--- /dev/null
+From b88b5ac5bc9125c5d92e30b0c83f0dd6052b2bb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:30 +0900
+Subject: 9p: fix /sys/fs/9p/caches overwriting itself
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
+
+caches_show() overwrote its buffer on each iteration,
+so only the last cache tag was visible in sysfs output.
+
+Properly append with snprintf(buf + count, …).
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 39def020a074b..b304e070139ca 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -558,7 +558,7 @@ static ssize_t caches_show(struct kobject *kobj,
+ spin_lock(&v9fs_sessionlist_lock);
+ list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
+ if (v9ses->cachetag) {
+- n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag);
+ if (n < 0) {
+ count = n;
+ break;
+--
+2.51.0
+
--- /dev/null
+From 9a145325ccac4fc7fa12ef3bcbeee6dde12ac7ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:31 +0900
+Subject: 9p: sysfs_init: don't hardcode error to ENOMEM
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
+
+v9fs_sysfs_init() always returned -ENOMEM on failure;
+return the actual sysfs_create_group() error instead.
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index b304e070139ca..1dd8a735bf7f6 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -594,13 +594,16 @@ static struct attribute_group v9fs_attr_group = {
+
+ static int __init v9fs_sysfs_init(void)
+ {
++ int ret;
++
+ v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
+ if (!v9fs_kobj)
+ return -ENOMEM;
+
+- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) {
++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group);
++ if (ret) {
+ kobject_put(v9fs_kobj);
+- return -ENOMEM;
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 3472a0c204b42c411115b9a0480c4c828b9f9198 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:26:36 +0300
+Subject: ACPI: property: Return present device nodes only on fwnode interface
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
+
+fwnode_graph_get_next_subnode() may return fwnode backed by ACPI
+device nodes and there has been no check these devices are present
+in the system, unlike there has been on fwnode OF backend.
+
+In order to provide consistent behaviour towards callers,
+add a check for device presence by introducing
+a new function acpi_get_next_present_subnode(), used as the
+get_next_child_node() fwnode operation that also checks device
+node presence.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com
+[ rjw: Kerneldoc comment and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/property.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index cf872dc5b07a6..821150dcb9762 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -1107,6 +1107,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
+ return NULL;
+ }
+
++/*
++ * acpi_get_next_present_subnode - Return the next present child node handle
++ * @fwnode: Firmware node to find the next child node for.
++ * @child: Handle to one of the device's child nodes or a null handle.
++ *
++ * Like acpi_get_next_subnode(), but the device nodes returned by
++ * acpi_get_next_present_subnode() are guaranteed to be present.
++ *
++ * Returns: The fwnode handle of the next present sub-node.
++ */
++static struct fwnode_handle *
++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode,
++ struct fwnode_handle *child)
++{
++ do {
++ child = acpi_get_next_subnode(fwnode, child);
++ } while (is_acpi_device_node(child) &&
++ !acpi_device_is_present(to_acpi_device_node(child)));
++
++ return child;
++}
++
+ /**
+ * acpi_node_get_parent - Return parent fwnode of this fwnode
+ * @fwnode: Firmware node whose parent to get
+@@ -1421,7 +1443,7 @@ acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
+ .property_read_string_array = \
+ acpi_fwnode_property_read_string_array, \
+ .get_parent = acpi_node_get_parent, \
+- .get_next_child_node = acpi_get_next_subnode, \
++ .get_next_child_node = acpi_get_next_present_subnode, \
+ .get_named_child_node = acpi_fwnode_get_named_child_node, \
+ .get_name = acpi_fwnode_get_name, \
+ .get_name_prefix = acpi_fwnode_get_name_prefix, \
+--
+2.51.0
+
--- /dev/null
+From e4bda7b1999449b1188c0c143c1dee65461d5ed7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:27 +0200
+Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ]
+
+Add a new word in assembly to store ACR value during the calls
+to at91_plla_disable/at91_plla_enable macros and use it.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading]
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index b683c2caa40b9..80494afb28a33 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -373,6 +373,10 @@ ENDPROC(at91_backup_mode)
+ bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID
+ str tmp2, [pmc, #AT91_PMC_PLL_UPDT]
+
++ /* save acr */
++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR]
++ str tmp2, .saved_acr
++
+ /* save div. */
+ mov tmp1, #0
+ ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0]
+@@ -442,7 +446,7 @@ ENDPROC(at91_backup_mode)
+ str tmp1, [pmc, #AT91_PMC_PLL_UPDT]
+
+ /* step 2. */
+- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
++ ldr tmp1, .saved_acr
+ str tmp1, [pmc, #AT91_PMC_PLL_ACR]
+
+ /* step 3. */
+@@ -694,6 +698,8 @@ ENDPROC(at91_sramc_self_refresh)
+ .word 0
+ .saved_mckr:
+ .word 0
++.saved_acr:
++ .word 0
+ .saved_pllar:
+ .word 0
+ .saved_sam9_lpr:
+--
+2.51.0
+
--- /dev/null
+From db97dadd7dace073c45a59505aa3fb90fad9a33f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 00:12:19 +0200
+Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
+
+From: Valerio Setti <vsetti@baylibre.com>
+
+[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ]
+
+According to I2S specs audio data is sampled on the rising edge of the
+clock and it can change on the falling one. When operating in normal mode
+this SoC behaves the opposite so a clock polarity inversion is required
+in this case.
+
+This was tested on an OdroidC2 (Amlogic S905 SoC) board.
+
+Signed-off-by: Valerio Setti <vsetti@baylibre.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Tested-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c
+index 67729de41a73e..a512cd49bc507 100644
+--- a/sound/soc/meson/aiu-encoder-i2s.c
++++ b/sound/soc/meson/aiu-encoder-i2s.c
+@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ inv == SND_SOC_DAIFMT_IB_IF)
+ val |= AIU_CLK_CTRL_LRCLK_INVERT;
+
+- if (inv == SND_SOC_DAIFMT_IB_NF ||
+- inv == SND_SOC_DAIFMT_IB_IF)
++ /*
++ * The SoC changes data on the rising edge of the bitclock
++ * so an inversion of the bitclock is required in normal mode
++ */
++ if (inv == SND_SOC_DAIFMT_NB_NF ||
++ inv == SND_SOC_DAIFMT_NB_IF)
+ val |= AIU_CLK_CTRL_AOCLK_INVERT;
+
+ /* Signal skew */
+@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = {
+ .startup = aiu_encoder_i2s_startup,
+ .shutdown = aiu_encoder_i2s_shutdown,
+ };
+-
+--
+2.51.0
+
--- /dev/null
+From 7689c4723734d2c8db1adfd0507d5670bc773fec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 12:04:32 -0700
+Subject: ceph: add checking of wait_for_completion_killable() return value
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
+
+The Coverity Scan service has detected the calling of
+wait_for_completion_killable() without checking the return
+value in ceph_lock_wait_for_completion() [1]. The CID 1636232
+defect contains explanation: "If the function returns an error
+value, the error value may be mistaken for a normal value.
+In ceph_lock_wait_for_completion(): Value returned from
+a function is not checked for errors before being used. (CWE-252)".
+
+The patch adds the checking of wait_for_completion_killable()
+return value and return the error code from
+ceph_lock_wait_for_completion().
+
+[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/locks.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index 674d6ea89f717..642582a642a3a 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -202,7 +202,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,
+ if (err && err != -ERESTARTSYS)
+ return err;
+
+- wait_for_completion_killable(&req->r_safe_completion);
++ err = wait_for_completion_killable(&req->r_safe_completion);
++ if (err)
++ return err;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e1804f7a7b53e07be770bfeaac8efb61f7036d98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 03:32:09 -0400
+Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
+
+From: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+
+[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
+
+Add bounds checking to prevent writes past framebuffer boundaries when
+rendering text near screen edges. Return early if the Y position is off-screen
+and clip image height to screen boundary. Break from the rendering loop if the
+X position is off-screen. When clipping image width to fit the screen, update
+the character count to match the clipped width to prevent buffer size
+mismatches.
+
+Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
+receive mismatched parameters where the buffer is allocated for the clipped
+width but cnt reflects the original larger count, causing out-of-bounds writes.
+
+Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
+Suggested-by: Helge Deller <deller@gmx.de>
+Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index 4e774010d09f6..7c2fc9f83a848 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ image.height = vc->vc_font.height;
+ image.depth = 1;
+
++ if (image.dy >= info->var.yres)
++ return;
++
++ image.height = min(image.height, info->var.yres - image.dy);
++
+ if (attribute) {
+ buf = kmalloc(cellsize, GFP_ATOMIC);
+ if (!buf)
+@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ cnt = count;
+
+ image.width = vc->vc_font.width * cnt;
++
++ if (image.dx >= info->var.xres)
++ break;
++
++ if (image.dx + image.width > info->var.xres) {
++ image.width = info->var.xres - image.dx;
++ cnt = image.width / vc->vc_font.width;
++ if (cnt == 0)
++ break;
++ image.width = cnt * vc->vc_font.width;
++ }
++
+ pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
+ pitch &= ~scan_align;
+ size = pitch * image.height + buf_align;
+--
+2.51.0
+
--- /dev/null
+From c0c2ac2d80f64cd3944d2f5dacdde32bccbfb68a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 May 2025 20:44:34 -0500
+Subject: fs/hpfs: Fix error code for new_inode() failure in
+ mkdir/create/mknod/symlink
+
+From: Yikang Yue <yikangy2@illinois.edu>
+
+[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
+
+The function call new_inode() is a primitive for allocating an inode in memory,
+rather than planning disk space for it. Therefore, -ENOMEM should be returned
+as the error code rather than -ENOSPC.
+
+To be specific, new_inode()'s call path looks like this:
+new_inode
+ new_inode_pseudo
+ alloc_inode
+ ops->alloc_inode (hpfs_alloc_inode)
+ alloc_inode_sb
+ kmem_cache_alloc_lru
+
+Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM),
+not a lack of disk space. However, the current implementation of
+hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails.
+This patch fix this by set err to -ENOMEM before the goto statement.
+
+BTW, we also noticed that other nested calls within these four functions,
+like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure.
+But similarly, only -ENOSPC is returned. Addressing these will involve code
+modifications in other functions, and we plan to submit dedicated patches for these
+issues in the future. For this patch, we focus on new_inode().
+
+Signed-off-by: Yikang Yue <yikangy2@illinois.edu>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hpfs/namei.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index 1aee39160ac5b..bc1309ef4cfa5 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ dee.fnode = cpu_to_le32(fno);
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail2;
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -154,9 +156,10 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, b
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ result->i_mode |= S_IFREG;
+@@ -241,9 +244,10 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -317,8 +321,10 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
++ }
+ result->i_ino = fno;
+ hpfs_init_inode(result);
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+--
+2.51.0
+
orangefs-fix-xattr-related-buffer-overflow.patch
acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch
+fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch
+um-fix-help-message-for-ssl-non-raw.patch
+arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch
+9p-fix-sys-fs-9p-caches-overwriting-itself.patch
+9p-sysfs_init-don-t-hardcode-error-to-enomem.patch
+acpi-property-return-present-device-nodes-only-on-fw.patch
+tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch
+fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch
+asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch
+ceph-add-checking-of-wait_for_completion_killable-re.patch
--- /dev/null
+From 0430138bed32614aec8697650a0f3962e1c0b1d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:47:06 -0700
+Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
+
+small_const_nbits is defined in asm-generic/bitsperlong.h which
+bitmap.h uses but doesn't include causing build failures in some build
+systems. Add the missing #include.
+
+Note the bitmap.h in tools has diverged from that of the kernel, so no
+changes are made there.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Yury Norov <yury.norov@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: André Almeida <andrealmeid@igalia.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Ido Schimmel <idosch@nvidia.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Jason Xing <kerneljasonxing@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Maurice Lambert <mauricelambert434@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Petr Machata <petrm@nvidia.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yuyang Huang <yuyanghuang@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/bitmap.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
+index de45cad6cec19..1eeba6a147fb6 100644
+--- a/tools/include/linux/bitmap.h
++++ b/tools/include/linux/bitmap.h
+@@ -3,6 +3,7 @@
+ #define _PERF_BITOPS_H
+
+ #include <string.h>
++#include <asm-generic/bitsperlong.h>
+ #include <linux/align.h>
+ #include <linux/bitops.h>
+ #include <stdlib.h>
+--
+2.51.0
+
--- /dev/null
+From 7d680d99ee191a2441d78034a1b859924afea941 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 08:56:59 +0800
+Subject: um: Fix help message for ssl-non-raw
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ]
+
+Add the missing option name in the help message. Additionally,
+switch to __uml_help(), because this is a global option rather
+than a per-channel option.
+
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/ssl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
+index 6476b28d7c5ec..63da74e3f2776 100644
+--- a/arch/um/drivers/ssl.c
++++ b/arch/um/drivers/ssl.c
+@@ -202,4 +202,7 @@ static int ssl_non_raw_setup(char *str)
+ return 1;
+ }
+ __setup("ssl-non-raw", ssl_non_raw_setup);
+-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode");
++__uml_help(ssl_non_raw_setup,
++"ssl-non-raw\n"
++" Set serial lines to non-raw mode.\n\n"
++);
+--
+2.51.0
+
--- /dev/null
+From 93ca50406bfdc88af14127df6c7b3c61fec9cd7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:30 +0900
+Subject: 9p: fix /sys/fs/9p/caches overwriting itself
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
+
+caches_show() overwrote its buffer on each iteration,
+so only the last cache tag was visible in sysfs output.
+
+Properly append with snprintf(buf + count, …).
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 141067379f5e4..52765f7a3375a 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -558,7 +558,7 @@ static ssize_t caches_show(struct kobject *kobj,
+ spin_lock(&v9fs_sessionlist_lock);
+ list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
+ if (v9ses->cachetag) {
+- n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag);
+ if (n < 0) {
+ count = n;
+ break;
+--
+2.51.0
+
--- /dev/null
+From 1a69fa131936921aed8f29a6e8a12088376c666f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:31 +0900
+Subject: 9p: sysfs_init: don't hardcode error to ENOMEM
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
+
+v9fs_sysfs_init() always returned -ENOMEM on failure;
+return the actual sysfs_create_group() error instead.
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 52765f7a3375a..3a44a77e276b8 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -594,13 +594,16 @@ static const struct attribute_group v9fs_attr_group = {
+
+ static int __init v9fs_sysfs_init(void)
+ {
++ int ret;
++
+ v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
+ if (!v9fs_kobj)
+ return -ENOMEM;
+
+- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) {
++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group);
++ if (ret) {
+ kobject_put(v9fs_kobj);
+- return -ENOMEM;
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 9cdc4ace6b8a59526c1a4a27d982b7f4162913f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:26:36 +0300
+Subject: ACPI: property: Return present device nodes only on fwnode interface
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
+
+fwnode_graph_get_next_subnode() may return fwnode backed by ACPI
+device nodes and there has been no check these devices are present
+in the system, unlike there has been on fwnode OF backend.
+
+In order to provide consistent behaviour towards callers,
+add a check for device presence by introducing
+a new function acpi_get_next_present_subnode(), used as the
+get_next_child_node() fwnode operation that also checks device
+node presence.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com
+[ rjw: Kerneldoc comment and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/property.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index 9ab7f7184343a..4205c7fdc4cc9 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -1087,6 +1087,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
+ return NULL;
+ }
+
++/*
++ * acpi_get_next_present_subnode - Return the next present child node handle
++ * @fwnode: Firmware node to find the next child node for.
++ * @child: Handle to one of the device's child nodes or a null handle.
++ *
++ * Like acpi_get_next_subnode(), but the device nodes returned by
++ * acpi_get_next_present_subnode() are guaranteed to be present.
++ *
++ * Returns: The fwnode handle of the next present sub-node.
++ */
++static struct fwnode_handle *
++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode,
++ struct fwnode_handle *child)
++{
++ do {
++ child = acpi_get_next_subnode(fwnode, child);
++ } while (is_acpi_device_node(child) &&
++ !acpi_device_is_present(to_acpi_device_node(child)));
++
++ return child;
++}
++
+ /**
+ * acpi_node_get_parent - Return parent fwnode of this fwnode
+ * @fwnode: Firmware node whose parent to get
+@@ -1400,7 +1422,7 @@ acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
+ .property_read_string_array = \
+ acpi_fwnode_property_read_string_array, \
+ .get_parent = acpi_node_get_parent, \
+- .get_next_child_node = acpi_get_next_subnode, \
++ .get_next_child_node = acpi_get_next_present_subnode, \
+ .get_named_child_node = acpi_fwnode_get_named_child_node, \
+ .get_name = acpi_fwnode_get_name, \
+ .get_name_prefix = acpi_fwnode_get_name_prefix, \
+--
+2.51.0
+
--- /dev/null
+From 9f541fcea9a9e7f845a6c398c9a30457f5dda072 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:27 +0200
+Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ]
+
+Add a new word in assembly to store ACR value during the calls
+to at91_plla_disable/at91_plla_enable macros and use it.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading]
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index 60f9d6f5f8229..1b8d1fbb41ef4 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -685,6 +685,10 @@ sr_dis_exit:
+ bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID
+ str tmp2, [pmc, #AT91_PMC_PLL_UPDT]
+
++ /* save acr */
++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR]
++ str tmp2, .saved_acr
++
+ /* save div. */
+ mov tmp1, #0
+ ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0]
+@@ -754,7 +758,7 @@ sr_dis_exit:
+ str tmp1, [pmc, #AT91_PMC_PLL_UPDT]
+
+ /* step 2. */
+- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
++ ldr tmp1, .saved_acr
+ str tmp1, [pmc, #AT91_PMC_PLL_ACR]
+
+ /* step 3. */
+@@ -1130,6 +1134,8 @@ ENDPROC(at91_pm_suspend_in_sram)
+ .word 0
+ .saved_mckr:
+ .word 0
++.saved_acr:
++ .word 0
+ .saved_pllar:
+ .word 0
+ .saved_sam9_lpr:
+--
+2.51.0
+
--- /dev/null
+From eac92281b780af587eb4b1ebbd2e76fae4b976d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 00:12:19 +0200
+Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
+
+From: Valerio Setti <vsetti@baylibre.com>
+
+[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ]
+
+According to I2S specs audio data is sampled on the rising edge of the
+clock and it can change on the falling one. When operating in normal mode
+this SoC behaves the opposite so a clock polarity inversion is required
+in this case.
+
+This was tested on an OdroidC2 (Amlogic S905 SoC) board.
+
+Signed-off-by: Valerio Setti <vsetti@baylibre.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Tested-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c
+index 67729de41a73e..a512cd49bc507 100644
+--- a/sound/soc/meson/aiu-encoder-i2s.c
++++ b/sound/soc/meson/aiu-encoder-i2s.c
+@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ inv == SND_SOC_DAIFMT_IB_IF)
+ val |= AIU_CLK_CTRL_LRCLK_INVERT;
+
+- if (inv == SND_SOC_DAIFMT_IB_NF ||
+- inv == SND_SOC_DAIFMT_IB_IF)
++ /*
++ * The SoC changes data on the rising edge of the bitclock
++ * so an inversion of the bitclock is required in normal mode
++ */
++ if (inv == SND_SOC_DAIFMT_NB_NF ||
++ inv == SND_SOC_DAIFMT_NB_IF)
+ val |= AIU_CLK_CTRL_AOCLK_INVERT;
+
+ /* Signal skew */
+@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = {
+ .startup = aiu_encoder_i2s_startup,
+ .shutdown = aiu_encoder_i2s_shutdown,
+ };
+-
+--
+2.51.0
+
--- /dev/null
+From 11c1d22be757fcd24308ac2f9e880d4ddb10cd0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 12:04:32 -0700
+Subject: ceph: add checking of wait_for_completion_killable() return value
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
+
+The Coverity Scan service has detected the calling of
+wait_for_completion_killable() without checking the return
+value in ceph_lock_wait_for_completion() [1]. The CID 1636232
+defect contains explanation: "If the function returns an error
+value, the error value may be mistaken for a normal value.
+In ceph_lock_wait_for_completion(): Value returned from
+a function is not checked for errors before being used. (CWE-252)".
+
+The patch adds the checking of wait_for_completion_killable()
+return value and return the error code from
+ceph_lock_wait_for_completion().
+
+[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/locks.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index 3e3b8be76b21e..38974c54240d6 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -202,7 +202,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,
+ if (err && err != -ERESTARTSYS)
+ return err;
+
+- wait_for_completion_killable(&req->r_safe_completion);
++ err = wait_for_completion_killable(&req->r_safe_completion);
++ if (err)
++ return err;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 363aaa1e0dc9698fbc46f6e1a166247bd174a930 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 13:07:17 -0700
+Subject: clk: at91: clk-master: Add check for divide by 3
+
+From: Ryan Wanner <Ryan.Wanner@microchip.com>
+
+[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ]
+
+A potential divider for the master clock is div/3. The register
+configuration for div/3 is MASTER_PRES_MAX. The current bit shifting
+method does not work for this case. Checking for MASTER_PRES_MAX will
+ensure the correct decimal value is stored in the system.
+
+Signed-off-by: Ryan Wanner <Ryan.Wanner@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-master.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
+index 04d0dd8385945..3f4a071e4dab4 100644
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -437,6 +437,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw,
+ {
+ struct clk_master *master = to_clk_master(hw);
+
++ if (master->div == MASTER_PRES_MAX)
++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3);
++
+ return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div));
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 44e840dc72c7d55e09be72afd261a8f6aaf35dcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 16:08:11 +0200
+Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ]
+
+As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL
+can't be disabled - the clock module will just be stuck in transitioning
+state forever, resulting in the following warning message after the wait
+loop times out:
+
+ l3-aon-clkctrl:0000:0: failed to disable
+
+Just add the clock to enable_init_clks, so no attempt is made to disable
+it.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-33xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c
+index f2c22120aaa75..37bb20e92f787 100644
+--- a/drivers/clk/ti/clk-33xx.c
++++ b/drivers/clk/ti/clk-33xx.c
+@@ -266,6 +266,8 @@ static const char *enable_init_clks[] = {
+ "dpll_ddr_m2_ck",
+ "dpll_mpu_m2_ck",
+ "l3_gclk",
++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */
++ "l3-aon-clkctrl:0000:0",
+ /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */
+ "l3-clkctrl:00bc:0",
+ "l4hs_gclk",
+--
+2.51.0
+
--- /dev/null
+From 63fd32580fb8541c5026bbf0e02b380d15b90832 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:13 -0500
+Subject: cpufreq: tegra186: Initialize all cores to max frequencies
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ]
+
+During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores
+are still at reset values and not reflecting the actual frequency. This
+causes get calls to fail. Set all cores to their respective max
+frequency during probe to initialize the registers to working values.
