbtsi_probe(struct i2c_client *client)
+ struct device *dev = &client->dev;
+ struct device *hwmon_dev;
+ struct sbtsi_data *data;
++ int err;
+
+ data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ if (!data)
+@@ -211,8 +221,14 @@ static int sbtsi_probe(struct i2c_client *client)
+ data->client = client;
+ mutex_init(&data->lock);
+
+- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+- NULL);
++ err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++ if (err < 0)
++ return err;
++ data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++ data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++ hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++ &sbtsi_chip_info, NULL);
+
+ return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From a530cfa43309a152147c4f9bda51ad48fd053d99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:02:49 +0200
+Subject: hwmon: sy7636a: add alias
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
+
+Add module alias to have it autoloaded.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sy7636a-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
+index ed110884786b4..a12fc0ce70e76 100644
+--- a/drivers/hwmon/sy7636a-hwmon.c
++++ b/drivers/hwmon/sy7636a-hwmon.c
+@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);
+
+ MODULE_DESCRIPTION("SY7636A sensor driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:sy7636a-temperature");
+--
+2.51.0
+
--- /dev/null
+From a67950932fe731a7947a051e148885e86085809f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index 683e8721e3b49..4bce475824171 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ msi_alloc_info_t *info = args;
+ struct v2m_data *v2m = NULL, *tmp;
+- int hwirq, offset, i, err = 0;
++ int hwirq, i, err = 0;
++ unsigned long offset;
++ unsigned long align_mask = nr_irqs - 1;
+
+ spin_lock(&v2m_lock);
+ list_for_each_entry(tmp, &v2m_nodes, entry) {
+- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+- get_count_order(nr_irqs));
+- if (offset >= 0) {
++ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++ nr_irqs, align_mask, align_off);
++ if (offset < tmp->nr_spis) {
+ v2m = tmp;
++ bitmap_set(v2m->bm, offset, nr_irqs);
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 9f873f6d7fcb66cde0e02d7c3dc6ee07a58f2202 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:40 +0800
+Subject: irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ
+ controller
+
+From: Ming Wang <wangming01@loongson.cn>
+
+[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
+
+On certain Loongson platforms, drivers attempting to request a legacy
+ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The
+virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
+
+This issue does not affect ACPI-enumerated devices described in DSDT,
+as their interrupts are properly mapped via the GSI translation path.
+This indicates the LPC irqdomain itself is functional but is not correctly
+handling direct VIRQ-to-HWIRQ mappings.
+
+The root cause is the use of irq_domain_create_linear(). This API sets
+up a domain for dynamic, on-demand mapping, typically triggered by a GSI
+request. It does not pre-populate the mappings for the legacy VIRQ range
+(0-15). Consequently, if no ACPI device claims a specific GSI
+(e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to
+the LPC domain. A direct call to request_irq(4, ...) then fails because
+the kernel cannot resolve this VIRQ to a hardware interrupt managed by
+the LPC controller.
+
+The PCH-LPC interrupt controller is an i8259-compatible legacy device
+that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to
+support legacy drivers.
+
+Fix this by replacing irq_domain_create_linear() with
+irq_domain_create_legacy(). This API is specifically designed for such
+controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ
+mapping for the entire legacy range (0-15) immediately upon domain
+creation. This ensures that any VIRQ in this range is always resolvable,
+making direct calls to request_irq() for legacy IRQs function correctly.
+
+Signed-off-by: Ming Wang <wangming01@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c
+index 9b35492fb6be9..1e9fcea1826f8 100644
+--- a/drivers/irqchip/irq-loongson-pch-lpc.c
++++ b/drivers/irqchip/irq-loongson-pch-lpc.c
+@@ -198,8 +198,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent,
+ goto iounmap_base;
+ }
+
+- priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT,
+- &pch_lpc_domain_ops, priv);
++ /*
++ * The LPC interrupt controller is a legacy i8259-compatible device,
++ * which requires a static 1:1 mapping for IRQs 0-15.
++ * Use irq_domain_create_legacy to establish this static mapping early.
++ */
++ priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0,
++ &pch_lpc_domain_ops, priv);
+ if (!priv->lpc_domain) {
+ pr_err("Failed to create IRQ domain\n");
+ goto free_irq_handle;
+--
+2.51.0
+
--- /dev/null
+From 4a56ba564bdeaa0d1a53669cec7304f9448f167f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:26:32 +0800
+Subject: irqchip/sifive-plic: Respect mask state when setting affinity
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
+
+plic_set_affinity() always calls plic_irq_enable(), which clears up the
+priority setting even the interrupt is only masked. This unmasks the
+interrupt unexpectly.
