--- /dev/null
+From b4f7c61c27902ea2c4d75823d184b97048480f12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 15:42:15 +0200
+Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
+
+From: Sharique Mohammad <sharq0406@gmail.com>
+
+[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
+
+The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM
+suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they
+are turned on or off, the required startup or shutdown sequences
+must be taken care by the max98090_shdn_event.
+
+Signed-off-by: Sharique Mohammad <sharq0406@gmail.com>
+Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 0c73979cad4a4..c7df685be4ea5 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1233,9 +1233,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("DMIC4"),
+
+ SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC3_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC4_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ };
+
+ static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
+--
+2.51.0
+
--- /dev/null
+From 4969e80c3136175ef7cbf3aeb6a1afa280ef465e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 11:50:00 +0100
+Subject: compiler_types: Move unused static inline functions warning to W=2
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
+
+Per Nathan, clang catches unused "static inline" functions in C files
+since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
+inline functions for W=1 build").
+
+Linus said:
+
+> So I entirely ignore W=1 issues, because I think so many of the extra
+> warnings are bogus.
+>
+> But if this one in particular is causing more problems than most -
+> some teams do seem to use W=1 as part of their test builds - it's fine
+> to send me a patch that just moves bad warnings to W=2.
+>
+> And if anybody uses W=2 for their test builds, that's THEIR problem..
+
+Here is the change to bump the warning from W=1 to W=2.
+
+Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
+[nathan: Adjust comment as well]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler_types.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index eb2bda017ccb7..9cecd02c1280a 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -158,10 +158,9 @@ struct ftrace_likely_data {
+ /*
+ * GCC does not warn about unused static inline functions for -Wunused-function.
+ * Suppress the warning in clang as well by using __maybe_unused, but enable it
+- * for W=1 build. This will allow clang to find unused functions. Remove the
+- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings.
++ * for W=2 build. This will allow clang to find unused functions.
+ */
+-#ifdef KBUILD_EXTRA_WARN1
++#ifdef KBUILD_EXTRA_WARN2
+ #define __inline_maybe_unused
+ #else
+ #define __inline_maybe_unused __maybe_unused
+--
+2.51.0
+
--- /dev/null
+From e98b0d1b8039e4a147651ac12bf76ed45c1c8c49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 18:25:43 +0200
+Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
+
+From: Tristan Lobb <tristan.lobb@it-lobb.de>
+
+[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
+
+The Cooler Master Mice Dongle includes a vendor defined HID interface
+alongside its mouse interface. Not polling it will cause the mouse to
+stop responding to polls on any interface once woken up again after
+going into power saving mode.
+
+Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
+the Dongle's PID.
+
+Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 8bfa90e37ea17..c213f1cc8aebc 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -298,6 +298,9 @@
+ #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
+ #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+
++#define USB_VENDOR_ID_COOLER_MASTER 0x2516
++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7
++
+ #define USB_VENDOR_ID_CORSAIR 0x1b1c
+ #define USB_DEVICE_ID_CORSAIR_K90 0x1b02
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 9c1c65612adb7..5fcd6f7b5f787 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET },
++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
+--
+2.51.0
+
--- /dev/null
+From fe5b7e76631bdcb7da917d8c908c08596126a905 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 15:48:04 -0600
+Subject: NFS4: Fix state renewals missing after boot
+
+From: Joshua Watt <jpewhacker@gmail.com>
+
+[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
+
+Since the last renewal time was initialized to 0 and jiffies start
+counting at -5 minutes, any clients connected in the first 5 minutes
+after a reboot would have their renewal timer set to a very long
+interval. If the connection was idle, this would result in the client
+state timing out on the server and the next call to the server would
+return NFS4ERR_BADSESSION.
+
+Fix this by initializing the last renewal time to the current jiffies
+instead of 0.
+
+Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 89835457b7fda..5fd63df2db8b1 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
+ clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
+ clp->cl_mig_gen = 1;
++ clp->cl_last_renewal = jiffies;
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+ init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 7e32a9868d17b0b1a26fb2560a5abb664d56a4e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 16:28:46 +0300
+Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid
+ rfence errors
+
+From: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+
+[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
+
+openSBI v1.7 adds harts checks for ipi operations. Especially it
+adds comparison between hmask passed as an argument from linux
+and mask of online harts (from openSBI side). If they don't
+fit each other the error occurs.
+
+When cpu is offline, cpu_online_mask is explicitly cleared in
+__cpu_disable. However, there is no explicit clearing of
+mm_cpumask. mm_cpumask is used for rfence operations that
+call openSBI RFENCE extension which uses ipi to remote harts.
+If hart is offline there may be error if mask of linux is not
+as mask of online harts in openSBI.
+
+this patch adds explicit clearing of mm_cpumask for offline hart.
+
+Signed-off-by: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru
+[pjw@kernel.org: rewrote subject line for clarity]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/cpu-hotplug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c
+index 0e948e87bd813..6cd16a2af2ee0 100644
+--- a/arch/riscv/kernel/cpu-hotplug.c
++++ b/arch/riscv/kernel/cpu-hotplug.c
+@@ -65,6 +65,7 @@ void __cpu_die(unsigned int cpu)
+ }
+ pr_notice("CPU%u: off\n", cpu);
+
++ clear_tasks_mm_cpumask(cpu);
+ /* Verify from the firmware if the cpu is really stopped*/
+ if (cpu_ops[cpu]->cpu_is_stopped)
+ ret = cpu_ops[cpu]->cpu_is_stopped(cpu);
+--
+2.51.0
+
tracing-fix-memory-leaks-in-create_field_var.patch
lib-crypto-curve25519-hacl64-fix-older-clang-kasan-workaround-for-gcc.patch
extcon-adc-jack-cleanup-wakeup-source-only-if-it-was-enabled.patch
+compiler_types-move-unused-static-inline-functions-w.patch
+risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch
+nfs4-fix-state-renewals-missing-after-boot.patch
+hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch
+asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch
--- /dev/null
+From 372e6bb577bb081f6b5f1ce7a4dff0528ef7b1fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 15:42:15 +0200
+Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
+
+From: Sharique Mohammad <sharq0406@gmail.com>
+
+[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
+
+The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM
+suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they
+are turned on or off, the required startup or shutdown sequences
+must be taken care by the max98090_shdn_event.
+
+Signed-off-by: Sharique Mohammad <sharq0406@gmail.com>
+Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 5513acd360b8f..3cf41870978da 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1233,9 +1233,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("DMIC4"),
+
+ SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC3_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC4_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ };
+
+ static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
+--
+2.51.0
+
--- /dev/null
+From 46acbf27382d73b466b807a6d956acbcf16ad5e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 11:50:00 +0100
+Subject: compiler_types: Move unused static inline functions warning to W=2
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
+
+Per Nathan, clang catches unused "static inline" functions in C files
+since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
+inline functions for W=1 build").
+
+Linus said:
+
+> So I entirely ignore W=1 issues, because I think so many of the extra
+> warnings are bogus.
+>
+> But if this one in particular is causing more problems than most -
+> some teams do seem to use W=1 as part of their test builds - it's fine
+> to send me a patch that just moves bad warnings to W=2.
+>
+> And if anybody uses W=2 for their test builds, that's THEIR problem..
+
+Here is the change to bump the warning from W=1 to W=2.
+
+Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
+[nathan: Adjust comment as well]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler_types.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index 4f2203c4a2574..ca9345e2934d3 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -163,10 +163,9 @@ struct ftrace_likely_data {
+ /*
+ * GCC does not warn about unused static inline functions for -Wunused-function.
+ * Suppress the warning in clang as well by using __maybe_unused, but enable it
+- * for W=1 build. This will allow clang to find unused functions. Remove the
+- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings.
++ * for W=2 build. This will allow clang to find unused functions.
+ */
+-#ifdef KBUILD_EXTRA_WARN1
++#ifdef KBUILD_EXTRA_WARN2
+ #define __inline_maybe_unused
+ #else
+ #define __inline_maybe_unused __maybe_unused
+--
+2.51.0
+
--- /dev/null
+From c606352873b0607b1c3c2196df413d887e90d4b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 10:25:19 +0200
+Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
+
+From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+
+[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ]
+
+On completion of i915_vma_pin_ww(), a synchronous variant of
+dma_fence_work_commit() is called. When pinning a VMA to GGTT address
+space on a Cherry View family processor, or on a Broxton generation SoC
+with VTD enabled, i.e., when stop_machine() is then called from
+intel_ggtt_bind_vma(), that can potentially lead to lock inversion among
+reservation_ww and cpu_hotplug locks.
+
+[86.861179] ======================================================
+[86.861193] WARNING: possible circular locking dependency detected
+[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U
+[86.861226] ------------------------------------------------------
+[86.861238] i915_module_loa/1432 is trying to acquire lock:
+[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50
+[86.861290]
+but task is already holding lock:
+[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.862233]
+which lock already depends on the new lock.
+[86.862251]
+the existing dependency chain (in reverse order) is:
+[86.862265]
+-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}:
+[86.862292] dma_resv_lockdep+0x19a/0x390
+[86.862315] do_one_initcall+0x60/0x3f0
+[86.862334] kernel_init_freeable+0x3cd/0x680
+[86.862353] kernel_init+0x1b/0x200
+[86.862369] ret_from_fork+0x47/0x70
+[86.862383] ret_from_fork_asm+0x1a/0x30
+[86.862399]
+-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}:
+[86.862425] dma_resv_lockdep+0x178/0x390
+[86.862440] do_one_initcall+0x60/0x3f0
+[86.862454] kernel_init_freeable+0x3cd/0x680
+[86.862470] kernel_init+0x1b/0x200
+[86.862482] ret_from_fork+0x47/0x70
+[86.862495] ret_from_fork_asm+0x1a/0x30
+[86.862509]
+-> #3 (&mm->mmap_lock){++++}-{3:3}:
+[86.862531] down_read_killable+0x46/0x1e0
+[86.862546] lock_mm_and_find_vma+0xa2/0x280
+[86.862561] do_user_addr_fault+0x266/0x8e0
+[86.862578] exc_page_fault+0x8a/0x2f0
+[86.862593] asm_exc_page_fault+0x27/0x30
+[86.862607] filldir64+0xeb/0x180
+[86.862620] kernfs_fop_readdir+0x118/0x480
+[86.862635] iterate_dir+0xcf/0x2b0
+[86.862648] __x64_sys_getdents64+0x84/0x140
+[86.862661] x64_sys_call+0x1058/0x2660
+[86.862675] do_syscall_64+0x91/0xe90
+[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.862703]
+-> #2 (&root->kernfs_rwsem){++++}-{3:3}:
+[86.862725] down_write+0x3e/0xf0
+[86.862738] kernfs_add_one+0x30/0x3c0
+[86.862751] kernfs_create_dir_ns+0x53/0xb0
+[86.862765] internal_create_group+0x134/0x4c0
+[86.862779] sysfs_create_group+0x13/0x20
+[86.862792] topology_add_dev+0x1d/0x30
+[86.862806] cpuhp_invoke_callback+0x4b5/0x850
+[86.862822] cpuhp_issue_call+0xbf/0x1f0
+[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320
+[86.862852] __cpuhp_setup_state+0xb0/0x220
+[86.862866] topology_sysfs_init+0x30/0x50
+[86.862879] do_one_initcall+0x60/0x3f0
+[86.862893] kernel_init_freeable+0x3cd/0x680
+[86.862908] kernel_init+0x1b/0x200
+[86.862921] ret_from_fork+0x47/0x70
+[86.862934] ret_from_fork_asm+0x1a/0x30
+[86.862947]
+-> #1 (cpuhp_state_mutex){+.+.}-{3:3}:
+[86.862969] __mutex_lock+0xaa/0xed0
+[86.862982] mutex_lock_nested+0x1b/0x30
+[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320
+[86.863012] __cpuhp_setup_state+0xb0/0x220
+[86.863026] page_alloc_init_cpuhp+0x2d/0x60
+[86.863041] mm_core_init+0x22/0x2d0
+[86.863054] start_kernel+0x576/0xbd0
+[86.863068] x86_64_start_reservations+0x18/0x30
+[86.863084] x86_64_start_kernel+0xbf/0x110
+[86.863098] common_startup_64+0x13e/0x141
+[86.863114]
+-> #0 (cpu_hotplug_lock){++++}-{0:0}:
+[86.863135] __lock_acquire+0x1635/0x2810
+[86.863152] lock_acquire+0xc4/0x2f0
+[86.863166] cpus_read_lock+0x41/0x100
+[86.863180] stop_machine+0x1c/0x50
+[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.864735] __vma_bind+0x55/0x70 [i915]
+[86.865510] fence_work+0x26/0xa0 [i915]
+[86.866248] fence_notify+0xa1/0x140 [i915]
+[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.867719] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.870001] initial_plane_vma+0x307/0x840 [i915]
+[86.870774] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.872330] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.873057] i915_pci_probe+0xe6/0x220 [i915]
+[86.873782] local_pci_probe+0x47/0xb0
+[86.873802] pci_device_probe+0xf3/0x260
+[86.873817] really_probe+0xf1/0x3c0
+[86.873833] __driver_probe_device+0x8c/0x180
+[86.873848] driver_probe_device+0x24/0xd0
+[86.873862] __driver_attach+0x10f/0x220
+[86.873876] bus_for_each_dev+0x7f/0xe0
+[86.873892] driver_attach+0x1e/0x30
+[86.873904] bus_add_driver+0x151/0x290
+[86.873917] driver_register+0x5e/0x130
+[86.873931] __pci_register_driver+0x7d/0x90
+[86.873945] i915_pci_register_driver+0x23/0x30 [i915]
+[86.874678] i915_init+0x37/0x120 [i915]
+[86.875347] do_one_initcall+0x60/0x3f0
+[86.875369] do_init_module+0x97/0x2a0
+[86.875385] load_module+0x2c54/0x2d80
+[86.875398] init_module_from_file+0x96/0xe0
+[86.875413] idempotent_init_module+0x117/0x330
+[86.875426] __x64_sys_finit_module+0x77/0x100
+[86.875440] x64_sys_call+0x24de/0x2660
+[86.875454] do_syscall_64+0x91/0xe90
+[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.875486]
+other info that might help us debug this:
+[86.875502] Chain exists of:
+ cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex
+[86.875539] Possible unsafe locking scenario:
+[86.875552] CPU0 CPU1
+[86.875563] ---- ----
+[86.875573] lock(reservation_ww_class_mutex);
+[86.875588] lock(reservation_ww_class_acquire);
+[86.875606] lock(reservation_ww_class_mutex);
+[86.875624] rlock(cpu_hotplug_lock);
+[86.875637]
+ *** DEADLOCK ***
+[86.875650] 3 locks held by i915_module_loa/1432:
+[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220
+[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.877305]
+stack backtrace:
+[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary)
+[86.877334] Tainted: [U]=USER
+[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020
+[86.877339] Call Trace:
+[86.877344] <TASK>
+[86.877353] dump_stack_lvl+0x91/0xf0
+[86.877364] dump_stack+0x10/0x20
+[86.877369] print_circular_bug+0x285/0x360
+[86.877379] check_noncircular+0x135/0x150
+[86.877390] __lock_acquire+0x1635/0x2810
+[86.877403] lock_acquire+0xc4/0x2f0
+[86.877408] ? stop_machine+0x1c/0x50
+[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878173] cpus_read_lock+0x41/0x100
+[86.878182] ? stop_machine+0x1c/0x50
+[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878916] stop_machine+0x1c/0x50
+[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.880375] __vma_bind+0x55/0x70 [i915]
+[86.881133] fence_work+0x26/0xa0 [i915]
+[86.881851] fence_notify+0xa1/0x140 [i915]
+[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.883286] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915]
+[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.886281] initial_plane_vma+0x307/0x840 [i915]
+[86.887049] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.888587] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.889293] ? mutex_unlock+0x12/0x20
+[86.889301] ? drm_privacy_screen_get+0x171/0x190
+[86.889308] ? acpi_dev_found+0x66/0x80
+[86.889321] i915_pci_probe+0xe6/0x220 [i915]
+[86.890038] local_pci_probe+0x47/0xb0
+[86.890049] pci_device_probe+0xf3/0x260
+[86.890058] really_probe+0xf1/0x3c0
+[86.890067] __driver_probe_device+0x8c/0x180
+[86.890072] driver_probe_device+0x24/0xd0
+[86.890078] __driver_attach+0x10f/0x220
+[86.890083] ? __pfx___driver_attach+0x10/0x10
+[86.890088] bus_for_each_dev+0x7f/0xe0
+[86.890097] driver_attach+0x1e/0x30
+[86.890101] bus_add_driver+0x151/0x290
+[86.890107] driver_register+0x5e/0x130
+[86.890113] __pci_register_driver+0x7d/0x90
+[86.890119] i915_pci_register_driver+0x23/0x30 [i915]
+[86.890833] i915_init+0x37/0x120 [i915]
+[86.891482] ? __pfx_i915_init+0x10/0x10 [i915]
+[86.892135] do_one_initcall+0x60/0x3f0
+[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470
+[86.892157] do_init_module+0x97/0x2a0
+[86.892164] load_module+0x2c54/0x2d80
+[86.892168] ? __kernel_read+0x15c/0x300
+[86.892185] ? kernel_read_file+0x2b1/0x320
+[86.892195] init_module_from_file+0x96/0xe0
+[86.892199] ? init_module_from_file+0x96/0xe0
+[86.892211] idempotent_init_module+0x117/0x330
+[86.892224] __x64_sys_finit_module+0x77/0x100
+[86.892230] x64_sys_call+0x24de/0x2660
+[86.892236] do_syscall_64+0x91/0xe90
+[86.892243] ? irqentry_exit+0x77/0xb0
+[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0
+[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.892261] RIP: 0033:0x7303e1b2725d
+[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
+[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d
+[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c
+[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80
+[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0
+[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710
+[86.892304] </TASK>
+
+Call asynchronous variant of dma_fence_work_commit() in that case.
+
+v3: Provide more verbose in-line comment (Andi),
+ - mention target environments in commit message.
+
+Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985
+Cc: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com>
+Acked-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com
+(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
+index 3df304edabc79..d9ca42203517a 100644
+--- a/drivers/gpu/drm/i915/i915_vma.c
++++ b/drivers/gpu/drm/i915/i915_vma.c
+@@ -1012,8 +1012,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww,
+ err_unlock:
+ mutex_unlock(&vma->vm->mutex);
+ err_fence:
+- if (work)
+- dma_fence_work_commit_imm(&work->base);
++ if (work) {
++ /*
++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled,
++ * commit VMA binding asynchronously to avoid risk of lock
++ * inversion among reservation_ww locks held here and
++ * cpu_hotplug_lock acquired from stop_machine(), which we
++ * wrap around GGTT updates when running in those environments.
++ */
++ if (i915_vma_is_ggtt(vma) &&
++ intel_vm_no_concurrent_access_wa(vma->vm->i915))
++ dma_fence_work_commit(&work->base);
++ else
++ dma_fence_work_commit_imm(&work->base);
++ }
+ err_rpm:
+ if (wakeref)
+ intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref);
+--
+2.51.0
+
--- /dev/null
+From 06a60855d75e8e2c09f28d21d0e689bde4541599 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 18:25:43 +0200
+Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
+
+From: Tristan Lobb <tristan.lobb@it-lobb.de>
+
+[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
+
+The Cooler Master Mice Dongle includes a vendor defined HID interface
+alongside its mouse interface. Not polling it will cause the mouse to
+stop responding to polls on any interface once woken up again after
+going into power saving mode.
+
+Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
+the Dongle's PID.
+
+Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index bdad42f1e9f96..906e0c37a8e7e 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -304,6 +304,9 @@
+ #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
+ #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+
++#define USB_VENDOR_ID_COOLER_MASTER 0x2516
++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7
++
+ #define USB_VENDOR_ID_CORSAIR 0x1b1c
+ #define USB_DEVICE_ID_CORSAIR_K90 0x1b02
+ #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 72b7aebcc771f..3f83070349b82 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET },
++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
+--
+2.51.0
+
--- /dev/null
+From e395ca66d41671314ab4dd7d78af75d0517487f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:42:12 -0400
+Subject: NFS: check if suid/sgid was cleared after a write as needed
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ]
+
+I noticed xfstests generic/193 and generic/355 started failing against
+knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN
+with OPEN4_SHARE_ACCESS_WRITE").
+
+I ran those same tests against ONTAP (which has had write delegation
+support for a lot longer than knfsd) and they fail there too... so
+while it's a new failure against knfsd, it isn't an entirely new
+failure.
+
+Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation
+doesn't keep the inode from being revalidated to fetch the updated mode.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/write.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 9323631f4889c..914a2d7a09742 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1619,7 +1619,8 @@ static int nfs_writeback_done(struct rpc_task *task,
+ /* Deal with the suid/sgid bit corner case */
+ if (nfs_should_remove_suid(inode)) {
+ spin_lock(&inode->i_lock);
+- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE);
++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE
++ | NFS_INO_REVAL_FORCED);
+ spin_unlock(&inode->i_lock);
+ }
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 080b5abe85ca8cd5482117ec6184aef6ff5a06a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 15:48:04 -0600
+Subject: NFS4: Fix state renewals missing after boot
+
+From: Joshua Watt <jpewhacker@gmail.com>
+
+[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
+
+Since the last renewal time was initialized to 0 and jiffies start
+counting at -5 minutes, any clients connected in the first 5 minutes
+after a reboot would have their renewal timer set to a very long
+interval. If the connection was idle, this would result in the client
+state timing out on the server and the next call to the server would
+return NFS4ERR_BADSESSION.
+
+Fix this by initializing the last renewal time to the current jiffies
+instead of 0.
+
+Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 7e4b126e3061e..02082580d34eb 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
+ clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
+ clp->cl_mig_gen = 1;
++ clp->cl_last_renewal = jiffies;
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+ init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
+--
+2.51.0
+
--- /dev/null
+From b3e304a44d35dc36ebd08bd74c131cb49b938279 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 16:28:46 +0300
+Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid
+ rfence errors
+
+From: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+
+[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
+
+openSBI v1.7 adds harts checks for ipi operations. Especially it
+adds comparison between hmask passed as an argument from linux
+and mask of online harts (from openSBI side). If they don't
+fit each other the error occurs.
+
+When cpu is offline, cpu_online_mask is explicitly cleared in
+__cpu_disable. However, there is no explicit clearing of
+mm_cpumask. mm_cpumask is used for rfence operations that
+call openSBI RFENCE extension which uses ipi to remote harts.
+If hart is offline there may be error if mask of linux is not
+as mask of online harts in openSBI.
+
+this patch adds explicit clearing of mm_cpumask for offline hart.
+
+Signed-off-by: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru
+[pjw@kernel.org: rewrote subject line for clarity]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/cpu-hotplug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c
+index 28a3fa6e67d79..25659db3b1a43 100644
+--- a/arch/riscv/kernel/cpu-hotplug.c
++++ b/arch/riscv/kernel/cpu-hotplug.c
+@@ -67,6 +67,7 @@ void __cpu_die(unsigned int cpu)
+ }
+ pr_notice("CPU%u: off\n", cpu);
+
++ clear_tasks_mm_cpumask(cpu);
+ /* Verify from the firmware if the cpu is really stopped*/
+ if (cpu_ops[cpu]->cpu_is_stopped)
+ ret = cpu_ops[cpu]->cpu_is_stopped(cpu);
+--
+2.51.0
+
lib-crypto-curve25519-hacl64-fix-older-clang-kasan-workaround-for-gcc.patch
extcon-adc-jack-cleanup-wakeup-source-only-if-it-was-enabled.patch
selftests-netdevsim-set-test-timeout-to-10-minutes.patch
+drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch
+compiler_types-move-unused-static-inline-functions-w.patch
+risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch
+nfs4-fix-state-renewals-missing-after-boot.patch
+hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch
+nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch
+asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch
--- /dev/null
+From 27949746bdd1e0eb03b8fb2bd4ca901fcca1f361 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 15:42:15 +0200
+Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
+
+From: Sharique Mohammad <sharq0406@gmail.com>
+
+[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
+
+The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM
+suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they
+are turned on or off, the required startup or shutdown sequences
+must be taken care by the max98090_shdn_event.
+
+Signed-off-by: Sharique Mohammad <sharq0406@gmail.com>
+Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index ce9f99dd3e87d..7955ba75255f1 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1231,9 +1231,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("DMIC4"),
+
+ SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC3_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC4_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ };
+
+ static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
+--
+2.51.0
+
--- /dev/null
+From 51d8d42dda656d55628b81aab5b3a81adb246620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 11:50:00 +0100
+Subject: compiler_types: Move unused static inline functions warning to W=2
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
+
+Per Nathan, clang catches unused "static inline" functions in C files
+since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
+inline functions for W=1 build").
+
+Linus said:
+
+> So I entirely ignore W=1 issues, because I think so many of the extra
+> warnings are bogus.
+>
+> But if this one in particular is causing more problems than most -
+> some teams do seem to use W=1 as part of their test builds - it's fine
+> to send me a patch that just moves bad warnings to W=2.
+>
+> And if anybody uses W=2 for their test builds, that's THEIR problem..
+
+Here is the change to bump the warning from W=1 to W=2.
+
+Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
+[nathan: Adjust comment as well]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler_types.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index b94d08d055ff5..a428104c5e777 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -165,10 +165,9 @@ struct ftrace_likely_data {
+ /*
+ * GCC does not warn about unused static inline functions for -Wunused-function.
+ * Suppress the warning in clang as well by using __maybe_unused, but enable it
+- * for W=1 build. This will allow clang to find unused functions. Remove the
+- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings.
++ * for W=2 build. This will allow clang to find unused functions.
+ */
+-#ifdef KBUILD_EXTRA_WARN1
++#ifdef KBUILD_EXTRA_WARN2
+ #define __inline_maybe_unused
+ #else
+ #define __inline_maybe_unused __maybe_unused
+--
+2.51.0
+
--- /dev/null
+From 86ab2aad0e3e4d4d68b5aa359e3fef3e90a385fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 18:25:43 +0200
+Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
+
+From: Tristan Lobb <tristan.lobb@it-lobb.de>
+
+[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
+
+The Cooler Master Mice Dongle includes a vendor defined HID interface
+alongside its mouse interface. Not polling it will cause the mouse to
+stop responding to polls on any interface once woken up again after
+going into power saving mode.
+
+Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
+the Dongle's PID.
+
+Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index d2e355a9744a0..39b2602c41c7a 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -303,6 +303,9 @@
+ #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
+ #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+
++#define USB_VENDOR_ID_COOLER_MASTER 0x2516
++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7
++
+ #define USB_VENDOR_ID_CORSAIR 0x1b1c
+ #define USB_DEVICE_ID_CORSAIR_K90 0x1b02
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index d1cfd45f2585a..f81ea6c36040b 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET },
++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
+--
+2.51.0
+
--- /dev/null
+From 845f623adc7753f412b53ba12d60774a24581ced Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 15:48:04 -0600
+Subject: NFS4: Fix state renewals missing after boot
+
+From: Joshua Watt <jpewhacker@gmail.com>
+
+[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
+
+Since the last renewal time was initialized to 0 and jiffies start
+counting at -5 minutes, any clients connected in the first 5 minutes
+after a reboot would have their renewal timer set to a very long
+interval. If the connection was idle, this would result in the client
+state timing out on the server and the next call to the server would
+return NFS4ERR_BADSESSION.
+
+Fix this by initializing the last renewal time to the current jiffies
+instead of 0.
+
+Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index eeab44727a766..dcef5785c1528 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
+ clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
+ clp->cl_mig_gen = 1;
++ clp->cl_last_renewal = jiffies;
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+ init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
+--
+2.51.0
+
net-usb-qmi_wwan-initialize-mac-header-offset-in-qmi.patch
tracing-fix-memory-leaks-in-create_field_var.patch
extcon-adc-jack-cleanup-wakeup-source-only-if-it-was-enabled.patch
+compiler_types-move-unused-static-inline-functions-w.patch
+nfs4-fix-state-renewals-missing-after-boot.patch
+hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch
+asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch
--- /dev/null
+From d6f5048950be70198d84515ac91f7069eab0e32d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 15:42:15 +0200
+Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
+
+From: Sharique Mohammad <sharq0406@gmail.com>
+
+[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
+
+The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM
+suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they
+are turned on or off, the required startup or shutdown sequences
+must be taken care by the max98090_shdn_event.
+
+Signed-off-by: Sharique Mohammad <sharq0406@gmail.com>
+Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 06ed2a938108e..f5acf84ee20cc 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1235,9 +1235,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("DMIC4"),
+
+ SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC3_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC4_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ };
+
+ static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
+--
+2.51.0
+
--- /dev/null
+From 16b0553e6a0c045f1317ea14dcc6c4203bafd77b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 11:50:00 +0100
+Subject: compiler_types: Move unused static inline functions warning to W=2
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
+
+Per Nathan, clang catches unused "static inline" functions in C files
+since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
+inline functions for W=1 build").
+
+Linus said:
+
+> So I entirely ignore W=1 issues, because I think so many of the extra
+> warnings are bogus.
+>
+> But if this one in particular is causing more problems than most -
+> some teams do seem to use W=1 as part of their test builds - it's fine
+> to send me a patch that just moves bad warnings to W=2.
+>
+> And if anybody uses W=2 for their test builds, that's THEIR problem..
+
+Here is the change to bump the warning from W=1 to W=2.
+
+Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
+[nathan: Adjust comment as well]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler_types.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index 8f50c589ad5f4..44767d754dff6 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -175,10 +175,9 @@ struct ftrace_likely_data {
+ /*
+ * GCC does not warn about unused static inline functions for -Wunused-function.
+ * Suppress the warning in clang as well by using __maybe_unused, but enable it
+- * for W=1 build. This will allow clang to find unused functions. Remove the
+- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings.
++ * for W=2 build. This will allow clang to find unused functions.
+ */
+-#ifdef KBUILD_EXTRA_WARN1
++#ifdef KBUILD_EXTRA_WARN2
+ #define __inline_maybe_unused
+ #else
+ #define __inline_maybe_unused __maybe_unused
+--
+2.51.0
+
--- /dev/null
+From 48336481f9576337c54fb2bbb434af73ab9f9ff8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 13:38:02 -0600
+Subject: drm/amd: Fix suspend failure with secure display TA
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ]
+
+commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded
+successfully") attempted to fix extra messages, but failed to port the
+cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable
+secure display TA multiple times") to prevent multiple tries.
+
+Add that to the failure handling path even on a quick failure.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679
+Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index e22eaf9d450d3..9153459455910 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -1962,8 +1962,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp)
+ if (!ret && !psp->securedisplay_context.context.resp_status) {
+ psp->securedisplay_context.context.initialized = true;
+ mutex_init(&psp->securedisplay_context.mutex);
+- } else
++ } else {
++ /* don't try again */
++ psp->securedisplay_context.context.bin_desc.size_bytes = 0;
+ return ret;
++ }
+
+ psp_prep_securedisplay_cmd_buf(psp, &securedisplay_cmd,
+ TA_SECUREDISPLAY_COMMAND__QUERY_TA);
+--
+2.51.0
+
--- /dev/null
+From 859c1756ce2adb153e9d60cc9559ea490cf1362f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 20:26:12 +0200
+Subject: drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ]
+
+On various SI GPUs, a flickering can be observed near the bottom
+edge of the screen when using a single 4K 60Hz monitor over DP.
+Disabling MCLK switching works around this problem.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 7a85c042a6db9..2395d0a831846 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3485,6 +3485,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ * for these GPUs to calculate bandwidth requirements.
+ */
+ if (high_pixelclock_count) {
++ /* Work around flickering lines at the bottom edge
++ * of the screen when using a single 4K 60Hz monitor.
++ */
++ disable_mclk_switching = true;
++
+ /* On Oland, we observe some flickering when two 4K 60Hz
+ * displays are connected, possibly because voltage is too low.
+ * Raise the voltage by requiring a higher SCLK.
+--
+2.51.0
+
--- /dev/null
+From a0942be1cd9e5f37ff38307bfe7952a32009d0c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 13:46:12 +0800
+Subject: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jesse.Zhang <Jesse.Zhang@amd.com>
+
+[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ]
+
+Previously, APU platforms (and other scenarios with uninitialized VRAM managers)
+triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root
+cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL,
+but that `man->bdev` (the backing device pointer within the manager) remains
+uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully
+set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to
+acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to
+a kernel OOPS.
+
+1. **amdgpu_cs.c**: Extend the existing bandwidth control check in
+ `amdgpu_cs_get_threshold_for_moves()` to include a check for
+ `ttm_resource_manager_used()`. If the manager is not used (uninitialized
+ `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific
+ logic that would trigger the NULL dereference.
+
+2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info
+ reporting to use a conditional: if the manager is used, return the real VRAM
+ usage; otherwise, return 0. This avoids accessing `man->bdev` when it is
+ NULL.
+
+3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function)
+ data write path. Use `ttm_resource_manager_used()` to check validity: if the
+ manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set
+ `fb_usage` to 0 (APUs have no discrete framebuffer to report).