+
+Suggested-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index af7edddaa84e4..cf37d2db1a899 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = {
+
+ static struct cpufreq_frequency_table *init_vhint_table(
+ struct platform_device *pdev, struct tegra_bpmp *bpmp,
+- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id)
++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id,
++ int *num_rates)
+ {
+ struct cpufreq_frequency_table *table;
+ struct mrq_cpu_vhint_request req;
+ struct tegra_bpmp_message msg;
+ struct cpu_vhint_data *data;
+- int err, i, j, num_rates = 0;
++ int err, i, j;
+ dma_addr_t phys;
+ void *virt;
+
+@@ -164,6 +165,7 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ goto free;
+ }
+
++ *num_rates = 0;
+ for (i = data->vfloor; i <= data->vceil; i++) {
+ u16 ndiv = data->ndiv[i];
+
+@@ -174,10 +176,10 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ if (i > 0 && ndiv == data->ndiv[i - 1])
+ continue;
+
+- num_rates++;
++ (*num_rates)++;
+ }
+
+- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table),
++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table),
+ GFP_KERNEL);
+ if (!table) {
+ table = ERR_PTR(-ENOMEM);
+@@ -219,7 +221,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ {
+ struct tegra186_cpufreq_data *data;
+ struct tegra_bpmp *bpmp;
+- unsigned int i = 0, err;
++ unsigned int i = 0, err, edvd_offset;
++ int num_rates = 0;
++ u32 edvd_val, cpu;
+
+ data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+ if (!data)
+@@ -245,10 +249,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) {
+ struct tegra186_cpufreq_cluster *cluster = &data->clusters[i];
+
+- cluster->table = init_vhint_table(pdev, bpmp, cluster, i);
++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates);
+ if (IS_ERR(cluster->table)) {
+ err = PTR_ERR(cluster->table);
+ goto put_bpmp;
++ } else if (!num_rates) {
++ err = -EINVAL;
++ goto put_bpmp;
++ }
++
++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) {
++ if (data->cpus[cpu].bpmp_cluster_id == i) {
++ edvd_val = cluster->table[num_rates - 1].driver_data;
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 295f37f57e2333ee1f2f130737b14e38c9561edb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 03:32:09 -0400
+Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
+
+From: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+
+[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
+
+Add bounds checking to prevent writes past framebuffer boundaries when
+rendering text near screen edges. Return early if the Y position is off-screen
+and clip image height to screen boundary. Break from the rendering loop if the
+X position is off-screen. When clipping image width to fit the screen, update
+the character count to match the clipped width to prevent buffer size
+mismatches.
+
+Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
+receive mismatched parameters where the buffer is allocated for the clipped
+width but cnt reflects the original larger count, causing out-of-bounds writes.
+
+Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
+Suggested-by: Helge Deller <deller@gmx.de>
+Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index a4b4e1ec702e5..8563264d11fac 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ image.height = vc->vc_font.height;
+ image.depth = 1;
+
++ if (image.dy >= info->var.yres)
++ return;
++
++ image.height = min(image.height, info->var.yres - image.dy);
++
+ if (attribute) {
+ buf = kmalloc(cellsize, GFP_ATOMIC);
+ if (!buf)
+@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ cnt = count;
+
+ image.width = vc->vc_font.width * cnt;
++
++ if (image.dx >= info->var.xres)
++ break;
++
++ if (image.dx + image.width > info->var.xres) {
++ image.width = info->var.xres - image.dx;
++ cnt = image.width / vc->vc_font.width;
++ if (cnt == 0)
++ break;
++ image.width = cnt * vc->vc_font.width;
++ }
++
+ pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
+ pitch &= ~scan_align;
+ size = pitch * image.height + buf_align;
+--
+2.51.0
+
--- /dev/null
+From 45cdaa1d70eb432b0a2c8fdf291082891d25c178 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 May 2025 20:44:34 -0500
+Subject: fs/hpfs: Fix error code for new_inode() failure in
+ mkdir/create/mknod/symlink
+
+From: Yikang Yue <yikangy2@illinois.edu>
+
+[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
+
+The function call new_inode() is a primitive for allocating an inode in memory,
+rather than planning disk space for it. Therefore, -ENOMEM should be returned
+as the error code rather than -ENOSPC.
+
+To be specific, new_inode()'s call path looks like this:
+new_inode
+ new_inode_pseudo
+ alloc_inode
+ ops->alloc_inode (hpfs_alloc_inode)
+ alloc_inode_sb
+ kmem_cache_alloc_lru
+
+Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM),
+not a lack of disk space. However, the current implementation of
+hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails.
+This patch fix this by set err to -ENOMEM before the goto statement.
+
+BTW, we also noticed that other nested calls within these four functions,
+like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure.
+But similarly, only -ENOSPC is returned. Addressing these will involve code
+modifications in other functions, and we plan to submit dedicated patches for these
+issues in the future. For this patch, we focus on new_inode().
+
+Signed-off-by: Yikang Yue <yikangy2@illinois.edu>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hpfs/namei.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index d73f8a67168e9..c1c53602e4130 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -53,8 +53,10 @@ static int hpfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
+ dee.fnode = cpu_to_le32(fno);
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail2;
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -156,9 +158,10 @@ static int hpfs_create(struct user_namespace *mnt_userns, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ result->i_mode |= S_IFREG;
+@@ -244,9 +247,10 @@ static int hpfs_mknod(struct user_namespace *mnt_userns, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -321,8 +325,10 @@ static int hpfs_symlink(struct user_namespace *mnt_userns, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
++ }
+ result->i_ino = fno;
+ hpfs_init_inode(result);
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+--
+2.51.0
+
--- /dev/null
+From ccb940e9823249d52ba3c0fc0e03daaf56f2e458 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 19:54:09 +0200
+Subject: rtc: pcf2127: clear minute/second interrupt
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ]
+
+PCF2127 can generate interrupt every full second or minute configured
+from control and status register 1, bits MI (1) and SI (0).
+
+On interrupt control register 2 bit MSF (7) is set and must be cleared
+to continue normal operation.
+
+While the driver never enables this interrupt on its own, users or
+firmware may do so - e.g. as an easy way to test the interrupt.
+
+Add preprocessor definition for MSF bit and include it in the irq
+bitmask to ensure minute and second interrupts are cleared when fired.
+
+This fixes an issue where the rtc enters a test mode and becomes
+unresponsive after a second interrupt has fired and is not cleared in
+time. In this state register writes to control registers have no
+effect and the interrupt line is kept asserted [1]:
+
+[1] userspace commands to put rtc into unresponsive state:
+$ i2cget -f -y 2 0x51 0x00
+0x04
+$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI
+$ i2cget -f -y 2 0x51 0x00
+0x84 # bit 8 EXT_TEST set
+$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register
+$ i2cget -f -y 2 0x51 0x00
+0x84 # no change
+
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 43f8011070952..f12d854d67b5e 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -35,6 +35,7 @@
+ #define PCF2127_BIT_CTRL2_AF BIT(4)
+ #define PCF2127_BIT_CTRL2_TSF2 BIT(5)
+ #define PCF2127_BIT_CTRL2_WDTF BIT(6)
++#define PCF2127_BIT_CTRL2_MSF BIT(7)
+ /* Control register 3 */
+ #define PCF2127_REG_CTRL3 0x02
+ #define PCF2127_BIT_CTRL3_BLIE BIT(0)
+@@ -99,7 +100,8 @@
+ #define PCF2127_CTRL2_IRQ_MASK ( \
+ PCF2127_BIT_CTRL2_AF | \
+ PCF2127_BIT_CTRL2_WDTF | \
+- PCF2127_BIT_CTRL2_TSF2)
++ PCF2127_BIT_CTRL2_TSF2 | \
++ PCF2127_BIT_CTRL2_MSF)
+
+ struct pcf2127 {
+ struct rtc_device *rtc;
+--
+2.51.0
+
rdma-irdma-set-irdma_cq-cq_num-field-during-cq-creat.patch
rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch
btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch
+fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch
+um-fix-help-message-for-ssl-non-raw.patch
+rtc-pcf2127-clear-minute-second-interrupt.patch
+arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch
+clk-at91-clk-master-add-check-for-divide-by-3.patch
+clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch
+9p-fix-sys-fs-9p-caches-overwriting-itself.patch
+cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch
+9p-sysfs_init-don-t-hardcode-error-to-enomem.patch
+acpi-property-return-present-device-nodes-only-on-fw.patch
+tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch
+fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch
+asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch
+ceph-add-checking-of-wait_for_completion_killable-re.patch
--- /dev/null
+From 57302daa9a0026053191219259fd89acf099fa45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:47:06 -0700
+Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
+
+small_const_nbits is defined in asm-generic/bitsperlong.h which
+bitmap.h uses but doesn't include causing build failures in some build
+systems. Add the missing #include.
+
+Note the bitmap.h in tools has diverged from that of the kernel, so no
+changes are made there.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Yury Norov <yury.norov@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: André Almeida <andrealmeid@igalia.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Ido Schimmel <idosch@nvidia.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Jason Xing <kerneljasonxing@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Maurice Lambert <mauricelambert434@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Petr Machata <petrm@nvidia.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yuyang Huang <yuyanghuang@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/bitmap.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
+index a83ffdf1e2117..e65a7e84c7541 100644
+--- a/tools/include/linux/bitmap.h
++++ b/tools/include/linux/bitmap.h
+@@ -3,6 +3,7 @@
+ #define _PERF_BITOPS_H
+
+ #include <string.h>
++#include <asm-generic/bitsperlong.h>
+ #include <linux/align.h>
+ #include <linux/bitops.h>
+ #include <stdlib.h>
+--
+2.51.0
+
--- /dev/null
+From 6595131bbf9e7b195a28bf356147fbe3d0f407ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 08:56:59 +0800
+Subject: um: Fix help message for ssl-non-raw
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ]
+
+Add the missing option name in the help message. Additionally,
+switch to __uml_help(), because this is a global option rather
+than a per-channel option.
+
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/ssl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
+index 8514966778d53..1bb657a296906 100644
+--- a/arch/um/drivers/ssl.c
++++ b/arch/um/drivers/ssl.c
+@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str)
+ return 1;
+ }
+ __setup("ssl-non-raw", ssl_non_raw_setup);
+-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode");
++__uml_help(ssl_non_raw_setup,
++"ssl-non-raw\n"
++" Set serial lines to non-raw mode.\n\n"
++);
+--
+2.51.0
+
--- /dev/null
+From 15bd8e11d267425db8ab5c1e995d179b5f634dfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:30 +0900
+Subject: 9p: fix /sys/fs/9p/caches overwriting itself
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
+
+caches_show() overwrote its buffer on each iteration,
+so only the last cache tag was visible in sysfs output.
+
+Properly append with snprintf(buf + count, …).
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 39def020a074b..b304e070139ca 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -558,7 +558,7 @@ static ssize_t caches_show(struct kobject *kobj,
+ spin_lock(&v9fs_sessionlist_lock);
+ list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
+ if (v9ses->cachetag) {
+- n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag);
+ if (n < 0) {
+ count = n;
+ break;
+--
+2.51.0
+
--- /dev/null
+From 837ad89b1fba8553ad8556a451de788044430e1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:31 +0900
+Subject: 9p: sysfs_init: don't hardcode error to ENOMEM
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
+
+v9fs_sysfs_init() always returned -ENOMEM on failure;
+return the actual sysfs_create_group() error instead.
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index b304e070139ca..1dd8a735bf7f6 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -594,13 +594,16 @@ static struct attribute_group v9fs_attr_group = {
+
+ static int __init v9fs_sysfs_init(void)
+ {
++ int ret;
++
+ v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
+ if (!v9fs_kobj)
+ return -ENOMEM;
+
+- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) {
++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group);
++ if (ret) {
+ kobject_put(v9fs_kobj);
+- return -ENOMEM;
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From b07a8000a87688c85f11724f7a14337808df1a3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:26:36 +0300
+Subject: ACPI: property: Return present device nodes only on fwnode interface
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
+
+fwnode_graph_get_next_subnode() may return fwnode backed by ACPI
+device nodes and there has been no check these devices are present
+in the system, unlike there has been on fwnode OF backend.
+
+In order to provide consistent behaviour towards callers,
+add a check for device presence by introducing
+a new function acpi_get_next_present_subnode(), used as the
+get_next_child_node() fwnode operation that also checks device
+node presence.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com
+[ rjw: Kerneldoc comment and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/property.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index 5906e247b9fa1..c25fe9b86e237 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -1114,6 +1114,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
+ return NULL;
+ }
+
++/*
++ * acpi_get_next_present_subnode - Return the next present child node handle
++ * @fwnode: Firmware node to find the next child node for.
++ * @child: Handle to one of the device's child nodes or a null handle.
++ *
++ * Like acpi_get_next_subnode(), but the device nodes returned by
++ * acpi_get_next_present_subnode() are guaranteed to be present.
++ *
++ * Returns: The fwnode handle of the next present sub-node.
++ */
++static struct fwnode_handle *
++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode,
++ struct fwnode_handle *child)
++{
++ do {
++ child = acpi_get_next_subnode(fwnode, child);
++ } while (is_acpi_device_node(child) &&
++ !acpi_device_is_present(to_acpi_device_node(child)));
++
++ return child;
++}
++
+ /**
+ * acpi_node_get_parent - Return parent fwnode of this fwnode
+ * @fwnode: Firmware node whose parent to get
+@@ -1387,7 +1409,7 @@ acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
+ .property_read_string_array = \
+ acpi_fwnode_property_read_string_array, \
+ .get_parent = acpi_node_get_parent, \
+- .get_next_child_node = acpi_get_next_subnode, \
++ .get_next_child_node = acpi_get_next_present_subnode, \
+ .get_named_child_node = acpi_fwnode_get_named_child_node, \
+ .get_reference_args = acpi_fwnode_get_reference_args, \
+ .graph_get_next_endpoint = \
+--
+2.51.0
+
--- /dev/null
+From 8ce5e4f9e60b48cfe6f89429167050fb3c53bdac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 12:04:32 -0700
+Subject: ceph: add checking of wait_for_completion_killable() return value
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
+
+The Coverity Scan service has detected the calling of
+wait_for_completion_killable() without checking the return
+value in ceph_lock_wait_for_completion() [1]. The CID 1636232
+defect contains explanation: "If the function returns an error
+value, the error value may be mistaken for a normal value.
+In ceph_lock_wait_for_completion(): Value returned from
+a function is not checked for errors before being used. (CWE-252)".
+
+The patch adds the checking of wait_for_completion_killable()
+return value and return the error code from
+ceph_lock_wait_for_completion().
+
+[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/locks.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index 544e9e85b1202..d93515c2fa56f 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -206,7 +206,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,
+ if (err && err != -ERESTARTSYS)
+ return err;
+
+- wait_for_completion_killable(&req->r_safe_completion);
++ err = wait_for_completion_killable(&req->r_safe_completion);
++ if (err)
++ return err;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1057e4d7177add1d23dace671efe697ddcbac639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 03:32:09 -0400
+Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
+
+From: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+
+[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
+
+Add bounds checking to prevent writes past framebuffer boundaries when
+rendering text near screen edges. Return early if the Y position is off-screen
+and clip image height to screen boundary. Break from the rendering loop if the
+X position is off-screen. When clipping image width to fit the screen, update
+the character count to match the clipped width to prevent buffer size
+mismatches.
+
+Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
+receive mismatched parameters where the buffer is allocated for the clipped
+width but cnt reflects the original larger count, causing out-of-bounds writes.
+
+Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
+Suggested-by: Helge Deller <deller@gmx.de>
+Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index 99a4f048b96ac..75c20f8e58e33 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -169,6 +169,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ image.height = vc->vc_font.height;
+ image.depth = 1;
+
++ if (image.dy >= info->var.yres)
++ return;
++
++ image.height = min(image.height, info->var.yres - image.dy);
++
+ if (attribute) {
+ buf = kmalloc(cellsize, GFP_ATOMIC);
+ if (!buf)
+@@ -182,6 +187,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ cnt = count;
+
+ image.width = vc->vc_font.width * cnt;
++
++ if (image.dx >= info->var.xres)
++ break;
++
++ if (image.dx + image.width > info->var.xres) {
++ image.width = info->var.xres - image.dx;
++ cnt = image.width / vc->vc_font.width;
++ if (cnt == 0)
++ break;
++ image.width = cnt * vc->vc_font.width;
++ }
++
+ pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
+ pitch &= ~scan_align;
+ size = pitch * image.height + buf_align;
+--
+2.51.0
+
--- /dev/null
+From 58a455d2e08191c6e44e771c2d2c0c45f58fe518 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 May 2025 20:44:34 -0500
+Subject: fs/hpfs: Fix error code for new_inode() failure in
+ mkdir/create/mknod/symlink
+
+From: Yikang Yue <yikangy2@illinois.edu>
+
+[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
+
+The function call new_inode() is a primitive for allocating an inode in memory,
+rather than planning disk space for it. Therefore, -ENOMEM should be returned
+as the error code rather than -ENOSPC.
+
+To be specific, new_inode()'s call path looks like this:
+new_inode
+ new_inode_pseudo
+ alloc_inode
+ ops->alloc_inode (hpfs_alloc_inode)
+ alloc_inode_sb
+ kmem_cache_alloc_lru
+
+Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM),
+not a lack of disk space. However, the current implementation of
+hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails.
+This patch fix this by set err to -ENOMEM before the goto statement.
+
+BTW, we also noticed that other nested calls within these four functions,
+like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure.
+But similarly, only -ENOSPC is returned. Addressing these will involve code
+modifications in other functions, and we plan to submit dedicated patches for these
+issues in the future. For this patch, we focus on new_inode().
+
+Signed-off-by: Yikang Yue <yikangy2@illinois.edu>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hpfs/namei.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index 1aee39160ac5b..bc1309ef4cfa5 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ dee.fnode = cpu_to_le32(fno);
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail2;
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -154,9 +156,10 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, b
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ result->i_mode |= S_IFREG;
+@@ -241,9 +244,10 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -317,8 +321,10 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
++ }
+ result->i_ino = fno;
+ hpfs_init_inode(result);
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+--
+2.51.0
+
page_pool-clamp-pool-size-to-max-16k-pages.patch
orangefs-fix-xattr-related-buffer-overflow.patch
acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
+fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch
+9p-fix-sys-fs-9p-caches-overwriting-itself.patch
+9p-sysfs_init-don-t-hardcode-error-to-enomem.patch
+acpi-property-return-present-device-nodes-only-on-fw.patch
+tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch
+fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch
+ceph-add-checking-of-wait_for_completion_killable-re.patch
--- /dev/null
+From badfd5e0bfb9e452ee05578edc90f0a5f28f6732 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:47:06 -0700
+Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
+
+small_const_nbits is defined in asm-generic/bitsperlong.h which
+bitmap.h uses but doesn't include causing build failures in some build
+systems. Add the missing #include.
+
+Note the bitmap.h in tools has diverged from that of the kernel, so no
+changes are made there.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Yury Norov <yury.norov@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: André Almeida <andrealmeid@igalia.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Ido Schimmel <idosch@nvidia.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Jason Xing <kerneljasonxing@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Maurice Lambert <mauricelambert434@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Petr Machata <petrm@nvidia.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yuyang Huang <yuyanghuang@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/bitmap.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
+index 61cf3b9a23a6f..614df0e8822c4 100644
+--- a/tools/include/linux/bitmap.h
++++ b/tools/include/linux/bitmap.h
+@@ -3,6 +3,7 @@
+ #define _PERF_BITOPS_H
+
+ #include <string.h>
++#include <asm-generic/bitsperlong.h>
+ #include <linux/align.h>
+ #include <linux/bitops.h>
+ #include <stdlib.h>
+--
+2.51.0
+
--- /dev/null
+From c9777a98b64d0f64cdfb3c927f948be2661765a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:30 +0900
+Subject: 9p: fix /sys/fs/9p/caches overwriting itself
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
+
+caches_show() overwrote its buffer on each iteration,
+so only the last cache tag was visible in sysfs output.
+
+Properly append with snprintf(buf + count, …).
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 0129de2ea31ae..fc3dadbd2e11c 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj,
+ spin_lock(&v9fs_sessionlist_lock);
+ list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
+ if (v9ses->cachetag) {
+- n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag);
+ if (n < 0) {
+ count = n;
+ break;
+--
+2.51.0
+
--- /dev/null
+From ca6accca5d94f9371619bf54357f548267352735 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:31 +0900
+Subject: 9p: sysfs_init: don't hardcode error to ENOMEM
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
+
+v9fs_sysfs_init() always returned -ENOMEM on failure;
+return the actual sysfs_create_group() error instead.
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index fc3dadbd2e11c..2a6988db807b3 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = {
+
+ static int __init v9fs_sysfs_init(void)
+ {
++ int ret;
++
+ v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
+ if (!v9fs_kobj)
+ return -ENOMEM;
+
+- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) {
++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group);
++ if (ret) {
+ kobject_put(v9fs_kobj);
+- return -ENOMEM;
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From c7574896b6f4de38ca36e09dc5b42f07caa5e81b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:26:36 +0300
+Subject: ACPI: property: Return present device nodes only on fwnode interface
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
+
+fwnode_graph_get_next_subnode() may return fwnode backed by ACPI
+device nodes and there has been no check these devices are present
+in the system, unlike there has been on fwnode OF backend.
+
+In order to provide consistent behaviour towards callers,
+add a check for device presence by introducing
+a new function acpi_get_next_present_subnode(), used as the
+get_next_child_node() fwnode operation that also checks device
+node presence.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com
+[ rjw: Kerneldoc comment and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/property.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index 46003b642b597..9f7880cc2bd8c 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -1298,6 +1298,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
+ return NULL;
+ }
+
++/*
++ * acpi_get_next_present_subnode - Return the next present child node handle
++ * @fwnode: Firmware node to find the next child node for.
++ * @child: Handle to one of the device's child nodes or a null handle.
++ *
++ * Like acpi_get_next_subnode(), but the device nodes returned by
++ * acpi_get_next_present_subnode() are guaranteed to be present.
++ *
++ * Returns: The fwnode handle of the next present sub-node.
++ */
++static struct fwnode_handle *
++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode,
++ struct fwnode_handle *child)
++{
++ do {
++ child = acpi_get_next_subnode(fwnode, child);
++ } while (is_acpi_device_node(child) &&
++ !acpi_device_is_present(to_acpi_device_node(child)));
++
++ return child;
++}
++
+ /**
+ * acpi_node_get_parent - Return parent fwnode of this fwnode
+ * @fwnode: Firmware node whose parent to get
+@@ -1641,7 +1663,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode,
+ .property_read_string_array = \
+ acpi_fwnode_property_read_string_array, \
+ .get_parent = acpi_node_get_parent, \
+- .get_next_child_node = acpi_get_next_subnode, \
++ .get_next_child_node = acpi_get_next_present_subnode, \
+ .get_named_child_node = acpi_fwnode_get_named_child_node, \
+ .get_name = acpi_fwnode_get_name, \
+ .get_name_prefix = acpi_fwnode_get_name_prefix, \
+--
+2.51.0
+
--- /dev/null
+From 27a6ffac2013c4e13f4eaaff8d5ae0befe0f7239 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:27 +0200
+Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ]
+
+Add a new word in assembly to store ACR value during the calls
+to at91_plla_disable/at91_plla_enable macros and use it.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading]
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index 0af2598899fc5..c410da92ce38b 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -685,6 +685,10 @@ sr_dis_exit:
+ bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID
+ str tmp2, [pmc, #AT91_PMC_PLL_UPDT]
+
++ /* save acr */
++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR]
++ str tmp2, .saved_acr
++
+ /* save div. */
+ mov tmp1, #0
+ ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0]
+@@ -754,7 +758,7 @@ sr_dis_exit:
+ str tmp1, [pmc, #AT91_PMC_PLL_UPDT]
+
+ /* step 2. */
+- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
++ ldr tmp1, .saved_acr
+ str tmp1, [pmc, #AT91_PMC_PLL_ACR]
+
+ /* step 3. */
+@@ -1130,6 +1134,8 @@ ENDPROC(at91_pm_suspend_in_sram)
+ .word 0
+ .saved_mckr:
+ .word 0
++.saved_acr:
++ .word 0
+ .saved_pllar:
+ .word 0
+ .saved_sam9_lpr:
+--
+2.51.0
+
--- /dev/null
+From 7d0f59bd304bd00f432e610d12c2a88679af9d30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 00:12:19 +0200
+Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
+
+From: Valerio Setti <vsetti@baylibre.com>
+
+[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ]
+
+According to I2S specs audio data is sampled on the rising edge of the
+clock and it can change on the falling one. When operating in normal mode
+this SoC behaves the opposite so a clock polarity inversion is required
+in this case.