+
+Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid
+changing the priority setting.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Nam Cao <namcao@linutronix.de> # VisionFive 2
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com
+Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 2d20cf9d84cea..a8f5cfad16f7d 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -176,12 +176,14 @@ static int plic_set_affinity(struct irq_data *d,
+ if (cpu >= nr_cpu_ids)
+ return -EINVAL;
+
+- plic_irq_disable(d);
++ /* Invalidate the original routing entry */
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+
++ /* Setting the new routing entry if irq is enabled */
+ if (!irqd_irq_disabled(d))
+- plic_irq_enable(d);
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+
+ return IRQ_SET_MASK_OK_DONE;
+ }
+--
+2.51.0
+
--- /dev/null
+From 73d5301dcc7559a38db80b949120bfade2cb7dcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index e0895e979e35b..65af43201b693 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ card->next_request = h_memstick_set_rw_addr;
+ memstick_new_req(card->host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ return card->current_mrq.error;
+ }
+@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+
+ card->next_request = h_memstick_read_dev_id;
+ memstick_new_req(host);
+- wait_for_completion(&card->mrq_complete);
++ if (!wait_for_completion_timeout(&card->mrq_complete,
++ msecs_to_jiffies(500)))
++ card->current_mrq.error = -ETIMEDOUT;
+
+ if (card->current_mrq.error)
+ goto err_out;
+--
+2.51.0
+
--- /dev/null
+From 69c81f3676cfc2d7bcd4c92b3f3f73beee65713c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index d715cf9a9e688..7b829bfe04bc7 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ DA9063_PAGE_SEL_BUF_SIZE,
+ };
+
++enum da9063_page_sel_msgs {
++ DA9063_PAGE_SEL_MSG = 0,
++ DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+- DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+- DA9063_PAGED_READ_MSG_REG_SEL,
++ DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ DA9063_PAGED_READ_MSG_DATA,
+ DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ (page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+
+ /* Write reg address, page selection */
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++ xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++ xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++ xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++ xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++ ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++ if (ret < 0) {
++ dev_err(&client->dev, "Page switch failed: %d\n", ret);
++ return ret;
++ }
++
++ if (ret != DA9063_PAGE_SEL_CNT) {
++ dev_err(&client->dev, "Page switch failed to complete\n");
++ return -EIO;
++ }
+
+ /* Select register address */
+ xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+--
+2.51.0
+
--- /dev/null
+From f44454e0822969688f93a2b7e07bab686fe036a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+ 739 | mfd_devs, n_devs,
+ | ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+ 459 | const struct mfd_cell *mfd_devs;
+ | ^
+ | = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index bdbd5bfc97145..2f74a8c644a32 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -456,7 +456,7 @@ int madera_dev_init(struct madera *madera)
+ struct device *dev = madera->dev;
+ unsigned int hwid;
+ int (*patch_fn)(struct madera *) = NULL;
+- const struct mfd_cell *mfd_devs;
++ const struct mfd_cell *mfd_devs = NULL;
+ int n_devs = 0;
+ int i, ret;
+
+@@ -670,7 +670,7 @@ int madera_dev_init(struct madera *madera)
+ goto err_reset;
+ }
+
+- if (!n_devs) {
++ if (!n_devs || !mfd_devs) {
+ dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ madera->type_name);
+ ret = -ENODEV;
+--
+2.51.0
+
--- /dev/null
+From e105a5c606ec0e597c6eb82fd335a882ef53d7fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index fe018bedab983..7e2ca39758825 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -137,3 +137,4 @@ module_exit(stmpe_exit);
+
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+--
+2.51.0
+
--- /dev/null
+From a85b51cc3b73d0fcd9d18b4045ed22eaae33851d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 9c3cf58457a7d..be6a84a3062cc 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ void stmpe_remove(struct stmpe *stmpe)
+ {
++ if (stmpe->domain)
++ irq_domain_remove(stmpe->domain);
++
+ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+--
+2.51.0
+
--- /dev/null
+From 9b7024ee1315a4389a311584fa368a332ba7dbd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock: 50000000 Hz
+actual clock: 200000000 Hz
+
+After the fix:
+clock: 50000000 Hz
+actual clock: 50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 597b00e8c9539..cffacf4434b55 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ clk &= ~0xff;
+ }
+
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++ clock = clk & CLK_CTL_DIV_MASK;
++ if (clock != 0xff)
++ host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ usleep_range(10000, 11000);
+
+--
+2.51.0
+
--- /dev/null
+From 91b04308d60d3a6c0aaf36f828ef3cb24499eccc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index c2144a3efb308..74234ee5f6089 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -81,6 +81,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH BIT(16)
+ #define CORE_HC_SELECT_IN_EN BIT(18)
++#define CORE_HC_SELECT_IN_SDR50 (4 << 19)
+ #define CORE_HC_SELECT_IN_HS400 (6 << 19)
+ #define CORE_HC_SELECT_IN_MASK (7 << 19)
+
+@@ -1133,6 +1134,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ struct mmc_ios *ios = &host->mmc->ios;
+
++ if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING)
++ return true;
++
+ /*
+ * Tuning is required for SDR104, HS200 and HS400 cards and
+ * if clock frequency is greater than 100MHz in these modes.