+
+This approach is more robust than APU-specific checks because it:
+- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
+- Aligns with TTM's design by using its native helper function,
+- Preserves correct behavior for discrete GPUs (which have fully initialized
+ `man->bdev` and pass the `ttm_resource_manager_used()` check).
+
+v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++--
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 9ff6a9255c1b1..f83eff3c62e17 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -663,7 +663,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev,
+ */
+ const s64 us_upper_bound = 200000;
+
+- if (!adev->mm_stats.log2_max_MBps) {
++ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) {
+ *max_bytes = 0;
+ *max_vis_bytes = 0;
+ return;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 24b4bd6bb2771..345ccd721d745 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -647,7 +647,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ ui64 = atomic64_read(&adev->num_vram_cpu_page_faults);
+ return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
+ case AMDGPU_INFO_VRAM_USAGE:
+- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager);
++ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0;
+ return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
+ case AMDGPU_INFO_VIS_VRAM_USAGE:
+ ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr);
+@@ -693,8 +694,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ mem.vram.usable_heap_size = adev->gmc.real_vram_size -
+ atomic64_read(&adev->vram_pin_size) -
+ AMDGPU_VM_RESERVED_VRAM;
+- mem.vram.heap_usage =
+- ttm_resource_manager_usage(vram_man);
++ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(vram_man) : 0;
+ mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4;
+
+ mem.cpu_accessible_vram.total_heap_size =
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index 6174bef0ecb88..c626ed88e6420 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -593,8 +593,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev)
+ vf2pf_info->driver_cert = 0;
+ vf2pf_info->os_info.all = 0;
+
+- vf2pf_info->fb_usage =
+- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20;
++ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0;
+ vf2pf_info->fb_vis_usage =
+ amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20;
+ vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20;
+--
+2.51.0
+
--- /dev/null
+From ebac228b9b284bc32a7835cb3001c83dc94ffb06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 10:25:19 +0200
+Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
+
+From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+
+[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ]
+
+On completion of i915_vma_pin_ww(), a synchronous variant of
+dma_fence_work_commit() is called. When pinning a VMA to GGTT address
+space on a Cherry View family processor, or on a Broxton generation SoC
+with VTD enabled, i.e., when stop_machine() is then called from
+intel_ggtt_bind_vma(), that can potentially lead to lock inversion among
+reservation_ww and cpu_hotplug locks.
+
+[86.861179] ======================================================
+[86.861193] WARNING: possible circular locking dependency detected
+[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U
+[86.861226] ------------------------------------------------------
+[86.861238] i915_module_loa/1432 is trying to acquire lock:
+[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50
+[86.861290]
+but task is already holding lock:
+[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.862233]
+which lock already depends on the new lock.
+[86.862251]
+the existing dependency chain (in reverse order) is:
+[86.862265]
+-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}:
+[86.862292] dma_resv_lockdep+0x19a/0x390
+[86.862315] do_one_initcall+0x60/0x3f0
+[86.862334] kernel_init_freeable+0x3cd/0x680
+[86.862353] kernel_init+0x1b/0x200
+[86.862369] ret_from_fork+0x47/0x70
+[86.862383] ret_from_fork_asm+0x1a/0x30
+[86.862399]
+-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}:
+[86.862425] dma_resv_lockdep+0x178/0x390
+[86.862440] do_one_initcall+0x60/0x3f0
+[86.862454] kernel_init_freeable+0x3cd/0x680
+[86.862470] kernel_init+0x1b/0x200
+[86.862482] ret_from_fork+0x47/0x70
+[86.862495] ret_from_fork_asm+0x1a/0x30
+[86.862509]
+-> #3 (&mm->mmap_lock){++++}-{3:3}:
+[86.862531] down_read_killable+0x46/0x1e0
+[86.862546] lock_mm_and_find_vma+0xa2/0x280
+[86.862561] do_user_addr_fault+0x266/0x8e0
+[86.862578] exc_page_fault+0x8a/0x2f0
+[86.862593] asm_exc_page_fault+0x27/0x30
+[86.862607] filldir64+0xeb/0x180
+[86.862620] kernfs_fop_readdir+0x118/0x480
+[86.862635] iterate_dir+0xcf/0x2b0
+[86.862648] __x64_sys_getdents64+0x84/0x140
+[86.862661] x64_sys_call+0x1058/0x2660
+[86.862675] do_syscall_64+0x91/0xe90
+[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.862703]
+-> #2 (&root->kernfs_rwsem){++++}-{3:3}:
+[86.862725] down_write+0x3e/0xf0
+[86.862738] kernfs_add_one+0x30/0x3c0
+[86.862751] kernfs_create_dir_ns+0x53/0xb0
+[86.862765] internal_create_group+0x134/0x4c0
+[86.862779] sysfs_create_group+0x13/0x20
+[86.862792] topology_add_dev+0x1d/0x30
+[86.862806] cpuhp_invoke_callback+0x4b5/0x850
+[86.862822] cpuhp_issue_call+0xbf/0x1f0
+[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320
+[86.862852] __cpuhp_setup_state+0xb0/0x220
+[86.862866] topology_sysfs_init+0x30/0x50
+[86.862879] do_one_initcall+0x60/0x3f0
+[86.862893] kernel_init_freeable+0x3cd/0x680
+[86.862908] kernel_init+0x1b/0x200
+[86.862921] ret_from_fork+0x47/0x70
+[86.862934] ret_from_fork_asm+0x1a/0x30
+[86.862947]
+-> #1 (cpuhp_state_mutex){+.+.}-{3:3}:
+[86.862969] __mutex_lock+0xaa/0xed0
+[86.862982] mutex_lock_nested+0x1b/0x30
+[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320
+[86.863012] __cpuhp_setup_state+0xb0/0x220
+[86.863026] page_alloc_init_cpuhp+0x2d/0x60
+[86.863041] mm_core_init+0x22/0x2d0
+[86.863054] start_kernel+0x576/0xbd0
+[86.863068] x86_64_start_reservations+0x18/0x30
+[86.863084] x86_64_start_kernel+0xbf/0x110
+[86.863098] common_startup_64+0x13e/0x141
+[86.863114]
+-> #0 (cpu_hotplug_lock){++++}-{0:0}:
+[86.863135] __lock_acquire+0x1635/0x2810
+[86.863152] lock_acquire+0xc4/0x2f0
+[86.863166] cpus_read_lock+0x41/0x100
+[86.863180] stop_machine+0x1c/0x50
+[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.864735] __vma_bind+0x55/0x70 [i915]
+[86.865510] fence_work+0x26/0xa0 [i915]
+[86.866248] fence_notify+0xa1/0x140 [i915]
+[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.867719] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.870001] initial_plane_vma+0x307/0x840 [i915]
+[86.870774] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.872330] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.873057] i915_pci_probe+0xe6/0x220 [i915]
+[86.873782] local_pci_probe+0x47/0xb0
+[86.873802] pci_device_probe+0xf3/0x260
+[86.873817] really_probe+0xf1/0x3c0
+[86.873833] __driver_probe_device+0x8c/0x180
+[86.873848] driver_probe_device+0x24/0xd0
+[86.873862] __driver_attach+0x10f/0x220
+[86.873876] bus_for_each_dev+0x7f/0xe0
+[86.873892] driver_attach+0x1e/0x30
+[86.873904] bus_add_driver+0x151/0x290
+[86.873917] driver_register+0x5e/0x130
+[86.873931] __pci_register_driver+0x7d/0x90
+[86.873945] i915_pci_register_driver+0x23/0x30 [i915]
+[86.874678] i915_init+0x37/0x120 [i915]
+[86.875347] do_one_initcall+0x60/0x3f0
+[86.875369] do_init_module+0x97/0x2a0
+[86.875385] load_module+0x2c54/0x2d80
+[86.875398] init_module_from_file+0x96/0xe0
+[86.875413] idempotent_init_module+0x117/0x330
+[86.875426] __x64_sys_finit_module+0x77/0x100
+[86.875440] x64_sys_call+0x24de/0x2660
+[86.875454] do_syscall_64+0x91/0xe90
+[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.875486]
+other info that might help us debug this:
+[86.875502] Chain exists of:
+ cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex
+[86.875539] Possible unsafe locking scenario:
+[86.875552] CPU0 CPU1
+[86.875563] ---- ----
+[86.875573] lock(reservation_ww_class_mutex);
+[86.875588] lock(reservation_ww_class_acquire);
+[86.875606] lock(reservation_ww_class_mutex);
+[86.875624] rlock(cpu_hotplug_lock);
+[86.875637]
+ *** DEADLOCK ***
+[86.875650] 3 locks held by i915_module_loa/1432:
+[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220
+[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.877305]
+stack backtrace:
+[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary)
+[86.877334] Tainted: [U]=USER
+[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020
+[86.877339] Call Trace:
+[86.877344] <TASK>
+[86.877353] dump_stack_lvl+0x91/0xf0
+[86.877364] dump_stack+0x10/0x20
+[86.877369] print_circular_bug+0x285/0x360
+[86.877379] check_noncircular+0x135/0x150
+[86.877390] __lock_acquire+0x1635/0x2810
+[86.877403] lock_acquire+0xc4/0x2f0
+[86.877408] ? stop_machine+0x1c/0x50
+[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878173] cpus_read_lock+0x41/0x100
+[86.878182] ? stop_machine+0x1c/0x50
+[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878916] stop_machine+0x1c/0x50
+[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.880375] __vma_bind+0x55/0x70 [i915]
+[86.881133] fence_work+0x26/0xa0 [i915]
+[86.881851] fence_notify+0xa1/0x140 [i915]
+[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.883286] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915]
+[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.886281] initial_plane_vma+0x307/0x840 [i915]
+[86.887049] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.888587] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.889293] ? mutex_unlock+0x12/0x20
+[86.889301] ? drm_privacy_screen_get+0x171/0x190
+[86.889308] ? acpi_dev_found+0x66/0x80
+[86.889321] i915_pci_probe+0xe6/0x220 [i915]
+[86.890038] local_pci_probe+0x47/0xb0
+[86.890049] pci_device_probe+0xf3/0x260
+[86.890058] really_probe+0xf1/0x3c0
+[86.890067] __driver_probe_device+0x8c/0x180
+[86.890072] driver_probe_device+0x24/0xd0
+[86.890078] __driver_attach+0x10f/0x220
+[86.890083] ? __pfx___driver_attach+0x10/0x10
+[86.890088] bus_for_each_dev+0x7f/0xe0
+[86.890097] driver_attach+0x1e/0x30
+[86.890101] bus_add_driver+0x151/0x290
+[86.890107] driver_register+0x5e/0x130
+[86.890113] __pci_register_driver+0x7d/0x90
+[86.890119] i915_pci_register_driver+0x23/0x30 [i915]
+[86.890833] i915_init+0x37/0x120 [i915]
+[86.891482] ? __pfx_i915_init+0x10/0x10 [i915]
+[86.892135] do_one_initcall+0x60/0x3f0
+[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470
+[86.892157] do_init_module+0x97/0x2a0
+[86.892164] load_module+0x2c54/0x2d80
+[86.892168] ? __kernel_read+0x15c/0x300
+[86.892185] ? kernel_read_file+0x2b1/0x320
+[86.892195] init_module_from_file+0x96/0xe0
+[86.892199] ? init_module_from_file+0x96/0xe0
+[86.892211] idempotent_init_module+0x117/0x330
+[86.892224] __x64_sys_finit_module+0x77/0x100
+[86.892230] x64_sys_call+0x24de/0x2660
+[86.892236] do_syscall_64+0x91/0xe90
+[86.892243] ? irqentry_exit+0x77/0xb0
+[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0
+[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.892261] RIP: 0033:0x7303e1b2725d
+[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
+[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d
+[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c
+[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80
+[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0
+[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710
+[86.892304] </TASK>
+
+Call asynchronous variant of dma_fence_work_commit() in that case.
+
+v3: Provide more verbose in-line comment (Andi),
+ - mention target environments in commit message.
+
+Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985
+Cc: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com>
+Acked-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com
+(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
+index 58a03da16a10f..7601e74a96de4 100644
+--- a/drivers/gpu/drm/i915/i915_vma.c
++++ b/drivers/gpu/drm/i915/i915_vma.c
+@@ -1548,8 +1548,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww,
+ err_vma_res:
+ i915_vma_resource_free(vma_res);
+ err_fence:
+- if (work)
+- dma_fence_work_commit_imm(&work->base);
++ if (work) {
++ /*
++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled,
++ * commit VMA binding asynchronously to avoid risk of lock
++ * inversion among reservation_ww locks held here and
++ * cpu_hotplug_lock acquired from stop_machine(), which we
++ * wrap around GGTT updates when running in those environments.
++ */
++ if (i915_vma_is_ggtt(vma) &&
++ intel_vm_no_concurrent_access_wa(vma->vm->i915))
++ dma_fence_work_commit(&work->base);
++ else
++ dma_fence_work_commit_imm(&work->base);
++ }
+ err_rpm:
+ intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref);
+
+--
+2.51.0
+
--- /dev/null
+From 17bac66aef6423aa6cda383b683629bbdf3c41c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 17:03:51 -0700
+Subject: drm/i915: Fix conversion between clock ticks and nanoseconds
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ]
+
+When tick values are large, the multiplication by NSEC_PER_SEC is larger
+than 64 bits and results in bad conversions.
+
+The issue is seen in PMU busyness counters that look like they have
+wrapped around due to bad conversion. i915 PMU implementation returns
+monotonically increasing counters. If a count is lesser than previous
+one, it will only return the larger value until the smaller value
+catches up. The user will see this as zero delta between two
+measurements even though the engines are busy.
+
+Fix it by using mul_u64_u32_div()
+
+Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+[Rodrigo: Added the Fixes tag while cherry-picking to fixes]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+index 3f656d3dba9a8..8eebf41799781 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
++++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+@@ -180,7 +180,7 @@ static u64 div_u64_roundup(u64 nom, u32 den)
+
+ u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count)
+ {
+- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency);
++ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency);
+ }
+
+ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
+@@ -190,7 +190,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
+
+ u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns)
+ {
+- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC);
++ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC);
+ }
+
+ u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns)
+--
+2.51.0
+
--- /dev/null
+From a1d5d4b735df06b86125a2505e32245975cec02f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 18:25:43 +0200
+Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
+
+From: Tristan Lobb <tristan.lobb@it-lobb.de>
+
+[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
+
+The Cooler Master Mice Dongle includes a vendor defined HID interface
+alongside its mouse interface. Not polling it will cause the mouse to
+stop responding to polls on any interface once woken up again after
+going into power saving mode.
+
+Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
+the Dongle's PID.
+
+Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 0bbba80d6c51c..307f921a98068 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -321,6 +321,9 @@
+ #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
+ #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+
++#define USB_VENDOR_ID_COOLER_MASTER 0x2516
++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7
++
+ #define USB_VENDOR_ID_CORSAIR 0x1b1c
+ #define USB_DEVICE_ID_CORSAIR_K90 0x1b02
+ #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index b37927f909412..b42aa9e22fcf0 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET },
++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
+--
+2.51.0
+
--- /dev/null
+From 3098c29cfc0b9726221ed20e26f5ddcd248fc5e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:42:12 -0400
+Subject: NFS: check if suid/sgid was cleared after a write as needed
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ]
+
+I noticed xfstests generic/193 and generic/355 started failing against
+knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN
+with OPEN4_SHARE_ACCESS_WRITE").
+
+I ran those same tests against ONTAP (which has had write delegation
+support for a lot longer than knfsd) and they fail there too... so
+while it's a new failure against knfsd, it isn't an entirely new
+failure.
+
+Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation
+doesn't keep the inode from being revalidated to fetch the updated mode.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/write.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index eb1fc33198be8..a20a381efc5df 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1633,7 +1633,8 @@ static int nfs_writeback_done(struct rpc_task *task,
+ /* Deal with the suid/sgid bit corner case */
+ if (nfs_should_remove_suid(inode)) {
+ spin_lock(&inode->i_lock);
+- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE);
++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE
++ | NFS_INO_REVAL_FORCED);
+ spin_unlock(&inode->i_lock);
+ }
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 116c7285df14efc0b9c0262f2d73d14acd17cd02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 15:48:04 -0600
+Subject: NFS4: Fix state renewals missing after boot
+
+From: Joshua Watt <jpewhacker@gmail.com>
+
+[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
+
+Since the last renewal time was initialized to 0 and jiffies start
+counting at -5 minutes, any clients connected in the first 5 minutes
+after a reboot would have their renewal timer set to a very long
+interval. If the connection was idle, this would result in the client
+state timing out on the server and the next call to the server would
+return NFS4ERR_BADSESSION.
+
+Fix this by initializing the last renewal time to the current jiffies
+instead of 0.
+
+Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 6b14e4af25d37..4cb405e343b83 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
+ clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
+ clp->cl_mig_gen = 1;
++ clp->cl_last_renewal = jiffies;
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+ init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 99c893cc933af102aa4d897c1006d05bac589ce1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 16:28:46 +0300
+Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid
+ rfence errors
+
+From: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+
+[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
+
+openSBI v1.7 adds harts checks for ipi operations. Especially it
+adds comparison between hmask passed as an argument from linux
+and mask of online harts (from openSBI side). If they don't
+fit each other the error occurs.
+
+When cpu is offline, cpu_online_mask is explicitly cleared in
+__cpu_disable. However, there is no explicit clearing of
+mm_cpumask. mm_cpumask is used for rfence operations that
+call openSBI RFENCE extension which uses ipi to remote harts.
+If hart is offline there may be error if mask of linux is not
+as mask of online harts in openSBI.
+
+this patch adds explicit clearing of mm_cpumask for offline hart.
+
+Signed-off-by: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru
+[pjw@kernel.org: rewrote subject line for clarity]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/cpu-hotplug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c
+index 462b3631663f9..374f334df86de 100644
+--- a/arch/riscv/kernel/cpu-hotplug.c
++++ b/arch/riscv/kernel/cpu-hotplug.c
+@@ -61,6 +61,7 @@ void __cpu_die(unsigned int cpu)
+ }
+ pr_notice("CPU%u: off\n", cpu);
+
++ clear_tasks_mm_cpumask(cpu);
+ /* Verify from the firmware if the cpu is really stopped*/
+ if (cpu_ops[cpu]->cpu_is_stopped)
+ ret = cpu_ops[cpu]->cpu_is_stopped(cpu);
+--
+2.51.0
+
extcon-adc-jack-cleanup-wakeup-source-only-if-it-was-enabled.patch
drm-amdgpu-fix-function-header-names-in-amdgpu_connectors.c.patch
selftests-netdevsim-set-test-timeout-to-10-minutes.patch
+drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch
+drm-i915-fix-conversion-between-clock-ticks-and-nano.patch
+smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch
+drm-amd-fix-suspend-failure-with-secure-display-ta.patch
+compiler_types-move-unused-static-inline-functions-w.patch
+risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch
+drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch
+drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch
+nfs4-fix-state-renewals-missing-after-boot.patch
+hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch
+nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch
+smb-server-fix-possible-memory-leak-in-smb2_read.patch
+smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch
+asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch
--- /dev/null
+From 13c0353f9793c4bde92777001f8985bf70bcbe70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 23:13:15 +0800
+Subject: smb: client: fix refcount leak in smb2_set_path_attr
+
+From: Shuhao Fu <sfual@cse.ust.hk>
+
+[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ]
+
+Fix refcount leak in `smb2_set_path_attr` when path conversion fails.
+
+Function `cifs_get_writable_path` returns `cfile` with its reference
+counter `cfile->count` increased on success. Function `smb2_compound_op`
+would decrease the reference counter for `cfile`, as stated in its
+comment. By calling `smb2_rename_path`, the reference counter of `cfile`
+would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`.
+
+Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name")
+Acked-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index 7d3685cd345fd..452a60e09cbed 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -721,6 +721,8 @@ smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon,
+ smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb);
+ if (smb2_to_name == NULL) {
+ rc = -ENOMEM;
++ if (cfile)
++ cifsFileInfo_put(cfile);
+ goto smb2_rename_path;
+ }
+ rc = smb2_compound_op(xid, tcon, cifs_sb, from_name, access,
+--
+2.51.0
+
--- /dev/null
+From b605f26184e422a665bf149cbee5fff1b43b4f67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 00:47:59 +0800
+Subject: smb/server: fix possible memory leak in smb2_read()
+
+From: ZhangGuoDong <zhangguodong@kylinos.cn>
+
+[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ]
+
+Memory leak occurs when ksmbd_vfs_read() fails.
+Fix this by adding the missing kvfree().
+
+Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index d2dca5d2f17cb..173135f6f7dbf 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -6405,6 +6405,7 @@ int smb2_read(struct ksmbd_work *work)
+
+ nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf);
+ if (nbytes < 0) {
++ kvfree(aux_payload_buf);
+ err = nbytes;
+ goto out;
+ }
+--
+2.51.0
+
--- /dev/null
+From 59ff08f44d14878451b03e241e1f488feaa4c212 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 00:51:36 +0800
+Subject: smb/server: fix possible refcount leak in smb2_sess_setup()
+
+From: ZhangGuoDong <zhangguodong@kylinos.cn>
+
+[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ]
+
+Reference count of ksmbd_session will leak when session need reconnect.
+Fix this by adding the missing ksmbd_user_session_put().
+
+Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 173135f6f7dbf..e3ea06aab8c1b 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -1796,6 +1796,7 @@ int smb2_sess_setup(struct ksmbd_work *work)
+
+ if (ksmbd_conn_need_reconnect(conn)) {
+ rc = -EFAULT;
++ ksmbd_user_session_put(sess);
+ sess = NULL;
+ goto out_err;
+ }
+--
+2.51.0
+
--- /dev/null
+From e519734496a83cc33dca302ef8fb15eafca7f5c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 13:49:47 -0800
+Subject: arm64: kprobes: check the return value of set_memory_rox()
+
+From: Yang Shi <yang@os.amperecomputing.com>
+
+[ Upstream commit 0ec364c0c95fc85bcbc88f1a9a06ebe83c88e18c ]
+
+Since commit a166563e7ec3 ("arm64: mm: support large block mapping when
+rodata=full"), __change_memory_common has more chance to fail due to
+memory allocation failure when splitting page table. So check the return
+value of set_memory_rox(), then bail out if it fails otherwise we may have
+RW memory mapping for kprobes insn page.
+
+Fixes: 195a1b7d8388 ("arm64: kprobes: call set_memory_rox() for kprobe page")
+Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
+Reviewed-by: Dev Jain <dev.jain@arm.com>
+Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/probes/kprobes.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
+index 6e397d8dcd4c2..b0e0f0aed748a 100644
+--- a/arch/arm64/kernel/probes/kprobes.c
++++ b/arch/arm64/kernel/probes/kprobes.c
+@@ -49,7 +49,10 @@ void *alloc_insn_page(void)
+ addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
+ if (!addr)
+ return NULL;
+- set_memory_rox((unsigned long)addr, 1);
++ if (set_memory_rox((unsigned long)addr, 1)) {
++ execmem_free(addr);
++ return NULL;
++ }
+ return addr;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 7d3586de07532f086b67e2f4510b25b9f985feed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 15:42:15 +0200
+Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
+
+From: Sharique Mohammad <sharq0406@gmail.com>
+
+[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
+
+The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM
+suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they
+are turned on or off, the required startup or shutdown sequences
+must be taken care by the max98090_shdn_event.
+
+Signed-off-by: Sharique Mohammad <sharq0406@gmail.com>
+Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 2adf744c65263..4023b88e7bc13 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1234,9 +1234,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("DMIC4"),
+
+ SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC3_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC4_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ };
+
+ static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
+--
+2.51.0
+
--- /dev/null
+From 0bad0638ccd944e2cef985e26b39b5c10e2a1f83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 11:50:00 +0100
+Subject: compiler_types: Move unused static inline functions warning to W=2
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
+
+Per Nathan, clang catches unused "static inline" functions in C files
+since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
+inline functions for W=1 build").
+
+Linus said:
+
+> So I entirely ignore W=1 issues, because I think so many of the extra
+> warnings are bogus.
+>
+> But if this one in particular is causing more problems than most -
+> some teams do seem to use W=1 as part of their test builds - it's fine
+> to send me a patch that just moves bad warnings to W=2.
+>
+> And if anybody uses W=2 for their test builds, that's THEIR problem..
+
+Here is the change to bump the warning from W=1 to W=2.
+
+Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
+[nathan: Adjust comment as well]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler_types.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index 639be0f30b455..beb2a1e1bac53 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -250,10 +250,9 @@ struct ftrace_likely_data {
+ /*
+ * GCC does not warn about unused static inline functions for -Wunused-function.
+ * Suppress the warning in clang as well by using __maybe_unused, but enable it
+- * for W=1 build. This will allow clang to find unused functions. Remove the
+- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings.
++ * for W=2 build. This will allow clang to find unused functions.
+ */
+-#ifdef KBUILD_EXTRA_WARN1
++#ifdef KBUILD_EXTRA_WARN2
+ #define __inline_maybe_unused
+ #else
+ #define __inline_maybe_unused __maybe_unused
+--
+2.51.0
+
--- /dev/null
+From 704597e188c0821055c1abc2ba6254ecabb5ba40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 13:38:02 -0600
+Subject: drm/amd: Fix suspend failure with secure display TA
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ]
+
+commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded
+successfully") attempted to fix extra messages, but failed to port the
+cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable
+secure display TA multiple times") to prevent multiple tries.
+
+Add that to the failure handling path even on a quick failure.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679
+Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index a8358d1d1acbc..fa84208eed18e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -2174,8 +2174,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp)
+ if (!ret && !psp->securedisplay_context.context.resp_status) {
+ psp->securedisplay_context.context.initialized = true;
+ mutex_init(&psp->securedisplay_context.mutex);
+- } else
++ } else {
++ /* don't try again */
++ psp->securedisplay_context.context.bin_desc.size_bytes = 0;
+ return ret;
++ }
+
+ mutex_lock(&psp->securedisplay_context.mutex);
+
+--
+2.51.0
+
--- /dev/null
+From 8dce35a56b65a6313306dbeb6c50ef49743ab1df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 20:26:12 +0200
+Subject: drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ]
+
+On various SI GPUs, a flickering can be observed near the bottom
+edge of the screen when using a single 4K 60Hz monitor over DP.
+Disabling MCLK switching works around this problem.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 82167eca26683..f6ba54cf701e7 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3485,6 +3485,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ * for these GPUs to calculate bandwidth requirements.
+ */
+ if (high_pixelclock_count) {
++ /* Work around flickering lines at the bottom edge
++ * of the screen when using a single 4K 60Hz monitor.
++ */
++ disable_mclk_switching = true;
++
+ /* On Oland, we observe some flickering when two 4K 60Hz
+ * displays are connected, possibly because voltage is too low.
+ * Raise the voltage by requiring a higher SCLK.
+--
+2.51.0
+
--- /dev/null
+From 2b3a08244caf572de470b30391c97a0bcec7b919 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 13:46:12 +0800
+Subject: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jesse.Zhang <Jesse.Zhang@amd.com>
+
+[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ]
+
+Previously, APU platforms (and other scenarios with uninitialized VRAM managers)
+triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root
+cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL,
+but that `man->bdev` (the backing device pointer within the manager) remains
+uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully
+set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to
+acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to
+a kernel OOPS.
+
+1. **amdgpu_cs.c**: Extend the existing bandwidth control check in
+ `amdgpu_cs_get_threshold_for_moves()` to include a check for
+ `ttm_resource_manager_used()`. If the manager is not used (uninitialized
+ `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific
+ logic that would trigger the NULL dereference.
+
+2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info
+ reporting to use a conditional: if the manager is used, return the real VRAM
+ usage; otherwise, return 0. This avoids accessing `man->bdev` when it is
+ NULL.
+
+3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function)
+ data write path. Use `ttm_resource_manager_used()` to check validity: if the
+ manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set
+ `fb_usage` to 0 (APUs have no discrete framebuffer to report).
+
+This approach is more robust than APU-specific checks because it:
+- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
+- Aligns with TTM's design by using its native helper function,
+- Preserves correct behavior for discrete GPUs (which have fully initialized
+ `man->bdev` and pass the `ttm_resource_manager_used()` check).
+
+v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++--
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 082fc12fe28dc..844e49d1499ed 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -691,7 +691,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev,
+ */
+ const s64 us_upper_bound = 200000;
+
+- if (!adev->mm_stats.log2_max_MBps) {
++ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) {
+ *max_bytes = 0;
+ *max_vis_bytes = 0;
+ return;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 016a6f6c4267b..1291ca57a1cb3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -707,7 +707,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ ui64 = atomic64_read(&adev->num_vram_cpu_page_faults);
+ return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
+ case AMDGPU_INFO_VRAM_USAGE:
+- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager);
++ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0;
+ return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
+ case AMDGPU_INFO_VIS_VRAM_USAGE:
+ ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr);
+@@ -753,8 +754,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ mem.vram.usable_heap_size = adev->gmc.real_vram_size -
+ atomic64_read(&adev->vram_pin_size) -
+ AMDGPU_VM_RESERVED_VRAM;
+- mem.vram.heap_usage =
+- ttm_resource_manager_usage(vram_man);
++ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(vram_man) : 0;
+ mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4;
+
+ mem.cpu_accessible_vram.total_heap_size =
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index 01dccd489a805..9247cd7b1868c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -595,8 +595,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev)
+ vf2pf_info->driver_cert = 0;
+ vf2pf_info->os_info.all = 0;
+
+- vf2pf_info->fb_usage =
+- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20;
++ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0;
+ vf2pf_info->fb_vis_usage =
+ amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20;
+ vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20;
+--
+2.51.0
+
--- /dev/null
+From ad9e6986171c1b3bd4dc47853f4bd6abaa7e41db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 10:10:52 +0200
+Subject: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 33cc891b56b93cad1a83263eaf2e417436f70c82 ]
+
+Otherwise accessing them can cause a crash.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Tested-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+index ea4df412decff..54f2e7b392796 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+@@ -234,6 +234,9 @@ static umode_t amdgpu_vram_attrs_is_visible(struct kobject *kobj,
+ !adev->gmc.vram_vendor)
+ return 0;
+
++ if (!ttm_resource_manager_used(&adev->mman.vram_mgr.manager))
++ return 0;
++
+ return attr->mode;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 48e7e22c63b51866f2f57128706af1683470a754 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 14:47:23 +0200
+Subject: drm/amdgpu: remove two invalid BUG_ON()s
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 5d55ed19d4190d2c210ac05ac7a53f800a8c6fe5 ]
+
+Those can be triggered trivially by userspace.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 --
+ drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+index 96e5c520af316..c0a15d1920e28 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -5632,8 +5632,6 @@ static void gfx_v11_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,
+ unsigned vmid = AMDGPU_JOB_GET_VMID(job);
+ u32 header, control = 0;
+
+- BUG_ON(ib->flags & AMDGPU_IB_FLAG_CE);
+-
+ header = PACKET3(PACKET3_INDIRECT_BUFFER, 2);
+
+ control |= ib->length_dw | (vmid << 24);
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+index adcfcf594286f..0c8581dfbee6e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+@@ -4330,8 +4330,6 @@ static void gfx_v12_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,
+ unsigned vmid = AMDGPU_JOB_GET_VMID(job);
+ u32 header, control = 0;
+
+- BUG_ON(ib->flags & AMDGPU_IB_FLAG_CE);
+-
+ header = PACKET3(PACKET3_INDIRECT_BUFFER, 2);
+
+ control |= ib->length_dw | (vmid << 24);
+--
+2.51.0
+
--- /dev/null
+From 51ea09a48cba0f96b846e2d066ae21455ad26a3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 10:25:19 +0200
+Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
+
+From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+
+[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ]
+
+On completion of i915_vma_pin_ww(), a synchronous variant of
+dma_fence_work_commit() is called. When pinning a VMA to GGTT address
+space on a Cherry View family processor, or on a Broxton generation SoC
+with VTD enabled, i.e., when stop_machine() is then called from
+intel_ggtt_bind_vma(), that can potentially lead to lock inversion among
+reservation_ww and cpu_hotplug locks.
+
+[86.861179] ======================================================
+[86.861193] WARNING: possible circular locking dependency detected
+[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U
+[86.861226] ------------------------------------------------------
+[86.861238] i915_module_loa/1432 is trying to acquire lock:
+[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50
+[86.861290]
+but task is already holding lock:
+[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.862233]
+which lock already depends on the new lock.