+
+This was tested on an OdroidC2 (Amlogic S905 SoC) board.
+
+Signed-off-by: Valerio Setti <vsetti@baylibre.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Tested-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c
+index a0dd914c8ed13..3b4061508c180 100644
+--- a/sound/soc/meson/aiu-encoder-i2s.c
++++ b/sound/soc/meson/aiu-encoder-i2s.c
+@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ inv == SND_SOC_DAIFMT_IB_IF)
+ val |= AIU_CLK_CTRL_LRCLK_INVERT;
+
+- if (inv == SND_SOC_DAIFMT_IB_NF ||
+- inv == SND_SOC_DAIFMT_IB_IF)
++ /*
++ * The SoC changes data on the rising edge of the bitclock
++ * so an inversion of the bitclock is required in normal mode
++ */
++ if (inv == SND_SOC_DAIFMT_NB_NF ||
++ inv == SND_SOC_DAIFMT_NB_IF)
+ val |= AIU_CLK_CTRL_AOCLK_INVERT;
+
+ /* Signal skew */
+@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = {
+ .startup = aiu_encoder_i2s_startup,
+ .shutdown = aiu_encoder_i2s_shutdown,
+ };
+-
+--
+2.51.0
+
--- /dev/null
+From f9719d05e573125bf958fcc8cb7eff538470343d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 12:04:32 -0700
+Subject: ceph: add checking of wait_for_completion_killable() return value
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
+
+The Coverity Scan service has detected the calling of
+wait_for_completion_killable() without checking the return
+value in ceph_lock_wait_for_completion() [1]. The CID 1636232
+defect contains explanation: "If the function returns an error
+value, the error value may be mistaken for a normal value.
+In ceph_lock_wait_for_completion(): Value returned from
+a function is not checked for errors before being used. (CWE-252)".
+
+The patch adds the checking of wait_for_completion_killable()
+return value and return the error code from
+ceph_lock_wait_for_completion().
+
+[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/locks.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index b191426bf880c..3da9e53f80918 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -202,7 +202,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,
+ if (err && err != -ERESTARTSYS)
+ return err;
+
+- wait_for_completion_killable(&req->r_safe_completion);
++ err = wait_for_completion_killable(&req->r_safe_completion);
++ if (err)
++ return err;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f894511f5dd052d3d776cb4c95c7a8e525060a0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 13:07:17 -0700
+Subject: clk: at91: clk-master: Add check for divide by 3
+
+From: Ryan Wanner <Ryan.Wanner@microchip.com>
+
+[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ]
+
+A potential divider for the master clock is div/3. The register
+configuration for div/3 is MASTER_PRES_MAX. The current bit shifting
+method does not work for this case. Checking for MASTER_PRES_MAX will
+ensure the correct decimal value is stored in the system.
+
+Signed-off-by: Ryan Wanner <Ryan.Wanner@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-master.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
+index b7cd1924de52a..1f07a5d292602 100644
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -574,6 +574,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw,
+ {
+ struct clk_master *master = to_clk_master(hw);
+
++ if (master->div == MASTER_PRES_MAX)
++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3);
++
+ return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div));
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ff70bd7dadcc0b43d72a204d14f3ab25fce4018f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:08:10 +0200
+Subject: clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 ]
+
+This register is important for sequencing the commands to PLLs, so
+actually write the update bits with regmap_write_bits() instead of
+relying on a read/modify/write regmap command that could skip the actual
+hardware write if the value is identical to the one read.
+
+It's changed when modification is needed to the PLL, when
+read-only operation is done, we could keep the call to
+regmap_update_bits().
+
+Add a comment to the sam9x60_div_pll_set_div() function that uses this
+PLL_UPDT register so that it's used consistently, according to the
+product's datasheet.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Tested-by: Ryan Wanner <ryan.wanner@microchip.com> # on sama7d65 and sam9x75
+Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com
+[claudiu.beznea: fix "Alignment should match open parenthesis"
+ checkpatch.pl check]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-sam9x60-pll.c | 75 ++++++++++++++++--------------
+ 1 file changed, 39 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c
+index 0882ed01d5c27..a010a8fce58b2 100644
+--- a/drivers/clk/at91/clk-sam9x60-pll.c
++++ b/drivers/clk/at91/clk-sam9x60-pll.c
+@@ -90,8 +90,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
+ cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
+ cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
+@@ -125,17 +125,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
+ udelay(10);
+ }
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -161,8 +161,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0);
+
+@@ -170,9 +170,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
+ regmap_update_bits(regmap, AT91_PMC_PLL_ACR,
+ AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ spin_unlock_irqrestore(core->lock, flags);
+ }
+@@ -257,8 +257,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+
+ spin_lock_irqsave(core->lock, irqflags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
+ cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
+ cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
+@@ -270,18 +270,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+ (frac->mul << core->layout->mul_shift) |
+ (frac->frac << core->layout->frac_shift));
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
+ AT91_PMC_PLL_CTRL0_ENLOCK |
+ AT91_PMC_PLL_CTRL0_ENPLL);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -333,7 +333,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = {
+ .restore_context = sam9x60_frac_pll_restore_context,
+ };
+
+-/* This function should be called with spinlock acquired. */
++/* This function should be called with spinlock acquired.
++ * Warning: this function must be called only if the same PLL ID was set in
++ * PLL_UPDT register previously.
++ */
+ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
+ bool enable)
+ {
+@@ -345,9 +348,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
+ core->layout->div_mask | ena_msk,
+ (div << core->layout->div_shift) | ena_val);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -361,8 +364,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core)
+ unsigned int val, cdiv;
+
+ spin_lock_irqsave(core->lock, flags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
+
+@@ -393,15 +396,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ core->layout->endiv_mask, 0);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ spin_unlock_irqrestore(core->lock, flags);
+ }
+@@ -507,8 +510,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+ div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1;
+
+ spin_lock_irqsave(core->lock, irqflags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
+
+@@ -563,8 +566,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier,
+ div->div = div->safe_div;
+
+ spin_lock_irqsave(core.lock, irqflags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core.id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core.id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core.layout->div_mask) >> core.layout->div_shift;
+
+--
+2.51.0
+
--- /dev/null
+From edabc77b0da4fc325a7b7f23cc79b58e5c44b9ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 01:09:47 +0800
+Subject: clk: sunxi-ng: sun6i-rtc: Add A523 specifics
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ]
+
+The A523's RTC block is backward compatible with the R329's, but it also
+has a calibration function for its internal oscillator, which would
+allow it to provide a clock rate closer to the desired 32.768 KHz. This
+is useful on the Radxa Cubie A5E, which does not have an external 32.768
+KHz crystal.
+
+Add new compatible-specific data for it.
+
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
+index d65398497d5f6..e42348bda20f8 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
++++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
+@@ -323,6 +323,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = {
+ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
+ };
+
++static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = {
++ .have_ext_osc32k = true,
++ .have_iosc_calibration = true,
++ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents,
++ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
++};
++
+ static const struct of_device_id sun6i_rtc_ccu_match[] = {
+ {
+ .compatible = "allwinner,sun50i-h616-rtc",
+@@ -332,6 +339,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = {
+ .compatible = "allwinner,sun50i-r329-rtc",
+ .data = &sun50i_r329_rtc_ccu_data,
+ },
++ {
++ .compatible = "allwinner,sun55i-a523-rtc",
++ .data = &sun55i_a523_rtc_ccu_data,
++ },
+ {},
+ };
+
+--
+2.51.0
+
--- /dev/null
+From db779ee61260ac8faf91d3aeb9ad54f266bdd343 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 16:08:11 +0200
+Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ]
+
+As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL
+can't be disabled - the clock module will just be stuck in transitioning
+state forever, resulting in the following warning message after the wait
+loop times out:
+
+ l3-aon-clkctrl:0000:0: failed to disable
+
+Just add the clock to enable_init_clks, so no attempt is made to disable
+it.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-33xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c
+index 85c50ea39e6da..9269e6a0db6a4 100644
+--- a/drivers/clk/ti/clk-33xx.c
++++ b/drivers/clk/ti/clk-33xx.c
+@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = {
+ "dpll_ddr_m2_ck",
+ "dpll_mpu_m2_ck",
+ "l3_gclk",
++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */
++ "l3-aon-clkctrl:0000:0",
+ /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */
+ "l3-clkctrl:00bc:0",
+ "l4hs_gclk",
+--
+2.51.0
+
--- /dev/null
+From ddc4f9c71c13b5ca1cdc941c4d86c302148cd639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:13 -0500
+Subject: cpufreq: tegra186: Initialize all cores to max frequencies
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ]
+
+During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores
+are still at reset values and not reflecting the actual frequency. This
+causes get calls to fail. Set all cores to their respective max
+frequency during probe to initialize the registers to working values.
+
+Suggested-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index ee57676bbee14..db27aa0e35074 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = {
+
+ static struct cpufreq_frequency_table *init_vhint_table(
+ struct platform_device *pdev, struct tegra_bpmp *bpmp,
+- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id)
++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id,
++ int *num_rates)
+ {
+ struct cpufreq_frequency_table *table;
+ struct mrq_cpu_vhint_request req;
+ struct tegra_bpmp_message msg;
+ struct cpu_vhint_data *data;
+- int err, i, j, num_rates = 0;
++ int err, i, j;
+ dma_addr_t phys;
+ void *virt;
+
+@@ -168,6 +169,7 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ goto free;
+ }
+
++ *num_rates = 0;
+ for (i = data->vfloor; i <= data->vceil; i++) {
+ u16 ndiv = data->ndiv[i];
+
+@@ -178,10 +180,10 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ if (i > 0 && ndiv == data->ndiv[i - 1])
+ continue;
+
+- num_rates++;
++ (*num_rates)++;
+ }
+
+- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table),
++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table),
+ GFP_KERNEL);
+ if (!table) {
+ table = ERR_PTR(-ENOMEM);
+@@ -223,7 +225,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ {
+ struct tegra186_cpufreq_data *data;
+ struct tegra_bpmp *bpmp;
+- unsigned int i = 0, err;
++ unsigned int i = 0, err, edvd_offset;
++ int num_rates = 0;
++ u32 edvd_val, cpu;
+
+ data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+ if (!data)
+@@ -249,10 +253,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) {
+ struct tegra186_cpufreq_cluster *cluster = &data->clusters[i];
+
+- cluster->table = init_vhint_table(pdev, bpmp, cluster, i);
++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates);
+ if (IS_ERR(cluster->table)) {
+ err = PTR_ERR(cluster->table);
+ goto put_bpmp;
++ } else if (!num_rates) {
++ err = -EINVAL;
++ goto put_bpmp;
++ }
++
++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) {
++ if (data->cpus[cpu].bpmp_cluster_id == i) {
++ edvd_val = cluster->table[num_rates - 1].driver_data;
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c85b3d6d031b54580b26bb3cc195b977b818c166 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 03:32:09 -0400
+Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
+
+From: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+
+[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
+
+Add bounds checking to prevent writes past framebuffer boundaries when
+rendering text near screen edges. Return early if the Y position is off-screen
+and clip image height to screen boundary. Break from the rendering loop if the
+X position is off-screen. When clipping image width to fit the screen, update
+the character count to match the clipped width to prevent buffer size
+mismatches.
+
+Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
+receive mismatched parameters where the buffer is allocated for the clipped
+width but cnt reflects the original larger count, causing out-of-bounds writes.
+
+Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
+Suggested-by: Helge Deller <deller@gmx.de>
+Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index a4b4e1ec702e5..8563264d11fac 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ image.height = vc->vc_font.height;
+ image.depth = 1;
+
++ if (image.dy >= info->var.yres)
++ return;
++
++ image.height = min(image.height, info->var.yres - image.dy);
++
+ if (attribute) {
+ buf = kmalloc(cellsize, GFP_ATOMIC);
+ if (!buf)
+@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ cnt = count;
+
+ image.width = vc->vc_font.width * cnt;
++
++ if (image.dx >= info->var.xres)
++ break;
++
++ if (image.dx + image.width > info->var.xres) {
++ image.width = info->var.xres - image.dx;
++ cnt = image.width / vc->vc_font.width;
++ if (cnt == 0)
++ break;
++ image.width = cnt * vc->vc_font.width;
++ }
++
+ pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
+ pitch &= ~scan_align;
+ size = pitch * image.height + buf_align;
+--
+2.51.0
+
--- /dev/null
+From 6936edd0b11ff4aacc0d0ca572c759c885e6614d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 May 2025 20:44:34 -0500
+Subject: fs/hpfs: Fix error code for new_inode() failure in
+ mkdir/create/mknod/symlink
+
+From: Yikang Yue <yikangy2@illinois.edu>
+
+[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
+
+The function call new_inode() is a primitive for allocating an inode in memory,
+rather than planning disk space for it. Therefore, -ENOMEM should be returned
+as the error code rather than -ENOSPC.
+
+To be specific, new_inode()'s call path looks like this:
+new_inode
+ new_inode_pseudo
+ alloc_inode
+ ops->alloc_inode (hpfs_alloc_inode)
+ alloc_inode_sb
+ kmem_cache_alloc_lru
+
+Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM),
+not a lack of disk space. However, the current implementation of
+hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails.
+This patch fix this by set err to -ENOMEM before the goto statement.
+
+BTW, we also noticed that other nested calls within these four functions,
+like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure.
+But similarly, only -ENOSPC is returned. Addressing these will involve code
+modifications in other functions, and we plan to submit dedicated patches for these
+issues in the future. For this patch, we focus on new_inode().
+
+Signed-off-by: Yikang Yue <yikangy2@illinois.edu>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hpfs/namei.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index 15fc63276caae..63779d978c6db 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -53,8 +53,10 @@ static int hpfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
+ dee.fnode = cpu_to_le32(fno);
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail2;
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -156,9 +158,10 @@ static int hpfs_create(struct user_namespace *mnt_userns, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ result->i_mode |= S_IFREG;
+@@ -244,9 +247,10 @@ static int hpfs_mknod(struct user_namespace *mnt_userns, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -321,8 +325,10 @@ static int hpfs_symlink(struct user_namespace *mnt_userns, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
++ }
+ result->i_ino = fno;
+ hpfs_init_inode(result);
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+--
+2.51.0
+
--- /dev/null
+From acb3f652aa865e40d1203c3f662bcef61665c2b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 14:33:42 +0200
+Subject: kbuild: uapi: Strip comments before size type check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 66128f4287b04aef4d4db9bf5035985ab51487d5 ]
+
+On m68k, check_sizetypes in headers_check reports:
+
+ ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include <linux/types.h>
+
+This header file does not use any of the Linux-specific integer types,
+but merely refers to them from comments, so this is a false positive.
+As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes()
+warning to error"), this check was promoted to an error, breaking m68k
+all{mod,yes}config builds.
+
+Fix this by stripping simple comments before looking for Linux-specific
+integer types.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org
+[nathan: Adjust comment and remove unnecessary escaping from slashes in
+ regex]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ usr/include/headers_check.pl | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/usr/include/headers_check.pl b/usr/include/headers_check.pl
+index b6aec5e4365f9..682980781eb37 100755
+--- a/usr/include/headers_check.pl
++++ b/usr/include/headers_check.pl
+@@ -160,6 +160,8 @@ sub check_sizetypes
+ if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) {
+ check_include_typesh($included);
+ }
++ # strip single-line comments, as types may be referenced within them
++ $line =~ s@/\*.*?\*/@@;
+ if ($line =~ m/__[us](8|16|32|64)\b/) {
+ printf STDERR "$filename:$lineno: " .
+ "found __[us]{8,16,32,64} type " .
+--
+2.51.0
+
--- /dev/null
+From e627e3158d013b9671d0a03b61526299adf95099 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 18:48:33 +0200
+Subject: NTB: epf: Allow arbitrary BAR mapping
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ]
+
+The NTB epf host driver assumes the BAR number associated with a memory
+window is just incremented from the BAR number associated with MW1. This
+seems to have been enough so far but this is not really how the endpoint
+side work and the two could easily become mis-aligned.
+
+ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window
+index + 2, which means the function only returns a proper result if BAR_2
+is associated with MW1.
+
+Instead, fully describe and allow arbitrary NTB BAR mapping.
+
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++++++++++++++++----------------
+ 1 file changed, 53 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
+index 3ece49cb18ffa..9a0745664dcc7 100644
+--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
++++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
+@@ -49,6 +49,7 @@
+ #define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */
+
+ enum pci_barno {
++ NO_BAR = -1,
+ BAR_0,
+ BAR_1,
+ BAR_2,
+@@ -57,16 +58,26 @@ enum pci_barno {
+ BAR_5,
+ };
+
++enum epf_ntb_bar {
++ BAR_CONFIG,
++ BAR_PEER_SPAD,
++ BAR_DB,
++ BAR_MW1,
++ BAR_MW2,
++ BAR_MW3,
++ BAR_MW4,
++ NTB_BAR_NUM,
++};
++
++#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1)
++
+ struct ntb_epf_dev {
+ struct ntb_dev ntb;
+ struct device *dev;
+ /* Mutex to protect providing commands to NTB EPF */
+ struct mutex cmd_lock;
+
+- enum pci_barno ctrl_reg_bar;
+- enum pci_barno peer_spad_reg_bar;
+- enum pci_barno db_reg_bar;
+- enum pci_barno mw_bar;
++ const enum pci_barno *barno_map;
+
+ unsigned int mw_count;
+ unsigned int spad_count;
+@@ -85,17 +96,6 @@ struct ntb_epf_dev {
+
+ #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb)
+
+-struct ntb_epf_data {
+- /* BAR that contains both control region and self spad region */
+- enum pci_barno ctrl_reg_bar;
+- /* BAR that contains peer spad region */
+- enum pci_barno peer_spad_reg_bar;
+- /* BAR that contains Doorbell region and Memory window '1' */
+- enum pci_barno db_reg_bar;
+- /* BAR that contains memory windows*/
+- enum pci_barno mw_bar;
+-};
+-
+ static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command,
+ u32 argument)
+ {
+@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx)
+ return -EINVAL;
+ }
+
+- return idx + 2;
++ return ndev->barno_map[BAR_MW1 + idx];
+ }
+
+ static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx)
+@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx,
+ return -EINVAL;
+ }
+
+- bar = idx + ndev->mw_bar;
++ bar = ntb_epf_mw_to_bar(ndev, idx);
++ if (bar < 0)
++ return bar;
+
+ mw_size = pci_resource_len(ntb->pdev, bar);
+
+@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx,
+ if (idx == 0)
+ offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET);
+
+- bar = idx + ndev->mw_bar;
++ bar = ntb_epf_mw_to_bar(ndev, idx);
++ if (bar < 0)
++ return bar;
+
+ if (base)
+ *base = pci_resource_start(ndev->ntb.pdev, bar) + offset;
+@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev)
+ ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT);
+ ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT);
+
++ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) {
++ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count);
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
+@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
+ dev_warn(&pdev->dev, "Cannot DMA highmem\n");
+ }
+
+- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0);
++ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0);
+ if (!ndev->ctrl_reg) {
+ ret = -EIO;
+ goto err_dma_mask;
+ }
+
+- if (ndev->peer_spad_reg_bar) {
+- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0);
++ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) {
++ ndev->peer_spad_reg = pci_iomap(pdev,
++ ndev->barno_map[BAR_PEER_SPAD], 0);
+ if (!ndev->peer_spad_reg) {
+ ret = -EIO;
+ goto err_dma_mask;
+@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
+ ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz;
+ }
+
+- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0);
++ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0);
+ if (!ndev->db_reg) {
+ ret = -EIO;
+ goto err_dma_mask;
+@@ -663,12 +673,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev)
+ static int ntb_epf_pci_probe(struct pci_dev *pdev,
+ const struct pci_device_id *id)
+ {
+- enum pci_barno peer_spad_reg_bar = BAR_1;
+- enum pci_barno ctrl_reg_bar = BAR_0;
+- enum pci_barno db_reg_bar = BAR_2;
+- enum pci_barno mw_bar = BAR_2;
+ struct device *dev = &pdev->dev;
+- struct ntb_epf_data *data;
+ struct ntb_epf_dev *ndev;
+ int ret;
+
+@@ -679,18 +684,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev,
+ if (!ndev)
+ return -ENOMEM;
+
+- data = (struct ntb_epf_data *)id->driver_data;
+- if (data) {
+- peer_spad_reg_bar = data->peer_spad_reg_bar;
+- ctrl_reg_bar = data->ctrl_reg_bar;
+- db_reg_bar = data->db_reg_bar;
+- mw_bar = data->mw_bar;
+- }
++ ndev->barno_map = (const enum pci_barno *)id->driver_data;
++ if (!ndev->barno_map)
++ return -EINVAL;
+
+- ndev->peer_spad_reg_bar = peer_spad_reg_bar;
+- ndev->ctrl_reg_bar = ctrl_reg_bar;
+- ndev->db_reg_bar = db_reg_bar;
+- ndev->mw_bar = mw_bar;
+ ndev->dev = dev;
+
+ ntb_epf_init_struct(ndev, pdev);
+@@ -734,30 +731,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev)
+ ntb_epf_deinit_pci(ndev);
+ }
+
+-static const struct ntb_epf_data j721e_data = {
+- .ctrl_reg_bar = BAR_0,
+- .peer_spad_reg_bar = BAR_1,
+- .db_reg_bar = BAR_2,
+- .mw_bar = BAR_2,
++static const enum pci_barno j721e_map[NTB_BAR_NUM] = {
++ [BAR_CONFIG] = BAR_0,
++ [BAR_PEER_SPAD] = BAR_1,
++ [BAR_DB] = BAR_2,
++ [BAR_MW1] = BAR_2,
++ [BAR_MW2] = BAR_3,
++ [BAR_MW3] = BAR_4,
++ [BAR_MW4] = BAR_5
+ };
+
+-static const struct ntb_epf_data mx8_data = {
+- .ctrl_reg_bar = BAR_0,
+- .peer_spad_reg_bar = BAR_0,
+- .db_reg_bar = BAR_2,
+- .mw_bar = BAR_4,
++static const enum pci_barno mx8_map[NTB_BAR_NUM] = {
++ [BAR_CONFIG] = BAR_0,
++ [BAR_PEER_SPAD] = BAR_0,
++ [BAR_DB] = BAR_2,
++ [BAR_MW1] = BAR_4,
++ [BAR_MW2] = BAR_5,
++ [BAR_MW3] = NO_BAR,
++ [BAR_MW4] = NO_BAR
+ };
+
+ static const struct pci_device_id ntb_epf_pci_tbl[] = {
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E),
+ .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
+- .driver_data = (kernel_ulong_t)&j721e_data,
++ .driver_data = (kernel_ulong_t)j721e_map,
+ },
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809),
+ .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
+- .driver_data = (kernel_ulong_t)&mx8_data,
++ .driver_data = (kernel_ulong_t)mx8_map,
+ },
+ { },
+ };
+--
+2.51.0
+
--- /dev/null
+From c8ae7744b156370f43fe893276a969e3befac1df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 19:54:09 +0200
+Subject: rtc: pcf2127: clear minute/second interrupt
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ]
+
+PCF2127 can generate interrupt every full second or minute configured
+from control and status register 1, bits MI (1) and SI (0).