+@@ -1201,6 +1206,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ struct mmc_ios ios = host->mmc->ios;
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++ const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++ u32 config;
+
+ if (!sdhci_msm_is_tuning_needed(host)) {
+ msm_host->use_cdr = false;
+@@ -1217,6 +1224,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ */
+ msm_host->tuning_done = 0;
+
++ if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++ host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++ config &= ~CORE_HC_SELECT_IN_MASK;
++ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++ }
++
+ /*
+ * For HS400 tuning in HS200 timing requires:
+ * - select MCLK/2 in VENDOR_SPEC
+--
+2.51.0
+
--- /dev/null
+From 2c7e83cba3d84549dda3a27a433b073e77898301 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 3e0da2422b334..bf9ab07257642 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3024,11 +3024,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+
+ ++ctrl->ctrl.nr_reconnects;
+
+- if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++ spin_lock_irqsave(&ctrl->rport->lock, flags);
++ if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENODEV;
++ }
+
+- if (nvme_fc_ctlr_active_on_rport(ctrl))
++ if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ return -ENOTUNIQ;
++ }
++ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+
+ dev_info(ctrl->ctrl.device,
+ "NVME-FC{%d}: create association : host wwpn 0x%016llx "
+--
+2.51.0
+
--- /dev/null
+From 0e5d8ac9a2717dd7d657d9c536dbfa5295b8a481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:52:11 +1000
+Subject: nvme: Use non zero KATO for persistent discovery connections
+
+From: Alistair Francis <alistair.francis@wdc.com>
+
+[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
+
+The NVMe Base Specification 2.1 states that:
+
+"""
+A host requests an explicit persistent connection ... by specifying a
+non-zero Keep Alive Timer value in the Connect command.
+"""
+
+As such if we are starting a persistent connection to a discovery
+controller and the KATO is currently 0 we need to update KATO to a non
+zero value to avoid continuous timeouts on the target.
+
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 13221cc0d17d4..78d00e25a1790 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4414,8 +4414,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
+ * checking that they started once before, hence are reconnecting back.
+ */
+ if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+- nvme_discovery_ctrl(ctrl))
++ nvme_discovery_ctrl(ctrl)) {
++ if (!ctrl->kato) {
++ nvme_stop_keep_alive(ctrl);
++ ctrl->kato = NVME_DEFAULT_KATO;
++ nvme_start_keep_alive(ctrl);
++ }
+ nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
++ }
+
+ if (ctrl->queue_count > 1) {
+ nvme_queue_scan(ctrl);
+--
+2.51.0
+
--- /dev/null
+From 9b04736a59dc4ea221d9108d592ff40172d8c7a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index a15e764bae35b..188b9f1bdaca1 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++ int terminating;
++
++ terminating = atomic_xchg(&assoc->terminating, 1);
++
++ /* if already terminating, do nothing */
++ if (terminating)
++ return;
++
+ nvmet_fc_tgtport_get(assoc->tgtport);
+ if (!queue_work(nvmet_wq, &assoc->del_work))
+ nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ unsigned long flags;
+- int i, terminating;
+-
+- terminating = atomic_xchg(&assoc->terminating, 1);
+-
+- /* if already terminating, do nothing */
+- if (terminating)
+- return;
++ int i;
+
+ spin_lock_irqsave(&tgtport->lock, flags);
+ list_del_rcu(&assoc->a_list);
+--
+2.51.0
+
--- /dev/null
+From 884e6c08990c6be74c51d614c9cc4a4f516987cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:59:17 +0200
+Subject: pinctrl: keembay: release allocated memory in detach path
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit aae7a2876c3b39d07aa7655ea082af8e7862f3a5 ]
+
+Unlike all the other allocations in this driver, the memory for storing
+the pin function descriptions allocated with kcalloc() and later resized
+with krealloc() is never freed. Use devres like elsewhere to handle
+that. While at it - replace krealloc() with more suitable
+devm_krealloc_array().
+
+Note: the logic in this module is pretty convoluted and could probably
+use some revisiting, we should probably be able to calculate the exact
+amount of memory needed in advance or even skip the allocation
+altogether and just add each function to the radix tree separately.