+[86.862251]
+the existing dependency chain (in reverse order) is:
+[86.862265]
+-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}:
+[86.862292] dma_resv_lockdep+0x19a/0x390
+[86.862315] do_one_initcall+0x60/0x3f0
+[86.862334] kernel_init_freeable+0x3cd/0x680
+[86.862353] kernel_init+0x1b/0x200
+[86.862369] ret_from_fork+0x47/0x70
+[86.862383] ret_from_fork_asm+0x1a/0x30
+[86.862399]
+-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}:
+[86.862425] dma_resv_lockdep+0x178/0x390
+[86.862440] do_one_initcall+0x60/0x3f0
+[86.862454] kernel_init_freeable+0x3cd/0x680
+[86.862470] kernel_init+0x1b/0x200
+[86.862482] ret_from_fork+0x47/0x70
+[86.862495] ret_from_fork_asm+0x1a/0x30
+[86.862509]
+-> #3 (&mm->mmap_lock){++++}-{3:3}:
+[86.862531] down_read_killable+0x46/0x1e0
+[86.862546] lock_mm_and_find_vma+0xa2/0x280
+[86.862561] do_user_addr_fault+0x266/0x8e0
+[86.862578] exc_page_fault+0x8a/0x2f0
+[86.862593] asm_exc_page_fault+0x27/0x30
+[86.862607] filldir64+0xeb/0x180
+[86.862620] kernfs_fop_readdir+0x118/0x480
+[86.862635] iterate_dir+0xcf/0x2b0
+[86.862648] __x64_sys_getdents64+0x84/0x140
+[86.862661] x64_sys_call+0x1058/0x2660
+[86.862675] do_syscall_64+0x91/0xe90
+[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.862703]
+-> #2 (&root->kernfs_rwsem){++++}-{3:3}:
+[86.862725] down_write+0x3e/0xf0
+[86.862738] kernfs_add_one+0x30/0x3c0
+[86.862751] kernfs_create_dir_ns+0x53/0xb0
+[86.862765] internal_create_group+0x134/0x4c0
+[86.862779] sysfs_create_group+0x13/0x20
+[86.862792] topology_add_dev+0x1d/0x30
+[86.862806] cpuhp_invoke_callback+0x4b5/0x850
+[86.862822] cpuhp_issue_call+0xbf/0x1f0
+[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320
+[86.862852] __cpuhp_setup_state+0xb0/0x220
+[86.862866] topology_sysfs_init+0x30/0x50
+[86.862879] do_one_initcall+0x60/0x3f0
+[86.862893] kernel_init_freeable+0x3cd/0x680
+[86.862908] kernel_init+0x1b/0x200
+[86.862921] ret_from_fork+0x47/0x70
+[86.862934] ret_from_fork_asm+0x1a/0x30
+[86.862947]
+-> #1 (cpuhp_state_mutex){+.+.}-{3:3}:
+[86.862969] __mutex_lock+0xaa/0xed0
+[86.862982] mutex_lock_nested+0x1b/0x30
+[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320
+[86.863012] __cpuhp_setup_state+0xb0/0x220
+[86.863026] page_alloc_init_cpuhp+0x2d/0x60
+[86.863041] mm_core_init+0x22/0x2d0
+[86.863054] start_kernel+0x576/0xbd0
+[86.863068] x86_64_start_reservations+0x18/0x30
+[86.863084] x86_64_start_kernel+0xbf/0x110
+[86.863098] common_startup_64+0x13e/0x141
+[86.863114]
+-> #0 (cpu_hotplug_lock){++++}-{0:0}:
+[86.863135] __lock_acquire+0x1635/0x2810
+[86.863152] lock_acquire+0xc4/0x2f0
+[86.863166] cpus_read_lock+0x41/0x100
+[86.863180] stop_machine+0x1c/0x50
+[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.864735] __vma_bind+0x55/0x70 [i915]
+[86.865510] fence_work+0x26/0xa0 [i915]
+[86.866248] fence_notify+0xa1/0x140 [i915]
+[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.867719] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.870001] initial_plane_vma+0x307/0x840 [i915]
+[86.870774] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.872330] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.873057] i915_pci_probe+0xe6/0x220 [i915]
+[86.873782] local_pci_probe+0x47/0xb0
+[86.873802] pci_device_probe+0xf3/0x260
+[86.873817] really_probe+0xf1/0x3c0
+[86.873833] __driver_probe_device+0x8c/0x180
+[86.873848] driver_probe_device+0x24/0xd0
+[86.873862] __driver_attach+0x10f/0x220
+[86.873876] bus_for_each_dev+0x7f/0xe0
+[86.873892] driver_attach+0x1e/0x30
+[86.873904] bus_add_driver+0x151/0x290
+[86.873917] driver_register+0x5e/0x130
+[86.873931] __pci_register_driver+0x7d/0x90
+[86.873945] i915_pci_register_driver+0x23/0x30 [i915]
+[86.874678] i915_init+0x37/0x120 [i915]
+[86.875347] do_one_initcall+0x60/0x3f0
+[86.875369] do_init_module+0x97/0x2a0
+[86.875385] load_module+0x2c54/0x2d80
+[86.875398] init_module_from_file+0x96/0xe0
+[86.875413] idempotent_init_module+0x117/0x330
+[86.875426] __x64_sys_finit_module+0x77/0x100
+[86.875440] x64_sys_call+0x24de/0x2660
+[86.875454] do_syscall_64+0x91/0xe90
+[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.875486]
+other info that might help us debug this:
+[86.875502] Chain exists of:
+ cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex
+[86.875539] Possible unsafe locking scenario:
+[86.875552] CPU0 CPU1
+[86.875563] ---- ----
+[86.875573] lock(reservation_ww_class_mutex);
+[86.875588] lock(reservation_ww_class_acquire);
+[86.875606] lock(reservation_ww_class_mutex);
+[86.875624] rlock(cpu_hotplug_lock);
+[86.875637]
+ *** DEADLOCK ***
+[86.875650] 3 locks held by i915_module_loa/1432:
+[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220
+[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.877305]
+stack backtrace:
+[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary)
+[86.877334] Tainted: [U]=USER
+[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020
+[86.877339] Call Trace:
+[86.877344] <TASK>
+[86.877353] dump_stack_lvl+0x91/0xf0
+[86.877364] dump_stack+0x10/0x20
+[86.877369] print_circular_bug+0x285/0x360
+[86.877379] check_noncircular+0x135/0x150
+[86.877390] __lock_acquire+0x1635/0x2810
+[86.877403] lock_acquire+0xc4/0x2f0
+[86.877408] ? stop_machine+0x1c/0x50
+[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878173] cpus_read_lock+0x41/0x100
+[86.878182] ? stop_machine+0x1c/0x50
+[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878916] stop_machine+0x1c/0x50
+[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.880375] __vma_bind+0x55/0x70 [i915]
+[86.881133] fence_work+0x26/0xa0 [i915]
+[86.881851] fence_notify+0xa1/0x140 [i915]
+[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.883286] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915]
+[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.886281] initial_plane_vma+0x307/0x840 [i915]
+[86.887049] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.888587] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.889293] ? mutex_unlock+0x12/0x20
+[86.889301] ? drm_privacy_screen_get+0x171/0x190
+[86.889308] ? acpi_dev_found+0x66/0x80
+[86.889321] i915_pci_probe+0xe6/0x220 [i915]
+[86.890038] local_pci_probe+0x47/0xb0
+[86.890049] pci_device_probe+0xf3/0x260
+[86.890058] really_probe+0xf1/0x3c0
+[86.890067] __driver_probe_device+0x8c/0x180
+[86.890072] driver_probe_device+0x24/0xd0
+[86.890078] __driver_attach+0x10f/0x220
+[86.890083] ? __pfx___driver_attach+0x10/0x10
+[86.890088] bus_for_each_dev+0x7f/0xe0
+[86.890097] driver_attach+0x1e/0x30
+[86.890101] bus_add_driver+0x151/0x290
+[86.890107] driver_register+0x5e/0x130
+[86.890113] __pci_register_driver+0x7d/0x90
+[86.890119] i915_pci_register_driver+0x23/0x30 [i915]
+[86.890833] i915_init+0x37/0x120 [i915]
+[86.891482] ? __pfx_i915_init+0x10/0x10 [i915]
+[86.892135] do_one_initcall+0x60/0x3f0
+[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470
+[86.892157] do_init_module+0x97/0x2a0
+[86.892164] load_module+0x2c54/0x2d80
+[86.892168] ? __kernel_read+0x15c/0x300
+[86.892185] ? kernel_read_file+0x2b1/0x320
+[86.892195] init_module_from_file+0x96/0xe0
+[86.892199] ? init_module_from_file+0x96/0xe0
+[86.892211] idempotent_init_module+0x117/0x330
+[86.892224] __x64_sys_finit_module+0x77/0x100
+[86.892230] x64_sys_call+0x24de/0x2660
+[86.892236] do_syscall_64+0x91/0xe90
+[86.892243] ? irqentry_exit+0x77/0xb0
+[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0
+[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.892261] RIP: 0033:0x7303e1b2725d
+[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
+[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d
+[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c
+[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80
+[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0
+[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710
+[86.892304] </TASK>
+
+Call asynchronous variant of dma_fence_work_commit() in that case.
+
+v3: Provide more verbose in-line comment (Andi),
+ - mention target environments in commit message.
+
+Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985
+Cc: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com>
+Acked-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com
+(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
+index d2f064d2525cc..48f66d7f13678 100644
+--- a/drivers/gpu/drm/i915/i915_vma.c
++++ b/drivers/gpu/drm/i915/i915_vma.c
+@@ -1595,8 +1595,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww,
+ err_vma_res:
+ i915_vma_resource_free(vma_res);
+ err_fence:
+- if (work)
+- dma_fence_work_commit_imm(&work->base);
++ if (work) {
++ /*
++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled,
++ * commit VMA binding asynchronously to avoid risk of lock
++ * inversion among reservation_ww locks held here and
++ * cpu_hotplug_lock acquired from stop_machine(), which we
++ * wrap around GGTT updates when running in those environments.
++ */
++ if (i915_vma_is_ggtt(vma) &&
++ intel_vm_no_concurrent_access_wa(vma->vm->i915))
++ dma_fence_work_commit(&work->base);
++ else
++ dma_fence_work_commit_imm(&work->base);
++ }
+ err_rpm:
+ intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref);
+
+--
+2.51.0
+
--- /dev/null
+From 47b38e8834f9ff81733b0bf704cc6c44d7a79108 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 17:03:51 -0700
+Subject: drm/i915: Fix conversion between clock ticks and nanoseconds
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ]
+
+When tick values are large, the multiplication by NSEC_PER_SEC is larger
+than 64 bits and results in bad conversions.
+
+The issue is seen in PMU busyness counters that look like they have
+wrapped around due to bad conversion. i915 PMU implementation returns
+monotonically increasing counters. If a count is lesser than previous
+one, it will only return the larger value until the smaller value
+catches up. The user will see this as zero delta between two
+measurements even though the engines are busy.
+
+Fix it by using mul_u64_u32_div()
+
+Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+[Rodrigo: Added the Fixes tag while cherry-picking to fixes]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+index 6e63505fe4781..f01399c78c99d 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
++++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+@@ -209,7 +209,7 @@ static u64 div_u64_roundup(u64 nom, u32 den)
+
+ u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count)
+ {
+- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency);
++ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency);
+ }
+
+ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
+@@ -219,7 +219,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
+
+ u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns)
+ {
+- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC);
++ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC);
+ }
+
+ u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns)
+--
+2.51.0
+
--- /dev/null
+From 28c2efbb4351c133d27a332ccc123744b05df9ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:15:59 +0800
+Subject: drm/mediatek: Add pm_runtime support for GCE power control
+
+From: Jason-JH Lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit afcfb6c8474d9e750880aaa77952cc588f859613 ]
+
+Call pm_runtime_resume_and_get() before accessing GCE hardware in
+mbox_send_message(), and invoke pm_runtime_put_autosuspend() in the
+cmdq callback to release the PM reference and start autosuspend for
+GCE. This ensures correct power management for the GCE device.
+
+Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend")
+Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20250829091727.3745415-3-jason-jh.lin@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_crtc.c b/drivers/gpu/drm/mediatek/mtk_crtc.c
+index bc7527542fdc6..c4c6d0249df56 100644
+--- a/drivers/gpu/drm/mediatek/mtk_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_crtc.c
+@@ -283,6 +283,10 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
+ unsigned int i;
+ unsigned long flags;
+
++ /* release GCE HW usage and start autosuspend */
++ pm_runtime_mark_last_busy(cmdq_cl->chan->mbox->dev);
++ pm_runtime_put_autosuspend(cmdq_cl->chan->mbox->dev);
++
+ if (data->sta < 0)
+ return;
+
+@@ -618,6 +622,9 @@ static void mtk_crtc_update_config(struct mtk_crtc *mtk_crtc, bool needs_vblank)
+ mtk_crtc->config_updating = false;
+ spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
+
++ if (pm_runtime_resume_and_get(mtk_crtc->cmdq_client.chan->mbox->dev) < 0)
++ goto update_config_out;
++
+ mbox_send_message(mtk_crtc->cmdq_client.chan, cmdq_handle);
+ mbox_client_txdone(mtk_crtc->cmdq_client.chan, 0);
+ goto update_config_out;
+--
+2.51.0
+
--- /dev/null
+From d8dac7ae5a90a4beb93a2c6fdfc2c2745e472e8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Oct 2025 14:23:11 +0200
+Subject: drm/xe: Do clean shutdown also when using flr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+[ Upstream commit b11a020d914c3b7628f56a9ea476a5b03679489b ]
+
+Currently Xe driver is triggering flr without any clean-up on
+shutdown. This is causing random warnings from pending related works as the
+underlying hardware is reset in the middle of their execution.
+
+Fix this by performing clean shutdown also when using flr.
+
+Fixes: 501d799a47e2 ("drm/xe: Wire up device shutdown handler")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Reviewed-by: Maarten Lankhorst <dev@lankhorst.se>
+Link: https://patch.msgid.link/20251031122312.1836534-1-jouni.hogander@intel.com
+Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
+(cherry picked from commit a4ff26b7c8ef38e4dd34f77cbcd73576fdde6dd4)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_device.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
+index 3fab4e67ef8c1..161c73e676640 100644
+--- a/drivers/gpu/drm/xe/xe_device.c
++++ b/drivers/gpu/drm/xe/xe_device.c
+@@ -809,21 +809,21 @@ void xe_device_remove(struct xe_device *xe)
+
+ void xe_device_shutdown(struct xe_device *xe)
+ {
++ struct xe_gt *gt;
++ u8 id;
++
+ drm_dbg(&xe->drm, "Shutting down device\n");
+
+- if (xe_driver_flr_disabled(xe)) {
+- struct xe_gt *gt;
+- u8 id;
++ xe_display_pm_shutdown(xe);
+
+- xe_display_pm_shutdown(xe);
++ xe_irq_suspend(xe);
+
+- xe_irq_suspend(xe);
++ for_each_gt(gt, xe, id)
++ xe_gt_shutdown(gt);
+
+- for_each_gt(gt, xe, id)
+- xe_gt_shutdown(gt);
++ xe_display_pm_shutdown_late(xe);
+
+- xe_display_pm_shutdown_late(xe);
+- } else {
++ if (!xe_driver_flr_disabled(xe)) {
+ /* BOOM! */
+ __xe_driver_flr(xe);
+ }
+--
+2.51.0
+
--- /dev/null
+From 87845e0ed4d1bce6a5a2276503c8c2f28f8191a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 18:01:47 +0530
+Subject: drm/xe/guc: Synchronize Dead CT worker with unbind
+
+From: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
+
+[ Upstream commit 95af8f4fdce8349a5fe75264007f1af2aa1082ea ]
+
+Cancel and wait for any Dead CT worker to complete before continuing
+with device unbinding. Else the worker will end up using resources freed
+by the undind operation.
+
+Cc: Zhanjun Dong <zhanjun.dong@intel.com>
+Fixes: d2c5a5a926f4 ("drm/xe/guc: Dead CT helper")
+Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://patch.msgid.link/20251103123144.3231829-6-balasubramani.vivekanandan@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_ct.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c
+index d692e279d9fbf..7619b48dbfe43 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ct.c
++++ b/drivers/gpu/drm/xe/xe_guc_ct.c
+@@ -188,6 +188,9 @@ static void guc_ct_fini(struct drm_device *drm, void *arg)
+ {
+ struct xe_guc_ct *ct = arg;
+
++#if IS_ENABLED(CONFIG_DRM_XE_DEBUG)
++ cancel_work_sync(&ct->dead.worker);
++#endif
+ ct_exit_safe_mode(ct);
+ destroy_workqueue(ct->g2h_wq);
+ xa_destroy(&ct->fence_lookup);
+--
+2.51.0
+
--- /dev/null
+From 5e1f05af2b81c4d6366f8881323105abb2a538c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 15:32:08 +0530
+Subject: drm/xe: Move declarations under conditional branch
+
+From: Tejas Upadhyay <tejas.upadhyay@intel.com>
+
+[ Upstream commit 9cd27eec872f0b95dcdd811edc39d2d32e4158c8 ]
+
+The xe_device_shutdown() function was needing a few declarations
+that were only required under a specific condition. This change
+moves those declarations to be within that conditional branch
+to avoid unnecessary declarations.
+
+Reviewed-by: Nitin Gote <nitin.r.gote@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20251007100208.1407021-1-tejas.upadhyay@intel.com
+Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+(cherry picked from commit 15b3036045188f4da4ca62b2ed01b0f160252e9b)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Stable-dep-of: b11a020d914c ("drm/xe: Do clean shutdown also when using flr")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_device.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
+index 2e1d6d248d2e0..3fab4e67ef8c1 100644
+--- a/drivers/gpu/drm/xe/xe_device.c
++++ b/drivers/gpu/drm/xe/xe_device.c
+@@ -809,12 +809,12 @@ void xe_device_remove(struct xe_device *xe)
+
+ void xe_device_shutdown(struct xe_device *xe)
+ {
+- struct xe_gt *gt;
+- u8 id;
+-
+ drm_dbg(&xe->drm, "Shutting down device\n");
+
+ if (xe_driver_flr_disabled(xe)) {
++ struct xe_gt *gt;
++ u8 id;
++
+ xe_display_pm_shutdown(xe);
+
+ xe_irq_suspend(xe);
+--
+2.51.0
+
--- /dev/null
+From 291981f3b4df105e936d15dd627f3d20e7383993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 22:01:46 +0900
+Subject: exfat: fix improper check of dentry.stream.valid_size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 82ebecdc74ff555daf70b811d854b1f32a296bea ]
+
+We found an infinite loop bug in the exFAT file system that can lead to a
+Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is
+malformed, the following system calls — SYS_openat, SYS_ftruncate, and
+SYS_pwrite64 — can cause the kernel to hang.
+
+Root cause analysis shows that the size validation code in exfat_find()
+does not check whether dentry.stream.valid_size is negative. As a result,
+the system calls mentioned above can succeed and eventually trigger the DoS
+issue.
+
+This patch adds a check for negative dentry.stream.valid_size to prevent
+this vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
+Signed-off-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/namei.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
+index e9624eb61cbc9..f0fda34694044 100644
+--- a/fs/exfat/namei.c
++++ b/fs/exfat/namei.c
+@@ -635,10 +635,14 @@ static int exfat_find(struct inode *dir, struct qstr *qname,
+
+ info->type = exfat_get_entry_type(ep);
+ info->attr = le16_to_cpu(ep->dentry.file.attr);
+- info->size = le64_to_cpu(ep2->dentry.stream.valid_size);
+ info->valid_size = le64_to_cpu(ep2->dentry.stream.valid_size);
+ info->size = le64_to_cpu(ep2->dentry.stream.size);
+
++ if (info->valid_size < 0) {
++ exfat_fs_error(sb, "data valid size is invalid(%lld)", info->valid_size);
++ return -EIO;
++ }
++
+ if (unlikely(EXFAT_B_TO_CLU_ROUND_UP(info->size, sbi) > sbi->used_clusters)) {
+ exfat_fs_error(sb, "data size is invalid(%lld)", info->size);
+ return -EIO;
+--
+2.51.0
+
--- /dev/null
+From 855c343a762359a49d80980f8d3241ff0f649f09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 02:05:49 +0100
+Subject: HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
+
+From: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
+
+[ Upstream commit ed80cc4667ac997b84546e6d35f0a0ae525d239c ]
+
+The Logitech G502 Hero Wireless's high resolution scrolling resets after
+being unplugged without notifying the driver, causing extremely slow
+scrolling.
+
+The only indication of this is a battery update packet, so add a quirk to
+detect when the device is unplugged and re-enable the scrolling.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218037
+Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 59f630962338d..2e72e8967e685 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -75,6 +75,7 @@ MODULE_PARM_DESC(disable_tap_to_click,
+ #define HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS BIT(27)
+ #define HIDPP_QUIRK_HI_RES_SCROLL_1P0 BIT(28)
+ #define HIDPP_QUIRK_WIRELESS_STATUS BIT(29)
++#define HIDPP_QUIRK_RESET_HI_RES_SCROLL BIT(30)
+
+ /* These are just aliases for now */
+ #define HIDPP_QUIRK_KBD_SCROLL_WHEEL HIDPP_QUIRK_HIDPP_WHEELS
+@@ -193,6 +194,7 @@ struct hidpp_device {
+ void *private_data;
+
+ struct work_struct work;
++ struct work_struct reset_hi_res_work;
+ struct kfifo delayed_work_fifo;
+ struct input_dev *delayed_input;
+
+@@ -3864,6 +3866,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
+ struct hidpp_report *answer = hidpp->send_receive_buf;
+ struct hidpp_report *report = (struct hidpp_report *)data;
+ int ret;
++ int last_online;
+
+ /*
+ * If the mutex is locked then we have a pending answer from a
+@@ -3905,6 +3908,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
+ "See: https://gitlab.freedesktop.org/jwrdegoede/logitech-27mhz-keyboard-encryption-setup/\n");
+ }
+
++ last_online = hidpp->battery.online;
+ if (hidpp->capabilities & HIDPP_CAPABILITY_HIDPP20_BATTERY) {
+ ret = hidpp20_battery_event_1000(hidpp, data, size);
+ if (ret != 0)
+@@ -3929,6 +3933,11 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
+ return ret;
+ }
+
++ if (hidpp->quirks & HIDPP_QUIRK_RESET_HI_RES_SCROLL) {
++ if (last_online == 0 && hidpp->battery.online == 1)
++ schedule_work(&hidpp->reset_hi_res_work);
++ }
++
+ if (hidpp->quirks & HIDPP_QUIRK_HIDPP_WHEELS) {
+ ret = hidpp10_wheel_raw_event(hidpp, data, size);
+ if (ret != 0)
+@@ -4302,6 +4311,13 @@ static void hidpp_connect_event(struct work_struct *work)
+ hidpp->delayed_input = input;
+ }
+
++static void hidpp_reset_hi_res_handler(struct work_struct *work)
++{
++ struct hidpp_device *hidpp = container_of(work, struct hidpp_device, reset_hi_res_work);
++
++ hi_res_scroll_enable(hidpp);
++}
++
+ static DEVICE_ATTR(builtin_power_supply, 0000, NULL, NULL);
+
+ static struct attribute *sysfs_attrs[] = {
+@@ -4432,6 +4448,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ }
+
+ INIT_WORK(&hidpp->work, hidpp_connect_event);
++ INIT_WORK(&hidpp->reset_hi_res_work, hidpp_reset_hi_res_handler);
+ mutex_init(&hidpp->send_mutex);
+ init_waitqueue_head(&hidpp->wait);
+
+@@ -4527,6 +4544,7 @@ static void hidpp_remove(struct hid_device *hdev)
+
+ hid_hw_stop(hdev);
+ cancel_work_sync(&hidpp->work);
++ cancel_work_sync(&hidpp->reset_hi_res_work);
+ mutex_destroy(&hidpp->send_mutex);
+ }
+
+@@ -4574,6 +4592,9 @@ static const struct hid_device_id hidpp_devices[] = {
+ { /* Keyboard MX5500 (Bluetooth-receiver in HID proxy mode) */
+ LDJ_DEVICE(0xb30b),
+ .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
++ { /* Logitech G502 Lightspeed Wireless Gaming Mouse */
++ LDJ_DEVICE(0x407f),
++ .driver_data = HIDPP_QUIRK_RESET_HI_RES_SCROLL },
+
+ { LDJ_DEVICE(HID_ANY_ID) },
+
+--
+2.51.0
+
--- /dev/null
+From 258cf4332c4b19066c893516b56c4eed7d18aef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 18:05:32 -0700
+Subject: HID: nintendo: Wait longer for initial probe
+
+From: Vicki Pfau <vi@endrift.com>
+
+[ Upstream commit b73bc6a51f0c0066912c7e181acee41091c70fe6 ]
+
+Some third-party controllers, such as the PB Tails CHOC, won't always
+respond quickly on startup. Since this packet is needed for probe, and only
+once during probe, let's just wait an extra second, which makes connecting
+consistent.
+
+Signed-off-by: Vicki Pfau <vi@endrift.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-nintendo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c
+index 2a3ae1068739d..6bdc9165f8226 100644
+--- a/drivers/hid/hid-nintendo.c
++++ b/drivers/hid/hid-nintendo.c
+@@ -2424,7 +2424,7 @@ static int joycon_read_info(struct joycon_ctlr *ctlr)
+ struct joycon_input_report *report;
+
+ req.subcmd_id = JC_SUBCMD_REQ_DEV_INFO;
+- ret = joycon_send_subcmd(ctlr, &req, 0, HZ);
++ ret = joycon_send_subcmd(ctlr, &req, 0, 2 * HZ);
+ if (ret) {
+ hid_err(ctlr->hdev, "Failed to get joycon info; ret=%d\n", ret);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 0da89cc93e09d70132de4c484cebe750864495c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 18:46:11 +0300
+Subject: HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
+
+From: Oleg Makarenko <oleg@makarenk.ooo>
+
+[ Upstream commit 1141ed52348d3df82d3fd2316128b3fc6203a68c ]
+
+This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick.
+This device reboots itself every 8-10 seconds if it is not polled.
+
+Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 63eb60effcaaf..4b85d9088a61b 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1420,6 +1420,7 @@
+
+ #define USB_VENDOR_ID_VRS 0x0483
+ #define USB_DEVICE_ID_VRS_DFP 0xa355
++#define USB_DEVICE_ID_VRS_R295 0xa44c
+
+ #define USB_VENDOR_ID_VTL 0x0306
+ #define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 468a47de96b10..75480ec3c15a2 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -207,6 +207,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT },
++ { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_R295), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT },
+--
+2.51.0
+
--- /dev/null
+From 95f65bfe15e8ec0ef6b5f3265b381ea5be98aa8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 18:25:43 +0200
+Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
+
+From: Tristan Lobb <tristan.lobb@it-lobb.de>
+
+[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
+
+The Cooler Master Mice Dongle includes a vendor defined HID interface
+alongside its mouse interface. Not polling it will cause the mouse to
+stop responding to polls on any interface once woken up again after
+going into power saving mode.
+
+Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
+the Dongle's PID.
+
+Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index d41a65362835d..63eb60effcaaf 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -338,6 +338,9 @@
+ #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
+ #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+
++#define USB_VENDOR_ID_COOLER_MASTER 0x2516
++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7
++
+ #define USB_VENDOR_ID_CORSAIR 0x1b1c
+ #define USB_DEVICE_ID_CORSAIR_K90 0x1b02
+ #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 64f9728018b88..468a47de96b10 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET },
++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
+--
+2.51.0
+
--- /dev/null
+From d3fb04207d0559a67566897f94be7c604fd3ead4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 14:11:49 -0400
+Subject: iommufd: Make vfio_compat's unmap succeed if the range is already
+ empty
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit afb47765f9235181fddc61c8633b5a8cfae29fd2 ]
+
+iommufd returns ENOENT when attempting to unmap a range that is already
+empty, while vfio type1 returns success. Fix vfio_compat to match.
+
+Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
+Link: https://patch.msgid.link/r/0-v1-76be45eff0be+5d-iommufd_unmap_compat_jgg@nvidia.com
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Reviewed-by: Alex Mastro <amastro@fb.com>
+Reported-by: Alex Mastro <amastro@fb.com>
+Closes: https://lore.kernel.org/r/aP0S5ZF9l3sWkJ1G@devgpu012.nha5.facebook.com
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommufd/io_pagetable.c | 12 +++---------
+ drivers/iommu/iommufd/ioas.c | 4 ++++
+ tools/testing/selftests/iommu/iommufd.c | 2 ++
+ 3 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c
+index 067222b238b7e..f0f094cc7e520 100644
+--- a/drivers/iommu/iommufd/io_pagetable.c
++++ b/drivers/iommu/iommufd/io_pagetable.c
+@@ -660,7 +660,8 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,
+ struct iopt_area *area;
+ unsigned long unmapped_bytes = 0;
+ unsigned int tries = 0;
+- int rc = -ENOENT;
++ /* If there are no mapped entries then success */
++ int rc = 0;
+
+ /*
+ * The domains_rwsem must be held in read mode any time any area->pages
+@@ -724,8 +725,6 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,
+
+ down_write(&iopt->iova_rwsem);
+ }
+- if (unmapped_bytes)
+- rc = 0;
+
+ out_unlock_iova:
+ up_write(&iopt->iova_rwsem);
+@@ -762,13 +761,8 @@ int iopt_unmap_iova(struct io_pagetable *iopt, unsigned long iova,
+
+ int iopt_unmap_all(struct io_pagetable *iopt, unsigned long *unmapped)
+ {
+- int rc;
+-
+- rc = iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped);
+ /* If the IOVAs are empty then unmap all succeeds */
+- if (rc == -ENOENT)
+- return 0;
+- return rc;
++ return iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped);
+ }
+
+ /* The caller must always free all the nodes in the allowed_iova rb_root. */
+diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c
+index 2c4b2bb11e78c..4885293bd94f1 100644
+--- a/drivers/iommu/iommufd/ioas.c
++++ b/drivers/iommu/iommufd/ioas.c
+@@ -317,6 +317,10 @@ int iommufd_ioas_unmap(struct iommufd_ucmd *ucmd)
+ &unmapped);
+ if (rc)
+ goto out_put;
++ if (!unmapped) {
++ rc = -ENOENT;
++ goto out_put;
++ }
+ }
+
+ cmd->length = unmapped;
+diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c
+index a81c22d520070..7a535c590245f 100644
+--- a/tools/testing/selftests/iommu/iommufd.c
++++ b/tools/testing/selftests/iommu/iommufd.c
+@@ -2329,6 +2329,8 @@ TEST_F(vfio_compat_mock_domain, map)
+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd));
+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd));
+ ASSERT_EQ(BUFFER_SIZE, unmap_cmd.size);
++ /* Unmap of empty is success */
++ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd));
+
+ /* UNMAP_FLAG_ALL requires 0 iova/size */
+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd));
+--
+2.51.0
+
--- /dev/null
+From d6fbc21e1ed620429c100eb12341420c79b0ecb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:42:12 -0400
+Subject: NFS: check if suid/sgid was cleared after a write as needed
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ]
+
+I noticed xfstests generic/193 and generic/355 started failing against
+knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN
+with OPEN4_SHARE_ACCESS_WRITE").
+
+I ran those same tests against ONTAP (which has had write delegation
+support for a lot longer than knfsd) and they fail there too... so
+while it's a new failure against knfsd, it isn't an entirely new
+failure.
+
+Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation
+doesn't keep the inode from being revalidated to fetch the updated mode.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/write.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index fd86546fafd3f..88d0e5168093a 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1577,7 +1577,8 @@ static int nfs_writeback_done(struct rpc_task *task,
+ /* Deal with the suid/sgid bit corner case */
+ if (nfs_should_remove_suid(inode)) {
+ spin_lock(&inode->i_lock);
+- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE);
++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE
++ | NFS_INO_REVAL_FORCED);
+ spin_unlock(&inode->i_lock);
+ }
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 944dd0aecfd6c2ea1c61b6fd4c8ad69c38ef3360 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 15:22:58 -0600
+Subject: NFS4: Apply delay_retrans to async operations
+
+From: Joshua Watt <jpewhacker@gmail.com>
+
+[ Upstream commit 7a84394f02ab1985ebbe0a8d6f6d69bd040de4b3 ]
+
+The setting of delay_retrans is applied to synchronous RPC operations
+because the retransmit count is stored in same struct nfs4_exception
+that is passed each time an error is checked. However, for asynchronous
+operations (READ, WRITE, LOCKU, CLOSE, DELEGRETURN), a new struct
+nfs4_exception is made on the stack each time the task callback is
+invoked. This means that the retransmit count is always zero and thus
+delay_retrans never takes effect.
+
+Apply delay_retrans to these operations by tracking and updating their
+retransmit count.