+
+On interrupt control register 2 bit MSF (7) is set and must be cleared
+to continue normal operation.
+
+While the driver never enables this interrupt on its own, users or
+firmware may do so - e.g. as an easy way to test the interrupt.
+
+Add preprocessor definition for MSF bit and include it in the irq
+bitmask to ensure minute and second interrupts are cleared when fired.
+
+This fixes an issue where the rtc enters a test mode and becomes
+unresponsive after a second interrupt has fired and is not cleared in
+time. In this state register writes to control registers have no
+effect and the interrupt line is kept asserted [1]:
+
+[1] userspace commands to put rtc into unresponsive state:
+$ i2cget -f -y 2 0x51 0x00
+0x04
+$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI
+$ i2cget -f -y 2 0x51 0x00
+0x84 # bit 8 EXT_TEST set
+$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register
+$ i2cget -f -y 2 0x51 0x00
+0x84 # no change
+
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 87f4fc9df68b4..ae2c52a0dab25 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -35,6 +35,7 @@
+ #define PCF2127_BIT_CTRL2_AF BIT(4)
+ #define PCF2127_BIT_CTRL2_TSF2 BIT(5)
+ #define PCF2127_BIT_CTRL2_WDTF BIT(6)
++#define PCF2127_BIT_CTRL2_MSF BIT(7)
+ /* Control register 3 */
+ #define PCF2127_REG_CTRL3 0x02
+ #define PCF2127_BIT_CTRL3_BLIE BIT(0)
+@@ -99,7 +100,8 @@
+ #define PCF2127_CTRL2_IRQ_MASK ( \
+ PCF2127_BIT_CTRL2_AF | \
+ PCF2127_BIT_CTRL2_WDTF | \
+- PCF2127_BIT_CTRL2_TSF2)
++ PCF2127_BIT_CTRL2_TSF2 | \
++ PCF2127_BIT_CTRL2_MSF)
+
+ struct pcf2127 {
+ struct rtc_device *rtc;
+--
+2.51.0
+
--- /dev/null
+From 3ad113273a7f180112c32ace3c186a2e5846012d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:14:28 +0900
+Subject: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
+
+From: Hoyoung Seo <hy50.seo@samsung.com>
+
+[ Upstream commit 558ae4579810fa0fef011944230c65a6f3087f85 ]
+
+When a UTP error occurs in isolation, UFS is not currently recoverable.
+This is because the UTP error is not considered fatal in the error
+handling code, leading to either an I/O timeout or an OCS error.
+
+Add the UTP error flag to INT_FATAL_ERRORS so the controller will be
+reset in this situation.
+
+ sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07
+ driverbyte=DRIVER_OK cmd_age=0s
+ sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00
+ I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg
+ 8 prio class 2
+ OCS error from controller = 9 for tag 39
+ pa_err[1] = 0x80000010 at 2667224756 us
+ pa_err: total cnt=2
+ dl_err[0] = 0x80000002 at 2667148060 us
+ dl_err[1] = 0x80002000 at 2667282844 us
+ No record of nl_err
+ No record of tl_err
+ No record of dme_err
+ No record of auto_hibern8_err
+ fatal_err[0] = 0x804 at 2667282836 us
+
+ ---------------------------------------------------
+ REGISTER
+ ---------------------------------------------------
+ NAME OFFSET VALUE
+ STD HCI SFR 0xfffffff0 0x0
+ AHIT 0x18 0x814
+ INTERRUPT STATUS 0x20 0x1000
+ INTERRUPT ENABLE 0x24 0x70ef5
+
+[mkp: commit desc]
+
+Signed-off-by: Hoyoung Seo <hy50.seo@samsung.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/ufs/ufshci.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h
+index f525566a0864d..6e80ed46e44ae 100644
+--- a/include/ufs/ufshci.h
++++ b/include/ufs/ufshci.h
+@@ -123,6 +123,7 @@ static inline u32 ufshci_version(u32 major, u32 minor)
+ #define UTP_TASK_REQ_COMPL 0x200
+ #define UIC_COMMAND_COMPL 0x400
+ #define DEVICE_FATAL_ERROR 0x800
++#define UTP_ERROR 0x1000
+ #define CONTROLLER_FATAL_ERROR 0x10000
+ #define SYSTEM_BUS_FATAL_ERROR 0x20000
+ #define CRYPTO_ENGINE_FATAL_ERROR 0x40000
+@@ -141,7 +142,8 @@ static inline u32 ufshci_version(u32 major, u32 minor)
+ CONTROLLER_FATAL_ERROR |\
+ SYSTEM_BUS_FATAL_ERROR |\
+ CRYPTO_ENGINE_FATAL_ERROR |\
+- UIC_LINK_LOST)
++ UIC_LINK_LOST |\
++ UTP_ERROR)
+
+ /* HCS - Host Controller Status 30h */
+ #define DEVICE_PRESENT 0x1
+--
+2.51.0
+
rdma-hns-fix-the-modification-of-max_send_sge.patch
rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch
btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch
+fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch
+um-fix-help-message-for-ssl-non-raw.patch
+clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch
+rtc-pcf2127-clear-minute-second-interrupt.patch
+arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch
+clk-at91-clk-master-add-check-for-divide-by-3.patch
+clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch
+clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch
+ntb-epf-allow-arbitrary-bar-mapping.patch
+9p-fix-sys-fs-9p-caches-overwriting-itself.patch
+cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch
+9p-sysfs_init-don-t-hardcode-error-to-enomem.patch
+scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch
+acpi-property-return-present-device-nodes-only-on-fw.patch
+tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch
+tools-lib-thermal-don-t-preserve-owner-in-install.patch
+tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch
+fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch
+kbuild-uapi-strip-comments-before-size-type-check.patch
+asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch
+ceph-add-checking-of-wait_for_completion_killable-re.patch
--- /dev/null
+From 78a7c2b6a8c7e4bdd9de99068a267f264db370ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:47:06 -0700
+Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
+
+small_const_nbits is defined in asm-generic/bitsperlong.h which
+bitmap.h uses but doesn't include causing build failures in some build
+systems. Add the missing #include.
+
+Note the bitmap.h in tools has diverged from that of the kernel, so no
+changes are made there.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Yury Norov <yury.norov@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: André Almeida <andrealmeid@igalia.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Ido Schimmel <idosch@nvidia.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Jason Xing <kerneljasonxing@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Maurice Lambert <mauricelambert434@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Petr Machata <petrm@nvidia.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yuyang Huang <yuyanghuang@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/bitmap.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
+index 2cbabc1dcf0fd..937e1e181775f 100644
+--- a/tools/include/linux/bitmap.h
++++ b/tools/include/linux/bitmap.h
+@@ -3,6 +3,7 @@
+ #define _TOOLS_LINUX_BITMAP_H
+
+ #include <string.h>
++#include <asm-generic/bitsperlong.h>
+ #include <linux/align.h>
+ #include <linux/bitops.h>
+ #include <linux/find.h>
+--
+2.51.0
+
--- /dev/null
+From 6b81c1fda8bf92bcf6bf7543b6475ebefa795d66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:40:56 +0200
+Subject: tools: lib: thermal: don't preserve owner in install
+
+From: Emil Dahl Juhl <juhl.emildahl@gmail.com>
+
+[ Upstream commit 1375152bb02ab2a8435e87ea27034482dbc95f57 ]
+
+Instead of preserving mode, timestamp, and owner, for the object files
+during installation, just preserve the mode and timestamp.
+
+When installing as root, the installed files should be owned by root.
+When installing as user, --preserve=ownership doesn't work anyway. This
+makes --preserve=ownership rather pointless.
+
+Signed-off-by: Emil Dahl Juhl <juhl.emildahl@gmail.com>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
+index 8890fd57b110c..1694889847caf 100644
+--- a/tools/lib/thermal/Makefile
++++ b/tools/lib/thermal/Makefile
+@@ -147,7 +147,7 @@ endef
+ install_lib: libs
+ $(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \
+ $(call do_install_mkdir,$(libdir_SQ)); \
+- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
++ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
+
+ install_headers:
+ $(call QUIET_INSTALL, headers) \
+--
+2.51.0
+
--- /dev/null
+From 6791067336804318857912d4ffa16c772c81effa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:40:55 +0200
+Subject: tools: lib: thermal: use pkg-config to locate libnl3
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit b31f7f725cd932e2c2b41f3e4b66273653953687 ]
+
+To make libthermal more cross compile friendly use pkg-config to locate
+libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/Makefile | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
+index 1694889847caf..8d21ea1950a31 100644
+--- a/tools/lib/thermal/Makefile
++++ b/tools/lib/thermal/Makefile
+@@ -59,8 +59,12 @@ else
+ CFLAGS := -g -Wall
+ endif
+
++NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null)
++ifeq ($(NL3_CFLAGS),)
++NL3_CFLAGS = -I/usr/include/libnl3
++endif
++
+ INCLUDES = \
+--I/usr/include/libnl3 \
+ -I$(srctree)/tools/lib/thermal/include \
+ -I$(srctree)/tools/lib/ \
+ -I$(srctree)/tools/include \
+@@ -72,6 +76,7 @@ INCLUDES = \
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += -Werror -Wall
+ override CFLAGS += -fPIC
++override CFLAGS += $(NL3_CFLAGS)
+ override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFGLAS += -Wl,-L.
+--
+2.51.0
+
--- /dev/null
+From 8c3a5703e1835fb1425475ab3a5d5c030e39c5f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 08:56:59 +0800
+Subject: um: Fix help message for ssl-non-raw
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ]
+
+Add the missing option name in the help message. Additionally,
+switch to __uml_help(), because this is a global option rather
+than a per-channel option.
+
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/ssl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
+index 277cea3d30eb5..8006a5bd578c2 100644
+--- a/arch/um/drivers/ssl.c
++++ b/arch/um/drivers/ssl.c
+@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str)
+ return 1;
+ }
+ __setup("ssl-non-raw", ssl_non_raw_setup);
+-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode");
++__uml_help(ssl_non_raw_setup,
++"ssl-non-raw\n"
++" Set serial lines to non-raw mode.\n\n"
++);
+--
+2.51.0
+
--- /dev/null
+From 8f190fb7d3b8d82cbc74cb588da1276b017941ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:30 +0900
+Subject: 9p: fix /sys/fs/9p/caches overwriting itself
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
+
+caches_show() overwrote its buffer on each iteration,
+so only the last cache tag was visible in sysfs output.
+
+Properly append with snprintf(buf + count, …).
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 281a1ed03a041..e35b30534787d 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj,
+ spin_lock(&v9fs_sessionlist_lock);
+ list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
+ if (v9ses->cachetag) {
+- n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag);
+ if (n < 0) {
+ count = n;
+ break;
+--
+2.51.0
+
--- /dev/null
+From 902f96a96938718ff1b8ba6850ae347fd0c1447e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:31 +0900
+Subject: 9p: sysfs_init: don't hardcode error to ENOMEM
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
+
+v9fs_sysfs_init() always returned -ENOMEM on failure;
+return the actual sysfs_create_group() error instead.
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index e35b30534787d..ccf00a948146a 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = {
+
+ static int __init v9fs_sysfs_init(void)
+ {
++ int ret;
++
+ v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
+ if (!v9fs_kobj)
+ return -ENOMEM;
+
+- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) {
++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group);
++ if (ret) {
+ kobject_put(v9fs_kobj);
+- return -ENOMEM;
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From f9e5fb5d6d0c79fb721b8947d4fc0416c890e740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 18:10:13 +0200
+Subject: 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+[ Upstream commit e8fe3f07a357c39d429e02ca34f740692d88967a ]
+
+p9_read_work() doesn't set Rworksched and doesn't do schedule_work(m->rq)
+if list_empty(&m->req_list).
+
+However, if the pipe is full, we need to read more data and this used to
+work prior to commit aaec5a95d59615 ("pipe_read: don't wake up the writer
+if the pipe is still full").
+
+p9_read_work() does p9_fd_read() -> ... -> anon_pipe_read() which (before
+the commit above) triggered the unnecessary wakeup. This wakeup calls
+p9_pollwake() which kicks p9_poll_workfn() -> p9_poll_mux(), p9_poll_mux()
+will notice EPOLLIN and schedule_work(&m->rq).
+
+This no longer happens after the optimization above, change p9_fd_request()
+to use p9_poll_mux() instead of only checking for EPOLLOUT.
+
+Reported-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com
+Tested-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/68a2de8f.050a0220.e29e5.0097.GAE@google.com/
+Link: https://lore.kernel.org/all/67dedd2f.050a0220.31a16b.003f.GAE@google.com/
+Co-developed-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Message-ID: <20250819161013.GB11345@redhat.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/9p/trans_fd.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index 7e9d731c45976..5bdfc25689169 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -665,7 +665,6 @@ static void p9_poll_mux(struct p9_conn *m)
+
+ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
+ {
+- __poll_t n;
+ int err;
+ struct p9_trans_fd *ts = client->trans;
+ struct p9_conn *m = &ts->conn;
+@@ -685,13 +684,7 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
+ list_add_tail(&req->req_list, &m->unsent_req_list);
+ spin_unlock(&m->req_lock);
+
+- if (test_and_clear_bit(Wpending, &m->wsched))
+- n = EPOLLOUT;
+- else
+- n = p9_fd_poll(m->client, NULL, NULL);
+-
+- if (n & EPOLLOUT && !test_and_set_bit(Wworksched, &m->wsched))
+- schedule_work(&m->wq);
++ p9_poll_mux(m);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 8cd1a1763f1fc3ca2774fdf944014101943ff948 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:26:36 +0300
+Subject: ACPI: property: Return present device nodes only on fwnode interface
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
+
+fwnode_graph_get_next_subnode() may return fwnode backed by ACPI
+device nodes and there has been no check these devices are present
+in the system, unlike there has been on fwnode OF backend.
+
+In order to provide consistent behaviour towards callers,
+add a check for device presence by introducing
+a new function acpi_get_next_present_subnode(), used as the
+get_next_child_node() fwnode operation that also checks device
+node presence.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com
+[ rjw: Kerneldoc comment and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/property.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index 342e7cef723cc..b51b947b0ca5b 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -1357,6 +1357,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
+ return NULL;
+ }
+
++/*
++ * acpi_get_next_present_subnode - Return the next present child node handle
++ * @fwnode: Firmware node to find the next child node for.
++ * @child: Handle to one of the device's child nodes or a null handle.
++ *
++ * Like acpi_get_next_subnode(), but the device nodes returned by
++ * acpi_get_next_present_subnode() are guaranteed to be present.
++ *
++ * Returns: The fwnode handle of the next present sub-node.
++ */
++static struct fwnode_handle *
++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode,
++ struct fwnode_handle *child)
++{
++ do {
++ child = acpi_get_next_subnode(fwnode, child);
++ } while (is_acpi_device_node(child) &&
++ !acpi_device_is_present(to_acpi_device_node(child)));
++
++ return child;
++}
++
+ /**
+ * acpi_node_get_parent - Return parent fwnode of this fwnode
+ * @fwnode: Firmware node whose parent to get
+@@ -1700,7 +1722,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode,
+ .property_read_string_array = \
+ acpi_fwnode_property_read_string_array, \
+ .get_parent = acpi_node_get_parent, \
+- .get_next_child_node = acpi_get_next_subnode, \
++ .get_next_child_node = acpi_get_next_present_subnode, \
+ .get_named_child_node = acpi_fwnode_get_named_child_node, \
+ .get_name = acpi_fwnode_get_name, \
+ .get_name_prefix = acpi_fwnode_get_name_prefix, \
+--
+2.51.0
+
--- /dev/null
+From 12b805c433092ab43952e0182016e57651359304 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:27 +0200
+Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ]
+
+Add a new word in assembly to store ACR value during the calls
+to at91_plla_disable/at91_plla_enable macros and use it.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading]
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index 94dece1839af3..99aaf5cf89696 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -689,6 +689,10 @@ sr_dis_exit:
+ bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID
+ str tmp2, [pmc, #AT91_PMC_PLL_UPDT]
+
++ /* save acr */
++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR]
++ str tmp2, .saved_acr
++
+ /* save div. */
+ mov tmp1, #0
+ ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0]
+@@ -758,7 +762,7 @@ sr_dis_exit:
+ str tmp1, [pmc, #AT91_PMC_PLL_UPDT]
+
+ /* step 2. */
+- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
++ ldr tmp1, .saved_acr
+ str tmp1, [pmc, #AT91_PMC_PLL_ACR]
+
+ /* step 3. */
+@@ -1134,6 +1138,8 @@ ENDPROC(at91_pm_suspend_in_sram)
+ .word 0
+ .saved_mckr:
+ .word 0
++.saved_acr:
++ .word 0
+ .saved_pllar:
+ .word 0
+ .saved_sam9_lpr:
+--
+2.51.0
+
--- /dev/null
+From 11c7f376065155ed1c583e45217957fd37bfd58a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 00:12:19 +0200
+Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
+
+From: Valerio Setti <vsetti@baylibre.com>
+
+[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ]
+
+According to I2S specs audio data is sampled on the rising edge of the
+clock and it can change on the falling one. When operating in normal mode
+this SoC behaves the opposite so a clock polarity inversion is required
+in this case.
+
+This was tested on an OdroidC2 (Amlogic S905 SoC) board.
+
+Signed-off-by: Valerio Setti <vsetti@baylibre.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Tested-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c
+index a0dd914c8ed13..3b4061508c180 100644
+--- a/sound/soc/meson/aiu-encoder-i2s.c
++++ b/sound/soc/meson/aiu-encoder-i2s.c
+@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ inv == SND_SOC_DAIFMT_IB_IF)
+ val |= AIU_CLK_CTRL_LRCLK_INVERT;
+
+- if (inv == SND_SOC_DAIFMT_IB_NF ||
+- inv == SND_SOC_DAIFMT_IB_IF)
++ /*
++ * The SoC changes data on the rising edge of the bitclock
++ * so an inversion of the bitclock is required in normal mode
++ */
++ if (inv == SND_SOC_DAIFMT_NB_NF ||
++ inv == SND_SOC_DAIFMT_NB_IF)
+ val |= AIU_CLK_CTRL_AOCLK_INVERT;
+
+ /* Signal skew */
+@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = {
+ .startup = aiu_encoder_i2s_startup,
+ .shutdown = aiu_encoder_i2s_shutdown,
+ };
+-
+--
+2.51.0
+
--- /dev/null
+From 90d1c7860a1e2a3c7e5e1887f7fb6348c2243b23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 12:04:32 -0700
+Subject: ceph: add checking of wait_for_completion_killable() return value
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
+
+The Coverity Scan service has detected the calling of
+wait_for_completion_killable() without checking the return
+value in ceph_lock_wait_for_completion() [1]. The CID 1636232
+defect contains explanation: "If the function returns an error
+value, the error value may be mistaken for a normal value.
+In ceph_lock_wait_for_completion(): Value returned from
+a function is not checked for errors before being used. (CWE-252)".
+
+The patch adds the checking of wait_for_completion_killable()
+return value and return the error code from
+ceph_lock_wait_for_completion().
+
+[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/locks.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index ebf4ac0055ddc..dd764f9c64b9f 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -221,7 +221,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,
+ if (err && err != -ERESTARTSYS)
+ return err;
+
+- wait_for_completion_killable(&req->r_safe_completion);
++ err = wait_for_completion_killable(&req->r_safe_completion);
++ if (err)
++ return err;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From feef08f8b88d7777c458971bda0818f465874f4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 15:02:35 +0530
+Subject: ceph: fix multifs mds auth caps issue
+
+From: Kotresh HR <khiremat@redhat.com>
+
+[ Upstream commit 22c73d52a6d05c5a2053385c0d6cd9984732799d ]
+
+The mds auth caps check should also validate the
+fsname along with the associated caps. Not doing
+so would result in applying the mds auth caps of
+one fs on to the other fs in a multifs ceph cluster.
+The bug causes multiple issues w.r.t user
+authentication, following is one such example.
+
+Steps to Reproduce (on vstart cluster):
+1. Create two file systems in a cluster, say 'fsname1' and 'fsname2'
+2. Authorize read only permission to the user 'client.usr' on fs 'fsname1'
+ $ceph fs authorize fsname1 client.usr / r
+3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2'
+ $ceph fs authorize fsname2 client.usr / rw
+4. Update the keyring
+ $ceph auth get client.usr >> ./keyring
+
+With above permssions for the user 'client.usr', following is the
+expectation.
+ a. The 'client.usr' should be able to only read the contents
+ and not allowed to create or delete files on file system 'fsname1'.
+ b. The 'client.usr' should be able to read/write on file system 'fsname2'.
+
+But, with this bug, the 'client.usr' is allowed to read/write on file
+system 'fsname1'. See below.
+
+5. Mount the file system 'fsname1' with the user 'client.usr'
+ $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/
+6. Try creating a file on file system 'fsname1' with user 'client.usr'. This
+ should fail but passes with this bug.
+ $touch /kmnt_fsname1_usr/file1
+7. Mount the file system 'fsname1' with the user 'client.admin' and create a
+ file.
+ $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin
+ $echo "data" > /kmnt_fsname1_admin/admin_file1
+8. Try removing an existing file on file system 'fsname1' with the user
+ 'client.usr'. This shoudn't succeed but succeeds with the bug.
+ $rm -f /kmnt_fsname1_usr/admin_file1
+
+For more information, please take a look at the corresponding mds/fuse patch
+and tests added by looking into the tracker mentioned below.
+
+v2: Fix a possible null dereference in doutc
+v3: Don't store fsname from mdsmap, validate against
+ ceph_mount_options's fsname and use it
+v4: Code refactor, better warning message and
+ fix possible compiler warning
+
+[ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ]
+
+Link: https://tracker.ceph.com/issues/72167
+Signed-off-by: Kotresh HR <khiremat@redhat.com>
+Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 8 ++++++++
+ fs/ceph/mdsmap.c | 14 +++++++++++++-
+ fs/ceph/super.c | 14 --------------
+ fs/ceph/super.h | 14 ++++++++++++++
+ 4 files changed, 35 insertions(+), 15 deletions(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index df89d45f33a1f..50587c64f6144 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -5652,11 +5652,19 @@ static int ceph_mds_auth_match(struct ceph_mds_client *mdsc,
+ u32 caller_uid = from_kuid(&init_user_ns, cred->fsuid);
+ u32 caller_gid = from_kgid(&init_user_ns, cred->fsgid);
+ struct ceph_client *cl = mdsc->fsc->client;
++ const char *fs_name = mdsc->fsc->mount_options->mds_namespace;
+ const char *spath = mdsc->fsc->mount_options->server_path;
+ bool gid_matched = false;
+ u32 gid, tlen, len;
+ int i, j;
+
++ doutc(cl, "fsname check fs_name=%s match.fs_name=%s\n",
++ fs_name, auth->match.fs_name ? auth->match.fs_name : "");
++ if (auth->match.fs_name && strcmp(auth->match.fs_name, fs_name)) {
++ /* fsname mismatch, try next one */
++ return 0;
++ }
++
+ doutc(cl, "match.uid %lld\n", auth->match.uid);
+ if (auth->match.uid != MDS_AUTH_UID_ANY) {
+ if (auth->match.uid != caller_uid)
+diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
+index 8109aba66e023..2c7b151a7c95c 100644
+--- a/fs/ceph/mdsmap.c
++++ b/fs/ceph/mdsmap.c
+@@ -353,10 +353,22 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
+ __decode_and_drop_type(p, end, u8, bad_ext);
+ }
+ if (mdsmap_ev >= 8) {
++ u32 fsname_len;
+ /* enabled */
+ ceph_decode_8_safe(p, end, m->m_enabled, bad_ext);
+ /* fs_name */
+- ceph_decode_skip_string(p, end, bad_ext);
++ ceph_decode_32_safe(p, end, fsname_len, bad_ext);
++
++ /* validate fsname against mds_namespace */
++ if (!namespace_equals(mdsc->fsc->mount_options, *p,
++ fsname_len)) {
++ pr_warn_client(cl, "fsname %*pE doesn't match mds_namespace %s\n",
++ (int)fsname_len, (char *)*p,
++ mdsc->fsc->mount_options->mds_namespace);
++ goto bad;
++ }
++ /* skip fsname after validation */
++ ceph_decode_skip_n(p, end, fsname_len, bad);
+ }
+ /* damaged */
+ if (mdsmap_ev >= 9) {
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index b61074b377ac5..96d582f71beaa 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -246,20 +246,6 @@ static void canonicalize_path(char *path)
+ path[j] = '\0';
+ }
+
+-/*
+- * Check if the mds namespace in ceph_mount_options matches
+- * the passed in namespace string. First time match (when
+- * ->mds_namespace is NULL) is treated specially, since
+- * ->mds_namespace needs to be initialized by the caller.