+
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-keembay.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-keembay.c b/drivers/pinctrl/pinctrl-keembay.c
+index 152c35bce8ecc..94b11a23829f6 100644
+--- a/drivers/pinctrl/pinctrl-keembay.c
++++ b/drivers/pinctrl/pinctrl-keembay.c
+@@ -1606,7 +1606,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ * being part of 8 (hw maximum) globally unique muxes.
+ */
+ kpc->nfuncs = 0;
+- keembay_funcs = kcalloc(kpc->npins * 8, sizeof(*keembay_funcs), GFP_KERNEL);
++ keembay_funcs = devm_kcalloc(kpc->dev, kpc->npins * 8,
++ sizeof(*keembay_funcs), GFP_KERNEL);
+ if (!keembay_funcs)
+ return -ENOMEM;
+
+@@ -1637,7 +1638,9 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ }
+
+ /* Reallocate memory based on actual number of functions */
+- new_funcs = krealloc(keembay_funcs, kpc->nfuncs * sizeof(*new_funcs), GFP_KERNEL);
++ new_funcs = devm_krealloc_array(kpc->dev, keembay_funcs,
++ kpc->nfuncs, sizeof(*new_funcs),
++ GFP_KERNEL);
+ if (!new_funcs) {
+ kfree(keembay_funcs);
+ return -ENOMEM;
+--
+2.51.0
+
--- /dev/null
+From b4e239c5293f864a09c62b9691cf90495e01c748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 6c670203b3ac2..7684039be10cb 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -587,8 +587,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+ case PIN_CONFIG_BIAS_PULL_UP:
+- if (arg)
++ if (arg) {
+ pcs_pinconf_clear_bias(pctldev, pin);
++ data = pcs->read(pcs->base + offset);
++ }
+ fallthrough;
+ case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ data &= ~func->conf[i].mask;
+--
+2.51.0
+
--- /dev/null
+From b1e0b08e4a9821bb380cbfcaee67aafd3ab7a0f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:01:22 +0200
+Subject: pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 442816f97a4f84cb321d3359177a3b9b0ce48a60 ]
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,pmgr-pwrstate" anymore [1]. Use
+"apple,t8103-pmgr-pwrstate" as base compatible as it is the SoC the
+driver and bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Signed-off-by: Janne Grunau <j@jannau.net>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/apple/pmgr-pwrstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pmdomain/apple/pmgr-pwrstate.c b/drivers/pmdomain/apple/pmgr-pwrstate.c
+index d62a776c89a12..e592f819c8fa0 100644
+--- a/drivers/pmdomain/apple/pmgr-pwrstate.c
++++ b/drivers/pmdomain/apple/pmgr-pwrstate.c
+@@ -306,6 +306,7 @@ static int apple_pmgr_ps_probe(struct platform_device *pdev)
+ }
+
+ static const struct of_device_id apple_pmgr_ps_of_match[] = {
++ { .compatible = "apple,t8103-pmgr-pwrstate" },
+ { .compatible = "apple,pmgr-pwrstate" },
+ {}
+ };
+--
+2.51.0
+
--- /dev/null
+From 347c5eb58602e60b42d63f5652ead0c5ca39b179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:22:09 +0200
+Subject: power: supply: qcom_battmgr: add OOI chemistry
+
+From: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+
+[ Upstream commit fee0904441325d83e7578ca457ec65a9d3f21264 ]
+
+The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this
+update the detection and return the appropriate type.
+
+Signed-off-by: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index 190e8a4cfa97f..c1cb338e54bbc 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -975,7 +975,8 @@ static void qcom_battmgr_sc8280xp_strcpy(char *dest, const char *src)
+
+ static unsigned int qcom_battmgr_sc8280xp_parse_technology(const char *chemistry)
+ {
+- if (!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN))
++ if ((!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN)) ||
++ (!strncmp(chemistry, "OOI", BATTMGR_CHEMISTRY_LEN)))
+ return POWER_SUPPLY_TECHNOLOGY_LION;
+ if (!strncmp(chemistry, "LIP", BATTMGR_CHEMISTRY_LEN))
+ return POWER_SUPPLY_TECHNOLOGY_LIPO;
+--
+2.51.0
+
--- /dev/null
+From 73eb60e0224f928e02c76c9d31cc82ecd6f15b40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 11:18:51 +0800
+Subject: power: supply: qcom_battmgr: handle charging state change
+ notifications
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 41307ec7df057239aae3d0f089cc35a0d735cdf8 ]
+
+The X1E80100 battery management firmware sends a notification with
+code 0x83 when the battery charging state changes, such as switching
+between fast charge, taper charge, end of charge, or any other error
+charging states.