+
+Change-Id: Ieb33e046c2b277cb979caa3faca7f52faf0568c9
+Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 13 +++++++++++++
+ include/linux/nfs_xdr.h | 1 +
+ 2 files changed, 14 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index b0ba9f2bef56b..a4531386c6485 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3612,6 +3612,7 @@ struct nfs4_closedata {
+ } lr;
+ struct nfs_fattr fattr;
+ unsigned long timestamp;
++ unsigned short retrans;
+ };
+
+ static void nfs4_free_closedata(void *data)
+@@ -3640,6 +3641,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
+ .state = state,
+ .inode = calldata->inode,
+ .stateid = &calldata->arg.stateid,
++ .retrans = calldata->retrans,
+ };
+
+ if (!nfs4_sequence_done(task, &calldata->res.seq_res))
+@@ -3687,6 +3689,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
+ default:
+ task->tk_status = nfs4_async_handle_exception(task,
+ server, task->tk_status, &exception);
++ calldata->retrans = exception.retrans;
+ if (exception.retry)
+ goto out_restart;
+ }
+@@ -5546,9 +5549,11 @@ static int nfs4_read_done_cb(struct rpc_task *task, struct nfs_pgio_header *hdr)
+ .inode = hdr->inode,
+ .state = hdr->args.context->state,
+ .stateid = &hdr->args.stateid,
++ .retrans = hdr->retrans,
+ };
+ task->tk_status = nfs4_async_handle_exception(task,
+ server, task->tk_status, &exception);
++ hdr->retrans = exception.retrans;
+ if (exception.retry) {
+ rpc_restart_call_prepare(task);
+ return -EAGAIN;
+@@ -5662,10 +5667,12 @@ static int nfs4_write_done_cb(struct rpc_task *task,
+ .inode = hdr->inode,
+ .state = hdr->args.context->state,
+ .stateid = &hdr->args.stateid,
++ .retrans = hdr->retrans,
+ };
+ task->tk_status = nfs4_async_handle_exception(task,
+ NFS_SERVER(inode), task->tk_status,
+ &exception);
++ hdr->retrans = exception.retrans;
+ if (exception.retry) {
+ rpc_restart_call_prepare(task);
+ return -EAGAIN;
+@@ -6677,6 +6684,7 @@ struct nfs4_delegreturndata {
+ struct nfs_fh fh;
+ nfs4_stateid stateid;
+ unsigned long timestamp;
++ unsigned short retrans;
+ struct {
+ struct nfs4_layoutreturn_args arg;
+ struct nfs4_layoutreturn_res res;
+@@ -6697,6 +6705,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
+ .inode = data->inode,
+ .stateid = &data->stateid,
+ .task_is_privileged = data->args.seq_args.sa_privileged,
++ .retrans = data->retrans,
+ };
+
+ if (!nfs4_sequence_done(task, &data->res.seq_res))
+@@ -6768,6 +6777,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
+ task->tk_status = nfs4_async_handle_exception(task,
+ data->res.server, task->tk_status,
+ &exception);
++ data->retrans = exception.retrans;
+ if (exception.retry)
+ goto out_restart;
+ }
+@@ -7044,6 +7054,7 @@ struct nfs4_unlockdata {
+ struct file_lock fl;
+ struct nfs_server *server;
+ unsigned long timestamp;
++ unsigned short retrans;
+ };
+
+ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
+@@ -7098,6 +7109,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)
+ struct nfs4_exception exception = {
+ .inode = calldata->lsp->ls_state->inode,
+ .stateid = &calldata->arg.stateid,
++ .retrans = calldata->retrans,
+ };
+
+ if (!nfs4_sequence_done(task, &calldata->res.seq_res))
+@@ -7131,6 +7143,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)
+ task->tk_status = nfs4_async_handle_exception(task,
+ calldata->server, task->tk_status,
+ &exception);
++ calldata->retrans = exception.retrans;
+ if (exception.retry)
+ rpc_restart_call_prepare(task);
+ }
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index b48d94f099657..b7a08c875514f 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1660,6 +1660,7 @@ struct nfs_pgio_header {
+ void *netfs;
+ #endif
+
++ unsigned short retrans;
+ int pnfs_error;
+ int error; /* merge with pnfs_error */
+ unsigned int good_bytes; /* boundary of good data */
+--
+2.51.0
+
--- /dev/null
+From 9970d946dff4a83cc49ff6afd792bf66bb788553 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 15:48:04 -0600
+Subject: NFS4: Fix state renewals missing after boot
+
+From: Joshua Watt <jpewhacker@gmail.com>
+
+[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
+
+Since the last renewal time was initialized to 0 and jiffies start
+counting at -5 minutes, any clients connected in the first 5 minutes
+after a reboot would have their renewal timer set to a very long
+interval. If the connection was idle, this would result in the client
+state timing out on the server and the next call to the server would
+return NFS4ERR_BADSESSION.
+
+Fix this by initializing the last renewal time to the current jiffies
+instead of 0.
+
+Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 37c17f70cebe3..aaf723471228b 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -222,6 +222,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
+ clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
+ clp->cl_mig_gen = 1;
++ clp->cl_last_renewal = jiffies;
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+ init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 79ba9babd139c87e4687a2030b09d15c4edab9fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 16:28:46 +0300
+Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid
+ rfence errors
+
+From: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+
+[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
+
+openSBI v1.7 adds harts checks for ipi operations. Especially it
+adds comparison between hmask passed as an argument from linux
+and mask of online harts (from openSBI side). If they don't
+fit each other the error occurs.
+
+When cpu is offline, cpu_online_mask is explicitly cleared in
+__cpu_disable. However, there is no explicit clearing of
+mm_cpumask. mm_cpumask is used for rfence operations that
+call openSBI RFENCE extension which uses ipi to remote harts.
+If hart is offline there may be error if mask of linux is not
+as mask of online harts in openSBI.
+
+this patch adds explicit clearing of mm_cpumask for offline hart.
+
+Signed-off-by: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru
+[pjw@kernel.org: rewrote subject line for clarity]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/cpu-hotplug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c
+index a1e38ecfc8be2..3f50d3dd76c6f 100644
+--- a/arch/riscv/kernel/cpu-hotplug.c
++++ b/arch/riscv/kernel/cpu-hotplug.c
+@@ -54,6 +54,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu)
+
+ pr_notice("CPU%u: off\n", cpu);
+
++ clear_tasks_mm_cpumask(cpu);
+ /* Verify from the firmware if the cpu is really stopped*/
+ if (cpu_ops->cpu_is_stopped)
+ ret = cpu_ops->cpu_is_stopped(cpu);
+--
+2.51.0
+
--- /dev/null
+From f0fe54457d8ab7515fb79daf3f396174258264f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:24:01 +0800
+Subject: riscv: acpi: avoid errors caused by probing DT devices when ACPI is
+ used
+
+From: Han Gao <rabenda.cn@gmail.com>
+
+[ Upstream commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e ]
+
+Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose
+to boot from acpi then disable FDT"), let's not do DT hardware probing
+if ACPI is enabled in early boot. This avoids errors caused by
+repeated driver probing.
+
+Signed-off-by: Han Gao <rabenda.cn@gmail.com>
+Link: https://lore.kernel.org/r/20250910112401.552987-1-rabenda.cn@gmail.com
+[pjw@kernel.org: cleaned up patch description and subject]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/setup.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
+index 194bda6d74ce7..4c430c9f017d8 100644
+--- a/arch/riscv/kernel/setup.c
++++ b/arch/riscv/kernel/setup.c
+@@ -298,11 +298,14 @@ void __init setup_arch(char **cmdline_p)
+ /* Parse the ACPI tables for possible boot-time configuration */
+ acpi_boot_table_init();
+
++ if (acpi_disabled) {
+ #if IS_ENABLED(CONFIG_BUILTIN_DTB)
+- unflatten_and_copy_device_tree();
++ unflatten_and_copy_device_tree();
+ #else
+- unflatten_device_tree();
++ unflatten_device_tree();
+ #endif
++ }
++
+ misc_mem_init();
+
+ init_resources();
+--
+2.51.0
+
--- /dev/null
+From d3f83f9c00cde775fa8dc7c153e847bcd557b504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Oct 2025 17:44:28 +0800
+Subject: riscv: Build loader.bin exclusively for Canaan K210
+
+From: Feng Jiang <jiangfeng@kylinos.cn>
+
+[ Upstream commit 3ad1b71fdc5707d14332d9ae710a237de936be9b ]
+
+According to the explanation in commit ef10bdf9c3e6 ("riscv:
+Kconfig.socs: Split ARCH_CANAAN and SOC_CANAAN_K210"),
+loader.bin is a special feature of the Canaan K210 and
+is not applicable to other SoCs.
+
+Fixes: e79dfcbfb902 ("riscv: make image compression configurable")
+Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
+Reviewed-by: Emil Renner Berthing <emil.renner.berthing@canonical.com>
+Link: https://lore.kernel.org/r/20251029094429.553842-1-jiangfeng@kylinos.cn
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index d469db9f46f42..3df2111673601 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -161,7 +161,7 @@ boot-image-$(CONFIG_KERNEL_LZO) := Image.lzo
+ boot-image-$(CONFIG_KERNEL_ZSTD) := Image.zst
+ boot-image-$(CONFIG_KERNEL_XZ) := Image.xz
+ ifdef CONFIG_RISCV_M_MODE
+-boot-image-$(CONFIG_ARCH_CANAAN) := loader.bin
++boot-image-$(CONFIG_SOC_CANAAN_K210) := loader.bin
+ endif
+ boot-image-$(CONFIG_EFI_ZBOOT) := vmlinuz.efi
+ boot-image-$(CONFIG_XIP_KERNEL) := xipImage
+--
+2.51.0
+
--- /dev/null
+drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch
+drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch
+drm-i915-fix-conversion-between-clock-ticks-and-nano.patch
+smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch
+iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch
+drm-amd-fix-suspend-failure-with-secure-display-ta.patch
+drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch
+drm-xe-move-declarations-under-conditional-branch.patch
+drm-xe-do-clean-shutdown-also-when-using-flr.patch
+arm64-kprobes-check-the-return-value-of-set_memory_r.patch
+compiler_types-move-unused-static-inline-functions-w.patch
+riscv-build-loader.bin-exclusively-for-canaan-k210.patch
+risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch
+riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch
+drm-amdgpu-remove-two-invalid-bug_on-s.patch
+drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch
+drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch
+drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch
+nfs4-fix-state-renewals-missing-after-boot.patch
+nfs4-apply-delay_retrans-to-async-operations.patch
+hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch
+hid-nintendo-wait-longer-for-initial-probe.patch
+nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch
+hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch
+exfat-fix-improper-check-of-dentry.stream.valid_size.patch
+smb-server-fix-possible-memory-leak-in-smb2_read.patch
+smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch
+hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch
+asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch
--- /dev/null
+From d9fa0ba392e32fe8bb1c3bcaa8405ec22900139a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 23:13:15 +0800
+Subject: smb: client: fix refcount leak in smb2_set_path_attr
+
+From: Shuhao Fu <sfual@cse.ust.hk>
+
+[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ]
+
+Fix refcount leak in `smb2_set_path_attr` when path conversion fails.
+
+Function `cifs_get_writable_path` returns `cfile` with its reference
+counter `cfile->count` increased on success. Function `smb2_compound_op`
+would decrease the reference counter for `cfile`, as stated in its
+comment. By calling `smb2_rename_path`, the reference counter of `cfile`
+would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`.
+
+Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name")
+Acked-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index cb049bc70e0cb..1c65787657ddc 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -1132,6 +1132,8 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon,
+ smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb);
+ if (smb2_to_name == NULL) {
+ rc = -ENOMEM;
++ if (cfile)
++ cifsFileInfo_put(cfile);
+ goto smb2_rename_path;
+ }
+ in_iov.iov_base = smb2_to_name;
+--
+2.51.0
+
--- /dev/null
+From 3d3bc013f29796ed6a795b982b98b9086c29eae3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 00:47:59 +0800
+Subject: smb/server: fix possible memory leak in smb2_read()
+
+From: ZhangGuoDong <zhangguodong@kylinos.cn>
+
+[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ]
+
+Memory leak occurs when ksmbd_vfs_read() fails.
+Fix this by adding the missing kvfree().
+
+Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 796235cb95677..67021dc6dfd81 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -6782,6 +6782,7 @@ int smb2_read(struct ksmbd_work *work)
+
+ nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf);
+ if (nbytes < 0) {
++ kvfree(aux_payload_buf);
+ err = nbytes;
+ goto out;
+ }
+--
+2.51.0
+
--- /dev/null
+From de0ef483f71cdfadfa39c44bf59899e68ad2dc3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 00:51:36 +0800
+Subject: smb/server: fix possible refcount leak in smb2_sess_setup()
+
+From: ZhangGuoDong <zhangguodong@kylinos.cn>
+
+[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ]
+
+Reference count of ksmbd_session will leak when session need reconnect.
+Fix this by adding the missing ksmbd_user_session_put().
+
+Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 67021dc6dfd81..cd42d25812661 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -1798,6 +1798,7 @@ int smb2_sess_setup(struct ksmbd_work *work)
+
+ if (ksmbd_conn_need_reconnect(conn)) {
+ rc = -EFAULT;
++ ksmbd_user_session_put(sess);
+ sess = NULL;
+ goto out_err;
+ }
+--
+2.51.0
+
--- /dev/null
+From 36a55cb93caf49deac03243fd33ce172741b02f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Oct 2025 15:42:06 -0300
+Subject: ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx
+
+From: Dawn Gardner <dawn.auroali@gmail.com>
+
+[ Upstream commit 2a786348004b34c5f61235d51c40c1c718b1f8f9 ]
+
+This laptop uses the ALC285 codec, fixed by enabling
+the ALC285_FIXUP_HP_MUTE_LED quirk
+
+Signed-off-by: Dawn Gardner <dawn.auroali@gmail.com>
+Link: https://patch.msgid.link/20251016184218.31508-3-dawn.auroali@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 28297e936a96f..19604352317dd 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -6399,6 +6399,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x854a, "HP EliteBook 830 G6", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x85c6, "HP Pavilion x360 Convertible 14-dy1xxx", ALC295_FIXUP_HP_MUTE_LED_COEFBIT11),
+ SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360),
++ SND_PCI_QUIRK(0x103c, 0x8603, "HP Omen 17-cb0xxx", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x860c, "HP ZBook 17 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+--
+2.51.0
+
--- /dev/null
+From 2014fc1517775d6f10ecbb61d99d3d72b0e4fc1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 13:49:47 -0800
+Subject: arm64: kprobes: check the return value of set_memory_rox()
+
+From: Yang Shi <yang@os.amperecomputing.com>
+
+[ Upstream commit 0ec364c0c95fc85bcbc88f1a9a06ebe83c88e18c ]
+
+Since commit a166563e7ec3 ("arm64: mm: support large block mapping when
+rodata=full"), __change_memory_common has more chance to fail due to
+memory allocation failure when splitting page table. So check the return
+value of set_memory_rox(), then bail out if it fails otherwise we may have
+RW memory mapping for kprobes insn page.
+
+Fixes: 195a1b7d8388 ("arm64: kprobes: call set_memory_rox() for kprobe page")
+Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
+Reviewed-by: Dev Jain <dev.jain@arm.com>
+Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/probes/kprobes.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
+index 8ab6104a4883d..43a0361a8bf04 100644
+--- a/arch/arm64/kernel/probes/kprobes.c
++++ b/arch/arm64/kernel/probes/kprobes.c
+@@ -49,7 +49,10 @@ void *alloc_insn_page(void)
+ addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
+ if (!addr)
+ return NULL;
+- set_memory_rox((unsigned long)addr, 1);
++ if (set_memory_rox((unsigned long)addr, 1)) {
++ execmem_free(addr);
++ return NULL;
++ }
+ return addr;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e51d024dc7f7146409ac73989bcf240218c4c932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 15:42:15 +0200
+Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
+
+From: Sharique Mohammad <sharq0406@gmail.com>
+
+[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
+
+The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM
+suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they
+are turned on or off, the required startup or shutdown sequences
+must be taken care by the max98090_shdn_event.
+
+Signed-off-by: Sharique Mohammad <sharq0406@gmail.com>
+Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 22177c1ce1602..cb1508fc99f89 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1234,9 +1234,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("DMIC4"),
+
+ SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC3_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC4_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ };
+
+ static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
+--
+2.51.0
+
--- /dev/null
+From e4eea84421cbaa8904bfa898bca8760e42592066 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:27 +0300
+Subject: ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit ee70bacef1c6050e4836409927294d744dbcfa72 ]
+
+The interrupt handler offloads the microphone detection logic to
+nau8821_jdet_work(), which implies a sleep operation. However, before
+being able to process any subsequent hotplug event, the interrupt
+handler needs to wait for any prior scheduled work to complete.
+
+Move the sleep out of jdet_work by converting it to a delayed work.
+This eliminates the undesired blocking in the interrupt handler when
+attempting to cancel a recently scheduled work item and should help
+reducing transient input reports that might confuse user-space.
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-5-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 22 ++++++++++++----------
+ sound/soc/codecs/nau8821.h | 2 +-
+ 2 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index a8ff2ce70be9a..4fa9a785513e5 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1104,16 +1104,12 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)
+ static void nau8821_jdet_work(struct work_struct *work)
+ {
+ struct nau8821 *nau8821 =
+- container_of(work, struct nau8821, jdet_work);
++ container_of(work, struct nau8821, jdet_work.work);
+ struct snd_soc_dapm_context *dapm = nau8821->dapm;
+ struct snd_soc_component *component = snd_soc_dapm_to_component(dapm);
+ struct regmap *regmap = nau8821->regmap;
+ int jack_status_reg, mic_detected, event = 0, event_mask = 0;
+
+- snd_soc_component_force_enable_pin(component, "MICBIAS");
+- snd_soc_dapm_sync(dapm);
+- msleep(20);
+-
+ regmap_read(regmap, NAU8821_R58_I2C_DEVICE_ID, &jack_status_reg);
+ mic_detected = !(jack_status_reg & NAU8821_KEYDET);
+ if (mic_detected) {
+@@ -1146,6 +1142,7 @@ static void nau8821_jdet_work(struct work_struct *work)
+ snd_soc_component_disable_pin(component, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+ }
++
+ event_mask |= SND_JACK_HEADSET;
+ snd_soc_jack_report(nau8821->jack, event, event_mask);
+ }
+@@ -1194,6 +1191,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+ {
+ struct nau8821 *nau8821 = (struct nau8821 *)data;
+ struct regmap *regmap = nau8821->regmap;
++ struct snd_soc_component *component;
+ int active_irq, event = 0, event_mask = 0;
+
+ if (regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq)) {
+@@ -1205,7 +1203,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+
+ if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) ==
+ NAU8821_JACK_EJECT_DETECTED) {
+- cancel_work_sync(&nau8821->jdet_work);
++ cancel_delayed_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_DIS);
+ nau8821_eject_jack(nau8821);
+@@ -1219,12 +1217,15 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+ nau8821_irq_status_clear(regmap, NAU8821_KEY_RELEASE_IRQ);
+ } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) ==
+ NAU8821_JACK_INSERT_DETECTED) {
+- cancel_work_sync(&nau8821->jdet_work);
++ cancel_delayed_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_EN);
+ if (nau8821_is_jack_inserted(regmap)) {
+- /* detect microphone and jack type */
+- schedule_work(&nau8821->jdet_work);
++ /* Detect microphone and jack type */
++ component = snd_soc_dapm_to_component(nau8821->dapm);
++ snd_soc_component_force_enable_pin(component, "MICBIAS");
++ snd_soc_dapm_sync(nau8821->dapm);
++ schedule_delayed_work(&nau8821->jdet_work, msecs_to_jiffies(20));
+ /* Turn off insertion interruption at manual mode */
+ nau8821_setup_inserted_irq(nau8821);
+ } else {
+@@ -1661,7 +1662,8 @@ int nau8821_enable_jack_detect(struct snd_soc_component *component,
+
+ nau8821->jack = jack;
+ /* Initiate jack detection work queue */
+- INIT_WORK(&nau8821->jdet_work, nau8821_jdet_work);
++ INIT_DELAYED_WORK(&nau8821->jdet_work, nau8821_jdet_work);
++
+ ret = devm_request_threaded_irq(nau8821->dev, nau8821->irq, NULL,
+ nau8821_interrupt, IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+ "nau8821", nau8821);
+diff --git a/sound/soc/codecs/nau8821.h b/sound/soc/codecs/nau8821.h
+index f0935ffafcbec..88602923780d8 100644
+--- a/sound/soc/codecs/nau8821.h
++++ b/sound/soc/codecs/nau8821.h
+@@ -561,7 +561,7 @@ struct nau8821 {
+ struct regmap *regmap;
+ struct snd_soc_dapm_context *dapm;
+ struct snd_soc_jack *jack;
+- struct work_struct jdet_work;
++ struct delayed_work jdet_work;
+ int irq;
+ int clk_id;
+ int micbias_voltage;
+--
+2.51.0
+
--- /dev/null
+From e2532b4cd925a4ac04b7a94d34b6d7b1fd85d202 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 11:50:00 +0100
+Subject: compiler_types: Move unused static inline functions warning to W=2
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
+
+Per Nathan, clang catches unused "static inline" functions in C files
+since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
+inline functions for W=1 build").
+
+Linus said:
+
+> So I entirely ignore W=1 issues, because I think so many of the extra
+> warnings are bogus.
+>
+> But if this one in particular is causing more problems than most -
+> some teams do seem to use W=1 as part of their test builds - it's fine
+> to send me a patch that just moves bad warnings to W=2.
+>
+> And if anybody uses W=2 for their test builds, that's THEIR problem..
+
+Here is the change to bump the warning from W=1 to W=2.
+
+Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
+[nathan: Adjust comment as well]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler_types.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index 16755431fc11e..e768d2c693662 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -250,10 +250,9 @@ struct ftrace_likely_data {
+ /*
+ * GCC does not warn about unused static inline functions for -Wunused-function.
+ * Suppress the warning in clang as well by using __maybe_unused, but enable it
+- * for W=1 build. This will allow clang to find unused functions. Remove the
+- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings.
++ * for W=2 build. This will allow clang to find unused functions.
+ */
+-#ifdef KBUILD_EXTRA_WARN1
++#ifdef KBUILD_EXTRA_WARN2
+ #define __inline_maybe_unused
+ #else
+ #define __inline_maybe_unused __maybe_unused
+--
+2.51.0
+
--- /dev/null
+From 7460c79d3803d04832080f4a9adfacf3b33c5d22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 20:26:13 +0200
+Subject: drm/amd: Disable ASPM on SI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 7bdd91abf0cb3ea78160e2e78fb58b12f6a38d55 ]
+
+Enabling ASPM causes randoms hangs on Tahiti and Oland on Zen4.
+It's unclear if this is a platform-specific or GPU-specific issue.
+Disable ASPM on SI for the time being.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index ddd0e7ab82be7..fdaf482c0c8a7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -1880,6 +1880,13 @@ static bool amdgpu_device_pcie_dynamic_switching_supported(struct amdgpu_device
+
+ static bool amdgpu_device_aspm_support_quirk(struct amdgpu_device *adev)
+ {
++ /* Enabling ASPM causes randoms hangs on Tahiti and Oland on Zen4.
++ * It's unclear if this is a platform-specific or GPU-specific issue.
++ * Disable ASPM on SI for the time being.
++ */
++ if (adev->family == AMDGPU_FAMILY_SI)
++ return true;
++
+ #if IS_ENABLED(CONFIG_X86)
+ struct cpuinfo_x86 *c = &cpu_data(0);
+
+--
+2.51.0
+
--- /dev/null
+From 3e27f8dffdeff138626c7700a70f7827b02b1d10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:17:50 +0200
+Subject: drm/amd/display: Add pixel_clock to amd_pp_display_configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit b515dcb0dc4e85d8254f5459cfb32fce88dacbfb ]
+
+This commit adds the pixel_clock field to the display config
+struct so that power management (DPM) can use it.
+
+We currently don't have a proper bandwidth calculation on old
+GPUs with DCE 6-10 because dce_calcs only supports DCE 11+.
+So the power management (DPM) on these GPUs may need to make
+ad-hoc decisions for display based on the pixel clock.
+
+Also rename sym_clock to pixel_clock in dm_pp_single_disp_config
+to avoid confusion with other code where the sym_clock refers to
+the DisplayPort symbol clock.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c | 1 +
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 2 +-
+ drivers/gpu/drm/amd/display/dc/dm_services_types.h | 2 +-
+ drivers/gpu/drm/amd/include/dm_pp_interface.h | 1 +
+ 4 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
+index 848c5b4bb301a..016230896d0e1 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
+@@ -97,6 +97,7 @@ bool dm_pp_apply_display_requirements(
+ const struct dm_pp_single_disp_config *dc_cfg =
+ &pp_display_cfg->disp_configs[i];
+ adev->pm.pm_display_cfg.displays[i].controller_id = dc_cfg->pipe_idx + 1;
++ adev->pm.pm_display_cfg.displays[i].pixel_clock = dc_cfg->pixel_clock;
+ }
+
+ amdgpu_dpm_display_configuration_change(adev, &adev->pm.pm_display_cfg);
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
+index 13cf415e38e50..d50b9440210e4 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
+@@ -164,7 +164,7 @@ void dce110_fill_display_configs(
+ stream->link->cur_link_settings.link_rate;
+ cfg->link_settings.link_spread =
+ stream->link->cur_link_settings.link_spread;
+- cfg->sym_clock = stream->phy_pix_clk;
++ cfg->pixel_clock = stream->phy_pix_clk;
+ /* Round v_refresh*/
+ cfg->v_refresh = stream->timing.pix_clk_100hz * 100;
+ cfg->v_refresh /= stream->timing.h_total;
+diff --git a/drivers/gpu/drm/amd/display/dc/dm_services_types.h b/drivers/gpu/drm/amd/display/dc/dm_services_types.h
+index bf63da266a18c..3b093b8699abd 100644
+--- a/drivers/gpu/drm/amd/display/dc/dm_services_types.h
++++ b/drivers/gpu/drm/amd/display/dc/dm_services_types.h
+@@ -127,7 +127,7 @@ struct dm_pp_single_disp_config {
+ uint32_t src_height;
+ uint32_t src_width;
+ uint32_t v_refresh;
+- uint32_t sym_clock; /* HDMI only */
++ uint32_t pixel_clock; /* Pixel clock in KHz (for HDMI only: normalized) */
+ struct dc_link_settings link_settings; /* DP only */
+ };
+
+diff --git a/drivers/gpu/drm/amd/include/dm_pp_interface.h b/drivers/gpu/drm/amd/include/dm_pp_interface.h
+index acd1cef61b7c5..349544504c93c 100644
+--- a/drivers/gpu/drm/amd/include/dm_pp_interface.h
++++ b/drivers/gpu/drm/amd/include/dm_pp_interface.h
+@@ -65,6 +65,7 @@ struct single_display_configuration {
+ uint32_t view_resolution_cy;
+ enum amd_pp_display_config_type displayconfigtype;
+ uint32_t vertical_refresh; /* for active display */
++ uint32_t pixel_clock; /* Pixel clock in KHz (for HDMI only: normalized) */
+ };
+
+ #define MAX_NUM_DISPLAY 32
+--
+2.51.0
+
--- /dev/null
+From cd8c65e09c93224b64e563fcdab4075ca08d4152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:56:29 +0200
+Subject: drm/amd/display: Disable fastboot on DCE 6 too
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 7495962cbceb967e095233a5673ea71f3bcdee7e ]
+
+It already didn't work on DCE 8,
+so there is no reason to assume it would on DCE 6.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 32fd6bdc18d73..537f538114607 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1923,10 +1923,8 @@ void dce110_enable_accelerated_mode(struct dc *dc, struct dc_state *context)
+
+ get_edp_streams(context, edp_streams, &edp_stream_num);
+
+- // Check fastboot support, disable on DCE8 because of blank screens
+- if (edp_num && edp_stream_num && dc->ctx->dce_version != DCE_VERSION_8_0 &&
+- dc->ctx->dce_version != DCE_VERSION_8_1 &&
+- dc->ctx->dce_version != DCE_VERSION_8_3) {
++ /* Check fastboot support, disable on DCE 6-8 because of blank screens */
++ if (edp_num && edp_stream_num && dc->ctx->dce_version < DCE_VERSION_10_0) {
+ for (i = 0; i < edp_num; i++) {
+ edp_link = edp_links[i];
+ if (edp_link != edp_streams[0]->link)
+--
+2.51.0
+
--- /dev/null
+From 1ea579120f1b79398f7077b775ece4f7d094d012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:39:43 -0500
+Subject: drm/amd/display: Don't stretch non-native images by default in eDP
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 3362692fea915ce56345366364a501c629c9ff17 ]
+
+commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native
+resolutions on eDP") started using the GPU scaler hardware to scale
+when a non-native resolution was picked on eDP. This scaling was done
+to fill the screen instead of maintain aspect ratio.
+
+The idea was supposed to be that if a different scaling behavior is
+preferred then the compositor would request it. The not following
+aspect ratio behavior however isn't desirable, so adjust it to follow
+aspect ratio and still try to fill screen.
+
+Note: This will lead to black bars in some cases for non-native
+resolutions. Compositors can request the previous behavior if desired.
+
+Fixes: 978fa2f6d0b1 ("drm/amd/display: Use scaling for non-native resolutions on eDP")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4538
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 825df7ff4bb1a383ad4827545e09aec60d230770)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index b997718f624f8..f06c918f5a33a 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -8003,7 +8003,7 @@ static int dm_encoder_helper_atomic_check(struct drm_encoder *encoder,
+ "mode %dx%d@%dHz is not native, enabling scaling\n",
+ adjusted_mode->hdisplay, adjusted_mode->vdisplay,
+ drm_mode_vrefresh(adjusted_mode));
+- dm_new_connector_state->scaling = RMX_FULL;
++ dm_new_connector_state->scaling = RMX_ASPECT;
+ }
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 27a8d6ba0379b5c6f558f801061a80cad5d9cdc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 13:38:02 -0600
+Subject: drm/amd: Fix suspend failure with secure display TA
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ]
+
+commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded
+successfully") attempted to fix extra messages, but failed to port the
+cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable
+secure display TA multiple times") to prevent multiple tries.
+
+Add that to the failure handling path even on a quick failure.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679
+Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index d9d7fc4c33cba..2c2d264cf8f68 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -2353,8 +2353,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp)
+ if (!ret && !psp->securedisplay_context.context.resp_status) {
+ psp->securedisplay_context.context.initialized = true;
+ mutex_init(&psp->securedisplay_context.mutex);
+- } else
++ } else {
++ /* don't try again */
++ psp->securedisplay_context.context.bin_desc.size_bytes = 0;
+ return ret;
++ }
+
+ mutex_lock(&psp->securedisplay_context.mutex);
+
+--
+2.51.0
+
--- /dev/null
+From ea4d6df18f4ad37810e3555eb765ac73a84787de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 20:26:12 +0200
+Subject: drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ]
+
+On various SI GPUs, a flickering can be observed near the bottom
+edge of the screen when using a single 4K 60Hz monitor over DP.
+Disabling MCLK switching works around this problem.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 70efa4dce3848..a2b411a93b0fe 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3500,6 +3500,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ * for these GPUs to calculate bandwidth requirements.
+ */
+ if (high_pixelclock_count) {
++ /* Work around flickering lines at the bottom edge
++ * of the screen when using a single 4K 60Hz monitor.
++ */
++ disable_mclk_switching = true;
++
+ /* On Oland, we observe some flickering when two 4K 60Hz
+ * displays are connected, possibly because voltage is too low.
+ * Raise the voltage by requiring a higher SCLK.
+--
+2.51.0
+
--- /dev/null
+From 95c162d5365e678b91577afe811f848a8baabb07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:17:51 +0200
+Subject: drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 9d73b107a61b73e7101d4b728ddac3d2c77db111 ]
+
+This commit is necessary for DC to function well with chips
+that use the legacy power management code, ie. SI and KV.
+Communicate display information from DC to the legacy PM code.
+
+Currently DC uses pm_display_cfg to communicate power management
+requirements from the display code to the DPM code.
+However, the legacy (non-DC) code path used different fields
+and therefore could not take into account anything from DC.
+
+Change the legacy display code to fill the same pm_display_cfg
+struct as DC and use the same in the legacy DPM code.
+
+To ease review and reduce churn, this commit does not yet
+delete the now unneeded code, that is done in the next commit.
+
+v2:
+Rebase.