+- */
+-static int namespace_equals(struct ceph_mount_options *fsopt,
+- const char *namespace, size_t len)
+-{
+- return !(fsopt->mds_namespace &&
+- (strlen(fsopt->mds_namespace) != len ||
+- strncmp(fsopt->mds_namespace, namespace, len)));
+-}
+-
+ static int ceph_parse_old_source(const char *dev_name, const char *dev_name_end,
+ struct fs_context *fc)
+ {
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 037eac35a9e02..caa01a564925c 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -104,6 +104,20 @@ struct ceph_mount_options {
+ struct fscrypt_dummy_policy dummy_enc_policy;
+ };
+
++/*
++ * Check if the mds namespace in ceph_mount_options matches
++ * the passed in namespace string. First time match (when
++ * ->mds_namespace is NULL) is treated specially, since
++ * ->mds_namespace needs to be initialized by the caller.
++ */
++static inline int namespace_equals(struct ceph_mount_options *fsopt,
++ const char *namespace, size_t len)
++{
++ return !(fsopt->mds_namespace &&
++ (strlen(fsopt->mds_namespace) != len ||
++ strncmp(fsopt->mds_namespace, namespace, len)));
++}
++
+ /* mount state */
+ enum {
+ CEPH_MOUNT_MOUNTING,
+--
+2.51.0
+
--- /dev/null
+From 6506421c65be985383f5524d25317639260e3e1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 11:31:08 -0700
+Subject: ceph: fix potential race condition in ceph_ioctl_lazyio()
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit 5824ccba9a39a3ad914fc9b2972a2c1119abaac9 ]
+
+The Coverity Scan service has detected potential
+race condition in ceph_ioctl_lazyio() [1].
+
+The CID 1591046 contains explanation: "Check of thread-shared
+field evades lock acquisition (LOCK_EVASION). Thread1 sets
+fmode to a new value. Now the two threads have an inconsistent
+view of fmode and updates to fields correlated with fmode
+may be lost. The data guarded by this critical section may
+be read while in an inconsistent state or modified by multiple
+racing threads. In ceph_ioctl_lazyio: Checking the value of
+a thread-shared field outside of a locked region to determine
+if a locked operation involving that thread shared field
+has completed. (CWE-543)".
+
+The patch places fi->fmode field access under ci->i_ceph_lock
+protection. Also, it introduces the is_file_already_lazy
+variable that is set under the lock and it is checked later
+out of scope of critical section.
+
+[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1591046
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/ioctl.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
+index e861de3c79b9e..15cde055f3da1 100644
+--- a/fs/ceph/ioctl.c
++++ b/fs/ceph/ioctl.c
+@@ -246,21 +246,28 @@ static long ceph_ioctl_lazyio(struct file *file)
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct ceph_mds_client *mdsc = ceph_inode_to_fs_client(inode)->mdsc;
+ struct ceph_client *cl = mdsc->fsc->client;
++ bool is_file_already_lazy = false;
+
++ spin_lock(&ci->i_ceph_lock);
+ if ((fi->fmode & CEPH_FILE_MODE_LAZY) == 0) {
+- spin_lock(&ci->i_ceph_lock);
+ fi->fmode |= CEPH_FILE_MODE_LAZY;
+ ci->i_nr_by_mode[ffs(CEPH_FILE_MODE_LAZY)]++;
+ __ceph_touch_fmode(ci, mdsc, fi->fmode);
+- spin_unlock(&ci->i_ceph_lock);
++ } else {
++ is_file_already_lazy = true;
++ }
++ spin_unlock(&ci->i_ceph_lock);
++
++ if (is_file_already_lazy) {
++ doutc(cl, "file %p %p %llx.%llx already lazy\n", file, inode,
++ ceph_vinop(inode));
++ } else {
+ doutc(cl, "file %p %p %llx.%llx marked lazy\n", file, inode,
+ ceph_vinop(inode));
+
+ ceph_check_caps(ci, 0);
+- } else {
+- doutc(cl, "file %p %p %llx.%llx already lazy\n", file, inode,
+- ceph_vinop(inode));
+ }
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f03d323b0ccdb5516694255745202c3e1561bef2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 12:20:57 -0700
+Subject: ceph: refactor wake_up_bit() pattern of calling
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit 53db6f25ee47cb1265141d31562604e56146919a ]
+
+The wake_up_bit() is called in ceph_async_unlink_cb(),
+wake_async_create_waiters(), and ceph_finish_async_create().
+It makes sense to switch on clear_bit() function, because
+it makes the code much cleaner and easier to understand.
+More important rework is the adding of smp_mb__after_atomic()
+memory barrier after the bit modification and before
+wake_up_bit() call. It can prevent potential race condition
+of accessing the modified bit in other threads. Luckily,
+clear_and_wake_up_bit() already implements the required
+functionality pattern:
+
+static inline void clear_and_wake_up_bit(int bit, unsigned long *word)
+{
+ clear_bit_unlock(bit, word);
+ /* See wake_up_bit() for which memory barrier you need to use. */
+ smp_mb__after_atomic();
+ wake_up_bit(word, bit);
+}
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/dir.c | 3 +--
+ fs/ceph/file.c | 6 ++----
+ 2 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 16c25c48465e5..ba960a9bfbc8b 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -1252,8 +1252,7 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc,
+ spin_unlock(&fsc->async_unlink_conflict_lock);
+
+ spin_lock(&dentry->d_lock);
+- di->flags &= ~CEPH_DENTRY_ASYNC_UNLINK;
+- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_UNLINK_BIT);
++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_UNLINK_BIT, &di->flags);
+ spin_unlock(&dentry->d_lock);
+
+ synchronize_rcu();
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 6587c2d5af1e0..147126d2fa0c7 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -579,8 +579,7 @@ static void wake_async_create_waiters(struct inode *inode,
+
+ spin_lock(&ci->i_ceph_lock);
+ if (ci->i_ceph_flags & CEPH_I_ASYNC_CREATE) {
+- ci->i_ceph_flags &= ~CEPH_I_ASYNC_CREATE;
+- wake_up_bit(&ci->i_ceph_flags, CEPH_ASYNC_CREATE_BIT);
++ clear_and_wake_up_bit(CEPH_ASYNC_CREATE_BIT, &ci->i_ceph_flags);
+
+ if (ci->i_ceph_flags & CEPH_I_ASYNC_CHECK_CAPS) {
+ ci->i_ceph_flags &= ~CEPH_I_ASYNC_CHECK_CAPS;
+@@ -762,8 +761,7 @@ static int ceph_finish_async_create(struct inode *dir, struct inode *inode,
+ }
+
+ spin_lock(&dentry->d_lock);
+- di->flags &= ~CEPH_DENTRY_ASYNC_CREATE;
+- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_CREATE_BIT);
++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_CREATE_BIT, &di->flags);
+ spin_unlock(&dentry->d_lock);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From ff81db1b67b6caca982b02dc1ac7c4ac797270f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 13:07:17 -0700
+Subject: clk: at91: clk-master: Add check for divide by 3
+
+From: Ryan Wanner <Ryan.Wanner@microchip.com>
+
+[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ]
+
+A potential divider for the master clock is div/3. The register
+configuration for div/3 is MASTER_PRES_MAX. The current bit shifting
+method does not work for this case. Checking for MASTER_PRES_MAX will
+ensure the correct decimal value is stored in the system.
+
+Signed-off-by: Ryan Wanner <Ryan.Wanner@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-master.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
+index 15c46489ba850..4c87a0f789de1 100644
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -580,6 +580,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw,
+ {
+ struct clk_master *master = to_clk_master(hw);
+
++ if (master->div == MASTER_PRES_MAX)
++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3);
++
+ return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div));
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5606a6730159c4bcac3ea448fe0d4cc171fc3dd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:08:10 +0200
+Subject: clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 ]
+
+This register is important for sequencing the commands to PLLs, so
+actually write the update bits with regmap_write_bits() instead of
+relying on a read/modify/write regmap command that could skip the actual
+hardware write if the value is identical to the one read.
+
+It's changed when modification is needed to the PLL, when
+read-only operation is done, we could keep the call to
+regmap_update_bits().
+
+Add a comment to the sam9x60_div_pll_set_div() function that uses this
+PLL_UPDT register so that it's used consistently, according to the
+product's datasheet.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Tested-by: Ryan Wanner <ryan.wanner@microchip.com> # on sama7d65 and sam9x75
+Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com
+[claudiu.beznea: fix "Alignment should match open parenthesis"
+ checkpatch.pl check]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-sam9x60-pll.c | 75 ++++++++++++++++--------------
+ 1 file changed, 39 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c
+index fda0411022246..e05d036252e0e 100644
+--- a/drivers/clk/at91/clk-sam9x60-pll.c
++++ b/drivers/clk/at91/clk-sam9x60-pll.c
+@@ -93,8 +93,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
+ cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
+ cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
+@@ -128,17 +128,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
+ udelay(10);
+ }
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -164,8 +164,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0);
+
+@@ -173,9 +173,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
+ regmap_update_bits(regmap, AT91_PMC_PLL_ACR,
+ AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ spin_unlock_irqrestore(core->lock, flags);
+ }
+@@ -262,8 +262,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+
+ spin_lock_irqsave(core->lock, irqflags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
+ cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
+ cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
+@@ -275,18 +275,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+ (frac->mul << core->layout->mul_shift) |
+ (frac->frac << core->layout->frac_shift));
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
+ AT91_PMC_PLL_CTRL0_ENLOCK |
+ AT91_PMC_PLL_CTRL0_ENPLL);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -338,7 +338,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = {
+ .restore_context = sam9x60_frac_pll_restore_context,
+ };
+
+-/* This function should be called with spinlock acquired. */
++/* This function should be called with spinlock acquired.
++ * Warning: this function must be called only if the same PLL ID was set in
++ * PLL_UPDT register previously.
++ */
+ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
+ bool enable)
+ {
+@@ -350,9 +353,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
+ core->layout->div_mask | ena_msk,
+ (div << core->layout->div_shift) | ena_val);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -366,8 +369,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core)
+ unsigned int val, cdiv;
+
+ spin_lock_irqsave(core->lock, flags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
+
+@@ -398,15 +401,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ core->layout->endiv_mask, 0);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ spin_unlock_irqrestore(core->lock, flags);
+ }
+@@ -518,8 +521,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+ div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1;
+
+ spin_lock_irqsave(core->lock, irqflags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
+
+@@ -574,8 +577,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier,
+ div->div = div->safe_div;
+
+ spin_lock_irqsave(core.lock, irqflags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core.id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core.id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core.layout->div_mask) >> core.layout->div_shift;
+
+--
+2.51.0
+
--- /dev/null
+From 9803582586aa326c65a1bf3a2c9ba20ff0d8c353 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:08:17 +0530
+Subject: clk: at91: sam9x7: Add peripheral clock id for pmecc
+
+From: Balamanikandan Gunasundar <balamanikandan.gunasundar@microchip.com>
+
+[ Upstream commit 94a1274100e397a27361ae53ace37be6da42a079 ]
+
+Add pmecc instance id in peripheral clock description.
+
+Signed-off-by: Balamanikandan Gunasundar <balamanikandan.gunasundar@microchip.com>
+Link: https://lore.kernel.org/r/20250909103817.49334-1-balamanikandan.gunasundar@microchip.com
+[claudiu.beznea@tuxon.dev: use tabs instead of spaces]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/sam9x7.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/at91/sam9x7.c b/drivers/clk/at91/sam9x7.c
+index ffab32b047a01..740f52906f6b4 100644
+--- a/drivers/clk/at91/sam9x7.c
++++ b/drivers/clk/at91/sam9x7.c
+@@ -403,6 +403,7 @@ static const struct {
+ { .n = "pioD_clk", .id = 44, },
+ { .n = "tcb1_clk", .id = 45, },
+ { .n = "dbgu_clk", .id = 47, },
++ { .n = "pmecc_clk", .id = 48, },
+ /*
+ * mpddr_clk feeds DDR controller and is enabled by bootloader thus we
+ * need to keep it enabled in case there is no Linux consumer for it.
+--
+2.51.0
+
--- /dev/null
+From 1d2ba1f75477ae2290d7c71c05f1b92a256e15b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 14:40:02 +0530
+Subject: clk: clocking-wizard: Fix output clock register offset for Versal
+ platforms
+
+From: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+
+[ Upstream commit 7c2e86f7b5af93d0e78c16e4359318fe7797671d ]
+
+The output clock register offset used in clk_wzrd_register_output_clocks
+was incorrectly referencing 0x3C instead of 0x38, which caused
+misconfiguration of output dividers on Versal platforms.
+
+Correcting the off-by-one error ensures proper configuration of output
+clocks.
+
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+index 7a0269bdfbb38..d2142bab5e289 100644
+--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+@@ -1153,7 +1153,7 @@ static int clk_wzrd_probe(struct platform_device *pdev)
+ (&pdev->dev,
+ clkout_name, clk_name, 0,
+ clk_wzrd->base,
+- (WZRD_CLK_CFG_REG(is_versal, 3) + i * 8),
++ (WZRD_CLK_CFG_REG(is_versal, 2) + i * 8),
+ WZRD_CLKOUT_DIVIDE_SHIFT,
+ WZRD_CLKOUT_DIVIDE_WIDTH,
+ CLK_DIVIDER_ONE_BASED |
+--
+2.51.0
+
--- /dev/null
+From 132ac8cf50009d11dfa8e196a8e54bc7017e602b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 12:55:46 +0300
+Subject: clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marko Mäkelä <marko.makela@iki.fi>
+
+[ Upstream commit 2f7b168323c22faafb1fbf94ef93b7ce5efc15c6 ]
+
+Rework nss_port5 to use the new multiple configuration implementation
+and correctly fix the clocks for this port under some corner case.
+
+In OpenWrt, this patch avoids intermittent dmesg errors of the form
+nss_port5_rx_clk_src: rcg didn't update its configuration.
+
+This is a mechanical, straightforward port of
+commit e88f03230dc07aa3293b6aeb078bd27370bb2594
+("clk: qcom: gcc-ipq8074: rework nss_port5/6 clock to multiple conf")
+to gcc-ipq6018, with two conflicts resolved: different frequency of the
+P_XO clock source, and only 5 Ethernet ports.
+
+This was originally developed by JiaY-shi <shi05275@163.com>.
+
+Link: https://lore.kernel.org/all/20231220221724.3822-4-ansuelsmth@gmail.com/
+Signed-off-by: Marko Mäkelä <marko.makela@iki.fi>
+Tested-by: Marko Mäkelä <marko.makela@iki.fi>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250802095546.295448-1-marko.makela@iki.fi
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq6018.c | 60 +++++++++++++++++++++-------------
+ 1 file changed, 38 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
+index ab0f7fc665a97..c04a7a961a24a 100644
+--- a/drivers/clk/qcom/gcc-ipq6018.c
++++ b/drivers/clk/qcom/gcc-ipq6018.c
+@@ -511,15 +511,23 @@ static struct clk_rcg2 apss_ahb_clk_src = {
+ },
+ };
+
+-static const struct freq_tbl ftbl_nss_port5_rx_clk_src[] = {
+- F(24000000, P_XO, 1, 0, 0),
+- F(25000000, P_UNIPHY1_RX, 12.5, 0, 0),
+- F(25000000, P_UNIPHY0_RX, 5, 0, 0),
+- F(78125000, P_UNIPHY1_RX, 4, 0, 0),
+- F(125000000, P_UNIPHY1_RX, 2.5, 0, 0),
+- F(125000000, P_UNIPHY0_RX, 1, 0, 0),
+- F(156250000, P_UNIPHY1_RX, 2, 0, 0),
+- F(312500000, P_UNIPHY1_RX, 1, 0, 0),
++static const struct freq_conf ftbl_nss_port5_rx_clk_src_25[] = {
++ C(P_UNIPHY1_RX, 12.5, 0, 0),
++ C(P_UNIPHY0_RX, 5, 0, 0),
++};
++
++static const struct freq_conf ftbl_nss_port5_rx_clk_src_125[] = {
++ C(P_UNIPHY1_RX, 2.5, 0, 0),
++ C(P_UNIPHY0_RX, 1, 0, 0),
++};
++
++static const struct freq_multi_tbl ftbl_nss_port5_rx_clk_src[] = {
++ FMS(24000000, P_XO, 1, 0, 0),
++ FM(25000000, ftbl_nss_port5_rx_clk_src_25),
++ FMS(78125000, P_UNIPHY1_RX, 4, 0, 0),
++ FM(125000000, ftbl_nss_port5_rx_clk_src_125),
++ FMS(156250000, P_UNIPHY1_RX, 2, 0, 0),
++ FMS(312500000, P_UNIPHY1_RX, 1, 0, 0),
+ { }
+ };
+
+@@ -547,26 +555,34 @@ gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map[] = {
+
+ static struct clk_rcg2 nss_port5_rx_clk_src = {
+ .cmd_rcgr = 0x68060,
+- .freq_tbl = ftbl_nss_port5_rx_clk_src,
++ .freq_multi_tbl = ftbl_nss_port5_rx_clk_src,
+ .hid_width = 5,
+ .parent_map = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "nss_port5_rx_clk_src",
+ .parent_data = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias,
+ .num_parents = 7,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_fm_ops,
+ },
+ };
+
+-static const struct freq_tbl ftbl_nss_port5_tx_clk_src[] = {
+- F(24000000, P_XO, 1, 0, 0),
+- F(25000000, P_UNIPHY1_TX, 12.5, 0, 0),
+- F(25000000, P_UNIPHY0_TX, 5, 0, 0),
+- F(78125000, P_UNIPHY1_TX, 4, 0, 0),
+- F(125000000, P_UNIPHY1_TX, 2.5, 0, 0),
+- F(125000000, P_UNIPHY0_TX, 1, 0, 0),
+- F(156250000, P_UNIPHY1_TX, 2, 0, 0),
+- F(312500000, P_UNIPHY1_TX, 1, 0, 0),
++static const struct freq_conf ftbl_nss_port5_tx_clk_src_25[] = {
++ C(P_UNIPHY1_TX, 12.5, 0, 0),
++ C(P_UNIPHY0_TX, 5, 0, 0),
++};
++
++static const struct freq_conf ftbl_nss_port5_tx_clk_src_125[] = {
++ C(P_UNIPHY1_TX, 2.5, 0, 0),
++ C(P_UNIPHY0_TX, 1, 0, 0),
++};
++
++static const struct freq_multi_tbl ftbl_nss_port5_tx_clk_src[] = {
++ FMS(24000000, P_XO, 1, 0, 0),
++ FM(25000000, ftbl_nss_port5_tx_clk_src_25),
++ FMS(78125000, P_UNIPHY1_TX, 4, 0, 0),
++ FM(125000000, ftbl_nss_port5_tx_clk_src_125),
++ FMS(156250000, P_UNIPHY1_TX, 2, 0, 0),
++ FMS(312500000, P_UNIPHY1_TX, 1, 0, 0),
+ { }
+ };
+
+@@ -594,14 +610,14 @@ gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map[] = {
+
+ static struct clk_rcg2 nss_port5_tx_clk_src = {
+ .cmd_rcgr = 0x68068,
+- .freq_tbl = ftbl_nss_port5_tx_clk_src,
++ .freq_multi_tbl = ftbl_nss_port5_tx_clk_src,
+ .hid_width = 5,
+ .parent_map = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "nss_port5_tx_clk_src",
+ .parent_data = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias,
+ .num_parents = 7,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_fm_ops,
+ },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 3d7a70d5a0e459d44426c5796c7f686347140e1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:04:46 +0800
+Subject: clk: scmi: Add duty cycle ops only when duty cycle is supported
+
+From: Jacky Bai <ping.bai@nxp.com>
+
+[ Upstream commit 18db1ff2dea0f97dedaeadd18b0cb0a0d76154df ]
+
+For some of the SCMI based platforms, the oem extended config may be
+supported, but not for duty cycle purpose. Skip the duty cycle ops if
+err return when trying to get duty cycle info.
+
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-scmi.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c
+index 1b1561c84127b..7b7ea36333a6b 100644
+--- a/drivers/clk/clk-scmi.c
++++ b/drivers/clk/clk-scmi.c
+@@ -349,6 +349,8 @@ scmi_clk_ops_select(struct scmi_clk *sclk, bool atomic_capable,
+ unsigned int atomic_threshold_us,
+ const struct clk_ops **clk_ops_db, size_t db_size)
+ {
++ int ret;
++ u32 val;
+ const struct scmi_clock_info *ci = sclk->info;
+ unsigned int feats_key = 0;
+ const struct clk_ops *ops;
+@@ -370,8 +372,13 @@ scmi_clk_ops_select(struct scmi_clk *sclk, bool atomic_capable,
+ if (!ci->parent_ctrl_forbidden)
+ feats_key |= BIT(SCMI_CLK_PARENT_CTRL_SUPPORTED);
+
+- if (ci->extended_config)
+- feats_key |= BIT(SCMI_CLK_DUTY_CYCLE_SUPPORTED);
++ if (ci->extended_config) {
++ ret = scmi_proto_clk_ops->config_oem_get(sclk->ph, sclk->id,
++ SCMI_CLOCK_CFG_DUTY_CYCLE,
++ &val, NULL, false);
++ if (!ret)
++ feats_key |= BIT(SCMI_CLK_DUTY_CYCLE_SUPPORTED);
++ }
+
+ if (WARN_ON(feats_key >= db_size))
+ return NULL;
+--
+2.51.0
+
--- /dev/null
+From a62e0b8b1804e1402a988f51ed80870b68b7bbc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 01:09:47 +0800
+Subject: clk: sunxi-ng: sun6i-rtc: Add A523 specifics
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ]
+
+The A523's RTC block is backward compatible with the R329's, but it also
+has a calibration function for its internal oscillator, which would
+allow it to provide a clock rate closer to the desired 32.768 KHz. This
+is useful on the Radxa Cubie A5E, which does not have an external 32.768
+KHz crystal.
+
+Add new compatible-specific data for it.