+
+The same notification code is used with bit[8] set when charging stops
+because the charge control end threshold is reached. Additionally,
+a 2-bit value is included in bit[10:9] with the same code to indicate
+the charging source capability, which is determined by the calculated
+power from voltage and current readings from PDOs: 2 means a strong
+charger over 60W, 1 indicates a weak charger, and 0 means there is no
+charging source.
+
+These 3-MSB [10:8] in the notification code is not much useful for now,
+hence just ignore them and trigger a power supply change event whenever
+0x83 notification code is received. This helps to eliminate the unknown
+notification error messages.
+
+Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Closes: https://lore.kernel.org/all/r65idyc4of5obo6untebw4iqfj2zteiggnnzabrqtlcinvtddx@xc4aig5abesu/
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index c1cb338e54bbc..0c993780d3ef2 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -29,8 +29,9 @@ enum qcom_battmgr_variant {
+ #define NOTIF_BAT_PROPERTY 0x30
+ #define NOTIF_USB_PROPERTY 0x32
+ #define NOTIF_WLS_PROPERTY 0x34
+-#define NOTIF_BAT_INFO 0x81
+ #define NOTIF_BAT_STATUS 0x80
++#define NOTIF_BAT_INFO 0x81
++#define NOTIF_BAT_CHARGING_STATE 0x83
+
+ #define BATTMGR_BAT_INFO 0x9
+
+@@ -940,12 +941,14 @@ static void qcom_battmgr_notification(struct qcom_battmgr *battmgr,
+ }
+
+ notification = le32_to_cpu(msg->notification);
++ notification &= 0xff;
+ switch (notification) {
+ case NOTIF_BAT_INFO:
+ battmgr->info.valid = false;
+ fallthrough;
+ case NOTIF_BAT_STATUS:
+ case NOTIF_BAT_PROPERTY:
++ case NOTIF_BAT_CHARGING_STATE:
+ power_supply_changed(battmgr->bat_psy);
+ break;
+ case NOTIF_USB_PROPERTY:
+--
+2.51.0
+
--- /dev/null
+From 6b58ddd3500a020cee6f7c1e9f21cb784cef209a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[ 8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[ 8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G O 5.10.147 #22
+[ 8.151974] Hardware name: ALE AMB (DT)
+[ 8.155828] Call trace:
+[ 8.158292] dump_backtrace+0x0/0x1d4
+[ 8.161960] show_stack+0x18/0x6c
+[ 8.165280] dump_stack+0xcc/0x128
+[ 8.168687] sysfs_warn_dup+0x60/0x7c
+[ 8.172353] sysfs_do_create_link_sd+0xf0/0x100
+[ 8.176886] sysfs_create_link+0x20/0x40
+[ 8.180816] device_add+0x270/0x7a4
+[ 8.184311] __power_supply_register+0x304/0x560
+[ 8.188930] devm_power_supply_register+0x54/0xa0
+[ 8.193644] sbs_probe+0xc0/0x214 [sbs_charger]
+[ 8.198183] i2c_device_probe+0x2dc/0x2f4
+[ 8.202196] really_probe+0xf0/0x510
+[ 8.205774] driver_probe_device+0xfc/0x160
+[ 8.209960] device_driver_attach+0xc0/0xcc
+[ 8.214146] __driver_attach+0xc0/0x170
+[ 8.218002] bus_for_each_dev+0x74/0xd4
+[ 8.221862] driver_attach+0x24/0x30
+[ 8.225444] bus_add_driver+0x148/0x250
+[ 8.229283] driver_register+0x78/0x130
+[ 8.233140] i2c_register_driver+0x4c/0xe0
+[ 8.237250] sbs_driver_init+0x20/0x1000 [sbs_charger]
+[ 8.242424] do_one_initcall+0x50/0x1b0
+[ 8.242434] do_init_module+0x44/0x230
+[ 8.242438] load_module+0x2200/0x27c0
+[ 8.242442] __do_sys_finit_module+0xa8/0x11c
+[ 8.242447] __arm64_sys_finit_module+0x20/0x30
+[ 8.242457] el0_svc_common.constprop.0+0x64/0x154
+[ 8.242464] do_el0_svc+0x24/0x8c
+[ 8.242474] el0_svc+0x10/0x20
+[ 8.242481] el0_sync_handler+0x108/0x114
+[ 8.242485] el0_sync+0x180/0x1c0
+[ 8.243847] sbs-charger 20-0009: Failed to register power supply
+[ 8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[ 7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[ 7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[ 7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[ 7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index f4adde4492707..d405c3657ce93 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+
+-static const struct power_supply_desc sbs_desc = {
+- .name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ .type = POWER_SUPPLY_TYPE_MAINS,