+Fix single_display in amdgpu_dpm_pick_power_state.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 67 +++++++++++++++++++
+ .../gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h | 2 +
+ drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +-
+ .../gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | 6 +-
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 65 ++++++------------
+ .../gpu/drm/amd/pm/powerplay/amd_powerplay.c | 11 +--
+ 6 files changed, 97 insertions(+), 58 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+index 2d2d2d5e67634..9ef965e4a92ed 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+@@ -100,3 +100,70 @@ u32 amdgpu_dpm_get_vrefresh(struct amdgpu_device *adev)
+
+ return vrefresh;
+ }
++
++void amdgpu_dpm_get_display_cfg(struct amdgpu_device *adev)
++{
++ struct drm_device *ddev = adev_to_drm(adev);
++ struct amd_pp_display_configuration *cfg = &adev->pm.pm_display_cfg;
++ struct single_display_configuration *display_cfg;
++ struct drm_crtc *crtc;
++ struct amdgpu_crtc *amdgpu_crtc;
++ struct amdgpu_connector *conn;
++ int num_crtcs = 0;
++ int vrefresh;
++ u32 vblank_in_pixels, vblank_time_us;
++
++ cfg->min_vblank_time = 0xffffffff; /* if the displays are off, vblank time is max */
++
++ if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) {
++ list_for_each_entry(crtc, &ddev->mode_config.crtc_list, head) {
++ amdgpu_crtc = to_amdgpu_crtc(crtc);
++
++ /* The array should only contain active displays. */
++ if (!amdgpu_crtc->enabled)
++ continue;
++
++ conn = to_amdgpu_connector(amdgpu_crtc->connector);
++ display_cfg = &adev->pm.pm_display_cfg.displays[num_crtcs++];
++
++ if (amdgpu_crtc->hw_mode.clock) {
++ vrefresh = drm_mode_vrefresh(&amdgpu_crtc->hw_mode);
++
++ vblank_in_pixels =
++ amdgpu_crtc->hw_mode.crtc_htotal *
++ (amdgpu_crtc->hw_mode.crtc_vblank_end -
++ amdgpu_crtc->hw_mode.crtc_vdisplay +
++ (amdgpu_crtc->v_border * 2));
++
++ vblank_time_us =
++ vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
++
++ /* The legacy (non-DC) code has issues with mclk switching
++ * with refresh rates over 120 Hz. Disable mclk switching.
++ */
++ if (vrefresh > 120)
++ vblank_time_us = 0;
++
++ /* Find minimum vblank time. */
++ if (vblank_time_us < cfg->min_vblank_time)
++ cfg->min_vblank_time = vblank_time_us;
++
++ /* Find vertical refresh rate of first active display. */
++ if (!cfg->vrefresh)
++ cfg->vrefresh = vrefresh;
++ }
++
++ if (amdgpu_crtc->crtc_id < cfg->crtc_index) {
++ /* Find first active CRTC and its line time. */
++ cfg->crtc_index = amdgpu_crtc->crtc_id;
++ cfg->line_time_in_us = amdgpu_crtc->line_time;
++ }
++
++ display_cfg->controller_id = amdgpu_crtc->crtc_id;
++ display_cfg->pixel_clock = conn->pixelclock_for_modeset;
++ }
++ }
++
++ cfg->display_clk = adev->clock.default_dispclk;
++ cfg->num_display = num_crtcs;
++}
+diff --git a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h
+index 5c2a89f0d5d5d..8be11510cd923 100644
+--- a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h
++++ b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h
+@@ -29,4 +29,6 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev);
+
+ u32 amdgpu_dpm_get_vrefresh(struct amdgpu_device *adev);
+
++void amdgpu_dpm_get_display_cfg(struct amdgpu_device *adev);
++
+ #endif
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
+index 307ebf7e32267..33eb85dd68e9c 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
+@@ -2299,7 +2299,7 @@ static void kv_apply_state_adjust_rules(struct amdgpu_device *adev,
+
+ if (pi->sys_info.nb_dpm_enable) {
+ force_high = (mclk >= pi->sys_info.nbp_memory_clock[3]) ||
+- pi->video_start || (adev->pm.dpm.new_active_crtc_count >= 3) ||
++ pi->video_start || (adev->pm.pm_display_cfg.num_display >= 3) ||
+ pi->disable_nb_ps3_in_battery;
+ ps->dpm0_pg_nb_ps_lo = force_high ? 0x2 : 0x3;
+ ps->dpm0_pg_nb_ps_hi = 0x2;
+@@ -2358,7 +2358,7 @@ static int kv_calculate_nbps_level_settings(struct amdgpu_device *adev)
+ return 0;
+
+ force_high = ((mclk >= pi->sys_info.nbp_memory_clock[3]) ||
+- (adev->pm.dpm.new_active_crtc_count >= 3) || pi->video_start);
++ (adev->pm.pm_display_cfg.num_display >= 3) || pi->video_start);
+
+ if (force_high) {
+ for (i = pi->lowest_valid; i <= pi->highest_valid; i++)
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c
+index ea3ace882a10a..6ebe3d0f5b877 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c
+@@ -771,8 +771,7 @@ static struct amdgpu_ps *amdgpu_dpm_pick_power_state(struct amdgpu_device *adev,
+ int i;
+ struct amdgpu_ps *ps;
+ u32 ui_class;
+- bool single_display = (adev->pm.dpm.new_active_crtc_count < 2) ?
+- true : false;
++ bool single_display = adev->pm.pm_display_cfg.num_display < 2;
+
+ /* check if the vblank period is too short to adjust the mclk */
+ if (single_display && adev->powerplay.pp_funcs->vblank_too_short) {
+@@ -968,7 +967,8 @@ void amdgpu_legacy_dpm_compute_clocks(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+- amdgpu_dpm_get_active_displays(adev);
++ if (!adev->dc_enabled)
++ amdgpu_dpm_get_display_cfg(adev);
+
+ amdgpu_dpm_change_power_state_locked(adev);
+ }
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 4236700fc1ad1..70efa4dce3848 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3081,7 +3081,7 @@ static int si_get_vce_clock_voltage(struct amdgpu_device *adev,
+ static bool si_dpm_vblank_too_short(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+- u32 vblank_time = amdgpu_dpm_get_vblank_time(adev);
++ u32 vblank_time = adev->pm.pm_display_cfg.min_vblank_time;
+ /* we never hit the non-gddr5 limit so disable it */
+ u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
+
+@@ -3447,9 +3447,10 @@ static void rv770_get_engine_memory_ss(struct amdgpu_device *adev)
+ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ struct amdgpu_ps *rps)
+ {
++ const struct amd_pp_display_configuration *display_cfg =
++ &adev->pm.pm_display_cfg;
+ struct si_ps *ps = si_get_ps(rps);
+ struct amdgpu_clock_and_voltage_limits *max_limits;
+- struct amdgpu_connector *conn;
+ bool disable_mclk_switching = false;
+ bool disable_sclk_switching = false;
+ u32 mclk, sclk;
+@@ -3488,14 +3489,9 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ * For example, 4K 60Hz and 1080p 144Hz fall into this category.
+ * Find number of such displays connected.
+ */
+- for (i = 0; i < adev->mode_info.num_crtc; i++) {
+- if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
+- !adev->mode_info.crtcs[i]->enabled)
+- continue;
+-
+- conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
+-
+- if (conn->pixelclock_for_modeset > 297000)
++ for (i = 0; i < display_cfg->num_display; i++) {
++ /* The array only contains active displays. */
++ if (display_cfg->displays[i].pixel_clock > 297000)
+ high_pixelclock_count++;
+ }
+
+@@ -3523,7 +3519,7 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ rps->ecclk = 0;
+ }
+
+- if ((adev->pm.dpm.new_active_crtc_count > 1) ||
++ if ((adev->pm.pm_display_cfg.num_display > 1) ||
+ si_dpm_vblank_too_short(adev))
+ disable_mclk_switching = true;
+
+@@ -3671,7 +3667,7 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ ps->performance_levels[i].mclk,
+ max_limits->vddc, &ps->performance_levels[i].vddc);
+ btc_apply_voltage_dependency_rules(&adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk,
+- adev->clock.current_dispclk,
++ display_cfg->display_clk,
+ max_limits->vddc, &ps->performance_levels[i].vddc);
+ }
+
+@@ -4196,16 +4192,16 @@ static void si_program_ds_registers(struct amdgpu_device *adev)
+
+ static void si_program_display_gap(struct amdgpu_device *adev)
+ {
++ const struct amd_pp_display_configuration *cfg = &adev->pm.pm_display_cfg;
+ u32 tmp, pipe;
+- int i;
+
+ tmp = RREG32(mmCG_DISPLAY_GAP_CNTL) & ~(CG_DISPLAY_GAP_CNTL__DISP1_GAP_MASK | CG_DISPLAY_GAP_CNTL__DISP2_GAP_MASK);
+- if (adev->pm.dpm.new_active_crtc_count > 0)
++ if (cfg->num_display > 0)
+ tmp |= R600_PM_DISPLAY_GAP_VBLANK_OR_WM << CG_DISPLAY_GAP_CNTL__DISP1_GAP__SHIFT;
+ else
+ tmp |= R600_PM_DISPLAY_GAP_IGNORE << CG_DISPLAY_GAP_CNTL__DISP1_GAP__SHIFT;
+
+- if (adev->pm.dpm.new_active_crtc_count > 1)
++ if (cfg->num_display > 1)
+ tmp |= R600_PM_DISPLAY_GAP_VBLANK_OR_WM << CG_DISPLAY_GAP_CNTL__DISP2_GAP__SHIFT;
+ else
+ tmp |= R600_PM_DISPLAY_GAP_IGNORE << CG_DISPLAY_GAP_CNTL__DISP2_GAP__SHIFT;
+@@ -4215,17 +4211,8 @@ static void si_program_display_gap(struct amdgpu_device *adev)
+ tmp = RREG32(DCCG_DISP_SLOW_SELECT_REG);
+ pipe = (tmp & DCCG_DISP1_SLOW_SELECT_MASK) >> DCCG_DISP1_SLOW_SELECT_SHIFT;
+
+- if ((adev->pm.dpm.new_active_crtc_count > 0) &&
+- (!(adev->pm.dpm.new_active_crtcs & (1 << pipe)))) {
+- /* find the first active crtc */
+- for (i = 0; i < adev->mode_info.num_crtc; i++) {
+- if (adev->pm.dpm.new_active_crtcs & (1 << i))
+- break;
+- }
+- if (i == adev->mode_info.num_crtc)
+- pipe = 0;
+- else
+- pipe = i;
++ if (cfg->num_display > 0 && pipe != cfg->crtc_index) {
++ pipe = cfg->crtc_index;
+
+ tmp &= ~DCCG_DISP1_SLOW_SELECT_MASK;
+ tmp |= DCCG_DISP1_SLOW_SELECT(pipe);
+@@ -4236,7 +4223,7 @@ static void si_program_display_gap(struct amdgpu_device *adev)
+ * This can be a problem on PowerXpress systems or if you want to use the card
+ * for offscreen rendering or compute if there are no crtcs enabled.
+ */
+- si_notify_smc_display_change(adev, adev->pm.dpm.new_active_crtc_count > 0);
++ si_notify_smc_display_change(adev, cfg->num_display > 0);
+ }
+
+ static void si_enable_spread_spectrum(struct amdgpu_device *adev, bool enable)
+@@ -5545,7 +5532,7 @@ static int si_convert_power_level_to_smc(struct amdgpu_device *adev,
+ (pl->mclk <= pi->mclk_stutter_mode_threshold) &&
+ !eg_pi->uvd_enabled &&
+ (RREG32(mmDPG_PIPE_STUTTER_CONTROL) & DPG_PIPE_STUTTER_CONTROL__STUTTER_ENABLE_MASK) &&
+- (adev->pm.dpm.new_active_crtc_count <= 2)) {
++ (adev->pm.pm_display_cfg.num_display <= 2)) {
+ level->mcFlags |= SISLANDS_SMC_MC_STUTTER_EN;
+ }
+
+@@ -5694,7 +5681,7 @@ static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
+ /* XXX validate against display requirements! */
+
+ for (i = 0; i < adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count; i++) {
+- if (adev->clock.current_dispclk <=
++ if (adev->pm.pm_display_cfg.display_clk <=
+ adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[i].clk) {
+ if (ulv->pl.vddc <
+ adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[i].v)
+@@ -5848,30 +5835,22 @@ static int si_upload_ulv_state(struct amdgpu_device *adev)
+
+ static int si_upload_smc_data(struct amdgpu_device *adev)
+ {
+- struct amdgpu_crtc *amdgpu_crtc = NULL;
+- int i;
++ const struct amd_pp_display_configuration *cfg = &adev->pm.pm_display_cfg;
+ u32 crtc_index = 0;
+ u32 mclk_change_block_cp_min = 0;
+ u32 mclk_change_block_cp_max = 0;
+
+- for (i = 0; i < adev->mode_info.num_crtc; i++) {
+- if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
+- amdgpu_crtc = adev->mode_info.crtcs[i];
+- break;
+- }
+- }
+-
+ /* When a display is plugged in, program these so that the SMC
+ * performs MCLK switching when it doesn't cause flickering.
+ * When no display is plugged in, there is no need to restrict
+ * MCLK switching, so program them to zero.
+ */
+- if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
+- crtc_index = amdgpu_crtc->crtc_id;
++ if (cfg->num_display) {
++ crtc_index = cfg->crtc_index;
+
+- if (amdgpu_crtc->line_time) {
+- mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
+- mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
++ if (cfg->line_time_in_us) {
++ mclk_change_block_cp_min = 200 / cfg->line_time_in_us;
++ mclk_change_block_cp_max = 100 / cfg->line_time_in_us;
+ }
+ }
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
+index b48a031cbba08..554492dfa3c00 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
+@@ -1554,16 +1554,7 @@ static void pp_pm_compute_clocks(void *handle)
+ struct amdgpu_device *adev = hwmgr->adev;
+
+ if (!adev->dc_enabled) {
+- amdgpu_dpm_get_active_displays(adev);
+- adev->pm.pm_display_cfg.num_display = adev->pm.dpm.new_active_crtc_count;
+- adev->pm.pm_display_cfg.vrefresh = amdgpu_dpm_get_vrefresh(adev);
+- adev->pm.pm_display_cfg.min_vblank_time = amdgpu_dpm_get_vblank_time(adev);
+- /* we have issues with mclk switching with
+- * refresh rates over 120 hz on the non-DC code.
+- */
+- if (adev->pm.pm_display_cfg.vrefresh > 120)
+- adev->pm.pm_display_cfg.min_vblank_time = 0;
+-
++ amdgpu_dpm_get_display_cfg(adev);
+ pp_display_configuration_change(handle,
+ &adev->pm.pm_display_cfg);
+ }
+--
+2.51.0
+
--- /dev/null
+From e8778ff9471ebd84847ba220f2215f3b6f118c16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 13:46:12 +0800
+Subject: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jesse.Zhang <Jesse.Zhang@amd.com>
+
+[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ]
+
+Previously, APU platforms (and other scenarios with uninitialized VRAM managers)
+triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root
+cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL,
+but that `man->bdev` (the backing device pointer within the manager) remains
+uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully
+set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to
+acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to
+a kernel OOPS.
+
+1. **amdgpu_cs.c**: Extend the existing bandwidth control check in
+ `amdgpu_cs_get_threshold_for_moves()` to include a check for
+ `ttm_resource_manager_used()`. If the manager is not used (uninitialized
+ `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific
+ logic that would trigger the NULL dereference.
+
+2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info
+ reporting to use a conditional: if the manager is used, return the real VRAM
+ usage; otherwise, return 0. This avoids accessing `man->bdev` when it is
+ NULL.
+
+3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function)
+ data write path. Use `ttm_resource_manager_used()` to check validity: if the
+ manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set
+ `fb_usage` to 0 (APUs have no discrete framebuffer to report).
+
+This approach is more robust than APU-specific checks because it:
+- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
+- Aligns with TTM's design by using its native helper function,
+- Preserves correct behavior for discrete GPUs (which have fully initialized
+ `man->bdev` and pass the `ttm_resource_manager_used()` check).
+
+v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++--
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 1ce1fd0c87a57..338fe62e864e9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -714,7 +714,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev,
+ */
+ const s64 us_upper_bound = 200000;
+
+- if (!adev->mm_stats.log2_max_MBps) {
++ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) {
+ *max_bytes = 0;
+ *max_vis_bytes = 0;
+ return;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 8a76960803c65..8162f7f625a86 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -758,7 +758,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ ui64 = atomic64_read(&adev->num_vram_cpu_page_faults);
+ return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
+ case AMDGPU_INFO_VRAM_USAGE:
+- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager);
++ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0;
+ return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
+ case AMDGPU_INFO_VIS_VRAM_USAGE:
+ ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr);
+@@ -804,8 +805,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ mem.vram.usable_heap_size = adev->gmc.real_vram_size -
+ atomic64_read(&adev->vram_pin_size) -
+ AMDGPU_VM_RESERVED_VRAM;
+- mem.vram.heap_usage =
+- ttm_resource_manager_usage(vram_man);
++ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(vram_man) : 0;
+ mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4;
+
+ mem.cpu_accessible_vram.total_heap_size =
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index 13f0cdeb59c46..e13bf2345ef5c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -598,8 +598,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev)
+ vf2pf_info->driver_cert = 0;
+ vf2pf_info->os_info.all = 0;
+
+- vf2pf_info->fb_usage =
+- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20;
++ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0;
+ vf2pf_info->fb_vis_usage =
+ amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20;
+ vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20;
+--
+2.51.0
+
--- /dev/null
+From 43d6dfa50cd299cad99b25f183e9253d8f149e65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 10:10:52 +0200
+Subject: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 33cc891b56b93cad1a83263eaf2e417436f70c82 ]
+
+Otherwise accessing them can cause a crash.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Tested-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+index 78f9e86ccc099..832ab87eb3451 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+@@ -234,6 +234,9 @@ static umode_t amdgpu_vram_attrs_is_visible(struct kobject *kobj,
+ !adev->gmc.vram_vendor)
+ return 0;
+
++ if (!ttm_resource_manager_used(&adev->mman.vram_mgr.manager))
++ return 0;
++
+ return attr->mode;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 7bca22ff154e50afa0a75f7db43d0ebf44871545 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 14:47:23 +0200
+Subject: drm/amdgpu: remove two invalid BUG_ON()s
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 5d55ed19d4190d2c210ac05ac7a53f800a8c6fe5 ]
+
+Those can be triggered trivially by userspace.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 --
+ drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+index c37527704d433..25a5f7fa5077d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -5864,8 +5864,6 @@ static void gfx_v11_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,
+ unsigned vmid = AMDGPU_JOB_GET_VMID(job);
+ u32 header, control = 0;
+
+- BUG_ON(ib->flags & AMDGPU_IB_FLAG_CE);
+-
+ header = PACKET3(PACKET3_INDIRECT_BUFFER, 2);
+
+ control |= ib->length_dw | (vmid << 24);
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+index fd44d5503e282..329632388b43e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+@@ -4421,8 +4421,6 @@ static void gfx_v12_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,
+ unsigned vmid = AMDGPU_JOB_GET_VMID(job);
+ u32 header, control = 0;
+
+- BUG_ON(ib->flags & AMDGPU_IB_FLAG_CE);
+-
+ header = PACKET3(PACKET3_INDIRECT_BUFFER, 2);
+
+ control |= ib->length_dw | (vmid << 24);
+--
+2.51.0
+
--- /dev/null
+From be8e244da108308ffa4d9e2b586813307f3ba299 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 16:45:17 -0400
+Subject: drm/amdgpu: set default gfx reset masks for gfx6-8
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 90b75e12a6e831c8516498f690058d4165d5a5d6 ]
+
+These were not set so soft recovery was inadvertantly
+disabled.
+
+Fixes: 6ac55eab4fc4 ("drm/amdgpu: move reset support type checks into the caller")
+Reviewed-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1972763505d728c604b537180727ec8132e619df)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 5 +++++
+ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 5 +++++
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 5 +++++
+ 3 files changed, 15 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+index 70d7a1f434c4b..e2cf598f773a4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+@@ -3103,6 +3103,11 @@ static int gfx_v6_0_sw_init(struct amdgpu_ip_block *ip_block)
+ return r;
+ }
+
++ adev->gfx.gfx_supported_reset =
++ amdgpu_get_soft_full_reset_mask(&adev->gfx.gfx_ring[0]);
++ adev->gfx.compute_supported_reset =
++ amdgpu_get_soft_full_reset_mask(&adev->gfx.compute_ring[0]);
++
+ return r;
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+index 2aa323dab34e3..df1993d137364 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+@@ -4400,6 +4400,11 @@ static int gfx_v7_0_sw_init(struct amdgpu_ip_block *ip_block)
+
+ gfx_v7_0_gpu_early_init(adev);
+
++ adev->gfx.gfx_supported_reset =
++ amdgpu_get_soft_full_reset_mask(&adev->gfx.gfx_ring[0]);
++ adev->gfx.compute_supported_reset =
++ amdgpu_get_soft_full_reset_mask(&adev->gfx.compute_ring[0]);
++
+ return r;
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index 367449d8061b0..13e38b44540bd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -2024,6 +2024,11 @@ static int gfx_v8_0_sw_init(struct amdgpu_ip_block *ip_block)
+ if (r)
+ return r;
+
++ adev->gfx.gfx_supported_reset =
++ amdgpu_get_soft_full_reset_mask(&adev->gfx.gfx_ring[0]);
++ adev->gfx.compute_supported_reset =
++ amdgpu_get_soft_full_reset_mask(&adev->gfx.compute_ring[0]);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 23950cfd71285a2fb699e7ce2d465b7de43f0431 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jun 2025 10:31:15 -0400
+Subject: drm/amdkfd: fix suspend/resume all calls in mes based eviction path
+
+From: Jonathan Kim <jonathan.kim@amd.com>
+
+[ Upstream commit 079ae5118e1f0dcf5b1ab68ffdb5760b06ed79a2 ]
+
+Suspend/resume all gangs should be done with the device lock is held.
+
+Signed-off-by: Jonathan Kim <jonathan.kim@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Harish Kasiviswanathan <harish.kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/amdkfd/kfd_device_queue_manager.c | 73 ++++++-------------
+ 1 file changed, 21 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+index 6c5c7c1bf5eda..6e7bc983fc0b6 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -1209,6 +1209,15 @@ static int evict_process_queues_cpsch(struct device_queue_manager *dqm,
+ pr_debug_ratelimited("Evicting process pid %d queues\n",
+ pdd->process->lead_thread->pid);
+
++ if (dqm->dev->kfd->shared_resources.enable_mes) {
++ pdd->last_evict_timestamp = get_jiffies_64();
++ retval = suspend_all_queues_mes(dqm);
++ if (retval) {
++ dev_err(dev, "Suspending all queues failed");
++ goto out;
++ }
++ }
++
+ /* Mark all queues as evicted. Deactivate all active queues on
+ * the qpd.
+ */
+@@ -1221,23 +1230,27 @@ static int evict_process_queues_cpsch(struct device_queue_manager *dqm,
+ decrement_queue_count(dqm, qpd, q);
+
+ if (dqm->dev->kfd->shared_resources.enable_mes) {
+- int err;
+-
+- err = remove_queue_mes(dqm, q, qpd);
+- if (err) {
++ retval = remove_queue_mes(dqm, q, qpd);
++ if (retval) {
+ dev_err(dev, "Failed to evict queue %d\n",
+ q->properties.queue_id);
+- retval = err;
++ goto out;
+ }
+ }
+ }
+- pdd->last_evict_timestamp = get_jiffies_64();
+- if (!dqm->dev->kfd->shared_resources.enable_mes)
++
++ if (!dqm->dev->kfd->shared_resources.enable_mes) {
++ pdd->last_evict_timestamp = get_jiffies_64();
+ retval = execute_queues_cpsch(dqm,
+ qpd->is_debug ?
+ KFD_UNMAP_QUEUES_FILTER_ALL_QUEUES :
+ KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0,
+ USE_DEFAULT_GRACE_PERIOD);
++ } else {
++ retval = resume_all_queues_mes(dqm);
++ if (retval)
++ dev_err(dev, "Resuming all queues failed");
++ }
+
+ out:
+ dqm_unlock(dqm);
+@@ -3098,61 +3111,17 @@ int kfd_dqm_suspend_bad_queue_mes(struct kfd_node *knode, u32 pasid, u32 doorbel
+ return ret;
+ }
+
+-static int kfd_dqm_evict_pasid_mes(struct device_queue_manager *dqm,
+- struct qcm_process_device *qpd)
+-{
+- struct device *dev = dqm->dev->adev->dev;
+- int ret = 0;
+-
+- /* Check if process is already evicted */
+- dqm_lock(dqm);
+- if (qpd->evicted) {
+- /* Increment the evicted count to make sure the
+- * process stays evicted before its terminated.
+- */
+- qpd->evicted++;
+- dqm_unlock(dqm);
+- goto out;
+- }
+- dqm_unlock(dqm);
+-
+- ret = suspend_all_queues_mes(dqm);
+- if (ret) {
+- dev_err(dev, "Suspending all queues failed");
+- goto out;
+- }
+-
+- ret = dqm->ops.evict_process_queues(dqm, qpd);
+- if (ret) {
+- dev_err(dev, "Evicting process queues failed");
+- goto out;
+- }
+-
+- ret = resume_all_queues_mes(dqm);
+- if (ret)
+- dev_err(dev, "Resuming all queues failed");
+-
+-out:
+- return ret;
+-}
+-
+ int kfd_evict_process_device(struct kfd_process_device *pdd)
+ {
+ struct device_queue_manager *dqm;
+ struct kfd_process *p;
+- int ret = 0;
+
+ p = pdd->process;
+ dqm = pdd->dev->dqm;
+
+ WARN(debug_evictions, "Evicting pid %d", p->lead_thread->pid);
+
+- if (dqm->dev->kfd->shared_resources.enable_mes)
+- ret = kfd_dqm_evict_pasid_mes(dqm, &pdd->qpd);
+- else
+- ret = dqm->ops.evict_process_queues(dqm, &pdd->qpd);
+-
+- return ret;
++ return dqm->ops.evict_process_queues(dqm, &pdd->qpd);
+ }
+
+ int reserve_debug_trap_vmid(struct device_queue_manager *dqm,
+--
+2.51.0
+
--- /dev/null
+From ec6f87b3afeea37ae2fe696cbbe19560376a0c85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 10:25:19 +0200
+Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
+
+From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+
+[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ]
+
+On completion of i915_vma_pin_ww(), a synchronous variant of
+dma_fence_work_commit() is called. When pinning a VMA to GGTT address
+space on a Cherry View family processor, or on a Broxton generation SoC
+with VTD enabled, i.e., when stop_machine() is then called from
+intel_ggtt_bind_vma(), that can potentially lead to lock inversion among
+reservation_ww and cpu_hotplug locks.
+
+[86.861179] ======================================================
+[86.861193] WARNING: possible circular locking dependency detected
+[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U
+[86.861226] ------------------------------------------------------
+[86.861238] i915_module_loa/1432 is trying to acquire lock:
+[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50
+[86.861290]
+but task is already holding lock:
+[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.862233]
+which lock already depends on the new lock.
+[86.862251]
+the existing dependency chain (in reverse order) is:
+[86.862265]
+-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}:
+[86.862292] dma_resv_lockdep+0x19a/0x390
+[86.862315] do_one_initcall+0x60/0x3f0
+[86.862334] kernel_init_freeable+0x3cd/0x680
+[86.862353] kernel_init+0x1b/0x200
+[86.862369] ret_from_fork+0x47/0x70
+[86.862383] ret_from_fork_asm+0x1a/0x30
+[86.862399]
+-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}:
+[86.862425] dma_resv_lockdep+0x178/0x390
+[86.862440] do_one_initcall+0x60/0x3f0
+[86.862454] kernel_init_freeable+0x3cd/0x680
+[86.862470] kernel_init+0x1b/0x200
+[86.862482] ret_from_fork+0x47/0x70
+[86.862495] ret_from_fork_asm+0x1a/0x30
+[86.862509]
+-> #3 (&mm->mmap_lock){++++}-{3:3}:
+[86.862531] down_read_killable+0x46/0x1e0
+[86.862546] lock_mm_and_find_vma+0xa2/0x280
+[86.862561] do_user_addr_fault+0x266/0x8e0
+[86.862578] exc_page_fault+0x8a/0x2f0
+[86.862593] asm_exc_page_fault+0x27/0x30
+[86.862607] filldir64+0xeb/0x180
+[86.862620] kernfs_fop_readdir+0x118/0x480
+[86.862635] iterate_dir+0xcf/0x2b0
+[86.862648] __x64_sys_getdents64+0x84/0x140
+[86.862661] x64_sys_call+0x1058/0x2660
+[86.862675] do_syscall_64+0x91/0xe90
+[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.862703]
+-> #2 (&root->kernfs_rwsem){++++}-{3:3}:
+[86.862725] down_write+0x3e/0xf0
+[86.862738] kernfs_add_one+0x30/0x3c0
+[86.862751] kernfs_create_dir_ns+0x53/0xb0
+[86.862765] internal_create_group+0x134/0x4c0
+[86.862779] sysfs_create_group+0x13/0x20
+[86.862792] topology_add_dev+0x1d/0x30
+[86.862806] cpuhp_invoke_callback+0x4b5/0x850
+[86.862822] cpuhp_issue_call+0xbf/0x1f0
+[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320
+[86.862852] __cpuhp_setup_state+0xb0/0x220
+[86.862866] topology_sysfs_init+0x30/0x50
+[86.862879] do_one_initcall+0x60/0x3f0
+[86.862893] kernel_init_freeable+0x3cd/0x680
+[86.862908] kernel_init+0x1b/0x200
+[86.862921] ret_from_fork+0x47/0x70
+[86.862934] ret_from_fork_asm+0x1a/0x30
+[86.862947]
+-> #1 (cpuhp_state_mutex){+.+.}-{3:3}:
+[86.862969] __mutex_lock+0xaa/0xed0
+[86.862982] mutex_lock_nested+0x1b/0x30
+[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320
+[86.863012] __cpuhp_setup_state+0xb0/0x220
+[86.863026] page_alloc_init_cpuhp+0x2d/0x60
+[86.863041] mm_core_init+0x22/0x2d0
+[86.863054] start_kernel+0x576/0xbd0
+[86.863068] x86_64_start_reservations+0x18/0x30
+[86.863084] x86_64_start_kernel+0xbf/0x110
+[86.863098] common_startup_64+0x13e/0x141
+[86.863114]
+-> #0 (cpu_hotplug_lock){++++}-{0:0}:
+[86.863135] __lock_acquire+0x1635/0x2810
+[86.863152] lock_acquire+0xc4/0x2f0
+[86.863166] cpus_read_lock+0x41/0x100
+[86.863180] stop_machine+0x1c/0x50
+[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.864735] __vma_bind+0x55/0x70 [i915]
+[86.865510] fence_work+0x26/0xa0 [i915]
+[86.866248] fence_notify+0xa1/0x140 [i915]
+[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.867719] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.870001] initial_plane_vma+0x307/0x840 [i915]
+[86.870774] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.872330] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.873057] i915_pci_probe+0xe6/0x220 [i915]
+[86.873782] local_pci_probe+0x47/0xb0
+[86.873802] pci_device_probe+0xf3/0x260
+[86.873817] really_probe+0xf1/0x3c0
+[86.873833] __driver_probe_device+0x8c/0x180
+[86.873848] driver_probe_device+0x24/0xd0
+[86.873862] __driver_attach+0x10f/0x220
+[86.873876] bus_for_each_dev+0x7f/0xe0
+[86.873892] driver_attach+0x1e/0x30
+[86.873904] bus_add_driver+0x151/0x290
+[86.873917] driver_register+0x5e/0x130
+[86.873931] __pci_register_driver+0x7d/0x90
+[86.873945] i915_pci_register_driver+0x23/0x30 [i915]
+[86.874678] i915_init+0x37/0x120 [i915]
+[86.875347] do_one_initcall+0x60/0x3f0
+[86.875369] do_init_module+0x97/0x2a0
+[86.875385] load_module+0x2c54/0x2d80
+[86.875398] init_module_from_file+0x96/0xe0
+[86.875413] idempotent_init_module+0x117/0x330
+[86.875426] __x64_sys_finit_module+0x77/0x100
+[86.875440] x64_sys_call+0x24de/0x2660
+[86.875454] do_syscall_64+0x91/0xe90
+[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.875486]
+other info that might help us debug this:
+[86.875502] Chain exists of:
+ cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex
+[86.875539] Possible unsafe locking scenario:
+[86.875552] CPU0 CPU1
+[86.875563] ---- ----
+[86.875573] lock(reservation_ww_class_mutex);
+[86.875588] lock(reservation_ww_class_acquire);
+[86.875606] lock(reservation_ww_class_mutex);
+[86.875624] rlock(cpu_hotplug_lock);
+[86.875637]
+ *** DEADLOCK ***
+[86.875650] 3 locks held by i915_module_loa/1432:
+[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220
+[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.877305]
+stack backtrace:
+[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary)
+[86.877334] Tainted: [U]=USER
+[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020
+[86.877339] Call Trace:
+[86.877344] <TASK>
+[86.877353] dump_stack_lvl+0x91/0xf0
+[86.877364] dump_stack+0x10/0x20
+[86.877369] print_circular_bug+0x285/0x360
+[86.877379] check_noncircular+0x135/0x150
+[86.877390] __lock_acquire+0x1635/0x2810
+[86.877403] lock_acquire+0xc4/0x2f0
+[86.877408] ? stop_machine+0x1c/0x50
+[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878173] cpus_read_lock+0x41/0x100
+[86.878182] ? stop_machine+0x1c/0x50
+[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878916] stop_machine+0x1c/0x50
+[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.880375] __vma_bind+0x55/0x70 [i915]
+[86.881133] fence_work+0x26/0xa0 [i915]
+[86.881851] fence_notify+0xa1/0x140 [i915]
+[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.883286] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915]
+[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.886281] initial_plane_vma+0x307/0x840 [i915]
+[86.887049] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.888587] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.889293] ? mutex_unlock+0x12/0x20
+[86.889301] ? drm_privacy_screen_get+0x171/0x190
+[86.889308] ? acpi_dev_found+0x66/0x80
+[86.889321] i915_pci_probe+0xe6/0x220 [i915]
+[86.890038] local_pci_probe+0x47/0xb0
+[86.890049] pci_device_probe+0xf3/0x260
+[86.890058] really_probe+0xf1/0x3c0
+[86.890067] __driver_probe_device+0x8c/0x180
+[86.890072] driver_probe_device+0x24/0xd0
+[86.890078] __driver_attach+0x10f/0x220
+[86.890083] ? __pfx___driver_attach+0x10/0x10
+[86.890088] bus_for_each_dev+0x7f/0xe0
+[86.890097] driver_attach+0x1e/0x30
+[86.890101] bus_add_driver+0x151/0x290
+[86.890107] driver_register+0x5e/0x130
+[86.890113] __pci_register_driver+0x7d/0x90
+[86.890119] i915_pci_register_driver+0x23/0x30 [i915]
+[86.890833] i915_init+0x37/0x120 [i915]
+[86.891482] ? __pfx_i915_init+0x10/0x10 [i915]
+[86.892135] do_one_initcall+0x60/0x3f0
+[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470
+[86.892157] do_init_module+0x97/0x2a0
+[86.892164] load_module+0x2c54/0x2d80
+[86.892168] ? __kernel_read+0x15c/0x300
+[86.892185] ? kernel_read_file+0x2b1/0x320
+[86.892195] init_module_from_file+0x96/0xe0
+[86.892199] ? init_module_from_file+0x96/0xe0
+[86.892211] idempotent_init_module+0x117/0x330
+[86.892224] __x64_sys_finit_module+0x77/0x100
+[86.892230] x64_sys_call+0x24de/0x2660
+[86.892236] do_syscall_64+0x91/0xe90
+[86.892243] ? irqentry_exit+0x77/0xb0
+[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0
+[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.892261] RIP: 0033:0x7303e1b2725d
+[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
+[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d
+[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c
+[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80
+[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0
+[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710
+[86.892304] </TASK>
+
+Call asynchronous variant of dma_fence_work_commit() in that case.