+
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
+index 87e23d16ed0f3..50a85f33b8fbb 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
++++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
+@@ -325,6 +325,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = {
+ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
+ };
+
++static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = {
++ .have_ext_osc32k = true,
++ .have_iosc_calibration = true,
++ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents,
++ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
++};
++
+ static const struct of_device_id sun6i_rtc_ccu_match[] = {
+ {
+ .compatible = "allwinner,sun50i-h616-rtc",
+@@ -334,6 +341,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = {
+ .compatible = "allwinner,sun50i-r329-rtc",
+ .data = &sun50i_r329_rtc_ccu_data,
+ },
++ {
++ .compatible = "allwinner,sun55i-a523-rtc",
++ .data = &sun55i_a523_rtc_ccu_data,
++ },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, sun6i_rtc_ccu_match);
+--
+2.51.0
+
--- /dev/null
+From 228e2a5c8866fd66f9afe14344056806848ac21e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 16:08:11 +0200
+Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ]
+
+As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL
+can't be disabled - the clock module will just be stuck in transitioning
+state forever, resulting in the following warning message after the wait
+loop times out:
+
+ l3-aon-clkctrl:0000:0: failed to disable
+
+Just add the clock to enable_init_clks, so no attempt is made to disable
+it.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-33xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c
+index 85c50ea39e6da..9269e6a0db6a4 100644
+--- a/drivers/clk/ti/clk-33xx.c
++++ b/drivers/clk/ti/clk-33xx.c
+@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = {
+ "dpll_ddr_m2_ck",
+ "dpll_mpu_m2_ck",
+ "l3_gclk",
++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */
++ "l3-aon-clkctrl:0000:0",
+ /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */
+ "l3-clkctrl:00bc:0",
+ "l4hs_gclk",
+--
+2.51.0
+
--- /dev/null
+From ecfa2bbab2e11b120d951f590c1e0e867a107161 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:13 -0500
+Subject: cpufreq: tegra186: Initialize all cores to max frequencies
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ]
+
+During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores
+are still at reset values and not reflecting the actual frequency. This
+causes get calls to fail. Set all cores to their respective max
+frequency during probe to initialize the registers to working values.
+
+Suggested-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index 39186008afbfd..233c82a834086 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = {
+
+ static struct cpufreq_frequency_table *init_vhint_table(
+ struct platform_device *pdev, struct tegra_bpmp *bpmp,
+- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id)
++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id,
++ int *num_rates)
+ {
+ struct cpufreq_frequency_table *table;
+ struct mrq_cpu_vhint_request req;
+ struct tegra_bpmp_message msg;
+ struct cpu_vhint_data *data;
+- int err, i, j, num_rates = 0;
++ int err, i, j;
+ dma_addr_t phys;
+ void *virt;
+
+@@ -168,6 +169,7 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ goto free;
+ }
+
++ *num_rates = 0;
+ for (i = data->vfloor; i <= data->vceil; i++) {
+ u16 ndiv = data->ndiv[i];
+
+@@ -178,10 +180,10 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ if (i > 0 && ndiv == data->ndiv[i - 1])
+ continue;
+
+- num_rates++;
++ (*num_rates)++;
+ }
+
+- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table),
++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table),
+ GFP_KERNEL);
+ if (!table) {
+ table = ERR_PTR(-ENOMEM);
+@@ -223,7 +225,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ {
+ struct tegra186_cpufreq_data *data;
+ struct tegra_bpmp *bpmp;
+- unsigned int i = 0, err;
++ unsigned int i = 0, err, edvd_offset;
++ int num_rates = 0;
++ u32 edvd_val, cpu;
+
+ data = devm_kzalloc(&pdev->dev,
+ struct_size(data, clusters, TEGRA186_NUM_CLUSTERS),
+@@ -246,10 +250,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) {
+ struct tegra186_cpufreq_cluster *cluster = &data->clusters[i];
+
+- cluster->table = init_vhint_table(pdev, bpmp, cluster, i);
++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates);
+ if (IS_ERR(cluster->table)) {
+ err = PTR_ERR(cluster->table);
+ goto put_bpmp;
++ } else if (!num_rates) {
++ err = -EINVAL;
++ goto put_bpmp;
++ }
++
++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) {
++ if (data->cpus[cpu].bpmp_cluster_id == i) {
++ edvd_val = cluster->table[num_rates - 1].driver_data;
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 827fd8dd126cf4d6aeb45de9733493c60e93870b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 15:57:32 -0400
+Subject: drm/amdkfd: Fix mmap write lock not release
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 7574f30337e19045f03126b4c51f525b84e5049e ]
+
+If mmap write lock is taken while draining retry fault, mmap write lock
+is not released because svm_range_restore_pages calls mmap_read_unlock
+then returns. This causes deadlock and system hangs later because mmap
+read or write lock cannot be taken.
+
+Downgrade mmap write lock to read lock if draining retry fault fix this
+bug.
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 155948dc3d07a..0d950a20741d8 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -3036,6 +3036,8 @@ svm_range_restore_pages(struct amdgpu_device *adev, unsigned int pasid,
+ if (svms->checkpoint_ts[gpuidx] != 0) {
+ if (amdgpu_ih_ts_after_or_equal(ts, svms->checkpoint_ts[gpuidx])) {
+ pr_debug("draining retry fault, drop fault 0x%llx\n", addr);
++ if (write_locked)
++ mmap_write_downgrade(mm);
+ r = -EAGAIN;
+ goto out_unlock_svms;
+ } else {
+--
+2.51.0
+
--- /dev/null
+From 20b4a03a171d60ba9721ff65e9f32be2a69f1ce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 03:32:09 -0400
+Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
+
+From: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+
+[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
+
+Add bounds checking to prevent writes past framebuffer boundaries when
+rendering text near screen edges. Return early if the Y position is off-screen
+and clip image height to screen boundary. Break from the rendering loop if the
+X position is off-screen. When clipping image width to fit the screen, update
+the character count to match the clipped width to prevent buffer size
+mismatches.
+
+Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
+receive mismatched parameters where the buffer is allocated for the clipped
+width but cnt reflects the original larger count, causing out-of-bounds writes.
+
+Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
+Suggested-by: Helge Deller <deller@gmx.de>
+Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index 2e46c41a706a2..dc5ad3fcc7be4 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ image.height = vc->vc_font.height;
+ image.depth = 1;
+
++ if (image.dy >= info->var.yres)
++ return;
++
++ image.height = min(image.height, info->var.yres - image.dy);
++
+ if (attribute) {
+ buf = kmalloc(cellsize, GFP_ATOMIC);
+ if (!buf)
+@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ cnt = count;
+
+ image.width = vc->vc_font.width * cnt;
++
++ if (image.dx >= info->var.xres)
++ break;
++
++ if (image.dx + image.width > info->var.xres) {
++ image.width = info->var.xres - image.dx;
++ cnt = image.width / vc->vc_font.width;
++ if (cnt == 0)
++ break;
++ image.width = cnt * vc->vc_font.width;
++ }
++
+ pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
+ pitch &= ~scan_align;
+ size = pitch * image.height + buf_align;
+--
+2.51.0
+
--- /dev/null
+From 1cc01f5e62854ee4d16ce00f152308a45fea6e41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 May 2025 20:44:34 -0500
+Subject: fs/hpfs: Fix error code for new_inode() failure in
+ mkdir/create/mknod/symlink
+
+From: Yikang Yue <yikangy2@illinois.edu>
+
+[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
+
+The function call new_inode() is a primitive for allocating an inode in memory,
+rather than planning disk space for it. Therefore, -ENOMEM should be returned
+as the error code rather than -ENOSPC.
+
+To be specific, new_inode()'s call path looks like this:
+new_inode
+ new_inode_pseudo
+ alloc_inode
+ ops->alloc_inode (hpfs_alloc_inode)
+ alloc_inode_sb
+ kmem_cache_alloc_lru
+
+Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM),
+not a lack of disk space. However, the current implementation of
+hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails.
+This patch fix this by set err to -ENOMEM before the goto statement.
+
+BTW, we also noticed that other nested calls within these four functions,
+like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure.
+But similarly, only -ENOSPC is returned. Addressing these will involve code
+modifications in other functions, and we plan to submit dedicated patches for these
+issues in the future. For this patch, we focus on new_inode().
+
+Signed-off-by: Yikang Yue <yikangy2@illinois.edu>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hpfs/namei.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index d0edf9ed33b60..9a40068b59b77 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+ dee.fnode = cpu_to_le32(fno);
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail2;
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -153,9 +155,10 @@ static int hpfs_create(struct mnt_idmap *idmap, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ result->i_mode |= S_IFREG;
+@@ -239,9 +242,10 @@ static int hpfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -314,8 +318,10 @@ static int hpfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
++ }
+ result->i_ino = fno;
+ hpfs_init_inode(result);
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+--
+2.51.0
+
--- /dev/null
+From f0a5ba2d6672681a5efe4c5890ebb0ae1c71c814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 14:33:42 +0200
+Subject: kbuild: uapi: Strip comments before size type check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 66128f4287b04aef4d4db9bf5035985ab51487d5 ]
+
+On m68k, check_sizetypes in headers_check reports:
+
+ ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include <linux/types.h>
+
+This header file does not use any of the Linux-specific integer types,
+but merely refers to them from comments, so this is a false positive.
+As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes()
+warning to error"), this check was promoted to an error, breaking m68k
+all{mod,yes}config builds.
+
+Fix this by stripping simple comments before looking for Linux-specific
+integer types.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org
+[nathan: Adjust comment and remove unnecessary escaping from slashes in
+ regex]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ usr/include/headers_check.pl | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/usr/include/headers_check.pl b/usr/include/headers_check.pl
+index b6aec5e4365f9..682980781eb37 100755
+--- a/usr/include/headers_check.pl
++++ b/usr/include/headers_check.pl
+@@ -160,6 +160,8 @@ sub check_sizetypes
+ if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) {
+ check_include_typesh($included);
+ }
++ # strip single-line comments, as types may be referenced within them
++ $line =~ s@/\*.*?\*/@@;
+ if ($line =~ m/__[us](8|16|32|64)\b/) {
+ printf STDERR "$filename:$lineno: " .
+ "found __[us]{8,16,32,64} type " .
+--
+2.51.0
+
--- /dev/null
+From 51b40ffd22fd07b38489b05e0c12bcc48080f3b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 22:39:35 +0800
+Subject: LoongArch: Handle new atomic instructions for probes
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit db740f5689e61f2e75b73e5c8e7c985a3b4bc045 ]
+
+The atomic instructions sc.q, llacq.{w/d}, screl.{w/d} were newly added
+in the LoongArch Reference Manual v1.10, it is necessary to handle them
+in insns_not_supported() to avoid putting a breakpoint in the middle of
+a ll/sc atomic sequence, otherwise it will loop forever for kprobes and
+uprobes.
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/include/asm/inst.h | 5 +++++
+ arch/loongarch/kernel/inst.c | 12 ++++++++++++
+ 2 files changed, 17 insertions(+)
+
+diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h
+index 3089785ca97e7..bec5b63e46888 100644
+--- a/arch/loongarch/include/asm/inst.h
++++ b/arch/loongarch/include/asm/inst.h
+@@ -77,6 +77,10 @@ enum reg2_op {
+ iocsrwrh_op = 0x19205,
+ iocsrwrw_op = 0x19206,
+ iocsrwrd_op = 0x19207,
++ llacqw_op = 0xe15e0,
++ screlw_op = 0xe15e1,
++ llacqd_op = 0xe15e2,
++ screld_op = 0xe15e3,
+ };
+
+ enum reg2i5_op {
+@@ -189,6 +193,7 @@ enum reg3_op {
+ fldxd_op = 0x7068,
+ fstxs_op = 0x7070,
+ fstxd_op = 0x7078,
++ scq_op = 0x70ae,
+ amswapw_op = 0x70c0,
+ amswapd_op = 0x70c1,
+ amaddw_op = 0x70c2,
+diff --git a/arch/loongarch/kernel/inst.c b/arch/loongarch/kernel/inst.c
+index 14d7d700bcb98..e6896a40017ea 100644
+--- a/arch/loongarch/kernel/inst.c
++++ b/arch/loongarch/kernel/inst.c
+@@ -139,6 +139,9 @@ bool insns_not_supported(union loongarch_instruction insn)
+ case amswapw_op ... ammindbdu_op:
+ pr_notice("atomic memory access instructions are not supported\n");
+ return true;
++ case scq_op:
++ pr_notice("sc.q instruction is not supported\n");
++ return true;
+ }
+
+ switch (insn.reg2i14_format.opcode) {
+@@ -150,6 +153,15 @@ bool insns_not_supported(union loongarch_instruction insn)
+ return true;
+ }
+
++ switch (insn.reg2_format.opcode) {
++ case llacqw_op:
++ case llacqd_op:
++ case screlw_op:
++ case screld_op:
++ pr_notice("llacq and screl instructions are not supported\n");
++ return true;
++ }
++
+ switch (insn.reg1i21_format.opcode) {
+ case bceqz_op:
+ pr_notice("bceqz and bcnez instructions are not supported\n");
+--
+2.51.0
+
--- /dev/null
+From 05024c4fb6d940a89afc50f886bc5fe592a97589 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 10:48:41 +0800
+Subject: net: wwan: t7xx: add support for HP DRMR-H01
+
+From: Sammy Hsu <zelda3121@gmail.com>
+
+[ Upstream commit 370e98728bda92b1bdffb448d1acdcbe19dadb4c ]
+
+add support for HP DRMR-H01 (0x03f0, 0x09c8)
+
+Signed-off-by: Sammy Hsu <sammy.hsu@wnc.com.tw>
+Link: https://patch.msgid.link/20251002024841.5979-1-sammy.hsu@wnc.com.tw
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/t7xx/t7xx_pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wwan/t7xx/t7xx_pci.c b/drivers/net/wwan/t7xx/t7xx_pci.c
+index e556e5bd49abc..c7020d107903a 100644
+--- a/drivers/net/wwan/t7xx/t7xx_pci.c
++++ b/drivers/net/wwan/t7xx/t7xx_pci.c
+@@ -885,6 +885,7 @@ static void t7xx_pci_remove(struct pci_dev *pdev)
+
+ static const struct pci_device_id t7xx_pci_table[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x4d75) },
++ { PCI_DEVICE(0x03f0, 0x09c8) }, // HP DRMR-H01
+ { PCI_DEVICE(0x14c0, 0x4d75) }, // Dell DW5933e
+ { }
+ };
+--
+2.51.0
+
--- /dev/null
+From 4f4b44661f80b78c75d0d1b41b4b06c590afd911 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 18:48:33 +0200
+Subject: NTB: epf: Allow arbitrary BAR mapping
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ]
+
+The NTB epf host driver assumes the BAR number associated with a memory
+window is just incremented from the BAR number associated with MW1. This
+seems to have been enough so far but this is not really how the endpoint
+side work and the two could easily become mis-aligned.
+
+ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window
+index + 2, which means the function only returns a proper result if BAR_2
+is associated with MW1.
+
+Instead, fully describe and allow arbitrary NTB BAR mapping.
+
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++++++++++++++++----------------
+ 1 file changed, 53 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
+index 00f0e78f685bf..2b51156e01b0f 100644
+--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
++++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
+@@ -49,6 +49,7 @@
+ #define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */
+
+ enum pci_barno {
++ NO_BAR = -1,
+ BAR_0,
+ BAR_1,
+ BAR_2,
+@@ -57,16 +58,26 @@ enum pci_barno {
+ BAR_5,
+ };
+
++enum epf_ntb_bar {
++ BAR_CONFIG,
++ BAR_PEER_SPAD,
++ BAR_DB,
++ BAR_MW1,
++ BAR_MW2,
++ BAR_MW3,
++ BAR_MW4,
++ NTB_BAR_NUM,
++};
++
++#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1)
++
+ struct ntb_epf_dev {
+ struct ntb_dev ntb;
+ struct device *dev;
+ /* Mutex to protect providing commands to NTB EPF */
+ struct mutex cmd_lock;
+
+- enum pci_barno ctrl_reg_bar;
+- enum pci_barno peer_spad_reg_bar;
+- enum pci_barno db_reg_bar;
+- enum pci_barno mw_bar;
++ const enum pci_barno *barno_map;
+
+ unsigned int mw_count;
+ unsigned int spad_count;
+@@ -85,17 +96,6 @@ struct ntb_epf_dev {
+
+ #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb)
+
+-struct ntb_epf_data {
+- /* BAR that contains both control region and self spad region */
+- enum pci_barno ctrl_reg_bar;
+- /* BAR that contains peer spad region */
+- enum pci_barno peer_spad_reg_bar;
+- /* BAR that contains Doorbell region and Memory window '1' */
+- enum pci_barno db_reg_bar;
+- /* BAR that contains memory windows*/
+- enum pci_barno mw_bar;
+-};
+-
+ static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command,
+ u32 argument)
+ {
+@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx)
+ return -EINVAL;
+ }
+
+- return idx + 2;
++ return ndev->barno_map[BAR_MW1 + idx];
+ }
+
+ static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx)
+@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx,
+ return -EINVAL;
+ }
+
+- bar = idx + ndev->mw_bar;
++ bar = ntb_epf_mw_to_bar(ndev, idx);
++ if (bar < 0)
++ return bar;
+
+ mw_size = pci_resource_len(ntb->pdev, bar);
+
+@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx,
+ if (idx == 0)
+ offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET);
+
+- bar = idx + ndev->mw_bar;
++ bar = ntb_epf_mw_to_bar(ndev, idx);
++ if (bar < 0)
++ return bar;
+
+ if (base)
+ *base = pci_resource_start(ndev->ntb.pdev, bar) + offset;
+@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev)
+ ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT);
+ ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT);
+
++ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) {
++ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count);
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
+@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
+ dev_warn(&pdev->dev, "Cannot DMA highmem\n");
+ }
+
+- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0);
++ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0);
+ if (!ndev->ctrl_reg) {
+ ret = -EIO;
+ goto err_pci_regions;
+ }
+
+- if (ndev->peer_spad_reg_bar) {
+- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0);
++ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) {
++ ndev->peer_spad_reg = pci_iomap(pdev,
++ ndev->barno_map[BAR_PEER_SPAD], 0);
+ if (!ndev->peer_spad_reg) {
+ ret = -EIO;
+ goto err_pci_regions;
+@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
+ ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz;
+ }
+
+- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0);
++ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0);
+ if (!ndev->db_reg) {
+ ret = -EIO;
+ goto err_pci_regions;
+@@ -659,12 +669,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev)
+ static int ntb_epf_pci_probe(struct pci_dev *pdev,
+ const struct pci_device_id *id)
+ {
+- enum pci_barno peer_spad_reg_bar = BAR_1;
+- enum pci_barno ctrl_reg_bar = BAR_0;
+- enum pci_barno db_reg_bar = BAR_2;
+- enum pci_barno mw_bar = BAR_2;
+ struct device *dev = &pdev->dev;
+- struct ntb_epf_data *data;
+ struct ntb_epf_dev *ndev;
+ int ret;
+
+@@ -675,18 +680,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev,
+ if (!ndev)
+ return -ENOMEM;
+
+- data = (struct ntb_epf_data *)id->driver_data;
+- if (data) {
+- peer_spad_reg_bar = data->peer_spad_reg_bar;
+- ctrl_reg_bar = data->ctrl_reg_bar;
+- db_reg_bar = data->db_reg_bar;
+- mw_bar = data->mw_bar;
+- }
++ ndev->barno_map = (const enum pci_barno *)id->driver_data;
++ if (!ndev->barno_map)
++ return -EINVAL;
+
+- ndev->peer_spad_reg_bar = peer_spad_reg_bar;
+- ndev->ctrl_reg_bar = ctrl_reg_bar;
+- ndev->db_reg_bar = db_reg_bar;
+- ndev->mw_bar = mw_bar;
+ ndev->dev = dev;
+
+ ntb_epf_init_struct(ndev, pdev);
+@@ -730,30 +727,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev)
+ ntb_epf_deinit_pci(ndev);
+ }
+
+-static const struct ntb_epf_data j721e_data = {
+- .ctrl_reg_bar = BAR_0,
+- .peer_spad_reg_bar = BAR_1,
+- .db_reg_bar = BAR_2,
+- .mw_bar = BAR_2,
++static const enum pci_barno j721e_map[NTB_BAR_NUM] = {
++ [BAR_CONFIG] = BAR_0,
++ [BAR_PEER_SPAD] = BAR_1,
++ [BAR_DB] = BAR_2,
++ [BAR_MW1] = BAR_2,
++ [BAR_MW2] = BAR_3,
++ [BAR_MW3] = BAR_4,
++ [BAR_MW4] = BAR_5
+ };
+
+-static const struct ntb_epf_data mx8_data = {
+- .ctrl_reg_bar = BAR_0,
+- .peer_spad_reg_bar = BAR_0,
+- .db_reg_bar = BAR_2,
+- .mw_bar = BAR_4,
++static const enum pci_barno mx8_map[NTB_BAR_NUM] = {
++ [BAR_CONFIG] = BAR_0,
++ [BAR_PEER_SPAD] = BAR_0,
++ [BAR_DB] = BAR_2,
++ [BAR_MW1] = BAR_4,
++ [BAR_MW2] = BAR_5,
++ [BAR_MW3] = NO_BAR,
++ [BAR_MW4] = NO_BAR
+ };
+
+ static const struct pci_device_id ntb_epf_pci_tbl[] = {
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E),
+ .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
+- .driver_data = (kernel_ulong_t)&j721e_data,
++ .driver_data = (kernel_ulong_t)j721e_map,
+ },
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809),
+ .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
+- .driver_data = (kernel_ulong_t)&mx8_data,
++ .driver_data = (kernel_ulong_t)mx8_map,
+ },
+ { },
+ };
+--
+2.51.0
+
--- /dev/null
+From bfbcb15043bd360bb516a6e4a8e77e2a52ba06e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 19:54:09 +0200
+Subject: rtc: pcf2127: clear minute/second interrupt
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ]
+
+PCF2127 can generate interrupt every full second or minute configured
+from control and status register 1, bits MI (1) and SI (0).
+
+On interrupt control register 2 bit MSF (7) is set and must be cleared
+to continue normal operation.
+
+While the driver never enables this interrupt on its own, users or
+firmware may do so - e.g. as an easy way to test the interrupt.
+
+Add preprocessor definition for MSF bit and include it in the irq
+bitmask to ensure minute and second interrupts are cleared when fired.
+
+This fixes an issue where the rtc enters a test mode and becomes
+unresponsive after a second interrupt has fired and is not cleared in
+time. In this state register writes to control registers have no
+effect and the interrupt line is kept asserted [1]:
+
+[1] userspace commands to put rtc into unresponsive state:
+$ i2cget -f -y 2 0x51 0x00
+0x04
+$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI
+$ i2cget -f -y 2 0x51 0x00
+0x84 # bit 8 EXT_TEST set
+$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register
+$ i2cget -f -y 2 0x51 0x00
+0x84 # no change
+
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 502571f0c203f..e793c019fb9d7 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -41,6 +41,7 @@
+ #define PCF2127_BIT_CTRL2_AF BIT(4)
+ #define PCF2127_BIT_CTRL2_TSF2 BIT(5)
+ #define PCF2127_BIT_CTRL2_WDTF BIT(6)
++#define PCF2127_BIT_CTRL2_MSF BIT(7)
+ /* Control register 3 */
+ #define PCF2127_REG_CTRL3 0x02
+ #define PCF2127_BIT_CTRL3_BLIE BIT(0)
+@@ -94,7 +95,8 @@
+ #define PCF2127_CTRL2_IRQ_MASK ( \
+ PCF2127_BIT_CTRL2_AF | \
+ PCF2127_BIT_CTRL2_WDTF | \
+- PCF2127_BIT_CTRL2_TSF2)
++ PCF2127_BIT_CTRL2_TSF2 | \
++ PCF2127_BIT_CTRL2_MSF)
+
+ #define PCF2127_MAX_TS_SUPPORTED 4
+
+--
+2.51.0
+
--- /dev/null
+From 525e7c556beb17821dcdd7b4e36acef62ed616f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 20:22:35 +0200
+Subject: rtc: pcf2127: fix watchdog interrupt mask on pcf2131
+
+From: Bruno Thomsen <bruno.thomsen@gmail.com>
+
+[ Upstream commit 87064da2db7be537a7da20a25c18ba912c4db9e1 ]
+
+When using interrupt pin (INT A) as watchdog output all other
+interrupt sources need to be disabled to avoid additional
+resets. Resulting INT_A_MASK1 value is 55 (0x37).