+ .properties = sbs_properties,
+ .num_properties = ARRAY_SIZE(sbs_properties),
+@@ -165,9 +164,20 @@ static const struct power_supply_desc sbs_desc = {
+ static int sbs_probe(struct i2c_client *client)
+ {
+ struct power_supply_config psy_cfg = {};
++ struct power_supply_desc *sbs_desc;
+ struct sbs_info *chip;
+ int ret, val;
+
++ sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++ sizeof(*sbs_desc), GFP_KERNEL);
++ if (!sbs_desc)
++ return -ENOMEM;
++
++ sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++ dev_name(&client->dev));
++ if (!sbs_desc->name)
++ return -ENOMEM;
++
+ chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ if (!chip)
+ return -ENOMEM;
+@@ -191,7 +201,7 @@ static int sbs_probe(struct i2c_client *client)
+ return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ chip->last_state = val;
+
+- chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++ chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ if (IS_ERR(chip->power_supply))
+ return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ "Failed to register power supply\n");
+--
+2.51.0
+
--- /dev/null
+From 71f7f36795f89226781eff1c792008ac8df88153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:22:44 +0800
+Subject: riscv: bpf: Fix uninitialized symbol 'retval_off'
+
+From: Chenghao Duan <duanchenghao@kylinos.cn>
+
+[ Upstream commit d0bf7cd5df18466d969bb60e8890b74cf96081ca ]
+
+In the __arch_prepare_bpf_trampoline() function, retval_off is only
+meaningful when save_ret is true, so the current logic is correct.
+However, in the original logic, retval_off is only initialized under
+certain conditions; for example, in the fmod_ret logic, the compiler is
+not aware that the flags of the fmod_ret program (prog) have set
+BPF_TRAMP_F_CALL_ORIG, which results in an uninitialized symbol
+compilation warning.
+
+So initialize retval_off unconditionally to fix it.
+
+Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
+Reviewed-by: Pu Lehui <pulehui@huawei.com>
+Link: https://lore.kernel.org/r/20250922062244.822937-2-duanchenghao@kylinos.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp64.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
+index 16eb4cd11cbd6..5426dc2697f94 100644
+--- a/arch/riscv/net/bpf_jit_comp64.c
++++ b/arch/riscv/net/bpf_jit_comp64.c
+@@ -855,10 +855,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ stack_size += 16;
+
+ save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
+- if (save_ret) {
++ if (save_ret)
+ stack_size += 16; /* Save both A5 (BPF R0) and A0 */
+- retval_off = stack_size;
+- }
++ retval_off = stack_size;
+
+ stack_size += nregs * 8;
+ args_off = stack_size;
+--
+2.51.0
+
--- /dev/null
+From 3a9fef27cb635abdaa44140407a6ae833a6be073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index 4694422aa76c3..88e4aeab21b7b 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -74,7 +74,7 @@ int main(int argc, char **argv)
+
+ /* Let's try detach it before it was ever attached */
+ ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+- if (ret != -1 || errno != ENOENT) {
++ if (ret != -ENOENT) {
+ printf("bpf_prog_detach2 not attached should fail: %m\n");
+ return 1;
+ }
+--
+2.51.0
+
--- /dev/null
+From e43fde5b90c36ecc84ee9c0e0a4f4adf3e345424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:48:30 -0300
+Subject: selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
+
+Currently, even if some subtests fails, the end result will still yield
+"ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are
+any failures.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xsk.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
+index 2aa5a3445056a..f4205823175a9 100755
+--- a/tools/testing/selftests/bpf/test_xsk.sh
++++ b/tools/testing/selftests/bpf/test_xsk.sh
+@@ -203,4 +203,6 @@ done
+
+ if [ $failures -eq 0 ]; then
+ echo "All tests successful!"