+
+v3: Provide more verbose in-line comment (Andi),
+ - mention target environments in commit message.
+
+Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985
+Cc: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com>
+Acked-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com
+(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
+index 25e97031d76e4..30d5889fc809d 100644
+--- a/drivers/gpu/drm/i915/i915_vma.c
++++ b/drivers/gpu/drm/i915/i915_vma.c
+@@ -1595,8 +1595,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww,
+ err_vma_res:
+ i915_vma_resource_free(vma_res);
+ err_fence:
+- if (work)
+- dma_fence_work_commit_imm(&work->base);
++ if (work) {
++ /*
++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled,
++ * commit VMA binding asynchronously to avoid risk of lock
++ * inversion among reservation_ww locks held here and
++ * cpu_hotplug_lock acquired from stop_machine(), which we
++ * wrap around GGTT updates when running in those environments.
++ */
++ if (i915_vma_is_ggtt(vma) &&
++ intel_vm_no_concurrent_access_wa(vma->vm->i915))
++ dma_fence_work_commit(&work->base);
++ else
++ dma_fence_work_commit_imm(&work->base);
++ }
+ err_rpm:
+ intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref);
+
+--
+2.51.0
+
--- /dev/null
+From ca71b530397358ee19f633cda405cfee674c5275 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 17:03:51 -0700
+Subject: drm/i915: Fix conversion between clock ticks and nanoseconds
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ]
+
+When tick values are large, the multiplication by NSEC_PER_SEC is larger
+than 64 bits and results in bad conversions.
+
+The issue is seen in PMU busyness counters that look like they have
+wrapped around due to bad conversion. i915 PMU implementation returns
+monotonically increasing counters. If a count is lesser than previous
+one, it will only return the larger value until the smaller value
+catches up. The user will see this as zero delta between two
+measurements even though the engines are busy.
+
+Fix it by using mul_u64_u32_div()
+
+Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+[Rodrigo: Added the Fixes tag while cherry-picking to fixes]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+index 6c499692d61ef..3eb4206b371d2 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
++++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+@@ -205,7 +205,7 @@ static u64 div_u64_roundup(u64 nom, u32 den)
+
+ u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count)
+ {
+- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency);
++ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency);
+ }
+
+ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
+@@ -215,7 +215,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
+
+ u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns)
+ {
+- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC);
++ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC);
+ }
+
+ u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns)
+--
+2.51.0
+
--- /dev/null
+From 5dfe89f06c9be95f605de3fd55e497c72d237c33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:15:59 +0800
+Subject: drm/mediatek: Add pm_runtime support for GCE power control
+
+From: Jason-JH Lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit afcfb6c8474d9e750880aaa77952cc588f859613 ]
+
+Call pm_runtime_resume_and_get() before accessing GCE hardware in
+mbox_send_message(), and invoke pm_runtime_put_autosuspend() in the
+cmdq callback to release the PM reference and start autosuspend for
+GCE. This ensures correct power management for the GCE device.
+
+Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend")
+Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20250829091727.3745415-3-jason-jh.lin@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_crtc.c b/drivers/gpu/drm/mediatek/mtk_crtc.c
+index bc7527542fdc6..c4c6d0249df56 100644
+--- a/drivers/gpu/drm/mediatek/mtk_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_crtc.c
+@@ -283,6 +283,10 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
+ unsigned int i;
+ unsigned long flags;
+
++ /* release GCE HW usage and start autosuspend */
++ pm_runtime_mark_last_busy(cmdq_cl->chan->mbox->dev);
++ pm_runtime_put_autosuspend(cmdq_cl->chan->mbox->dev);
++
+ if (data->sta < 0)
+ return;
+
+@@ -618,6 +622,9 @@ static void mtk_crtc_update_config(struct mtk_crtc *mtk_crtc, bool needs_vblank)
+ mtk_crtc->config_updating = false;
+ spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
+
++ if (pm_runtime_resume_and_get(mtk_crtc->cmdq_client.chan->mbox->dev) < 0)
++ goto update_config_out;
++
+ mbox_send_message(mtk_crtc->cmdq_client.chan, cmdq_handle);
+ mbox_client_txdone(mtk_crtc->cmdq_client.chan, 0);
+ goto update_config_out;
+--
+2.51.0
+
--- /dev/null
+From b3e6d4c028c8f8c9c7b31ada67707b28acd26a10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Oct 2025 14:23:11 +0200
+Subject: drm/xe: Do clean shutdown also when using flr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+[ Upstream commit b11a020d914c3b7628f56a9ea476a5b03679489b ]
+
+Currently Xe driver is triggering flr without any clean-up on
+shutdown. This is causing random warnings from pending related works as the
+underlying hardware is reset in the middle of their execution.
+
+Fix this by performing clean shutdown also when using flr.
+
+Fixes: 501d799a47e2 ("drm/xe: Wire up device shutdown handler")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Reviewed-by: Maarten Lankhorst <dev@lankhorst.se>
+Link: https://patch.msgid.link/20251031122312.1836534-1-jouni.hogander@intel.com
+Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
+(cherry picked from commit a4ff26b7c8ef38e4dd34f77cbcd73576fdde6dd4)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_device.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
+index 528e818edbd7f..107c1f48e87fc 100644
+--- a/drivers/gpu/drm/xe/xe_device.c
++++ b/drivers/gpu/drm/xe/xe_device.c
+@@ -962,21 +962,21 @@ void xe_device_remove(struct xe_device *xe)
+
+ void xe_device_shutdown(struct xe_device *xe)
+ {
++ struct xe_gt *gt;
++ u8 id;
++
+ drm_dbg(&xe->drm, "Shutting down device\n");
+
+- if (xe_driver_flr_disabled(xe)) {
+- struct xe_gt *gt;
+- u8 id;
++ xe_display_pm_shutdown(xe);
+
+- xe_display_pm_shutdown(xe);
++ xe_irq_suspend(xe);
+
+- xe_irq_suspend(xe);
++ for_each_gt(gt, xe, id)
++ xe_gt_shutdown(gt);
+
+- for_each_gt(gt, xe, id)
+- xe_gt_shutdown(gt);
++ xe_display_pm_shutdown_late(xe);
+
+- xe_display_pm_shutdown_late(xe);
+- } else {
++ if (!xe_driver_flr_disabled(xe)) {
+ /* BOOM! */
+ __xe_driver_flr(xe);
+ }
+--
+2.51.0
+
--- /dev/null
+From c51df45c04f6fc2115483051acabf87452c27aa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 18:01:47 +0530
+Subject: drm/xe/guc: Synchronize Dead CT worker with unbind
+
+From: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
+
+[ Upstream commit 95af8f4fdce8349a5fe75264007f1af2aa1082ea ]
+
+Cancel and wait for any Dead CT worker to complete before continuing
+with device unbinding. Else the worker will end up using resources freed
+by the undind operation.
+
+Cc: Zhanjun Dong <zhanjun.dong@intel.com>
+Fixes: d2c5a5a926f4 ("drm/xe/guc: Dead CT helper")
+Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://patch.msgid.link/20251103123144.3231829-6-balasubramani.vivekanandan@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_ct.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c
+index 22eff8476ad48..75ac0c424476e 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ct.c
++++ b/drivers/gpu/drm/xe/xe_guc_ct.c
+@@ -200,6 +200,9 @@ static void guc_ct_fini(struct drm_device *drm, void *arg)
+ {
+ struct xe_guc_ct *ct = arg;
+
++#if IS_ENABLED(CONFIG_DRM_XE_DEBUG)
++ cancel_work_sync(&ct->dead.worker);
++#endif
+ ct_exit_safe_mode(ct);
+ destroy_workqueue(ct->g2h_wq);
+ xa_destroy(&ct->fence_lookup);
+--
+2.51.0
+
--- /dev/null
+From f0bbaa16aff1f0249b92b7c4a5dae26b1fc72e20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 15:32:08 +0530
+Subject: drm/xe: Move declarations under conditional branch
+
+From: Tejas Upadhyay <tejas.upadhyay@intel.com>
+
+[ Upstream commit 9cd27eec872f0b95dcdd811edc39d2d32e4158c8 ]
+
+The xe_device_shutdown() function was needing a few declarations
+that were only required under a specific condition. This change
+moves those declarations to be within that conditional branch
+to avoid unnecessary declarations.
+
+Reviewed-by: Nitin Gote <nitin.r.gote@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20251007100208.1407021-1-tejas.upadhyay@intel.com
+Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+(cherry picked from commit 15b3036045188f4da4ca62b2ed01b0f160252e9b)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Stable-dep-of: b11a020d914c ("drm/xe: Do clean shutdown also when using flr")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_device.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
+index d399c2628fa33..528e818edbd7f 100644
+--- a/drivers/gpu/drm/xe/xe_device.c
++++ b/drivers/gpu/drm/xe/xe_device.c
+@@ -962,12 +962,12 @@ void xe_device_remove(struct xe_device *xe)
+
+ void xe_device_shutdown(struct xe_device *xe)
+ {
+- struct xe_gt *gt;
+- u8 id;
+-
+ drm_dbg(&xe->drm, "Shutting down device\n");
+
+ if (xe_driver_flr_disabled(xe)) {
++ struct xe_gt *gt;
++ u8 id;
++
+ xe_display_pm_shutdown(xe);
+
+ xe_irq_suspend(xe);
+--
+2.51.0
+
--- /dev/null
+From 5f95347d9937b554eb6c1016b374389b67d0f837 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 22:01:46 +0900
+Subject: exfat: fix improper check of dentry.stream.valid_size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jaehun Gou <p22gone@gmail.com>
+
+[ Upstream commit 82ebecdc74ff555daf70b811d854b1f32a296bea ]
+
+We found an infinite loop bug in the exFAT file system that can lead to a
+Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is
+malformed, the following system calls — SYS_openat, SYS_ftruncate, and
+SYS_pwrite64 — can cause the kernel to hang.
+
+Root cause analysis shows that the size validation code in exfat_find()
+does not check whether dentry.stream.valid_size is negative. As a result,
+the system calls mentioned above can succeed and eventually trigger the DoS
+issue.
+
+This patch adds a check for negative dentry.stream.valid_size to prevent
+this vulnerability.
+
+Co-developed-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Co-developed-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
+Signed-off-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
+Signed-off-by: Jaehun Gou <p22gone@gmail.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/namei.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
+index f5f1c4e8a29fd..d8964d7368142 100644
+--- a/fs/exfat/namei.c
++++ b/fs/exfat/namei.c
+@@ -642,10 +642,14 @@ static int exfat_find(struct inode *dir, struct qstr *qname,
+
+ info->type = exfat_get_entry_type(ep);
+ info->attr = le16_to_cpu(ep->dentry.file.attr);
+- info->size = le64_to_cpu(ep2->dentry.stream.valid_size);
+ info->valid_size = le64_to_cpu(ep2->dentry.stream.valid_size);
+ info->size = le64_to_cpu(ep2->dentry.stream.size);
+
++ if (info->valid_size < 0) {
++ exfat_fs_error(sb, "data valid size is invalid(%lld)", info->valid_size);
++ return -EIO;
++ }
++
+ if (unlikely(EXFAT_B_TO_CLU_ROUND_UP(info->size, sbi) > sbi->used_clusters)) {
+ exfat_fs_error(sb, "data size is invalid(%lld)", info->size);
+ return -EIO;
+--
+2.51.0
+
--- /dev/null
+From ba2ca583dac790e402c0066589cf07ab80caf4f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 14:44:18 +0200
+Subject: fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls
+
+From: Andrey Albershteyn <aalbersh@redhat.com>
+
+[ Upstream commit d90ad28e8aa482e397150e22f3762173d918a724 ]
+
+These syscalls call to vfs_fileattr_get/set functions which return
+ENOIOCTLCMD if filesystem doesn't support setting file attribute on an
+inode. For syscalls EOPNOTSUPP would be more appropriate return error.
+
+Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/file_attr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/file_attr.c b/fs/file_attr.c
+index 460b2dd21a852..1dcec88c06805 100644
+--- a/fs/file_attr.c
++++ b/fs/file_attr.c
+@@ -416,6 +416,8 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename,
+ }
+
+ error = vfs_fileattr_get(filepath.dentry, &fa);
++ if (error == -ENOIOCTLCMD || error == -ENOTTY)
++ error = -EOPNOTSUPP;
+ if (error)
+ return error;
+
+@@ -483,6 +485,8 @@ SYSCALL_DEFINE5(file_setattr, int, dfd, const char __user *, filename,
+ if (!error) {
+ error = vfs_fileattr_set(mnt_idmap(filepath.mnt),
+ filepath.dentry, &fa);
++ if (error == -ENOIOCTLCMD || error == -ENOTTY)
++ error = -EOPNOTSUPP;
+ mnt_drop_write(filepath.mnt);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ad4fb608493218389c5b8e19df02713234fda7c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 16:29:46 +0200
+Subject: futex: Optimize per-cpu reference counting
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 4cb5ac2626b5704ed712ac1d46b9d89fdfc12c5d ]
+
+Shrikanth noted that the per-cpu reference counter was still some 10%
+slower than the old immutable option (which removes the reference
+counting entirely).
+
+Further optimize the per-cpu reference counter by:
+
+ - switching from RCU to preempt;
+ - using __this_cpu_*() since we now have preempt disabled;
+ - switching from smp_load_acquire() to READ_ONCE().
+
+This is all safe because disabling preemption inhibits the RCU grace
+period exactly like rcu_read_lock().
+
+Having preemption disabled allows using __this_cpu_*() provided the
+only access to the variable is in task context -- which is the case
+here.
+
+Furthermore, since we know changing fph->state to FR_ATOMIC demands a
+full RCU grace period we can rely on the implied smp_mb() from that to
+replace the acquire barrier().
+
+This is very similar to the percpu_down_read_internal() fast-path.
+
+The reason this is significant for PowerPC is that it uses the generic
+this_cpu_*() implementation which relies on local_irq_disable() (the
+x86 implementation relies on it being a single memop instruction to be
+IRQ-safe). Switching to preempt_disable() and __this_cpu*() avoids
+this IRQ state swizzling. Also, PowerPC needs LWSYNC for the ACQUIRE
+barrier, not having to use explicit barriers safes a bunch.
+
+Combined this reduces the performance gap by half, down to some 5%.
+
+Fixes: 760e6f7befba ("futex: Remove support for IMMUTABLE")
+Reported-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Tested-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://patch.msgid.link/20251106092929.GR4067720@noisy.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/core.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/futex/core.c b/kernel/futex/core.c
+index 125804fbb5cb1..2e77a6e5c8657 100644
+--- a/kernel/futex/core.c
++++ b/kernel/futex/core.c
+@@ -1680,10 +1680,10 @@ static bool futex_ref_get(struct futex_private_hash *fph)
+ {
+ struct mm_struct *mm = fph->mm;
+
+- guard(rcu)();
++ guard(preempt)();
+
+- if (smp_load_acquire(&fph->state) == FR_PERCPU) {
+- this_cpu_inc(*mm->futex_ref);
++ if (READ_ONCE(fph->state) == FR_PERCPU) {
++ __this_cpu_inc(*mm->futex_ref);
+ return true;
+ }
+
+@@ -1694,10 +1694,10 @@ static bool futex_ref_put(struct futex_private_hash *fph)
+ {
+ struct mm_struct *mm = fph->mm;
+
+- guard(rcu)();
++ guard(preempt)();
+
+- if (smp_load_acquire(&fph->state) == FR_PERCPU) {
+- this_cpu_dec(*mm->futex_ref);
++ if (READ_ONCE(fph->state) == FR_PERCPU) {
++ __this_cpu_dec(*mm->futex_ref);
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c7d70d25938df908d5bad03dc792870ad98450e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 10:07:20 +0530
+Subject: HID: intel-thc-hid: intel-quickspi: Add ARL PCI Device Id's
+
+From: Abhishek Tamboli <abhishektamboli9@gmail.com>
+
+[ Upstream commit 50f1f782f8d621a90108340c632bcb6ab4307d2e ]
+
+Add the missing PCI ID for the quickspi device used on
+the Lenovo Yoga Pro 9i 16IAH10.
+
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=220567
+
+Signed-off-by: Abhishek Tamboli <abhishektamboli9@gmail.com>
+Reviewed-by: Even Xu <even.xu@intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 6 ++++++
+ drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 ++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+index 84314989dc534..14cabd5dc6ddb 100644
+--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
++++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+@@ -33,6 +33,10 @@ struct quickspi_driver_data ptl = {
+ .max_packet_size_value = MAX_PACKET_SIZE_VALUE_LNL,
+ };
+
++struct quickspi_driver_data arl = {
++ .max_packet_size_value = MAX_PACKET_SIZE_VALUE_MTL,
++};
++
+ /* THC QuickSPI ACPI method to get device properties */
+ /* HIDSPI Method: {6e2ac436-0fcf-41af-a265-b32a220dcfab} */
+ static guid_t hidspi_guid =
+@@ -978,6 +982,8 @@ static const struct pci_device_id quickspi_pci_tbl[] = {
+ {PCI_DEVICE_DATA(INTEL, THC_PTL_U_DEVICE_ID_SPI_PORT2, &ptl), },
+ {PCI_DEVICE_DATA(INTEL, THC_WCL_DEVICE_ID_SPI_PORT1, &ptl), },
+ {PCI_DEVICE_DATA(INTEL, THC_WCL_DEVICE_ID_SPI_PORT2, &ptl), },
++ {PCI_DEVICE_DATA(INTEL, THC_ARL_DEVICE_ID_SPI_PORT1, &arl), },
++ {PCI_DEVICE_DATA(INTEL, THC_ARL_DEVICE_ID_SPI_PORT2, &arl), },
+ {}
+ };
+ MODULE_DEVICE_TABLE(pci, quickspi_pci_tbl);
+diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
+index f3532d866749c..c30e1a42eb098 100644
+--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
++++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
+@@ -21,6 +21,8 @@
+ #define PCI_DEVICE_ID_INTEL_THC_PTL_U_DEVICE_ID_SPI_PORT2 0xE44B
+ #define PCI_DEVICE_ID_INTEL_THC_WCL_DEVICE_ID_SPI_PORT1 0x4D49
+ #define PCI_DEVICE_ID_INTEL_THC_WCL_DEVICE_ID_SPI_PORT2 0x4D4B
++#define PCI_DEVICE_ID_INTEL_THC_ARL_DEVICE_ID_SPI_PORT1 0x7749
++#define PCI_DEVICE_ID_INTEL_THC_ARL_DEVICE_ID_SPI_PORT2 0x774B
+
+ /* HIDSPI special ACPI parameters DSM methods */
+ #define ACPI_QUICKSPI_REVISION_NUM 2
+--
+2.51.0
+
--- /dev/null
+From ed27cc0856051778d146f5f88c04d0c2a46874f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 02:05:49 +0100
+Subject: HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
+
+From: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
+
+[ Upstream commit ed80cc4667ac997b84546e6d35f0a0ae525d239c ]
+
+The Logitech G502 Hero Wireless's high resolution scrolling resets after
+being unplugged without notifying the driver, causing extremely slow
+scrolling.
+
+The only indication of this is a battery update packet, so add a quirk to
+detect when the device is unplugged and re-enable the scrolling.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218037
+Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index aaef405a717ee..5e763de4b94fd 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -75,6 +75,7 @@ MODULE_PARM_DESC(disable_tap_to_click,
+ #define HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS BIT(27)
+ #define HIDPP_QUIRK_HI_RES_SCROLL_1P0 BIT(28)
+ #define HIDPP_QUIRK_WIRELESS_STATUS BIT(29)
++#define HIDPP_QUIRK_RESET_HI_RES_SCROLL BIT(30)
+
+ /* These are just aliases for now */
+ #define HIDPP_QUIRK_KBD_SCROLL_WHEEL HIDPP_QUIRK_HIDPP_WHEELS
+@@ -193,6 +194,7 @@ struct hidpp_device {
+ void *private_data;
+
+ struct work_struct work;
++ struct work_struct reset_hi_res_work;
+ struct kfifo delayed_work_fifo;
+ struct input_dev *delayed_input;
+
+@@ -3836,6 +3838,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
+ struct hidpp_report *answer = hidpp->send_receive_buf;
+ struct hidpp_report *report = (struct hidpp_report *)data;
+ int ret;
++ int last_online;
+
+ /*
+ * If the mutex is locked then we have a pending answer from a
+@@ -3877,6 +3880,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
+ "See: https://gitlab.freedesktop.org/jwrdegoede/logitech-27mhz-keyboard-encryption-setup/\n");
+ }
+
++ last_online = hidpp->battery.online;
+ if (hidpp->capabilities & HIDPP_CAPABILITY_HIDPP20_BATTERY) {
+ ret = hidpp20_battery_event_1000(hidpp, data, size);
+ if (ret != 0)
+@@ -3901,6 +3905,11 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
+ return ret;
+ }
+
++ if (hidpp->quirks & HIDPP_QUIRK_RESET_HI_RES_SCROLL) {
++ if (last_online == 0 && hidpp->battery.online == 1)
++ schedule_work(&hidpp->reset_hi_res_work);
++ }
++
+ if (hidpp->quirks & HIDPP_QUIRK_HIDPP_WHEELS) {
+ ret = hidpp10_wheel_raw_event(hidpp, data, size);
+ if (ret != 0)
+@@ -4274,6 +4283,13 @@ static void hidpp_connect_event(struct work_struct *work)
+ hidpp->delayed_input = input;
+ }
+
++static void hidpp_reset_hi_res_handler(struct work_struct *work)
++{
++ struct hidpp_device *hidpp = container_of(work, struct hidpp_device, reset_hi_res_work);
++
++ hi_res_scroll_enable(hidpp);
++}
++
+ static DEVICE_ATTR(builtin_power_supply, 0000, NULL, NULL);
+
+ static struct attribute *sysfs_attrs[] = {
+@@ -4404,6 +4420,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ }
+
+ INIT_WORK(&hidpp->work, hidpp_connect_event);
++ INIT_WORK(&hidpp->reset_hi_res_work, hidpp_reset_hi_res_handler);
+ mutex_init(&hidpp->send_mutex);
+ init_waitqueue_head(&hidpp->wait);
+
+@@ -4499,6 +4516,7 @@ static void hidpp_remove(struct hid_device *hdev)
+
+ hid_hw_stop(hdev);
+ cancel_work_sync(&hidpp->work);
++ cancel_work_sync(&hidpp->reset_hi_res_work);
+ mutex_destroy(&hidpp->send_mutex);
+ }
+
+@@ -4546,6 +4564,9 @@ static const struct hid_device_id hidpp_devices[] = {
+ { /* Keyboard MX5500 (Bluetooth-receiver in HID proxy mode) */
+ LDJ_DEVICE(0xb30b),
+ .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
++ { /* Logitech G502 Lightspeed Wireless Gaming Mouse */
++ LDJ_DEVICE(0x407f),
++ .driver_data = HIDPP_QUIRK_RESET_HI_RES_SCROLL },
+
+ { LDJ_DEVICE(HID_ANY_ID) },
+
+--
+2.51.0
+
--- /dev/null
+From 93d4e96d17370223865894dccc575c0dc402e4ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 18:05:32 -0700
+Subject: HID: nintendo: Wait longer for initial probe
+
+From: Vicki Pfau <vi@endrift.com>
+
+[ Upstream commit b73bc6a51f0c0066912c7e181acee41091c70fe6 ]
+
+Some third-party controllers, such as the PB Tails CHOC, won't always
+respond quickly on startup. Since this packet is needed for probe, and only
+once during probe, let's just wait an extra second, which makes connecting
+consistent.
+
+Signed-off-by: Vicki Pfau <vi@endrift.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-nintendo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c
+index fb4985988615b..e3e54f1df44fa 100644
+--- a/drivers/hid/hid-nintendo.c
++++ b/drivers/hid/hid-nintendo.c
+@@ -2420,7 +2420,7 @@ static int joycon_read_info(struct joycon_ctlr *ctlr)
+ struct joycon_input_report *report;
+
+ req.subcmd_id = JC_SUBCMD_REQ_DEV_INFO;
+- ret = joycon_send_subcmd(ctlr, &req, 0, HZ);
++ ret = joycon_send_subcmd(ctlr, &req, 0, 2 * HZ);
+ if (ret) {
+ hid_err(ctlr->hdev, "Failed to get joycon info; ret=%d\n", ret);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From a7988fd034b9e2337d50ccb91e3404e73f150313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 18:46:11 +0300
+Subject: HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
+
+From: Oleg Makarenko <oleg@makarenk.ooo>
+
+[ Upstream commit 1141ed52348d3df82d3fd2316128b3fc6203a68c ]
+
+This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick.
+This device reboots itself every 8-10 seconds if it is not polled.
+
+Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index d05a62bbafffb..0723b4b1c9eca 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1435,6 +1435,7 @@
+
+ #define USB_VENDOR_ID_VRS 0x0483
+ #define USB_DEVICE_ID_VRS_DFP 0xa355
++#define USB_DEVICE_ID_VRS_R295 0xa44c
+
+ #define USB_VENDOR_ID_VTL 0x0306
+ #define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index d7105a8395982..bcd4bccf1a7ce 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -207,6 +207,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT },
++ { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_R295), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT },
+--
+2.51.0
+
--- /dev/null
+From 2dcf6130bbf2c3011a57cceb55722e695fa2bbb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 18:25:43 +0200
+Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
+
+From: Tristan Lobb <tristan.lobb@it-lobb.de>
+
+[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
+
+The Cooler Master Mice Dongle includes a vendor defined HID interface
+alongside its mouse interface. Not polling it will cause the mouse to
+stop responding to polls on any interface once woken up again after
+going into power saving mode.
+
+Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
+the Dongle's PID.
+
+Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 5721b8414bbdf..d05a62bbafffb 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -342,6 +342,9 @@
+ #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
+ #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+
++#define USB_VENDOR_ID_COOLER_MASTER 0x2516
++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7
++
+ #define USB_VENDOR_ID_CORSAIR 0x1b1c
+ #define USB_DEVICE_ID_CORSAIR_K90 0x1b02
+ #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index ffd034566e2e1..d7105a8395982 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET },
++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
+--
+2.51.0
+
--- /dev/null
+From 1cd191e1e68b4ee388d1fc2fb8b10c13d089f354 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 13:10:31 +0100
+Subject: io_uring: fix unexpected placement on same size resizing
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 437c23357d897f5b5b7d297c477da44b56654d46 ]
+
+There might be many reasons why a user is resizing a ring, e.g. moving
+to huge pages or for some memory compaction using IORING_SETUP_NO_MMAP.
+Don't bypass resizing, the user will definitely be surprised seeing 0
+while the rings weren't actually moved to a new place.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/register.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/io_uring/register.c b/io_uring/register.c
+index b1772a470bf6e..dacbe8596b5c2 100644
+--- a/io_uring/register.c
++++ b/io_uring/register.c
+@@ -426,13 +426,6 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
+ if (unlikely(ret))
+ return ret;
+
+- /* nothing to do, but copy params back */
+- if (p.sq_entries == ctx->sq_entries && p.cq_entries == ctx->cq_entries) {
+- if (copy_to_user(arg, &p, sizeof(p)))
+- return -EFAULT;
+- return 0;
+- }
+-
+ size = rings_size(p.flags, p.sq_entries, p.cq_entries,
+ &sq_array_offset);
+ if (size == SIZE_MAX)
+--
+2.51.0
+
--- /dev/null
+From 54b7bd7b656edb0852aec59777940f2be8a85f2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 14:11:49 -0400
+Subject: iommufd: Make vfio_compat's unmap succeed if the range is already
+ empty
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit afb47765f9235181fddc61c8633b5a8cfae29fd2 ]
+
+iommufd returns ENOENT when attempting to unmap a range that is already
+empty, while vfio type1 returns success. Fix vfio_compat to match.
+
+Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
+Link: https://patch.msgid.link/r/0-v1-76be45eff0be+5d-iommufd_unmap_compat_jgg@nvidia.com
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Reviewed-by: Alex Mastro <amastro@fb.com>
+Reported-by: Alex Mastro <amastro@fb.com>
+Closes: https://lore.kernel.org/r/aP0S5ZF9l3sWkJ1G@devgpu012.nha5.facebook.com
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommufd/io_pagetable.c | 12 +++---------
+ drivers/iommu/iommufd/ioas.c | 4 ++++
+ tools/testing/selftests/iommu/iommufd.c | 2 ++
+ 3 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c
+index c0360c450880b..75d60f2ad9008 100644
+--- a/drivers/iommu/iommufd/io_pagetable.c
++++ b/drivers/iommu/iommufd/io_pagetable.c
+@@ -707,7 +707,8 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,
+ struct iopt_area *area;
+ unsigned long unmapped_bytes = 0;
+ unsigned int tries = 0;
+- int rc = -ENOENT;
++ /* If there are no mapped entries then success */
++ int rc = 0;
+
+ /*
+ * The domains_rwsem must be held in read mode any time any area->pages
+@@ -777,8 +778,6 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,
+
+ down_write(&iopt->iova_rwsem);
+ }
+- if (unmapped_bytes)
+- rc = 0;
+
+ out_unlock_iova:
+ up_write(&iopt->iova_rwsem);
+@@ -815,13 +814,8 @@ int iopt_unmap_iova(struct io_pagetable *iopt, unsigned long iova,
+
+ int iopt_unmap_all(struct io_pagetable *iopt, unsigned long *unmapped)
+ {
+- int rc;
+-
+- rc = iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped);
+ /* If the IOVAs are empty then unmap all succeeds */
+- if (rc == -ENOENT)
+- return 0;
+- return rc;
++ return iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped);
+ }
+
+ /* The caller must always free all the nodes in the allowed_iova rb_root. */
+diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c
+index 1542c5fd10a85..459a7c5169154 100644
+--- a/drivers/iommu/iommufd/ioas.c
++++ b/drivers/iommu/iommufd/ioas.c
+@@ -367,6 +367,10 @@ int iommufd_ioas_unmap(struct iommufd_ucmd *ucmd)
+ &unmapped);
+ if (rc)
+ goto out_put;
++ if (!unmapped) {
++ rc = -ENOENT;
++ goto out_put;
++ }
+ }
+
+ cmd->length = unmapped;
+diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c
+index 3eebf5e3b974f..bb4d33dde3c89 100644
+--- a/tools/testing/selftests/iommu/iommufd.c
++++ b/tools/testing/selftests/iommu/iommufd.c
+@@ -2638,6 +2638,8 @@ TEST_F(vfio_compat_mock_domain, map)
+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd));
+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd));
+ ASSERT_EQ(BUFFER_SIZE, unmap_cmd.size);
++ /* Unmap of empty is success */
++ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd));
+
+ /* UNMAP_FLAG_ALL requires 0 iova/size */
+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd));
+--
+2.51.0
+
--- /dev/null
+From 14db657b771530a7b3aac67a559846a93609d957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 14:48:46 -0700
+Subject: iommufd/selftest: Fix ioctl return value in
+ _test_cmd_trigger_vevents()
+
+From: Nicolin Chen <nicolinc@nvidia.com>
+
+[ Upstream commit b09ed52db1e688eb8205b1939ca1345179ecd515 ]
+
+The ioctl returns 0 upon success, so !0 returning -1 breaks the selftest.