+
+Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20250902182235.6825-1-bruno.thomsen@gmail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index e793c019fb9d7..05a54f4d4d9a6 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -528,6 +528,21 @@ static int pcf2127_watchdog_init(struct device *dev, struct pcf2127 *pcf2127)
+ set_bit(WDOG_HW_RUNNING, &pcf2127->wdd.status);
+ }
+
++ /*
++ * When using interrupt pin (INT A) as watchdog output, only allow
++ * watchdog interrupt (PCF2131_BIT_INT_WD_CD) and disable (mask) all
++ * other interrupts.
++ */
++ if (pcf2127->cfg->type == PCF2131) {
++ ret = regmap_write(pcf2127->regmap,
++ PCF2131_REG_INT_A_MASK1,
++ PCF2131_BIT_INT_BLIE |
++ PCF2131_BIT_INT_BIE |
++ PCF2131_BIT_INT_AIE |
++ PCF2131_BIT_INT_SI |
++ PCF2131_BIT_INT_MI);
++ }
++
+ return devm_watchdog_register_device(dev, &pcf2127->wdd);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 67477d6e368fe1b091e1097cc41129ce6ecc7ca3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:14:28 +0900
+Subject: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
+
+From: Hoyoung Seo <hy50.seo@samsung.com>
+
+[ Upstream commit 558ae4579810fa0fef011944230c65a6f3087f85 ]
+
+When a UTP error occurs in isolation, UFS is not currently recoverable.
+This is because the UTP error is not considered fatal in the error
+handling code, leading to either an I/O timeout or an OCS error.
+
+Add the UTP error flag to INT_FATAL_ERRORS so the controller will be
+reset in this situation.
+
+ sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07
+ driverbyte=DRIVER_OK cmd_age=0s
+ sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00
+ I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg
+ 8 prio class 2
+ OCS error from controller = 9 for tag 39
+ pa_err[1] = 0x80000010 at 2667224756 us
+ pa_err: total cnt=2
+ dl_err[0] = 0x80000002 at 2667148060 us
+ dl_err[1] = 0x80002000 at 2667282844 us
+ No record of nl_err
+ No record of tl_err
+ No record of dme_err
+ No record of auto_hibern8_err
+ fatal_err[0] = 0x804 at 2667282836 us
+
+ ---------------------------------------------------
+ REGISTER
+ ---------------------------------------------------
+ NAME OFFSET VALUE
+ STD HCI SFR 0xfffffff0 0x0
+ AHIT 0x18 0x814
+ INTERRUPT STATUS 0x20 0x1000
+ INTERRUPT ENABLE 0x24 0x70ef5
+
+[mkp: commit desc]
+
+Signed-off-by: Hoyoung Seo <hy50.seo@samsung.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/ufs/ufshci.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h
+index 27364c4a6ef9f..63ae3150f6be3 100644
+--- a/include/ufs/ufshci.h
++++ b/include/ufs/ufshci.h
+@@ -185,6 +185,7 @@ static inline u32 ufshci_version(u32 major, u32 minor)
+ #define UTP_TASK_REQ_COMPL 0x200
+ #define UIC_COMMAND_COMPL 0x400
+ #define DEVICE_FATAL_ERROR 0x800
++#define UTP_ERROR 0x1000
+ #define CONTROLLER_FATAL_ERROR 0x10000
+ #define SYSTEM_BUS_FATAL_ERROR 0x20000
+ #define CRYPTO_ENGINE_FATAL_ERROR 0x40000
+@@ -204,7 +205,8 @@ static inline u32 ufshci_version(u32 major, u32 minor)
+ CONTROLLER_FATAL_ERROR |\
+ SYSTEM_BUS_FATAL_ERROR |\
+ CRYPTO_ENGINE_FATAL_ERROR |\
+- UIC_LINK_LOST)
++ UIC_LINK_LOST |\
++ UTP_ERROR)
+
+ /* HCS - Host Controller Status 30h */
+ #define DEVICE_PRESENT 0x1
+--
+2.51.0
+
rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch
btrfs-fix-memory-leak-of-qgroup_list-in-btrfs_add_qg.patch
btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch
+clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch
+fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch
+um-fix-help-message-for-ssl-non-raw.patch
+clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch
+rtc-pcf2127-clear-minute-second-interrupt.patch
+arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch
+clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch
+clk-at91-clk-master-add-check-for-divide-by-3.patch
+clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch
+9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch
+clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch
+clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch
+clk-clocking-wizard-fix-output-clock-register-offset.patch
+ntb-epf-allow-arbitrary-bar-mapping.patch
+9p-fix-sys-fs-9p-caches-overwriting-itself.patch
+cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch
+9p-sysfs_init-don-t-hardcode-error-to-enomem.patch
+scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch
+acpi-property-return-present-device-nodes-only-on-fw.patch
+loongarch-handle-new-atomic-instructions-for-probes.patch
+tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch
+tools-lib-thermal-don-t-preserve-owner-in-install.patch
+tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch
+fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch
+rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch
+net-wwan-t7xx-add-support-for-hp-drmr-h01.patch
+kbuild-uapi-strip-comments-before-size-type-check.patch
+asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch
+drm-amdkfd-fix-mmap-write-lock-not-release.patch
+ceph-add-checking-of-wait_for_completion_killable-re.patch
+ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch
+ceph-refactor-wake_up_bit-pattern-of-calling.patch
+ceph-fix-multifs-mds-auth-caps-issue.patch
+x86-use-cmov-for-user-address-masking.patch
+x86-runtime-const-add-the-runtime_const_ptr-assembly.patch
+x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch
--- /dev/null
+From f6767e116bdd50d450a080ab0500fa8f47e3389f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:47:06 -0700
+Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
+
+small_const_nbits is defined in asm-generic/bitsperlong.h which
+bitmap.h uses but doesn't include causing build failures in some build
+systems. Add the missing #include.
+
+Note the bitmap.h in tools has diverged from that of the kernel, so no
+changes are made there.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Yury Norov <yury.norov@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: André Almeida <andrealmeid@igalia.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Ido Schimmel <idosch@nvidia.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Jason Xing <kerneljasonxing@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Maurice Lambert <mauricelambert434@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Petr Machata <petrm@nvidia.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yuyang Huang <yuyanghuang@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/bitmap.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
+index 2a7f260ef9dc5..7081f4a8d634b 100644
+--- a/tools/include/linux/bitmap.h
++++ b/tools/include/linux/bitmap.h
+@@ -3,6 +3,7 @@
+ #define _TOOLS_LINUX_BITMAP_H
+
+ #include <string.h>
++#include <asm-generic/bitsperlong.h>
+ #include <linux/align.h>
+ #include <linux/bitops.h>
+ #include <linux/find.h>
+--
+2.51.0
+
--- /dev/null
+From f054c1c970b1ff2631405d59c940ac704bbaa06b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:40:56 +0200
+Subject: tools: lib: thermal: don't preserve owner in install
+
+From: Emil Dahl Juhl <juhl.emildahl@gmail.com>
+
+[ Upstream commit 1375152bb02ab2a8435e87ea27034482dbc95f57 ]
+
+Instead of preserving mode, timestamp, and owner, for the object files
+during installation, just preserve the mode and timestamp.
+
+When installing as root, the installed files should be owned by root.
+When installing as user, --preserve=ownership doesn't work anyway. This
+makes --preserve=ownership rather pointless.
+
+Signed-off-by: Emil Dahl Juhl <juhl.emildahl@gmail.com>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
+index 8890fd57b110c..1694889847caf 100644
+--- a/tools/lib/thermal/Makefile
++++ b/tools/lib/thermal/Makefile
+@@ -147,7 +147,7 @@ endef
+ install_lib: libs
+ $(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \
+ $(call do_install_mkdir,$(libdir_SQ)); \
+- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
++ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
+
+ install_headers:
+ $(call QUIET_INSTALL, headers) \
+--
+2.51.0
+
--- /dev/null
+From f73bf9dacd2e018a736d5358a62d210051a63a15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:40:55 +0200
+Subject: tools: lib: thermal: use pkg-config to locate libnl3
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit b31f7f725cd932e2c2b41f3e4b66273653953687 ]
+
+To make libthermal more cross compile friendly use pkg-config to locate
+libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/Makefile | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
+index 1694889847caf..8d21ea1950a31 100644
+--- a/tools/lib/thermal/Makefile
++++ b/tools/lib/thermal/Makefile
+@@ -59,8 +59,12 @@ else
+ CFLAGS := -g -Wall
+ endif
+
++NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null)
++ifeq ($(NL3_CFLAGS),)
++NL3_CFLAGS = -I/usr/include/libnl3
++endif
++
+ INCLUDES = \
+--I/usr/include/libnl3 \
+ -I$(srctree)/tools/lib/thermal/include \
+ -I$(srctree)/tools/lib/ \
+ -I$(srctree)/tools/include \
+@@ -72,6 +76,7 @@ INCLUDES = \
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += -Werror -Wall
+ override CFLAGS += -fPIC
++override CFLAGS += $(NL3_CFLAGS)
+ override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFGLAS += -Wl,-L.
+--
+2.51.0
+
--- /dev/null
+From d3aa7e9538ce3ce41085473b7749b72534d22199 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 08:56:59 +0800
+Subject: um: Fix help message for ssl-non-raw
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ]
+
+Add the missing option name in the help message. Additionally,
+switch to __uml_help(), because this is a global option rather
+than a per-channel option.
+
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/ssl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
+index 277cea3d30eb5..8006a5bd578c2 100644
+--- a/arch/um/drivers/ssl.c
++++ b/arch/um/drivers/ssl.c
+@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str)
+ return 1;
+ }
+ __setup("ssl-non-raw", ssl_non_raw_setup);
+-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode");
++__uml_help(ssl_non_raw_setup,
++"ssl-non-raw\n"
++" Set serial lines to non-raw mode.\n\n"
++);
+--
+2.51.0
+
--- /dev/null
+From 2c680779ffe53d74a3e5e3d67dac3ead1d03ba18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Mar 2025 17:33:42 +0200
+Subject: x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit bd72baff229920da1d57c14364c11ecdbaf5b458 ]
+
+Add an assembly macro to refer runtime cost. It hides linker magic and
+makes assembly more readable.
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/20250304153342.2016569-1-kirill.shutemov@linux.intel.com
+Stable-dep-of: 284922f4c563 ("x86: uaccess: don't use runtime-const rewriting in modules")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/runtime-const.h | 13 +++++++++++++
+ arch/x86/lib/getuser.S | 7 ++-----
+ 2 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/include/asm/runtime-const.h b/arch/x86/include/asm/runtime-const.h
+index 6652ebddfd02f..8d983cfd06ea6 100644
+--- a/arch/x86/include/asm/runtime-const.h
++++ b/arch/x86/include/asm/runtime-const.h
+@@ -2,6 +2,18 @@
+ #ifndef _ASM_RUNTIME_CONST_H
+ #define _ASM_RUNTIME_CONST_H
+
++#ifdef __ASSEMBLY__
++
++.macro RUNTIME_CONST_PTR sym reg
++ movq $0x0123456789abcdef, %\reg
++ 1:
++ .pushsection runtime_ptr_\sym, "a"
++ .long 1b - 8 - .
++ .popsection
++.endm
++
++#else /* __ASSEMBLY__ */
++
+ #define runtime_const_ptr(sym) ({ \
+ typeof(sym) __ret; \
+ asm_inline("mov %1,%0\n1:\n" \
+@@ -58,4 +70,5 @@ static inline void runtime_const_fixup(void (*fn)(void *, unsigned long),
+ }
+ }
+
++#endif /* __ASSEMBLY__ */
+ #endif
+diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
+index 89ecd57c9d423..853a2e6287698 100644
+--- a/arch/x86/lib/getuser.S
++++ b/arch/x86/lib/getuser.S
+@@ -34,16 +34,13 @@
+ #include <asm/thread_info.h>
+ #include <asm/asm.h>
+ #include <asm/smap.h>
++#include <asm/runtime-const.h>
+
+ #define ASM_BARRIER_NOSPEC ALTERNATIVE "", "lfence", X86_FEATURE_LFENCE_RDTSC
+
+ .macro check_range size:req
+ .if IS_ENABLED(CONFIG_X86_64)
+- movq $0x0123456789abcdef,%rdx
+- 1:
+- .pushsection runtime_ptr_USER_PTR_MAX,"a"
+- .long 1b - 8 - .
+- .popsection
++ RUNTIME_CONST_PTR USER_PTR_MAX, rdx
+ cmp %rdx, %rax
+ cmova %rdx, %rax
+ .else
+--
+2.51.0
+
--- /dev/null
+From 6216035330ef8304a38e8875f805ed839801ed1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 15:25:20 +0900
+Subject: x86: uaccess: don't use runtime-const rewriting in modules
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 284922f4c563aa3a8558a00f2a05722133237fe8 ]
+
+The runtime-const infrastructure was never designed to handle the
+modular case, because the constant fixup is only done at boot time for
+core kernel code.
+
+But by the time I used it for the x86-64 user space limit handling in
+commit 86e6b1547b3d ("x86: fix user address masking non-canonical
+speculation issue"), I had completely repressed that fact.
+
+And it all happens to work because the only code that currently actually
+gets inlined by modules is for the access_ok() limit check, where the
+default constant value works even when not fixed up. Because at least I
+had intentionally made it be something that is in the non-canonical
+address space region.
+
+But it's technically very wrong, and it does mean that at least in
+theory, the use of 'access_ok()' + '__get_user()' can trigger the same
+speculation issue with non-canonical addresses that the original commit
+was all about.
+
+The pattern is unusual enough that this probably doesn't matter in
+practice, but very wrong is still very wrong. Also, let's fix it before
+the nice optimized scoped user accessor helpers that Thomas Gleixner is
+working on cause this pseudo-constant to then be more widely used.
+
+This all came up due to an unrelated discussion with Mateusz Guzik about
+using the runtime const infrastructure for names_cachep accesses too.
+There the modular case was much more obviously broken, and Mateusz noted
+it in his 'v2' of the patch series.
+
+That then made me notice how broken 'access_ok()' had been in modules
+all along. Mea culpa, mea maxima culpa.
+
+Fix it by simply not using the runtime-const code in modules, and just
+using the USER_PTR_MAX variable value instead. This is not
+performance-critical like the core user accessor functions (get_user()
+and friends) are.
+
+Also make sure this doesn't get forgotten the next time somebody wants
+to do runtime constant optimizations by having the x86 runtime-const.h
+header file error out if included by modules.
+
+Fixes: 86e6b1547b3d ("x86: fix user address masking non-canonical speculation issue")
+Acked-by: Borislav Petkov <bp@alien8.de>
+Acked-by: Sean Christopherson <seanjc@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Triggered-by: Mateusz Guzik <mjguzik@gmail.com>
+Link: https://lore.kernel.org/all/20251030105242.801528-1-mjguzik@gmail.com/
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/runtime-const.h | 4 ++++
+ arch/x86/include/asm/uaccess_64.h | 10 +++++-----
+ arch/x86/kernel/cpu/common.c | 6 +++++-
+ 3 files changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/include/asm/runtime-const.h b/arch/x86/include/asm/runtime-const.h
+index 8d983cfd06ea6..e5a13dc8816e2 100644
+--- a/arch/x86/include/asm/runtime-const.h
++++ b/arch/x86/include/asm/runtime-const.h
+@@ -2,6 +2,10 @@
+ #ifndef _ASM_RUNTIME_CONST_H
+ #define _ASM_RUNTIME_CONST_H
+
++#ifdef MODULE
++ #error "Cannot use runtime-const infrastructure from modules"
++#endif
++
+ #ifdef __ASSEMBLY__
+
+ .macro RUNTIME_CONST_PTR sym reg
+diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
+index c52f0133425b9..3f843369f4097 100644
+--- a/arch/x86/include/asm/uaccess_64.h
++++ b/arch/x86/include/asm/uaccess_64.h
+@@ -12,12 +12,12 @@
+ #include <asm/cpufeatures.h>
+ #include <asm/page.h>
+ #include <asm/percpu.h>
+-#include <asm/runtime-const.h>
+
+-/*
+- * Virtual variable: there's no actual backing store for this,
+- * it can purely be used as 'runtime_const_ptr(USER_PTR_MAX)'
+- */
++#ifdef MODULE
++ #define runtime_const_ptr(sym) (sym)
++#else
++ #include <asm/runtime-const.h>
++#endif
+ extern unsigned long USER_PTR_MAX;
+
+ #ifdef CONFIG_ADDRESS_MASKING
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index bc51fccba4cb6..b54717e6fc606 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -76,6 +76,10 @@
+ DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info);
+ EXPORT_PER_CPU_SYMBOL(cpu_info);
+
++/* Used for modules: built-in code uses runtime constants */
++unsigned long USER_PTR_MAX;
++EXPORT_SYMBOL(USER_PTR_MAX);
++
+ u32 elf_hwcap2 __read_mostly;
+
+ /* Number of siblings per CPU package */
+@@ -2473,7 +2477,7 @@ void __init arch_cpu_finalize_init(void)
+ alternative_instructions();
+
+ if (IS_ENABLED(CONFIG_X86_64)) {
+- unsigned long USER_PTR_MAX = TASK_SIZE_MAX;
++ USER_PTR_MAX = TASK_SIZE_MAX;
+
+ /*
+ * Enable this when LAM is gated on LASS support
+--
+2.51.0
+
--- /dev/null
+From be5b93a58835133902b9bfa9db98d4495b112573 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 10:25:04 -0800
+Subject: x86: use cmov for user address masking
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 91309a70829d94c735c8bb1cc383e78c96127a16 ]
+
+This was a suggestion by David Laight, and while I was slightly worried
+that some micro-architecture would predict cmov like a conditional
+branch, there is little reason to actually believe any core would be
+that broken.
+
+Intel documents that their existing cores treat CMOVcc as a data
+dependency that will constrain speculation in their "Speculative
+Execution Side Channel Mitigations" whitepaper:
+
+ "Other instructions such as CMOVcc, AND, ADC, SBB and SETcc can also
+ be used to prevent bounds check bypass by constraining speculative
+ execution on current family 6 processors (Intel® Core™, Intel® Atom™,
+ Intel® Xeon® and Intel® Xeon Phi™ processors)"
+
+and while that leaves the future uarch issues open, that's certainly
+true of our traditional SBB usage too.
+
+Any core that predicts CMOV will be unusable for various crypto
+algorithms that need data-independent timing stability, so let's just
+treat CMOV as the safe choice that simplifies the address masking by
+avoiding an extra instruction and doesn't need a temporary register.
+
+Suggested-by: David Laight <David.Laight@aculab.com>
+Link: https://www.intel.com/content/dam/develop/external/us/en/documents/336996-speculative-execution-side-channel-mitigations.pdf
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Stable-dep-of: 284922f4c563 ("x86: uaccess: don't use runtime-const rewriting in modules")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/uaccess_64.h | 12 ++++++------
+ arch/x86/lib/getuser.S | 5 ++---
+ 2 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
+index b0a887209400d..c52f0133425b9 100644
+--- a/arch/x86/include/asm/uaccess_64.h
++++ b/arch/x86/include/asm/uaccess_64.h
+@@ -63,13 +63,13 @@ static inline unsigned long __untagged_addr_remote(struct mm_struct *mm,
+ */
+ static inline void __user *mask_user_address(const void __user *ptr)
+ {
+- unsigned long mask;
++ void __user *ret;
+ asm("cmp %1,%0\n\t"
+- "sbb %0,%0"
+- :"=r" (mask)
+- :"r" (ptr),
+- "0" (runtime_const_ptr(USER_PTR_MAX)));
+- return (__force void __user *)(mask | (__force unsigned long)ptr);
++ "cmova %1,%0"
++ :"=r" (ret)
++ :"r" (runtime_const_ptr(USER_PTR_MAX)),
++ "0" (ptr));
++ return ret;
+ }
+ #define masked_user_access_begin(x) ({ \
+ __auto_type __masked_ptr = (x); \
+diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
+index 4357ec2a0bfc2..89ecd57c9d423 100644
+--- a/arch/x86/lib/getuser.S
++++ b/arch/x86/lib/getuser.S
+@@ -44,9 +44,8 @@
+ .pushsection runtime_ptr_USER_PTR_MAX,"a"
+ .long 1b - 8 - .
+ .popsection
+- cmp %rax, %rdx
+- sbb %rdx, %rdx
+- or %rdx, %rax
++ cmp %rdx, %rax
++ cmova %rdx, %rax
+ .else
+ cmp $TASK_SIZE_MAX-\size+1, %eax
+ jae .Lbad_get_user
+--
+2.51.0
+
--- /dev/null
+From aba7e2f068b8a2284f0f34401c6490b96308d48b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:30 +0900
+Subject: 9p: fix /sys/fs/9p/caches overwriting itself
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
+
+caches_show() overwrote its buffer on each iteration,
+so only the last cache tag was visible in sysfs output.
+
+Properly append with snprintf(buf + count, …).
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 77e9c4387c1df..714cfe76ee651 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj,
+ spin_lock(&v9fs_sessionlist_lock);
+ list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
+ if (v9ses->cachetag) {
+- n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag);
+ if (n < 0) {
+ count = n;
+ break;
+--
+2.51.0
+
--- /dev/null
+From 3a2e2c7d6437f2b186ce623025990ca6e70ebf01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:31 +0900
+Subject: 9p: sysfs_init: don't hardcode error to ENOMEM
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
+
+v9fs_sysfs_init() always returned -ENOMEM on failure;
+return the actual sysfs_create_group() error instead.
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 714cfe76ee651..a59c26cc3c7d9 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = {
+
+ static int __init v9fs_sysfs_init(void)
+ {
++ int ret;
++
+ v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
+ if (!v9fs_kobj)
+ return -ENOMEM;
+
+- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) {
++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group);
++ if (ret) {
+ kobject_put(v9fs_kobj);
+- return -ENOMEM;
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From bbf20db8fddaed474a517eb73638e624755f614f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 18:10:13 +0200
+Subject: 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+[ Upstream commit e8fe3f07a357c39d429e02ca34f740692d88967a ]
+
+p9_read_work() doesn't set Rworksched and doesn't do schedule_work(m->rq)
+if list_empty(&m->req_list).
+
+However, if the pipe is full, we need to read more data and this used to
+work prior to commit aaec5a95d59615 ("pipe_read: don't wake up the writer
+if the pipe is still full").
+
+p9_read_work() does p9_fd_read() -> ... -> anon_pipe_read() which (before
+the commit above) triggered the unnecessary wakeup. This wakeup calls
+p9_pollwake() which kicks p9_poll_workfn() -> p9_poll_mux(), p9_poll_mux()
+will notice EPOLLIN and schedule_work(&m->rq).