++else
++ exit 1
+ fi
+--
+2.51.0
+
drm-sched-fix-race-in-drm_sched_entity_select_rq.patch
drm-sysfb-do-not-dereference-null-pointer-in-plane-reset.patch
s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-crdump.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+irqchip-sifive-plic-respect-mask-state-when-setting-.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+power-supply-qcom_battmgr-add-ooi-chemistry.patch
+hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
+hwmon-k10temp-add-device-id-for-strix-halo.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+pinctrl-keembay-release-allocated-memory-in-detach-p.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+hwmon-sy7636a-add-alias.patch
+irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
+arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+arm-tegra-transformer-20-add-missing-magnetometer-in.patch
+arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
+power-supply-qcom_battmgr-handle-charging-state-chan.patch
+bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+futex-don-t-leak-robust_list-pointer-on-exec-race.patch
+spi-rpc-if-add-resume-support-for-rz-g3e.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
+riscv-bpf-fix-uninitialized-symbol-retval_off.patch
+bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
+nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
--- /dev/null
+From 7e69d400461faf0489244d09de0edc3d1d8eb541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ { "AST2620", 0x05010203 },
+ { "AST2605", 0x05030103 },
+ { "AST2625", 0x05030403 },
++ /* AST2700 */
++ { "AST2750", 0x06000003 },
++ { "AST2700", 0x06000103 },
++ { "AST2720", 0x06000203 },
+ };
+
+ static const char *siliconid_to_name(u32 siliconid)
+--
+2.51.0
+
--- /dev/null
+From dacc99c2321573fbdbec7badb9022b9246a81745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index 2e8568d6cde94..aead7dd482ea3 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -870,7 +870,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ if (IS_ERR_OR_NULL(ptable))
+ return SMEM_ITEM_COUNT;
+
+- info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ return SMEM_ITEM_COUNT;
+
+--
+2.51.0
+
--- /dev/null
+From 5fc8d6482e58b90b2279694f1092a6e08330b758 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index 402cf939c0326..a6b3217c3ccef 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -116,6 +116,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++ {
++ .name = "tsensor-cpu1",
++ .offset = 0x084,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu2",
++ .offset = 0x088,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-common",
++ .offset = 0x08c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu0",
++ .offset = 0x098,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "xusb-pad-calibration",
++ .offset = 0x0f0,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-cpu3",
++ .offset = 0x12c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-gpu",
++ .offset = 0x154,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem0",
++ .offset = 0x158,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-mem1",
++ .offset = 0x15c,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ }, {
++ .name = "tsensor-pllx",
++ .offset = 0x160,
++ .bytes = 4,
++ .bit_offset = 0,
++ .nbits = 32,
++ },
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++ {
++ .nvmem_name = "fuse",
++ .cell_name = "xusb-pad-calibration",
++ .dev_id = "7009f000.padctl",
++ .con_id = "calibration",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-common",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "common",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu2",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu2",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-cpu3",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "cpu3",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem0",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem0",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-mem1",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "mem1",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-gpu",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "gpu",
++ }, {
++ .nvmem_name = "fuse",
++ .cell_name = "tsensor-pllx",
++ .dev_id = "700e2000.thermal-sensor",
++ .con_id = "pllx",
++ },
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ .read = tegra30_fuse_read,
+ .size = 0x2a0,
+@@ -126,6 +244,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ .init = tegra30_fuse_init,
+ .speedo_init = tegra114_init_speedo_data,
+ .info = &tegra114_fuse_info,
++ .lookups = tegra114_fuse_lookups,
++ .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++ .cells = tegra114_fuse_cells,
++ .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ .soc_attr_group = &tegra_soc_attr_group,
+ .clk_suspend_on = false,
+ };
+--
+2.51.0
+
--- /dev/null
+From 3b1dea3e0c6b752f1ef096ee2671211ea9f0087a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 69b6c87c5525e..41e1fb27a9f34 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -447,7 +447,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ int i;
+ u8 b;
+
+- dev_info(&spi->dev, " spi_msg@%pK\n", msg);
++ dev_info(&spi->dev, " spi_msg@%p\n", msg);
+ if (msg->status)
+ dev_info(&spi->dev, " status: %i\n",
+ msg->status);
+@@ -457,15 +457,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ msg->actual_length);
+
+ list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer);
++ dev_info(&spi->dev, " spi_transfer@%p\n", xfer);
+ dev_info(&spi->dev, " len: %i\n", xfer->len);
+- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf);
++ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf);
+ if (dump_data && xfer->tx_buf)
+ spi_test_print_hex_dump(" TX: ",
+ xfer->tx_buf,
+ xfer->len);
+
+- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf);
++ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf);