+
+Drop the '!' to fix it.
+
+Fixes: 1d235d849425 ("iommu/selftest: prevent use of uninitialized variable")
+Link: https://patch.msgid.link/r/20251014214847.1113759-1-nicolinc@nvidia.com
+Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/iommu/iommufd_utils.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h
+index 772ca1db6e597..9f472c20c1905 100644
+--- a/tools/testing/selftests/iommu/iommufd_utils.h
++++ b/tools/testing/selftests/iommu/iommufd_utils.h
+@@ -1044,8 +1044,8 @@ static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents)
+ };
+
+ while (nvevents--) {
+- if (!ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
+- &trigger_vevent_cmd))
++ if (ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
++ &trigger_vevent_cmd))
+ return -1;
+ }
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From aaa4fe7863f7c00456c53d957dd7d6e4b6fe98e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 17:03:50 -0700
+Subject: ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd
+
+From: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+
+[ Upstream commit 823be089f9c8ab136ba382b516aedd3f7ac854bd ]
+
+Send to VF information about features supported by the PF driver.
+
+Increase API version to 1.7.
+
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-5-ef32a425b92a@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 10 +++++
+ .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 37 +++++++++++++++++++
+ 2 files changed, 47 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h
+index f7256a339c99b..0334ed4b8fa39 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h
+@@ -52,6 +52,7 @@ enum ixgbe_pfvf_api_rev {
+ ixgbe_mbox_api_14, /* API version 1.4, linux/freebsd VF driver */
+ ixgbe_mbox_api_15, /* API version 1.5, linux/freebsd VF driver */
+ ixgbe_mbox_api_16, /* API version 1.6, linux/freebsd VF driver */
++ ixgbe_mbox_api_17, /* API version 1.7, linux/freebsd VF driver */
+ /* This value should always be last */
+ ixgbe_mbox_api_unknown, /* indicates that API version is not known */
+ };
+@@ -91,6 +92,9 @@ enum ixgbe_pfvf_api_rev {
+ /* mailbox API, version 1.6 VF requests */
+ #define IXGBE_VF_GET_PF_LINK_STATE 0x11 /* request PF to send link info */
+
++/* mailbox API, version 1.7 VF requests */
++#define IXGBE_VF_FEATURES_NEGOTIATE 0x12 /* get features supported by PF */
++
+ /* length of permanent address message returned from PF */
+ #define IXGBE_VF_PERMADDR_MSG_LEN 4
+ /* word in permanent address message with the current multicast type */
+@@ -101,6 +105,12 @@ enum ixgbe_pfvf_api_rev {
+ #define IXGBE_VF_MBX_INIT_TIMEOUT 2000 /* number of retries on mailbox */
+ #define IXGBE_VF_MBX_INIT_DELAY 500 /* microseconds between retries */
+
++/* features negotiated between PF/VF */
++#define IXGBEVF_PF_SUP_IPSEC BIT(0)
++#define IXGBEVF_PF_SUP_ESX_MBX BIT(1)
++
++#define IXGBE_SUPPORTED_FEATURES IXGBEVF_PF_SUP_IPSEC
++
+ struct ixgbe_hw;
+
+ int ixgbe_read_mbx(struct ixgbe_hw *, u32 *, u16, u16);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index b09271d61a4ef..ee133d6749b37 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -511,6 +511,7 @@ static int ixgbe_set_vf_lpe(struct ixgbe_adapter *adapter, u32 max_frame, u32 vf
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
+ case ixgbe_mbox_api_16:
++ case ixgbe_mbox_api_17:
+ /* Version 1.1 supports jumbo frames on VFs if PF has
+ * jumbo frames enabled which means legacy VFs are
+ * disabled
+@@ -1048,6 +1049,7 @@ static int ixgbe_negotiate_vf_api(struct ixgbe_adapter *adapter,
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
+ case ixgbe_mbox_api_16:
++ case ixgbe_mbox_api_17:
+ adapter->vfinfo[vf].vf_api = api;
+ return 0;
+ default:
+@@ -1075,6 +1077,7 @@ static int ixgbe_get_vf_queues(struct ixgbe_adapter *adapter,
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
+ case ixgbe_mbox_api_16:
++ case ixgbe_mbox_api_17:
+ break;
+ default:
+ return -1;
+@@ -1115,6 +1118,7 @@ static int ixgbe_get_vf_reta(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)
+
+ /* verify the PF is supporting the correct API */
+ switch (adapter->vfinfo[vf].vf_api) {
++ case ixgbe_mbox_api_17:
+ case ixgbe_mbox_api_16:
+ case ixgbe_mbox_api_14:
+ case ixgbe_mbox_api_13:
+@@ -1149,6 +1153,7 @@ static int ixgbe_get_vf_rss_key(struct ixgbe_adapter *adapter,
+
+ /* verify the PF is supporting the correct API */
+ switch (adapter->vfinfo[vf].vf_api) {
++ case ixgbe_mbox_api_17:
+ case ixgbe_mbox_api_16:
+ case ixgbe_mbox_api_14:
+ case ixgbe_mbox_api_13:
+@@ -1180,6 +1185,7 @@ static int ixgbe_update_vf_xcast_mode(struct ixgbe_adapter *adapter,
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
+ case ixgbe_mbox_api_16:
++ case ixgbe_mbox_api_17:
+ break;
+ default:
+ return -EOPNOTSUPP;
+@@ -1251,6 +1257,7 @@ static int ixgbe_get_vf_link_state(struct ixgbe_adapter *adapter,
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
+ case ixgbe_mbox_api_16:
++ case ixgbe_mbox_api_17:
+ break;
+ default:
+ return -EOPNOTSUPP;
+@@ -1278,6 +1285,7 @@ static int ixgbe_send_vf_link_status(struct ixgbe_adapter *adapter,
+
+ switch (adapter->vfinfo[vf].vf_api) {
+ case ixgbe_mbox_api_16:
++ case ixgbe_mbox_api_17:
+ if (hw->mac.type != ixgbe_mac_e610)
+ return -EOPNOTSUPP;
+ break;
+@@ -1293,6 +1301,32 @@ static int ixgbe_send_vf_link_status(struct ixgbe_adapter *adapter,
+ return 0;
+ }
+
++/**
++ * ixgbe_negotiate_vf_features - negotiate supported features with VF driver
++ * @adapter: pointer to adapter struct
++ * @msgbuf: pointer to message buffers
++ * @vf: VF identifier
++ *
++ * Return: 0 on success or -EOPNOTSUPP when operation is not supported.
++ */
++static int ixgbe_negotiate_vf_features(struct ixgbe_adapter *adapter,
++ u32 *msgbuf, u32 vf)
++{
++ u32 features = msgbuf[1];
++
++ switch (adapter->vfinfo[vf].vf_api) {
++ case ixgbe_mbox_api_17:
++ break;
++ default:
++ return -EOPNOTSUPP;
++ }
++
++ features &= IXGBE_SUPPORTED_FEATURES;
++ msgbuf[1] = features;
++
++ return 0;
++}
++
+ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf)
+ {
+ u32 mbx_size = IXGBE_VFMAILBOX_SIZE;
+@@ -1370,6 +1404,9 @@ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf)
+ case IXGBE_VF_GET_PF_LINK_STATE:
+ retval = ixgbe_send_vf_link_status(adapter, msgbuf, vf);
+ break;
++ case IXGBE_VF_FEATURES_NEGOTIATE:
++ retval = ixgbe_negotiate_vf_features(adapter, msgbuf, vf);
++ break;
+ default:
+ e_err(drv, "Unhandled Msg %8.8x\n", msgbuf[0]);
+ retval = -EIO;
+--
+2.51.0
+
--- /dev/null
+From e1186c67763b4c84716b67cf2d8ca19a6c112e2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 17:03:48 -0700
+Subject: ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation
+
+From: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+
+[ Upstream commit f7f97cbc03a470ce405d48dedb7f135713caa0fa ]
+
+Update supported API version and provide handler for
+IXGBE_VF_GET_PF_LINK_STATE cmd.
+Simply put stored values of link speed and link_up from adapter context.
+
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Link: https://lore.kernel.org/stable/20250828095227.1857066-3-jedrzej.jagielski%40intel.com
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-3-ef32a425b92a@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 5 +++
+ .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 42 +++++++++++++++++++
+ 2 files changed, 47 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h
+index 4af149b63a39f..f7256a339c99b 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h
+@@ -50,6 +50,8 @@ enum ixgbe_pfvf_api_rev {
+ ixgbe_mbox_api_12, /* API version 1.2, linux/freebsd VF driver */
+ ixgbe_mbox_api_13, /* API version 1.3, linux/freebsd VF driver */
+ ixgbe_mbox_api_14, /* API version 1.4, linux/freebsd VF driver */
++ ixgbe_mbox_api_15, /* API version 1.5, linux/freebsd VF driver */
++ ixgbe_mbox_api_16, /* API version 1.6, linux/freebsd VF driver */
+ /* This value should always be last */
+ ixgbe_mbox_api_unknown, /* indicates that API version is not known */
+ };
+@@ -86,6 +88,9 @@ enum ixgbe_pfvf_api_rev {
+
+ #define IXGBE_VF_GET_LINK_STATE 0x10 /* get vf link state */
+
++/* mailbox API, version 1.6 VF requests */
++#define IXGBE_VF_GET_PF_LINK_STATE 0x11 /* request PF to send link info */
++
+ /* length of permanent address message returned from PF */
+ #define IXGBE_VF_PERMADDR_MSG_LEN 4
+ /* word in permanent address message with the current multicast type */
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index 32ac1e020d915..b09271d61a4ef 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -510,6 +510,7 @@ static int ixgbe_set_vf_lpe(struct ixgbe_adapter *adapter, u32 max_frame, u32 vf
+ case ixgbe_mbox_api_12:
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
++ case ixgbe_mbox_api_16:
+ /* Version 1.1 supports jumbo frames on VFs if PF has
+ * jumbo frames enabled which means legacy VFs are
+ * disabled
+@@ -1046,6 +1047,7 @@ static int ixgbe_negotiate_vf_api(struct ixgbe_adapter *adapter,
+ case ixgbe_mbox_api_12:
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
++ case ixgbe_mbox_api_16:
+ adapter->vfinfo[vf].vf_api = api;
+ return 0;
+ default:
+@@ -1072,6 +1074,7 @@ static int ixgbe_get_vf_queues(struct ixgbe_adapter *adapter,
+ case ixgbe_mbox_api_12:
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
++ case ixgbe_mbox_api_16:
+ break;
+ default:
+ return -1;
+@@ -1112,6 +1115,7 @@ static int ixgbe_get_vf_reta(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)
+
+ /* verify the PF is supporting the correct API */
+ switch (adapter->vfinfo[vf].vf_api) {
++ case ixgbe_mbox_api_16:
+ case ixgbe_mbox_api_14:
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_12:
+@@ -1145,6 +1149,7 @@ static int ixgbe_get_vf_rss_key(struct ixgbe_adapter *adapter,
+
+ /* verify the PF is supporting the correct API */
+ switch (adapter->vfinfo[vf].vf_api) {
++ case ixgbe_mbox_api_16:
+ case ixgbe_mbox_api_14:
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_12:
+@@ -1174,6 +1179,7 @@ static int ixgbe_update_vf_xcast_mode(struct ixgbe_adapter *adapter,
+ fallthrough;
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
++ case ixgbe_mbox_api_16:
+ break;
+ default:
+ return -EOPNOTSUPP;
+@@ -1244,6 +1250,7 @@ static int ixgbe_get_vf_link_state(struct ixgbe_adapter *adapter,
+ case ixgbe_mbox_api_12:
+ case ixgbe_mbox_api_13:
+ case ixgbe_mbox_api_14:
++ case ixgbe_mbox_api_16:
+ break;
+ default:
+ return -EOPNOTSUPP;
+@@ -1254,6 +1261,38 @@ static int ixgbe_get_vf_link_state(struct ixgbe_adapter *adapter,
+ return 0;
+ }
+
++/**
++ * ixgbe_send_vf_link_status - send link status data to VF
++ * @adapter: pointer to adapter struct
++ * @msgbuf: pointer to message buffers
++ * @vf: VF identifier
++ *
++ * Reply for IXGBE_VF_GET_PF_LINK_STATE mbox command sending link status data.
++ *
++ * Return: 0 on success or -EOPNOTSUPP when operation is not supported.
++ */
++static int ixgbe_send_vf_link_status(struct ixgbe_adapter *adapter,
++ u32 *msgbuf, u32 vf)
++{
++ struct ixgbe_hw *hw = &adapter->hw;
++
++ switch (adapter->vfinfo[vf].vf_api) {
++ case ixgbe_mbox_api_16:
++ if (hw->mac.type != ixgbe_mac_e610)
++ return -EOPNOTSUPP;
++ break;
++ default:
++ return -EOPNOTSUPP;
++ }
++ /* Simply provide stored values as watchdog & link status events take
++ * care of its freshness.
++ */
++ msgbuf[1] = adapter->link_speed;
++ msgbuf[2] = adapter->link_up;
++
++ return 0;
++}
++
+ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf)
+ {
+ u32 mbx_size = IXGBE_VFMAILBOX_SIZE;
+@@ -1328,6 +1367,9 @@ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf)
+ case IXGBE_VF_IPSEC_DEL:
+ retval = ixgbe_ipsec_vf_del_sa(adapter, msgbuf, vf);
+ break;
++ case IXGBE_VF_GET_PF_LINK_STATE:
++ retval = ixgbe_send_vf_link_status(adapter, msgbuf, vf);
++ break;
+ default:
+ e_err(drv, "Unhandled Msg %8.8x\n", msgbuf[0]);
+ retval = -EIO;
+--
+2.51.0
+
--- /dev/null
+From 19fa4a6709afe41cdb540dba35bf017345f55fd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:42:12 -0400
+Subject: NFS: check if suid/sgid was cleared after a write as needed
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ]
+
+I noticed xfstests generic/193 and generic/355 started failing against
+knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN
+with OPEN4_SHARE_ACCESS_WRITE").
+
+I ran those same tests against ONTAP (which has had write delegation
+support for a lot longer than knfsd) and they fail there too... so
+while it's a new failure against knfsd, it isn't an entirely new
+failure.
+
+Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation
+doesn't keep the inode from being revalidated to fetch the updated mode.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/write.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 647c53d1418ae..d9edcc36b0b44 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1521,7 +1521,8 @@ static int nfs_writeback_done(struct rpc_task *task,
+ /* Deal with the suid/sgid bit corner case */
+ if (nfs_should_remove_suid(inode)) {
+ spin_lock(&inode->i_lock);
+- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE);
++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE
++ | NFS_INO_REVAL_FORCED);
+ spin_unlock(&inode->i_lock);
+ }
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 909386a42d14cf412aa95932a8a6a27b330a2418 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 15:22:58 -0600
+Subject: NFS4: Apply delay_retrans to async operations
+
+From: Joshua Watt <jpewhacker@gmail.com>
+
+[ Upstream commit 7a84394f02ab1985ebbe0a8d6f6d69bd040de4b3 ]
+
+The setting of delay_retrans is applied to synchronous RPC operations
+because the retransmit count is stored in same struct nfs4_exception
+that is passed each time an error is checked. However, for asynchronous
+operations (READ, WRITE, LOCKU, CLOSE, DELEGRETURN), a new struct
+nfs4_exception is made on the stack each time the task callback is
+invoked. This means that the retransmit count is always zero and thus
+delay_retrans never takes effect.
+
+Apply delay_retrans to these operations by tracking and updating their
+retransmit count.
+
+Change-Id: Ieb33e046c2b277cb979caa3faca7f52faf0568c9
+Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 13 +++++++++++++
+ include/linux/nfs_xdr.h | 1 +
+ 2 files changed, 14 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index b76da06864e53..e5fa29dcdd114 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3636,6 +3636,7 @@ struct nfs4_closedata {
+ } lr;
+ struct nfs_fattr fattr;
+ unsigned long timestamp;
++ unsigned short retrans;
+ };
+
+ static void nfs4_free_closedata(void *data)
+@@ -3664,6 +3665,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
+ .state = state,
+ .inode = calldata->inode,
+ .stateid = &calldata->arg.stateid,
++ .retrans = calldata->retrans,
+ };
+
+ if (!nfs4_sequence_done(task, &calldata->res.seq_res))
+@@ -3711,6 +3713,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
+ default:
+ task->tk_status = nfs4_async_handle_exception(task,
+ server, task->tk_status, &exception);
++ calldata->retrans = exception.retrans;
+ if (exception.retry)
+ goto out_restart;
+ }
+@@ -5593,9 +5596,11 @@ static int nfs4_read_done_cb(struct rpc_task *task, struct nfs_pgio_header *hdr)
+ .inode = hdr->inode,
+ .state = hdr->args.context->state,
+ .stateid = &hdr->args.stateid,
++ .retrans = hdr->retrans,
+ };
+ task->tk_status = nfs4_async_handle_exception(task,
+ server, task->tk_status, &exception);
++ hdr->retrans = exception.retrans;
+ if (exception.retry) {
+ rpc_restart_call_prepare(task);
+ return -EAGAIN;
+@@ -5709,10 +5714,12 @@ static int nfs4_write_done_cb(struct rpc_task *task,
+ .inode = hdr->inode,
+ .state = hdr->args.context->state,
+ .stateid = &hdr->args.stateid,
++ .retrans = hdr->retrans,
+ };
+ task->tk_status = nfs4_async_handle_exception(task,
+ NFS_SERVER(inode), task->tk_status,
+ &exception);
++ hdr->retrans = exception.retrans;
+ if (exception.retry) {
+ rpc_restart_call_prepare(task);
+ return -EAGAIN;
+@@ -6726,6 +6733,7 @@ struct nfs4_delegreturndata {
+ struct nfs_fh fh;
+ nfs4_stateid stateid;
+ unsigned long timestamp;
++ unsigned short retrans;
+ struct {
+ struct nfs4_layoutreturn_args arg;
+ struct nfs4_layoutreturn_res res;
+@@ -6746,6 +6754,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
+ .inode = data->inode,
+ .stateid = &data->stateid,
+ .task_is_privileged = data->args.seq_args.sa_privileged,
++ .retrans = data->retrans,
+ };
+
+ if (!nfs4_sequence_done(task, &data->res.seq_res))
+@@ -6817,6 +6826,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
+ task->tk_status = nfs4_async_handle_exception(task,
+ data->res.server, task->tk_status,
+ &exception);
++ data->retrans = exception.retrans;
+ if (exception.retry)
+ goto out_restart;
+ }
+@@ -7093,6 +7103,7 @@ struct nfs4_unlockdata {
+ struct file_lock fl;
+ struct nfs_server *server;
+ unsigned long timestamp;
++ unsigned short retrans;
+ };
+
+ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
+@@ -7147,6 +7158,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)
+ struct nfs4_exception exception = {
+ .inode = calldata->lsp->ls_state->inode,
+ .stateid = &calldata->arg.stateid,
++ .retrans = calldata->retrans,
+ };
+
+ if (!nfs4_sequence_done(task, &calldata->res.seq_res))
+@@ -7180,6 +7192,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)
+ task->tk_status = nfs4_async_handle_exception(task,
+ calldata->server, task->tk_status,
+ &exception);
++ calldata->retrans = exception.retrans;
+ if (exception.retry)
+ rpc_restart_call_prepare(task);
+ }
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index ac4bff6e99135..ea437e468a91c 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1659,6 +1659,7 @@ struct nfs_pgio_header {
+ void *netfs;
+ #endif
+
++ unsigned short retrans;
+ int pnfs_error;
+ int error; /* merge with pnfs_error */
+ unsigned int good_bytes; /* boundary of good data */
+--
+2.51.0
+
--- /dev/null
+From 79420cccebdc2146b3931351330861d2dc597f66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 15:48:04 -0600
+Subject: NFS4: Fix state renewals missing after boot
+
+From: Joshua Watt <jpewhacker@gmail.com>
+
+[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
+
+Since the last renewal time was initialized to 0 and jiffies start
+counting at -5 minutes, any clients connected in the first 5 minutes
+after a reboot would have their renewal timer set to a very long
+interval. If the connection was idle, this would result in the client
+state timing out on the server and the next call to the server would
+return NFS4ERR_BADSESSION.
+
+Fix this by initializing the last renewal time to the current jiffies
+instead of 0.
+
+Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 6fddf43d729c8..5998d6bd8a4f4 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -222,6 +222,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
+ clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
+ clp->cl_mig_gen = 1;
++ clp->cl_last_renewal = jiffies;
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+ init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 91630554cdf7f4b4f4c26a4abad039bf0ee979fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 16:28:46 +0300
+Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid
+ rfence errors
+
+From: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+
+[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
+
+openSBI v1.7 adds harts checks for ipi operations. Especially it
+adds comparison between hmask passed as an argument from linux
+and mask of online harts (from openSBI side). If they don't
+fit each other the error occurs.
+
+When cpu is offline, cpu_online_mask is explicitly cleared in
+__cpu_disable. However, there is no explicit clearing of
+mm_cpumask. mm_cpumask is used for rfence operations that
+call openSBI RFENCE extension which uses ipi to remote harts.
+If hart is offline there may be error if mask of linux is not
+as mask of online harts in openSBI.
+
+this patch adds explicit clearing of mm_cpumask for offline hart.
+
+Signed-off-by: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru
+[pjw@kernel.org: rewrote subject line for clarity]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/cpu-hotplug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c
+index a1e38ecfc8be2..3f50d3dd76c6f 100644
+--- a/arch/riscv/kernel/cpu-hotplug.c
++++ b/arch/riscv/kernel/cpu-hotplug.c
+@@ -54,6 +54,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu)
+
+ pr_notice("CPU%u: off\n", cpu);
+
++ clear_tasks_mm_cpumask(cpu);
+ /* Verify from the firmware if the cpu is really stopped*/
+ if (cpu_ops->cpu_is_stopped)
+ ret = cpu_ops->cpu_is_stopped(cpu);
+--
+2.51.0
+
--- /dev/null
+From 5a0e8e3a78f6096d8739e2ca1a3d2ff8984a5a03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:24:01 +0800
+Subject: riscv: acpi: avoid errors caused by probing DT devices when ACPI is
+ used
+
+From: Han Gao <rabenda.cn@gmail.com>
+
+[ Upstream commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e ]
+
+Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose
+to boot from acpi then disable FDT"), let's not do DT hardware probing
+if ACPI is enabled in early boot. This avoids errors caused by
+repeated driver probing.
+
+Signed-off-by: Han Gao <rabenda.cn@gmail.com>
+Link: https://lore.kernel.org/r/20250910112401.552987-1-rabenda.cn@gmail.com
+[pjw@kernel.org: cleaned up patch description and subject]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/setup.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
+index f90cce7a3acea..d7ee62837aa4f 100644
+--- a/arch/riscv/kernel/setup.c
++++ b/arch/riscv/kernel/setup.c
+@@ -330,11 +330,14 @@ void __init setup_arch(char **cmdline_p)
+ /* Parse the ACPI tables for possible boot-time configuration */
+ acpi_boot_table_init();
+
++ if (acpi_disabled) {
+ #if IS_ENABLED(CONFIG_BUILTIN_DTB)
+- unflatten_and_copy_device_tree();
++ unflatten_and_copy_device_tree();
+ #else
+- unflatten_device_tree();
++ unflatten_device_tree();
+ #endif
++ }
++
+ misc_mem_init();
+
+ init_resources();
+--
+2.51.0
+
--- /dev/null
+From 64be1444bca64fdf72643f82fb0bca3491c48932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Oct 2025 17:44:28 +0800
+Subject: riscv: Build loader.bin exclusively for Canaan K210
+
+From: Feng Jiang <jiangfeng@kylinos.cn>
+
+[ Upstream commit 3ad1b71fdc5707d14332d9ae710a237de936be9b ]
+
+According to the explanation in commit ef10bdf9c3e6 ("riscv:
+Kconfig.socs: Split ARCH_CANAAN and SOC_CANAAN_K210"),
+loader.bin is a special feature of the Canaan K210 and
+is not applicable to other SoCs.
+
+Fixes: e79dfcbfb902 ("riscv: make image compression configurable")
+Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
+Reviewed-by: Emil Renner Berthing <emil.renner.berthing@canonical.com>
+Link: https://lore.kernel.org/r/20251029094429.553842-1-jiangfeng@kylinos.cn
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index df57654a615e0..c4e394ede6256 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -166,7 +166,7 @@ boot-image-$(CONFIG_KERNEL_LZO) := Image.lzo
+ boot-image-$(CONFIG_KERNEL_ZSTD) := Image.zst
+ boot-image-$(CONFIG_KERNEL_XZ) := Image.xz
+ ifdef CONFIG_RISCV_M_MODE
+-boot-image-$(CONFIG_ARCH_CANAAN) := loader.bin
++boot-image-$(CONFIG_SOC_CANAAN_K210) := loader.bin
+ endif
+ boot-image-$(CONFIG_EFI_ZBOOT) := vmlinuz.efi
+ boot-image-$(CONFIG_XIP_KERNEL) := xipImage
+--
+2.51.0
+
--- /dev/null
+iommufd-selftest-fix-ioctl-return-value-in-_test_cmd.patch
+drm-mediatek-add-pm_runtime-support-for-gce-power-co.patch
+drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch
+drm-i915-fix-conversion-between-clock-ticks-and-nano.patch
+drm-amdgpu-set-default-gfx-reset-masks-for-gfx6-8.patch
+drm-amd-display-don-t-stretch-non-native-images-by-d.patch
+smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch
+iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch
+futex-optimize-per-cpu-reference-counting.patch
+drm-amd-fix-suspend-failure-with-secure-display-ta.patch
+drm-xe-guc-synchronize-dead-ct-worker-with-unbind.patch
+drm-xe-move-declarations-under-conditional-branch.patch
+drm-xe-do-clean-shutdown-also-when-using-flr.patch
+drm-amd-display-add-pixel_clock-to-amd_pp_display_co.patch
+drm-amd-pm-use-pm_display_cfg-in-legacy-dpm-v2.patch
+drm-amd-display-disable-fastboot-on-dce-6-too.patch
+drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch
+drm-amd-disable-aspm-on-si.patch
+arm64-kprobes-check-the-return-value-of-set_memory_r.patch
+compiler_types-move-unused-static-inline-functions-w.patch
+riscv-build-loader.bin-exclusively-for-canaan-k210.patch
+risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch
+riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch
+fs-return-eopnotsupp-from-file_setattr-file_getattr-.patch
+asoc-nau8821-avoid-unnecessary-blocking-in-irq-handl.patch
+drm-amdgpu-remove-two-invalid-bug_on-s.patch
+drm-amdgpu-hide-vram-sysfs-attributes-on-gpus-withou.patch
+drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch
+nfs4-fix-state-renewals-missing-after-boot.patch
+drm-amdkfd-fix-suspend-resume-all-calls-in-mes-based.patch
+nfs4-apply-delay_retrans-to-async-operations.patch
+hid-intel-thc-hid-intel-quickspi-add-arl-pci-device-.patch
+hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch
+ixgbe-handle-ixgbe_vf_get_pf_link_state-mailbox-oper.patch
+hid-nintendo-wait-longer-for-initial-probe.patch
+nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch
+hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch
+exfat-fix-improper-check-of-dentry.stream.valid_size.patch
+io_uring-fix-unexpected-placement-on-same-size-resiz.patch
+smb-server-fix-possible-memory-leak-in-smb2_read.patch
+smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch
+hid-logitech-hidpp-add-hidpp_quirk_reset_hi_res_scro.patch
+asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch
+alsa-hda-realtek-fix-mute-led-for-hp-omen-17-cb0xxx.patch
+ixgbe-handle-ixgbe_vf_features_negotiate-mbox-cmd.patch
--- /dev/null
+From 52a6cda5e1d15ae8144749ca549175cba5e700f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 23:13:15 +0800
+Subject: smb: client: fix refcount leak in smb2_set_path_attr
+
+From: Shuhao Fu <sfual@cse.ust.hk>
+
+[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ]
+
+Fix refcount leak in `smb2_set_path_attr` when path conversion fails.
+
+Function `cifs_get_writable_path` returns `cfile` with its reference
+counter `cfile->count` increased on success. Function `smb2_compound_op`
+would decrease the reference counter for `cfile`, as stated in its
+comment. By calling `smb2_rename_path`, the reference counter of `cfile`
+would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`.
+
+Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name")
+Acked-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index e441fa2e76897..ff9cb25327458 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -1294,6 +1294,8 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon,
+ smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb);
+ if (smb2_to_name == NULL) {
+ rc = -ENOMEM;
++ if (cfile)
++ cifsFileInfo_put(cfile);
+ goto smb2_rename_path;
+ }
+ in_iov.iov_base = smb2_to_name;
+--
+2.51.0
+
--- /dev/null
+From 062646bb311f4c592c636ef1538ce825ed8dce46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 00:47:59 +0800
+Subject: smb/server: fix possible memory leak in smb2_read()
+
+From: ZhangGuoDong <zhangguodong@kylinos.cn>
+
+[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ]
+
+Memory leak occurs when ksmbd_vfs_read() fails.
+Fix this by adding the missing kvfree().
+
+Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 287200d7c0764..409b85af82e1c 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -6826,6 +6826,7 @@ int smb2_read(struct ksmbd_work *work)
+
+ nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf);
+ if (nbytes < 0) {
++ kvfree(aux_payload_buf);
+ err = nbytes;
+ goto out;
+ }
+--
+2.51.0
+
--- /dev/null
+From 1d0b03aeb6ce2c61bc88687d67b1b19394ee5f7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 00:51:36 +0800
+Subject: smb/server: fix possible refcount leak in smb2_sess_setup()
+
+From: ZhangGuoDong <zhangguodong@kylinos.cn>
+
+[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ]
+
+Reference count of ksmbd_session will leak when session need reconnect.
+Fix this by adding the missing ksmbd_user_session_put().
+
+Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 409b85af82e1c..acb06d7118571 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -1805,6 +1805,7 @@ int smb2_sess_setup(struct ksmbd_work *work)
+
+ if (ksmbd_conn_need_reconnect(conn)) {
+ rc = -EFAULT;
++ ksmbd_user_session_put(sess);
+ sess = NULL;
+ goto out_err;
+ }
+--
+2.51.0
+
--- /dev/null
+From c3a6200ba43713d30781029fac122e05beb1d570 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 15:42:15 +0200
+Subject: ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
+
+From: Sharique Mohammad <sharq0406@gmail.com>
+
+[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
+
+The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM
+suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they
+are turned on or off, the required startup or shutdown sequences
+must be taken care by the max98090_shdn_event.
+
+Signed-off-by: Sharique Mohammad <sharq0406@gmail.com>
+Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 2adf744c65263..4023b88e7bc13 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1234,9 +1234,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("DMIC4"),
+
+ SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC3_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
+- M98090_DIGMIC4_SHIFT, 0, NULL, 0),
++ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event,
++ SND_SOC_DAPM_POST_PMU),
+ };
+
+ static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
+--
+2.51.0
+
--- /dev/null
+From 443e85c1c021e3179aa6bde1592181980ad4bd45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 11:50:00 +0100
+Subject: compiler_types: Move unused static inline functions warning to W=2
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
+
+Per Nathan, clang catches unused "static inline" functions in C files
+since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
+inline functions for W=1 build").
+
+Linus said:
+
+> So I entirely ignore W=1 issues, because I think so many of the extra
+> warnings are bogus.
+>
+> But if this one in particular is causing more problems than most -
+> some teams do seem to use W=1 as part of their test builds - it's fine
+> to send me a patch that just moves bad warnings to W=2.
+>
+> And if anybody uses W=2 for their test builds, that's THEIR problem..
+
+Here is the change to bump the warning from W=1 to W=2.
+
+Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
+[nathan: Adjust comment as well]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler_types.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index 02f616dfb15f4..5c8aca9c34566 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -229,10 +229,9 @@ struct ftrace_likely_data {
+ /*
+ * GCC does not warn about unused static inline functions for -Wunused-function.
+ * Suppress the warning in clang as well by using __maybe_unused, but enable it
+- * for W=1 build. This will allow clang to find unused functions. Remove the
+- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings.
++ * for W=2 build. This will allow clang to find unused functions.
+ */
+-#ifdef KBUILD_EXTRA_WARN1
++#ifdef KBUILD_EXTRA_WARN2
+ #define __inline_maybe_unused
+ #else
+ #define __inline_maybe_unused __maybe_unused
+--
+2.51.0
+
--- /dev/null
+From 1cd16b9824d39472901a05de5f5d888771f885dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 13:38:02 -0600
+Subject: drm/amd: Fix suspend failure with secure display TA
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ]
+
+commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded
+successfully") attempted to fix extra messages, but failed to port the
+cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable
+secure display TA multiple times") to prevent multiple tries.
+
+Add that to the failure handling path even on a quick failure.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679
+Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index d358a08b5e006..08886e0ee6428 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -2015,8 +2015,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp)
+ if (!ret && !psp->securedisplay_context.context.resp_status) {
+ psp->securedisplay_context.context.initialized = true;
+ mutex_init(&psp->securedisplay_context.mutex);
+- } else
++ } else {
++ /* don't try again */
++ psp->securedisplay_context.context.bin_desc.size_bytes = 0;
+ return ret;
++ }
+
+ mutex_lock(&psp->securedisplay_context.mutex);
+
+--
+2.51.0
+
--- /dev/null
+From a8862333bc805b8036eba324e7d9cec0f12e6e70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 20:26:12 +0200
+Subject: drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ]
+
+On various SI GPUs, a flickering can be observed near the bottom
+edge of the screen when using a single 4K 60Hz monitor over DP.
+Disabling MCLK switching works around this problem.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 2863dc65ffc6f..e5f68b2b8def3 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3485,6 +3485,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ * for these GPUs to calculate bandwidth requirements.
+ */
+ if (high_pixelclock_count) {
++ /* Work around flickering lines at the bottom edge
++ * of the screen when using a single 4K 60Hz monitor.
++ */
++ disable_mclk_switching = true;
++
+ /* On Oland, we observe some flickering when two 4K 60Hz
+ * displays are connected, possibly because voltage is too low.
+ * Raise the voltage by requiring a higher SCLK.
+--
+2.51.0
+
--- /dev/null
+From 9a5f78a69e9814f135de462b71c0595422dbf0bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 13:46:12 +0800
+Subject: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jesse.Zhang <Jesse.Zhang@amd.com>
+
+[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ]
+
+Previously, APU platforms (and other scenarios with uninitialized VRAM managers)
+triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root
+cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL,
+but that `man->bdev` (the backing device pointer within the manager) remains
+uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully
+set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to
+acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to
+a kernel OOPS.
+
+1. **amdgpu_cs.c**: Extend the existing bandwidth control check in
+ `amdgpu_cs_get_threshold_for_moves()` to include a check for
+ `ttm_resource_manager_used()`. If the manager is not used (uninitialized
+ `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific
+ logic that would trigger the NULL dereference.
+
+2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info
+ reporting to use a conditional: if the manager is used, return the real VRAM
+ usage; otherwise, return 0. This avoids accessing `man->bdev` when it is
+ NULL.
+
+3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function)
+ data write path. Use `ttm_resource_manager_used()` to check validity: if the
+ manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set
+ `fb_usage` to 0 (APUs have no discrete framebuffer to report).
+
+This approach is more robust than APU-specific checks because it:
+- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
+- Aligns with TTM's design by using its native helper function,
+- Preserves correct behavior for discrete GPUs (which have fully initialized
+ `man->bdev` and pass the `ttm_resource_manager_used()` check).
+
+v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++--
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 5b4d7fe148586..05712d322024a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -690,7 +690,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev,
+ */
+ const s64 us_upper_bound = 200000;
+
+- if (!adev->mm_stats.log2_max_MBps) {
++ if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used(&adev->mman.vram_mgr.manager)) {
+ *max_bytes = 0;
+ *max_vis_bytes = 0;
+ return;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 5797055b1148f..1f0de6e717112 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -651,7 +651,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ ui64 = atomic64_read(&adev->num_vram_cpu_page_faults);
+ return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
+ case AMDGPU_INFO_VRAM_USAGE:
+- ui64 = ttm_resource_manager_usage(&adev->mman.vram_mgr.manager);
++ ui64 = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) : 0;
+ return copy_to_user(out, &ui64, min(size, 8u)) ? -EFAULT : 0;
+ case AMDGPU_INFO_VIS_VRAM_USAGE:
+ ui64 = amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr);
+@@ -697,8 +698,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ mem.vram.usable_heap_size = adev->gmc.real_vram_size -
+ atomic64_read(&adev->vram_pin_size) -
+ AMDGPU_VM_RESERVED_VRAM;
+- mem.vram.heap_usage =
+- ttm_resource_manager_usage(vram_man);
++ mem.vram.heap_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(vram_man) : 0;
+ mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4;
+
+ mem.cpu_accessible_vram.total_heap_size =
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index 7cb4b4118335a..5a4b1b625f037 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -604,8 +604,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev)
+ vf2pf_info->driver_cert = 0;
+ vf2pf_info->os_info.all = 0;
+
+- vf2pf_info->fb_usage =
+- ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20;
++ vf2pf_info->fb_usage = ttm_resource_manager_used(&adev->mman.vram_mgr.manager) ?
++ ttm_resource_manager_usage(&adev->mman.vram_mgr.manager) >> 20 : 0;
+ vf2pf_info->fb_vis_usage =
+ amdgpu_vram_mgr_vis_usage(&adev->mman.vram_mgr) >> 20;
+ vf2pf_info->fb_size = adev->gmc.real_vram_size >> 20;
+--
+2.51.0
+
--- /dev/null
+From 42b75a9aeeb2e612a6fc7b2c7ba7fe8ad2b534d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 10:25:19 +0200
+Subject: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
+
+From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+
+[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ]
+
+On completion of i915_vma_pin_ww(), a synchronous variant of
+dma_fence_work_commit() is called. When pinning a VMA to GGTT address
+space on a Cherry View family processor, or on a Broxton generation SoC
+with VTD enabled, i.e., when stop_machine() is then called from
+intel_ggtt_bind_vma(), that can potentially lead to lock inversion among
+reservation_ww and cpu_hotplug locks.
+
+[86.861179] ======================================================
+[86.861193] WARNING: possible circular locking dependency detected
+[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U
+[86.861226] ------------------------------------------------------
+[86.861238] i915_module_loa/1432 is trying to acquire lock:
+[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50
+[86.861290]
+but task is already holding lock:
+[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.862233]
+which lock already depends on the new lock.
+[86.862251]
+the existing dependency chain (in reverse order) is:
+[86.862265]
+-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}:
+[86.862292] dma_resv_lockdep+0x19a/0x390
+[86.862315] do_one_initcall+0x60/0x3f0
+[86.862334] kernel_init_freeable+0x3cd/0x680
+[86.862353] kernel_init+0x1b/0x200
+[86.862369] ret_from_fork+0x47/0x70
+[86.862383] ret_from_fork_asm+0x1a/0x30
+[86.862399]
+-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}:
+[86.862425] dma_resv_lockdep+0x178/0x390
+[86.862440] do_one_initcall+0x60/0x3f0
+[86.862454] kernel_init_freeable+0x3cd/0x680
+[86.862470] kernel_init+0x1b/0x200
+[86.862482] ret_from_fork+0x47/0x70
+[86.862495] ret_from_fork_asm+0x1a/0x30
+[86.862509]
+-> #3 (&mm->mmap_lock){++++}-{3:3}:
+[86.862531] down_read_killable+0x46/0x1e0
+[86.862546] lock_mm_and_find_vma+0xa2/0x280
+[86.862561] do_user_addr_fault+0x266/0x8e0
+[86.862578] exc_page_fault+0x8a/0x2f0
+[86.862593] asm_exc_page_fault+0x27/0x30
+[86.862607] filldir64+0xeb/0x180
+[86.862620] kernfs_fop_readdir+0x118/0x480
+[86.862635] iterate_dir+0xcf/0x2b0
+[86.862648] __x64_sys_getdents64+0x84/0x140
+[86.862661] x64_sys_call+0x1058/0x2660
+[86.862675] do_syscall_64+0x91/0xe90
+[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.862703]
+-> #2 (&root->kernfs_rwsem){++++}-{3:3}:
+[86.862725] down_write+0x3e/0xf0
+[86.862738] kernfs_add_one+0x30/0x3c0
+[86.862751] kernfs_create_dir_ns+0x53/0xb0
+[86.862765] internal_create_group+0x134/0x4c0
+[86.862779] sysfs_create_group+0x13/0x20
+[86.862792] topology_add_dev+0x1d/0x30
+[86.862806] cpuhp_invoke_callback+0x4b5/0x850
+[86.862822] cpuhp_issue_call+0xbf/0x1f0
+[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320
+[86.862852] __cpuhp_setup_state+0xb0/0x220
+[86.862866] topology_sysfs_init+0x30/0x50
+[86.862879] do_one_initcall+0x60/0x3f0
+[86.862893] kernel_init_freeable+0x3cd/0x680
+[86.862908] kernel_init+0x1b/0x200
+[86.862921] ret_from_fork+0x47/0x70
+[86.862934] ret_from_fork_asm+0x1a/0x30
+[86.862947]
+-> #1 (cpuhp_state_mutex){+.+.}-{3:3}:
+[86.862969] __mutex_lock+0xaa/0xed0
+[86.862982] mutex_lock_nested+0x1b/0x30
+[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320
+[86.863012] __cpuhp_setup_state+0xb0/0x220
+[86.863026] page_alloc_init_cpuhp+0x2d/0x60
+[86.863041] mm_core_init+0x22/0x2d0
+[86.863054] start_kernel+0x576/0xbd0
+[86.863068] x86_64_start_reservations+0x18/0x30
+[86.863084] x86_64_start_kernel+0xbf/0x110
+[86.863098] common_startup_64+0x13e/0x141
+[86.863114]
+-> #0 (cpu_hotplug_lock){++++}-{0:0}:
+[86.863135] __lock_acquire+0x1635/0x2810
+[86.863152] lock_acquire+0xc4/0x2f0
+[86.863166] cpus_read_lock+0x41/0x100
+[86.863180] stop_machine+0x1c/0x50
+[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.864735] __vma_bind+0x55/0x70 [i915]
+[86.865510] fence_work+0x26/0xa0 [i915]
+[86.866248] fence_notify+0xa1/0x140 [i915]
+[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.867719] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.870001] initial_plane_vma+0x307/0x840 [i915]
+[86.870774] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.872330] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.873057] i915_pci_probe+0xe6/0x220 [i915]
+[86.873782] local_pci_probe+0x47/0xb0
+[86.873802] pci_device_probe+0xf3/0x260
+[86.873817] really_probe+0xf1/0x3c0
+[86.873833] __driver_probe_device+0x8c/0x180
+[86.873848] driver_probe_device+0x24/0xd0
+[86.873862] __driver_attach+0x10f/0x220
+[86.873876] bus_for_each_dev+0x7f/0xe0
+[86.873892] driver_attach+0x1e/0x30
+[86.873904] bus_add_driver+0x151/0x290
+[86.873917] driver_register+0x5e/0x130
+[86.873931] __pci_register_driver+0x7d/0x90
+[86.873945] i915_pci_register_driver+0x23/0x30 [i915]
+[86.874678] i915_init+0x37/0x120 [i915]
+[86.875347] do_one_initcall+0x60/0x3f0
+[86.875369] do_init_module+0x97/0x2a0
+[86.875385] load_module+0x2c54/0x2d80
+[86.875398] init_module_from_file+0x96/0xe0
+[86.875413] idempotent_init_module+0x117/0x330
+[86.875426] __x64_sys_finit_module+0x77/0x100
+[86.875440] x64_sys_call+0x24de/0x2660
+[86.875454] do_syscall_64+0x91/0xe90
+[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.875486]
+other info that might help us debug this:
+[86.875502] Chain exists of:
+ cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex
+[86.875539] Possible unsafe locking scenario:
+[86.875552] CPU0 CPU1
+[86.875563] ---- ----
+[86.875573] lock(reservation_ww_class_mutex);
+[86.875588] lock(reservation_ww_class_acquire);
+[86.875606] lock(reservation_ww_class_mutex);
+[86.875624] rlock(cpu_hotplug_lock);
+[86.875637]
+ *** DEADLOCK ***
+[86.875650] 3 locks held by i915_module_loa/1432:
+[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220
+[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
+[86.877305]
+stack backtrace:
+[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary)
+[86.877334] Tainted: [U]=USER
+[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020
+[86.877339] Call Trace:
+[86.877344] <TASK>
+[86.877353] dump_stack_lvl+0x91/0xf0
+[86.877364] dump_stack+0x10/0x20
+[86.877369] print_circular_bug+0x285/0x360
+[86.877379] check_noncircular+0x135/0x150
+[86.877390] __lock_acquire+0x1635/0x2810
+[86.877403] lock_acquire+0xc4/0x2f0
+[86.877408] ? stop_machine+0x1c/0x50
+[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878173] cpus_read_lock+0x41/0x100
+[86.878182] ? stop_machine+0x1c/0x50
+[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
+[86.878916] stop_machine+0x1c/0x50
+[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
+[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915]
+[86.880375] __vma_bind+0x55/0x70 [i915]
+[86.881133] fence_work+0x26/0xa0 [i915]
+[86.881851] fence_notify+0xa1/0x140 [i915]
+[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915]
+[86.883286] i915_sw_fence_commit+0x39/0x60 [i915]
+[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915]
+[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915]
+[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
+[86.886281] initial_plane_vma+0x307/0x840 [i915]
+[86.887049] intel_initial_plane_config+0x33f/0x670 [i915]
+[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
+[86.888587] i915_driver_probe+0x7fa/0xe80 [i915]
+[86.889293] ? mutex_unlock+0x12/0x20
+[86.889301] ? drm_privacy_screen_get+0x171/0x190
+[86.889308] ? acpi_dev_found+0x66/0x80
+[86.889321] i915_pci_probe+0xe6/0x220 [i915]
+[86.890038] local_pci_probe+0x47/0xb0
+[86.890049] pci_device_probe+0xf3/0x260
+[86.890058] really_probe+0xf1/0x3c0
+[86.890067] __driver_probe_device+0x8c/0x180
+[86.890072] driver_probe_device+0x24/0xd0
+[86.890078] __driver_attach+0x10f/0x220
+[86.890083] ? __pfx___driver_attach+0x10/0x10
+[86.890088] bus_for_each_dev+0x7f/0xe0
+[86.890097] driver_attach+0x1e/0x30
+[86.890101] bus_add_driver+0x151/0x290
+[86.890107] driver_register+0x5e/0x130
+[86.890113] __pci_register_driver+0x7d/0x90
+[86.890119] i915_pci_register_driver+0x23/0x30 [i915]
+[86.890833] i915_init+0x37/0x120 [i915]
+[86.891482] ? __pfx_i915_init+0x10/0x10 [i915]
+[86.892135] do_one_initcall+0x60/0x3f0
+[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470
+[86.892157] do_init_module+0x97/0x2a0
+[86.892164] load_module+0x2c54/0x2d80
+[86.892168] ? __kernel_read+0x15c/0x300
+[86.892185] ? kernel_read_file+0x2b1/0x320
+[86.892195] init_module_from_file+0x96/0xe0
+[86.892199] ? init_module_from_file+0x96/0xe0
+[86.892211] idempotent_init_module+0x117/0x330
+[86.892224] __x64_sys_finit_module+0x77/0x100
+[86.892230] x64_sys_call+0x24de/0x2660
+[86.892236] do_syscall_64+0x91/0xe90
+[86.892243] ? irqentry_exit+0x77/0xb0
+[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0
+[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[86.892261] RIP: 0033:0x7303e1b2725d
+[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
+[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d
+[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c
+[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80
+[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0
+[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710
+[86.892304] </TASK>
+
+Call asynchronous variant of dma_fence_work_commit() in that case.
+
+v3: Provide more verbose in-line comment (Andi),
+ - mention target environments in commit message.
+
+Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985
+Cc: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com>
+Acked-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com
+(cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
+index 46e4a45e3c72a..772594360d57e 100644
+--- a/drivers/gpu/drm/i915/i915_vma.c
++++ b/drivers/gpu/drm/i915/i915_vma.c
+@@ -1586,8 +1586,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww,
+ err_vma_res:
+ i915_vma_resource_free(vma_res);
+ err_fence:
+- if (work)
+- dma_fence_work_commit_imm(&work->base);
++ if (work) {
++ /*
++ * When pinning VMA to GGTT on CHV or BXT with VTD enabled,
++ * commit VMA binding asynchronously to avoid risk of lock
++ * inversion among reservation_ww locks held here and
++ * cpu_hotplug_lock acquired from stop_machine(), which we
++ * wrap around GGTT updates when running in those environments.
++ */
++ if (i915_vma_is_ggtt(vma) &&
++ intel_vm_no_concurrent_access_wa(vma->vm->i915))
++ dma_fence_work_commit(&work->base);
++ else
++ dma_fence_work_commit_imm(&work->base);
++ }
+ err_rpm:
+ intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref);
+
+--
+2.51.0
+
--- /dev/null
+From 447d8fe9f9580acb190488087ac8fef46e41df83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 17:03:51 -0700
+Subject: drm/i915: Fix conversion between clock ticks and nanoseconds
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ]
+
+When tick values are large, the multiplication by NSEC_PER_SEC is larger
+than 64 bits and results in bad conversions.
+
+The issue is seen in PMU busyness counters that look like they have
+wrapped around due to bad conversion. i915 PMU implementation returns
+monotonically increasing counters. If a count is lesser than previous
+one, it will only return the larger value until the smaller value
+catches up. The user will see this as zero delta between two
+measurements even though the engines are busy.
+
+Fix it by using mul_u64_u32_div()
+
+Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+[Rodrigo: Added the Fixes tag while cherry-picking to fixes]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+index 7c9be4fd1c8c4..7a950c1502b6e 100644
+--- a/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
++++ b/drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c
+@@ -208,7 +208,7 @@ static u64 div_u64_roundup(u64 nom, u32 den)
+
+ u64 intel_gt_clock_interval_to_ns(const struct intel_gt *gt, u64 count)
+ {
+- return div_u64_roundup(count * NSEC_PER_SEC, gt->clock_frequency);
++ return mul_u64_u32_div(count, NSEC_PER_SEC, gt->clock_frequency);
+ }
+
+ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
+@@ -218,7 +218,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)
+
+ u64 intel_gt_ns_to_clock_interval(const struct intel_gt *gt, u64 ns)
+ {
+- return div_u64_roundup(gt->clock_frequency * ns, NSEC_PER_SEC);
++ return mul_u64_u32_div(ns, gt->clock_frequency, NSEC_PER_SEC);
+ }
+
+ u64 intel_gt_ns_to_pm_interval(const struct intel_gt *gt, u64 ns)
+--
+2.51.0
+
--- /dev/null
+From 04bf0e3e6646f543eb791185025f6748158a265f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 18:46:11 +0300
+Subject: HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
+
+From: Oleg Makarenko <oleg@makarenk.ooo>
+
+[ Upstream commit 1141ed52348d3df82d3fd2316128b3fc6203a68c ]
+
+This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick.
+This device reboots itself every 8-10 seconds if it is not polled.
+
+Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index be24029782b10..fbbab353f040a 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1403,6 +1403,7 @@
+
+ #define USB_VENDOR_ID_VRS 0x0483
+ #define USB_DEVICE_ID_VRS_DFP 0xa355
++#define USB_DEVICE_ID_VRS_R295 0xa44c
+
+ #define USB_VENDOR_ID_VTL 0x0306
+ #define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 468a47de96b10..75480ec3c15a2 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -207,6 +207,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT },
++ { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_R295), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT },
+--
+2.51.0
+
--- /dev/null
+From f25c8ac11c0d2c26218fc31649422ee3dc6f036a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 18:25:43 +0200
+Subject: HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
+
+From: Tristan Lobb <tristan.lobb@it-lobb.de>
+
+[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
+
+The Cooler Master Mice Dongle includes a vendor defined HID interface
+alongside its mouse interface. Not polling it will cause the mouse to
+stop responding to polls on any interface once woken up again after
+going into power saving mode.
+
+Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
+the Dongle's PID.
+
+Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 8de59d8a54580..be24029782b10 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -332,6 +332,9 @@
+ #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
+ #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+
++#define USB_VENDOR_ID_COOLER_MASTER 0x2516
++#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7
++
+ #define USB_VENDOR_ID_CORSAIR 0x1b1c
+ #define USB_DEVICE_ID_CORSAIR_K90 0x1b02
+ #define USB_DEVICE_ID_CORSAIR_K70R 0x1b09
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 64f9728018b88..468a47de96b10 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET },
++ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
+--
+2.51.0
+
--- /dev/null
+From 45abd7fb449768a9c55461e040be568004ed73fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 14:11:49 -0400
+Subject: iommufd: Make vfio_compat's unmap succeed if the range is already
+ empty
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit afb47765f9235181fddc61c8633b5a8cfae29fd2 ]
+
+iommufd returns ENOENT when attempting to unmap a range that is already
+empty, while vfio type1 returns success. Fix vfio_compat to match.
+
+Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
+Link: https://patch.msgid.link/r/0-v1-76be45eff0be+5d-iommufd_unmap_compat_jgg@nvidia.com
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Reviewed-by: Alex Mastro <amastro@fb.com>
+Reported-by: Alex Mastro <amastro@fb.com>
+Closes: https://lore.kernel.org/r/aP0S5ZF9l3sWkJ1G@devgpu012.nha5.facebook.com
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommufd/io_pagetable.c | 12 +++---------
+ drivers/iommu/iommufd/ioas.c | 4 ++++
+ tools/testing/selftests/iommu/iommufd.c | 2 ++
+ 3 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c
+index f058405c5fbb6..6bd37343061e0 100644
+--- a/drivers/iommu/iommufd/io_pagetable.c
++++ b/drivers/iommu/iommufd/io_pagetable.c
+@@ -488,7 +488,8 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,
+ struct iopt_area *area;
+ unsigned long unmapped_bytes = 0;
+ unsigned int tries = 0;
+- int rc = -ENOENT;
++ /* If there are no mapped entries then success */
++ int rc = 0;
+
+ /*
+ * The domains_rwsem must be held in read mode any time any area->pages
+@@ -552,8 +553,6 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,
+
+ down_write(&iopt->iova_rwsem);
+ }
+- if (unmapped_bytes)
+- rc = 0;
+
+ out_unlock_iova:
+ up_write(&iopt->iova_rwsem);
+@@ -590,13 +589,8 @@ int iopt_unmap_iova(struct io_pagetable *iopt, unsigned long iova,
+
+ int iopt_unmap_all(struct io_pagetable *iopt, unsigned long *unmapped)
+ {
+- int rc;
+-
+- rc = iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped);
+ /* If the IOVAs are empty then unmap all succeeds */
+- if (rc == -ENOENT)
+- return 0;
+- return rc;
++ return iopt_unmap_iova_range(iopt, 0, ULONG_MAX, unmapped);
+ }
+
+ /* The caller must always free all the nodes in the allowed_iova rb_root. */
+diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c
+index 0407e2b758ef4..18bbbeef5cccd 100644
+--- a/drivers/iommu/iommufd/ioas.c
++++ b/drivers/iommu/iommufd/ioas.c
+@@ -317,6 +317,10 @@ int iommufd_ioas_unmap(struct iommufd_ucmd *ucmd)
+ &unmapped);
+ if (rc)
+ goto out_put;
++ if (!unmapped) {
++ rc = -ENOENT;
++ goto out_put;
++ }
+ }
+
+ cmd->length = unmapped;
+diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c
+index 890a81f4ff618..67fcc99fbd6d3 100644
+--- a/tools/testing/selftests/iommu/iommufd.c
++++ b/tools/testing/selftests/iommu/iommufd.c
+@@ -1728,6 +1728,8 @@ TEST_F(vfio_compat_mock_domain, map)
+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd));
+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd));
+ ASSERT_EQ(BUFFER_SIZE, unmap_cmd.size);
++ /* Unmap of empty is success */
++ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_UNMAP_DMA, &unmap_cmd));
+
+ /* UNMAP_FLAG_ALL requres 0 iova/size */
+ ASSERT_EQ(0, ioctl(self->fd, VFIO_IOMMU_MAP_DMA, &map_cmd));
+--
+2.51.0
+
--- /dev/null
+From 613a374be8d7b761579343c374f7e0060521e10d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:42:12 -0400
+Subject: NFS: check if suid/sgid was cleared after a write as needed
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ]
+
+I noticed xfstests generic/193 and generic/355 started failing against
+knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN
+with OPEN4_SHARE_ACCESS_WRITE").
+
+I ran those same tests against ONTAP (which has had write delegation
+support for a lot longer than knfsd) and they fail there too... so
+while it's a new failure against knfsd, it isn't an entirely new
+failure.
+
+Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation
+doesn't keep the inode from being revalidated to fetch the updated mode.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/write.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index cb1e9996fcc8e..ef69b15aa72e5 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1638,7 +1638,8 @@ static int nfs_writeback_done(struct rpc_task *task,
+ /* Deal with the suid/sgid bit corner case */
+ if (nfs_should_remove_suid(inode)) {
+ spin_lock(&inode->i_lock);
+- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE);
++ nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE
++ | NFS_INO_REVAL_FORCED);
+ spin_unlock(&inode->i_lock);
+ }
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 54792719ff637e6b15d93bcbceb31008a9e4bc46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 15:48:04 -0600
+Subject: NFS4: Fix state renewals missing after boot
+
+From: Joshua Watt <jpewhacker@gmail.com>
+
+[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
+
+Since the last renewal time was initialized to 0 and jiffies start
+counting at -5 minutes, any clients connected in the first 5 minutes
+after a reboot would have their renewal timer set to a very long
+interval. If the connection was idle, this would result in the client
+state timing out on the server and the next call to the server would
+return NFS4ERR_BADSESSION.
+
+Fix this by initializing the last renewal time to the current jiffies
+instead of 0.
+
+Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index f6dc42de48f03..32b1147fcafc4 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -222,6 +222,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
+ clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
+ clp->cl_mig_gen = 1;
++ clp->cl_last_renewal = jiffies;
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+ init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 069ccfa1e21074b4f6f7c1269f6871f59b3e5946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 16:28:46 +0300
+Subject: RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid
+ rfence errors
+
+From: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+
+[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
+
+openSBI v1.7 adds harts checks for ipi operations. Especially it
+adds comparison between hmask passed as an argument from linux
+and mask of online harts (from openSBI side). If they don't
+fit each other the error occurs.
+
+When cpu is offline, cpu_online_mask is explicitly cleared in
+__cpu_disable. However, there is no explicit clearing of
+mm_cpumask. mm_cpumask is used for rfence operations that
+call openSBI RFENCE extension which uses ipi to remote harts.
+If hart is offline there may be error if mask of linux is not
+as mask of online harts in openSBI.
+
+this patch adds explicit clearing of mm_cpumask for offline hart.
+
+Signed-off-by: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru
+[pjw@kernel.org: rewrote subject line for clarity]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/cpu-hotplug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c
+index 6b710ef9d9aef..2114903ee3ad4 100644
+--- a/arch/riscv/kernel/cpu-hotplug.c
++++ b/arch/riscv/kernel/cpu-hotplug.c
+@@ -61,6 +61,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu)
+
+ pr_notice("CPU%u: off\n", cpu);
+
++ clear_tasks_mm_cpumask(cpu);
+ /* Verify from the firmware if the cpu is really stopped*/
+ if (cpu_ops[cpu]->cpu_is_stopped)
+ ret = cpu_ops[cpu]->cpu_is_stopped(cpu);
+--
+2.51.0
+
--- /dev/null
+From 11af88a91ecbb71df798aa7c006e86e0a6683aa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:24:01 +0800
+Subject: riscv: acpi: avoid errors caused by probing DT devices when ACPI is
+ used
+
+From: Han Gao <rabenda.cn@gmail.com>
+
+[ Upstream commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e ]
+
+Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose
+to boot from acpi then disable FDT"), let's not do DT hardware probing
+if ACPI is enabled in early boot. This avoids errors caused by
+repeated driver probing.
+
+Signed-off-by: Han Gao <rabenda.cn@gmail.com>
+Link: https://lore.kernel.org/r/20250910112401.552987-1-rabenda.cn@gmail.com
+[pjw@kernel.org: cleaned up patch description and subject]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/setup.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
+index f598e0eb3b0a0..ee269b1c99a19 100644
+--- a/arch/riscv/kernel/setup.c
++++ b/arch/riscv/kernel/setup.c
+@@ -318,11 +318,14 @@ void __init setup_arch(char **cmdline_p)
+ /* Parse the ACPI tables for possible boot-time configuration */
+ acpi_boot_table_init();
+
++ if (acpi_disabled) {
+ #if IS_ENABLED(CONFIG_BUILTIN_DTB)
+- unflatten_and_copy_device_tree();
++ unflatten_and_copy_device_tree();
+ #else
+- unflatten_device_tree();
++ unflatten_device_tree();
+ #endif
++ }
++
+ misc_mem_init();
+
+ init_resources();
+--
+2.51.0
+
drm-amd-display-fix-black-screen-with-hdmi-outputs.patch
riscv-stacktrace-fix-backtracing-through-exceptions.patch
selftests-netdevsim-set-test-timeout-to-10-minutes.patch
+drm-i915-avoid-lock-inversion-when-pinning-to-ggtt-o.patch
+drm-i915-fix-conversion-between-clock-ticks-and-nano.patch
+smb-client-fix-refcount-leak-in-smb2_set_path_attr.patch
+iommufd-make-vfio_compat-s-unmap-succeed-if-the-rang.patch
+drm-amd-fix-suspend-failure-with-secure-display-ta.patch
+compiler_types-move-unused-static-inline-functions-w.patch
+risc-v-clear-hot-unplugged-cores-from-all-task-mm_cp.patch
+riscv-acpi-avoid-errors-caused-by-probing-dt-devices.patch
+drm-amd-pm-disable-mclk-switching-on-si-at-high-pixe.patch
+drm-amdgpu-fix-null-pointer-dereference-in-vram-logi.patch
+nfs4-fix-state-renewals-missing-after-boot.patch
+hid-quirks-avoid-cooler-master-mm712-dongle-wakeup-b.patch
+nfs-check-if-suid-sgid-was-cleared-after-a-write-as-.patch
+hid-quirks-add-always_poll-quirk-for-vrs-r295-steeri.patch
+smb-server-fix-possible-memory-leak-in-smb2_read.patch
+smb-server-fix-possible-refcount-leak-in-smb2_sess_s.patch
+asoc-max98090-91-fixed-max98091-alsa-widget-powering.patch
--- /dev/null
+From 0f3faf76d4bdf93ac33209da53862afeb61e73aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 23:13:15 +0800
+Subject: smb: client: fix refcount leak in smb2_set_path_attr
+
+From: Shuhao Fu <sfual@cse.ust.hk>
+
+[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ]
+
+Fix refcount leak in `smb2_set_path_attr` when path conversion fails.
+
+Function `cifs_get_writable_path` returns `cfile` with its reference
+counter `cfile->count` increased on success. Function `smb2_compound_op`
+would decrease the reference counter for `cfile`, as stated in its
+comment. By calling `smb2_rename_path`, the reference counter of `cfile`
+would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`.
+
+Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name")
+Acked-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index 232a3c2890556..d6086394d0b84 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -1128,6 +1128,8 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon,
+ smb2_to_name = cifs_convert_path_to_utf16(to_name, cifs_sb);
+ if (smb2_to_name == NULL) {
+ rc = -ENOMEM;
++ if (cfile)
++ cifsFileInfo_put(cfile);
+ goto smb2_rename_path;
+ }
+ in_iov.iov_base = smb2_to_name;
+--
+2.51.0
+
--- /dev/null
+From 95c9045e79f33fc5b2532cb50ee6f26f2bb09ad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 00:47:59 +0800
+Subject: smb/server: fix possible memory leak in smb2_read()
+
+From: ZhangGuoDong <zhangguodong@kylinos.cn>
+
+[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ]
+
+Memory leak occurs when ksmbd_vfs_read() fails.
+Fix this by adding the missing kvfree().
+
+Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 9a58c5a6f9866..b3fa983a522fb 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -6772,6 +6772,7 @@ int smb2_read(struct ksmbd_work *work)
+
+ nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf);
+ if (nbytes < 0) {
++ kvfree(aux_payload_buf);
+ err = nbytes;
+ goto out;
+ }
+--
+2.51.0
+
--- /dev/null
+From 267d3411256802046d8f8553b47d04dc0d20d7ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 00:51:36 +0800
+Subject: smb/server: fix possible refcount leak in smb2_sess_setup()
+
+From: ZhangGuoDong <zhangguodong@kylinos.cn>
+
+[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ]
+
+Reference count of ksmbd_session will leak when session need reconnect.
+Fix this by adding the missing ksmbd_user_session_put().
+
+Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index b3fa983a522fb..9f64808c7917c 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -1793,6 +1793,7 @@ int smb2_sess_setup(struct ksmbd_work *work)
+
+ if (ksmbd_conn_need_reconnect(conn)) {
+ rc = -EFAULT;
++ ksmbd_user_session_put(sess);
+ sess = NULL;
+ goto out_err;
+ }
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