+ if (dump_data && xfer->rx_buf)
+ spi_test_print_hex_dump(" RX: ",
+ xfer->rx_buf,
+@@ -559,7 +559,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ /* if still not found then something has modified too much */
+ /* we could list the "closest" transfer here... */
+ dev_err(&spi->dev,
+- "loopback strangeness - rx changed outside of allowed range at: %pK\n",
++ "loopback strangeness - rx changed outside of allowed range at: %p\n",
+ addr);
+ /* do not return, only set ret,
+ * so that we list all addresses
+@@ -697,7 +697,7 @@ static int spi_test_translate(struct spi_device *spi,
+ }
+
+ dev_err(&spi->dev,
+- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ *ptr, *ptr + len,
+ RX(0), RX(SPI_TEST_MAX_SIZE),
+ TX(0), TX(SPI_TEST_MAX_SIZE));
+--
+2.51.0
+
--- /dev/null
+From a67c68176ad323fe5cd9c94ca88252bcefe03525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 12:26:46 +0100
+Subject: spi: rpc-if: Add resume support for RZ/G3E
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
+
+On RZ/G3E using PSCI, s2ram powers down the SoC. After resume,
+reinitialize the hardware for SPI operations.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rpc-if.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
+index 7cce2d2ab9ca6..a1696672d12fe 100644
+--- a/drivers/spi/spi-rpc-if.c
++++ b/drivers/spi/spi-rpc-if.c
+@@ -193,6 +193,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev)
+ {
+ struct spi_controller *ctlr = dev_get_drvdata(dev);
+
++ rpcif_hw_init(dev, false);
++
+ return spi_controller_resume(ctlr);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8d7b72153ff04b195ff3f59b82fc677b6c26de49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index d7ad16f262b2e..976912f3bb5b4 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+
+ if (!teedesc || !teedesc->name || !teedesc->ops ||
+ !teedesc->ops->get_version || !teedesc->ops->open ||
+- !teedesc->ops->release || !pool)
++ !teedesc->ops->release)
+ return ERR_PTR(-EINVAL);
+
+ teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From 5afd1aa584bc50c0a597f33c0730da47db6fa05d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 7a2ef691b20e1..c2a7af89a67bb 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -55,7 +55,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ if (numwritten < 1) {
+ perror(path);
+ close(fd);
+- return -1;
++ return 0;
+ }
+
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From b30c7d7671f8e47310e86aabdb2e3df4342b1443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ char value[SYSFS_PATH_MAX];
+ int bytes_written;
++ int len;
+
+ if (cpuidle_state_count(cpu) <= idlestate)
+ return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ idlestate_value_files[IDLESTATE_DISABLE]))
+ return -2;
+
+- snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+
+ bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+- value, sizeof(disable));
++ value, len);
+ if (bytes_written)
+ return 0;
+ return -3;
+--
+2.51.0
+
--- /dev/null
+From 5ba2c438960ea6f9e520b44660ef69b99cfe3961 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+
+ int enable_hwp_on_cpu(int cpu)
+ {
+- unsigned long long msr;
++ unsigned long long old_msr, new_msr;
++
++ get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++ if (old_msr & 1)
++ return 0; /* already enabled */
+
+- get_msr(cpu, MSR_PM_ENABLE, &msr);
+- put_msr(cpu, MSR_PM_ENABLE, 1);
++ new_msr = old_msr | 1;
++ put_msr(cpu, MSR_PM_ENABLE, new_msr);
+
+ if (verbose)
+- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From c8129906610a5dff32c7f6722eec35a016fd2634 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+ */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+- FILE *filep = fopen(path, "r");
++ FILE *filep = fopen(path, mode);
+
+ if (!filep)
+ err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ char *buffer;
+
+ /* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+- cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++ cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+
+ buffer = malloc(4096);
+ if (!buffer) {
+--
+2.51.0
+
--- /dev/null
+From df10487021c4d0db9d12252231a2e6c98fa3ef57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+ * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+ * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+ * so we don't have to touch that.)
+ */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ if (update_hwp_max)
+ update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+
++ hwp_limits_done_via_sysfs = 1;
++
+ return 0;
+ }
+
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ if (debug)
+ print_hwp_request(cpu, &req, "old: ");
+
+- if (update_hwp_min)
++ if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ req.hwp_min = req_update.hwp_min;
+
+- if (update_hwp_max)
++ if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ req.hwp_max = req_update.hwp_max;
+
+ if (update_hwp_desired)
+--
+2.51.0
+
--- /dev/null
+From 533206dcf6eed76e7f63ffe01e78de52c64f6d01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index a554f43d3ceb9..6304238293ae1 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2255,6 +2255,13 @@ static void handle_swbp(struct pt_regs *regs)
+
+ handler_chain(uprobe, regs);
+
++ /*
++ * If user decided to take execution elsewhere, it makes little sense
++ * to execute the original instruction, so let's skip it.
++ */
++ if (instruction_pointer(regs) != bp_vaddr)
++ goto out;
++
+ if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 039a28857dafbdb0aa132e573d8e55eca3e2ba70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index 7075bfab59c4d..d191560ce285f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -22,7 +22,7 @@
+ #define LP855X_DEVICE_CTRL 0x01
+ #define LP855X_EEPROM_START 0xA0
+ #define LP855X_EEPROM_END 0xA7
+-#define LP8556_EPROM_START 0xA0
++#define LP8556_EPROM_START 0x98
+ #define LP8556_EPROM_END 0xAF
+
+ /* LP8555/7 Registers */
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