+
+This no longer happens after the optimization above, change p9_fd_request()
+to use p9_poll_mux() instead of only checking for EPOLLOUT.
+
+Reported-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com
+Tested-by: syzbot+d1b5dace43896bc386c3@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/68a2de8f.050a0220.e29e5.0097.GAE@google.com/
+Link: https://lore.kernel.org/all/67dedd2f.050a0220.31a16b.003f.GAE@google.com/
+Co-developed-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Message-ID: <20250819161013.GB11345@redhat.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/9p/trans_fd.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index 8992d8bebbddf..a516745f732f7 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -666,7 +666,6 @@ static void p9_poll_mux(struct p9_conn *m)
+
+ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
+ {
+- __poll_t n;
+ int err;
+ struct p9_trans_fd *ts = client->trans;
+ struct p9_conn *m = &ts->conn;
+@@ -686,13 +685,7 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
+ list_add_tail(&req->req_list, &m->unsent_req_list);
+ spin_unlock(&m->req_lock);
+
+- if (test_and_clear_bit(Wpending, &m->wsched))
+- n = EPOLLOUT;
+- else
+- n = p9_fd_poll(m->client, NULL, NULL);
+-
+- if (n & EPOLLOUT && !test_and_set_bit(Wworksched, &m->wsched))
+- schedule_work(&m->wq);
++ p9_poll_mux(m);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From f57494d05ab0bcec590e8543bc09ad7edc44d08a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:26:36 +0300
+Subject: ACPI: property: Return present device nodes only on fwnode interface
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
+
+fwnode_graph_get_next_subnode() may return fwnode backed by ACPI
+device nodes and there has been no check these devices are present
+in the system, unlike there has been on fwnode OF backend.
+
+In order to provide consistent behaviour towards callers,
+add a check for device presence by introducing
+a new function acpi_get_next_present_subnode(), used as the
+get_next_child_node() fwnode operation that also checks device
+node presence.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com
+[ rjw: Kerneldoc comment and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/property.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index c086786fe84cb..d74678f0ba4af 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -1357,6 +1357,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
+ return NULL;
+ }
+
++/*
++ * acpi_get_next_present_subnode - Return the next present child node handle
++ * @fwnode: Firmware node to find the next child node for.
++ * @child: Handle to one of the device's child nodes or a null handle.
++ *
++ * Like acpi_get_next_subnode(), but the device nodes returned by
++ * acpi_get_next_present_subnode() are guaranteed to be present.
++ *
++ * Returns: The fwnode handle of the next present sub-node.
++ */
++static struct fwnode_handle *
++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode,
++ struct fwnode_handle *child)
++{
++ do {
++ child = acpi_get_next_subnode(fwnode, child);
++ } while (is_acpi_device_node(child) &&
++ !acpi_device_is_present(to_acpi_device_node(child)));
++
++ return child;
++}
++
+ /**
+ * acpi_node_get_parent - Return parent fwnode of this fwnode
+ * @fwnode: Firmware node whose parent to get
+@@ -1701,7 +1723,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode,
+ .property_read_string_array = \
+ acpi_fwnode_property_read_string_array, \
+ .get_parent = acpi_node_get_parent, \
+- .get_next_child_node = acpi_get_next_subnode, \
++ .get_next_child_node = acpi_get_next_present_subnode, \
+ .get_named_child_node = acpi_fwnode_get_named_child_node, \
+ .get_name = acpi_fwnode_get_name, \
+ .get_name_prefix = acpi_fwnode_get_name_prefix, \
+--
+2.51.0
+
--- /dev/null
+From 936a8271b2cd133176e0f0c9bcdbcce1533c8344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 11:09:14 -0400
+Subject: ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo
+
+From: Adam Holliday <dochollidayxx@gmail.com>
+
+[ Upstream commit 328b80b29a6a165c47fcc04d2bef3e09ed1d28f9 ]
+
+The ASUS ROG Zephyrus Duo 15 SE (GX551QS) with ALC 289 codec requires specific
+pin configuration for proper volume control. Without this quirk, volume
+adjustments produce a muffled sound effect as only certain channels attenuate,
+leaving bass frequency at full volume.
+
+Testing with hdajackretask confirms these pin tweaks fix the issue:
+- Pin 0x17: Internal Speaker (LFE)
+- Pin 0x1e: Internal Speaker
+
+Signed-off-by: Adam Holliday <dochollidayxx@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 8fb1a5c6ff6df..28297e936a96f 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -3737,6 +3737,7 @@ enum {
+ ALC285_FIXUP_ASUS_GA605K_HEADSET_MIC,
+ ALC285_FIXUP_ASUS_GA605K_I2C_SPEAKER2_TO_DAC1,
+ ALC269_FIXUP_POSITIVO_P15X_HEADSET_MIC,
++ ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK,
+ };
+
+ /* A special fixup for Lenovo C940 and Yoga Duet 7;
+@@ -6166,6 +6167,14 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
+ },
++ [ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x17, 0x90170151 }, /* Internal Speaker LFE */
++ { 0x1e, 0x90170150 }, /* Internal Speaker */
++ { }
++ },
++ }
+ };
+
+ static const struct hda_quirk alc269_fixup_tbl[] = {
+@@ -6721,6 +6730,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA/XJ/XQ/XU/XV/XI", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301VV/VQ/VU/VJ/VA/VC/VE/VVC/VQC/VUC/VJC/VEC/VCC", ALC285_FIXUP_ASUS_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1043, 0x1652, "ASUS ROG Zephyrus Do 15 SE", ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZI/ZJ/ZQ/ZU/ZV", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2),
+--
+2.51.0
+
--- /dev/null
+From c78247bd0b701bb0004fd8ecc8ea43c13daf2d7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:27 +0200
+Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ]
+
+Add a new word in assembly to store ACR value during the calls
+to at91_plla_disable/at91_plla_enable macros and use it.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading]
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index 7e6c94f8edeef..aad53ec9e957b 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -689,6 +689,10 @@ sr_dis_exit:
+ bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID
+ str tmp2, [pmc, #AT91_PMC_PLL_UPDT]
+
++ /* save acr */
++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR]
++ str tmp2, .saved_acr
++
+ /* save div. */
+ mov tmp1, #0
+ ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0]
+@@ -758,7 +762,7 @@ sr_dis_exit:
+ str tmp1, [pmc, #AT91_PMC_PLL_UPDT]
+
+ /* step 2. */
+- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
++ ldr tmp1, .saved_acr
+ str tmp1, [pmc, #AT91_PMC_PLL_ACR]
+
+ /* step 3. */
+@@ -1207,6 +1211,8 @@ ENDPROC(at91_pm_suspend_in_sram)
+ #endif
+ .saved_mckr:
+ .word 0
++.saved_acr:
++ .word 0
+ .saved_pllar:
+ .word 0
+ .saved_sam9_lpr:
+--
+2.51.0
+
--- /dev/null
+From 4e588d3407806ccafe7e63d05325f24dfa9ac8e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 00:12:19 +0200
+Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
+
+From: Valerio Setti <vsetti@baylibre.com>
+
+[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ]
+
+According to I2S specs audio data is sampled on the rising edge of the
+clock and it can change on the falling one. When operating in normal mode
+this SoC behaves the opposite so a clock polarity inversion is required
+in this case.
+
+This was tested on an OdroidC2 (Amlogic S905 SoC) board.
+
+Signed-off-by: Valerio Setti <vsetti@baylibre.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Tested-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c
+index a0dd914c8ed13..3b4061508c180 100644
+--- a/sound/soc/meson/aiu-encoder-i2s.c
++++ b/sound/soc/meson/aiu-encoder-i2s.c
+@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ inv == SND_SOC_DAIFMT_IB_IF)
+ val |= AIU_CLK_CTRL_LRCLK_INVERT;
+
+- if (inv == SND_SOC_DAIFMT_IB_NF ||
+- inv == SND_SOC_DAIFMT_IB_IF)
++ /*
++ * The SoC changes data on the rising edge of the bitclock
++ * so an inversion of the bitclock is required in normal mode
++ */
++ if (inv == SND_SOC_DAIFMT_NB_NF ||
++ inv == SND_SOC_DAIFMT_NB_IF)
+ val |= AIU_CLK_CTRL_AOCLK_INVERT;
+
+ /* Signal skew */
+@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = {
+ .startup = aiu_encoder_i2s_startup,
+ .shutdown = aiu_encoder_i2s_shutdown,
+ };
+-
+--
+2.51.0
+
--- /dev/null
+From e860c2ca270dd4c802b521f5c179df52ddfa441d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 16:09:50 +0800
+Subject: ASoC: rt722: add settings for rt722VB
+
+From: Shuming Fan <shumingf@realtek.com>
+
+[ Upstream commit a27539810e1e61efcfdeb51777ed875dc61e9d49 ]
+
+This patch adds settings for RT722VB.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Link: https://patch.msgid.link/20251007080950.1999411-1-shumingf@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt722-sdca-sdw.c | 2 +-
+ sound/soc/codecs/rt722-sdca.c | 14 ++++++++++++++
+ sound/soc/codecs/rt722-sdca.h | 6 ++++++
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c
+index 70700bdb80a14..5ea40c1b159a8 100644
+--- a/sound/soc/codecs/rt722-sdca-sdw.c
++++ b/sound/soc/codecs/rt722-sdca-sdw.c
+@@ -21,7 +21,7 @@ static int rt722_sdca_mbq_size(struct device *dev, unsigned int reg)
+ switch (reg) {
+ case 0x2f01 ... 0x2f0a:
+ case 0x2f35 ... 0x2f36:
+- case 0x2f50:
++ case 0x2f50 ... 0x2f52:
+ case 0x2f54:
+ case 0x2f58 ... 0x2f5d:
+ case SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT0, RT722_SDCA_CTL_FUNC_STATUS, 0):
+diff --git a/sound/soc/codecs/rt722-sdca.c b/sound/soc/codecs/rt722-sdca.c
+index 333611490ae35..79b8b7e70a334 100644
+--- a/sound/soc/codecs/rt722-sdca.c
++++ b/sound/soc/codecs/rt722-sdca.c
+@@ -1378,6 +1378,9 @@ static void rt722_sdca_dmic_preset(struct rt722_sdca_priv *rt722)
+ /* PHYtiming TDZ/TZD control */
+ regmap_write(rt722->regmap, 0x2f03, 0x06);
+
++ if (rt722->hw_vid == RT722_VB)
++ regmap_write(rt722->regmap, 0x2f52, 0x00);
++
+ /* clear flag */
+ regmap_write(rt722->regmap,
+ SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT0, RT722_SDCA_CTL_FUNC_STATUS, 0),
+@@ -1415,6 +1418,9 @@ static void rt722_sdca_amp_preset(struct rt722_sdca_priv *rt722)
+ SDW_SDCA_CTL(FUNC_NUM_AMP, RT722_SDCA_ENT_OT23,
+ RT722_SDCA_CTL_VENDOR_DEF, CH_08), 0x04);
+
++ if (rt722->hw_vid == RT722_VB)
++ regmap_write(rt722->regmap, 0x2f54, 0x00);
++
+ /* clear flag */
+ regmap_write(rt722->regmap,
+ SDW_SDCA_CTL(FUNC_NUM_AMP, RT722_SDCA_ENT0, RT722_SDCA_CTL_FUNC_STATUS, 0),
+@@ -1506,6 +1512,9 @@ static void rt722_sdca_jack_preset(struct rt722_sdca_priv *rt722)
+ rt722_sdca_index_write(rt722, RT722_VENDOR_REG, RT722_DIGITAL_MISC_CTRL4,
+ 0x0010);
+
++ if (rt722->hw_vid == RT722_VB)
++ regmap_write(rt722->regmap, 0x2f51, 0x00);
++
+ /* clear flag */
+ regmap_write(rt722->regmap,
+ SDW_SDCA_CTL(FUNC_NUM_JACK_CODEC, RT722_SDCA_ENT0, RT722_SDCA_CTL_FUNC_STATUS, 0),
+@@ -1516,6 +1525,7 @@ static void rt722_sdca_jack_preset(struct rt722_sdca_priv *rt722)
+ int rt722_sdca_io_init(struct device *dev, struct sdw_slave *slave)
+ {
+ struct rt722_sdca_priv *rt722 = dev_get_drvdata(dev);
++ unsigned int val;
+
+ rt722->disable_irq = false;
+
+@@ -1545,6 +1555,10 @@ int rt722_sdca_io_init(struct device *dev, struct sdw_slave *slave)
+
+ pm_runtime_get_noresume(&slave->dev);
+
++ rt722_sdca_index_read(rt722, RT722_VENDOR_REG, RT722_JD_PRODUCT_NUM, &val);
++ rt722->hw_vid = (val & 0x0f00) >> 8;
++ dev_dbg(&slave->dev, "%s hw_vid=0x%x\n", __func__, rt722->hw_vid);
++
+ rt722_sdca_dmic_preset(rt722);
+ rt722_sdca_amp_preset(rt722);
+ rt722_sdca_jack_preset(rt722);
+diff --git a/sound/soc/codecs/rt722-sdca.h b/sound/soc/codecs/rt722-sdca.h
+index 3c383705dd3cd..823abee9ab76c 100644
+--- a/sound/soc/codecs/rt722-sdca.h
++++ b/sound/soc/codecs/rt722-sdca.h
+@@ -39,6 +39,7 @@ struct rt722_sdca_priv {
+ /* For DMIC */
+ bool fu1e_dapm_mute;
+ bool fu1e_mixer_mute[4];
++ int hw_vid;
+ };
+
+ struct rt722_sdca_dmic_kctrl_priv {
+@@ -233,6 +234,11 @@ enum rt722_sdca_jd_src {
+ RT722_JD1,
+ };
+
++enum rt722_sdca_version {
++ RT722_VA,
++ RT722_VB,
++};
++
+ int rt722_sdca_io_init(struct device *dev, struct sdw_slave *slave);
+ int rt722_sdca_init(struct device *dev, struct regmap *regmap, struct sdw_slave *slave);
+ int rt722_sdca_index_write(struct rt722_sdca_priv *rt722,
+--
+2.51.0
+
--- /dev/null
+From 3c6afecb041121388c0c857c8b93866a5c883b8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 12:04:32 -0700
+Subject: ceph: add checking of wait_for_completion_killable() return value
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
+
+The Coverity Scan service has detected the calling of
+wait_for_completion_killable() without checking the return
+value in ceph_lock_wait_for_completion() [1]. The CID 1636232
+defect contains explanation: "If the function returns an error
+value, the error value may be mistaken for a normal value.
+In ceph_lock_wait_for_completion(): Value returned from
+a function is not checked for errors before being used. (CWE-252)".
+
+The patch adds the checking of wait_for_completion_killable()
+return value and return the error code from
+ceph_lock_wait_for_completion().
+
+[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/locks.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index ebf4ac0055ddc..dd764f9c64b9f 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -221,7 +221,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,
+ if (err && err != -ERESTARTSYS)
+ return err;
+
+- wait_for_completion_killable(&req->r_safe_completion);
++ err = wait_for_completion_killable(&req->r_safe_completion);
++ if (err)
++ return err;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ffa2a9eed483dbd67f578430a1ec114494745e5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 15:02:35 +0530
+Subject: ceph: fix multifs mds auth caps issue
+
+From: Kotresh HR <khiremat@redhat.com>
+
+[ Upstream commit 22c73d52a6d05c5a2053385c0d6cd9984732799d ]
+
+The mds auth caps check should also validate the
+fsname along with the associated caps. Not doing
+so would result in applying the mds auth caps of
+one fs on to the other fs in a multifs ceph cluster.
+The bug causes multiple issues w.r.t user
+authentication, following is one such example.
+
+Steps to Reproduce (on vstart cluster):
+1. Create two file systems in a cluster, say 'fsname1' and 'fsname2'
+2. Authorize read only permission to the user 'client.usr' on fs 'fsname1'
+ $ceph fs authorize fsname1 client.usr / r
+3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2'
+ $ceph fs authorize fsname2 client.usr / rw
+4. Update the keyring
+ $ceph auth get client.usr >> ./keyring
+
+With above permssions for the user 'client.usr', following is the
+expectation.
+ a. The 'client.usr' should be able to only read the contents
+ and not allowed to create or delete files on file system 'fsname1'.
+ b. The 'client.usr' should be able to read/write on file system 'fsname2'.
+
+But, with this bug, the 'client.usr' is allowed to read/write on file
+system 'fsname1'. See below.
+
+5. Mount the file system 'fsname1' with the user 'client.usr'
+ $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/
+6. Try creating a file on file system 'fsname1' with user 'client.usr'. This
+ should fail but passes with this bug.
+ $touch /kmnt_fsname1_usr/file1
+7. Mount the file system 'fsname1' with the user 'client.admin' and create a
+ file.
+ $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin
+ $echo "data" > /kmnt_fsname1_admin/admin_file1
+8. Try removing an existing file on file system 'fsname1' with the user
+ 'client.usr'. This shoudn't succeed but succeeds with the bug.
+ $rm -f /kmnt_fsname1_usr/admin_file1
+
+For more information, please take a look at the corresponding mds/fuse patch
+and tests added by looking into the tracker mentioned below.
+
+v2: Fix a possible null dereference in doutc
+v3: Don't store fsname from mdsmap, validate against
+ ceph_mount_options's fsname and use it
+v4: Code refactor, better warning message and
+ fix possible compiler warning
+
+[ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ]
+
+Link: https://tracker.ceph.com/issues/72167
+Signed-off-by: Kotresh HR <khiremat@redhat.com>
+Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 8 ++++++++
+ fs/ceph/mdsmap.c | 14 +++++++++++++-
+ fs/ceph/super.c | 14 --------------
+ fs/ceph/super.h | 14 ++++++++++++++
+ 4 files changed, 35 insertions(+), 15 deletions(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 3bc72b47fe4d4..3efbc11596e00 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -5649,11 +5649,19 @@ static int ceph_mds_auth_match(struct ceph_mds_client *mdsc,
+ u32 caller_uid = from_kuid(&init_user_ns, cred->fsuid);
+ u32 caller_gid = from_kgid(&init_user_ns, cred->fsgid);
+ struct ceph_client *cl = mdsc->fsc->client;
++ const char *fs_name = mdsc->fsc->mount_options->mds_namespace;
+ const char *spath = mdsc->fsc->mount_options->server_path;
+ bool gid_matched = false;
+ u32 gid, tlen, len;
+ int i, j;
+
++ doutc(cl, "fsname check fs_name=%s match.fs_name=%s\n",
++ fs_name, auth->match.fs_name ? auth->match.fs_name : "");
++ if (auth->match.fs_name && strcmp(auth->match.fs_name, fs_name)) {
++ /* fsname mismatch, try next one */
++ return 0;
++ }
++
+ doutc(cl, "match.uid %lld\n", auth->match.uid);
+ if (auth->match.uid != MDS_AUTH_UID_ANY) {
+ if (auth->match.uid != caller_uid)
+diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
+index 8109aba66e023..2c7b151a7c95c 100644
+--- a/fs/ceph/mdsmap.c
++++ b/fs/ceph/mdsmap.c
+@@ -353,10 +353,22 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
+ __decode_and_drop_type(p, end, u8, bad_ext);
+ }
+ if (mdsmap_ev >= 8) {
++ u32 fsname_len;
+ /* enabled */
+ ceph_decode_8_safe(p, end, m->m_enabled, bad_ext);
+ /* fs_name */
+- ceph_decode_skip_string(p, end, bad_ext);
++ ceph_decode_32_safe(p, end, fsname_len, bad_ext);
++
++ /* validate fsname against mds_namespace */
++ if (!namespace_equals(mdsc->fsc->mount_options, *p,
++ fsname_len)) {
++ pr_warn_client(cl, "fsname %*pE doesn't match mds_namespace %s\n",
++ (int)fsname_len, (char *)*p,
++ mdsc->fsc->mount_options->mds_namespace);
++ goto bad;
++ }
++ /* skip fsname after validation */
++ ceph_decode_skip_n(p, end, fsname_len, bad);
+ }
+ /* damaged */
+ if (mdsmap_ev >= 9) {
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index c3eb651862c55..ebef5244ae25a 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -246,20 +246,6 @@ static void canonicalize_path(char *path)
+ path[j] = '\0';
+ }
+
+-/*
+- * Check if the mds namespace in ceph_mount_options matches
+- * the passed in namespace string. First time match (when
+- * ->mds_namespace is NULL) is treated specially, since
+- * ->mds_namespace needs to be initialized by the caller.
+- */
+-static int namespace_equals(struct ceph_mount_options *fsopt,
+- const char *namespace, size_t len)
+-{
+- return !(fsopt->mds_namespace &&
+- (strlen(fsopt->mds_namespace) != len ||
+- strncmp(fsopt->mds_namespace, namespace, len)));
+-}
+-
+ static int ceph_parse_old_source(const char *dev_name, const char *dev_name_end,
+ struct fs_context *fc)
+ {
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index cf176aab0f823..4ac6561285b18 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -104,6 +104,20 @@ struct ceph_mount_options {
+ struct fscrypt_dummy_policy dummy_enc_policy;
+ };
+
++/*
++ * Check if the mds namespace in ceph_mount_options matches
++ * the passed in namespace string. First time match (when
++ * ->mds_namespace is NULL) is treated specially, since
++ * ->mds_namespace needs to be initialized by the caller.
++ */
++static inline int namespace_equals(struct ceph_mount_options *fsopt,
++ const char *namespace, size_t len)
++{
++ return !(fsopt->mds_namespace &&
++ (strlen(fsopt->mds_namespace) != len ||
++ strncmp(fsopt->mds_namespace, namespace, len)));
++}
++
+ /* mount state */
+ enum {
+ CEPH_MOUNT_MOUNTING,
+--
+2.51.0
+
--- /dev/null
+From ef060e252a477b4569a5060aab7c5d7136d277f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 11:31:08 -0700
+Subject: ceph: fix potential race condition in ceph_ioctl_lazyio()
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit 5824ccba9a39a3ad914fc9b2972a2c1119abaac9 ]
+
+The Coverity Scan service has detected potential
+race condition in ceph_ioctl_lazyio() [1].
+
+The CID 1591046 contains explanation: "Check of thread-shared
+field evades lock acquisition (LOCK_EVASION). Thread1 sets
+fmode to a new value. Now the two threads have an inconsistent
+view of fmode and updates to fields correlated with fmode
+may be lost. The data guarded by this critical section may
+be read while in an inconsistent state or modified by multiple
+racing threads. In ceph_ioctl_lazyio: Checking the value of
+a thread-shared field outside of a locked region to determine
+if a locked operation involving that thread shared field
+has completed. (CWE-543)".
+
+The patch places fi->fmode field access under ci->i_ceph_lock
+protection. Also, it introduces the is_file_already_lazy
+variable that is set under the lock and it is checked later
+out of scope of critical section.
+
+[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1591046
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/ioctl.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
+index e861de3c79b9e..15cde055f3da1 100644
+--- a/fs/ceph/ioctl.c
++++ b/fs/ceph/ioctl.c
+@@ -246,21 +246,28 @@ static long ceph_ioctl_lazyio(struct file *file)
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct ceph_mds_client *mdsc = ceph_inode_to_fs_client(inode)->mdsc;
+ struct ceph_client *cl = mdsc->fsc->client;
++ bool is_file_already_lazy = false;
+
++ spin_lock(&ci->i_ceph_lock);
+ if ((fi->fmode & CEPH_FILE_MODE_LAZY) == 0) {
+- spin_lock(&ci->i_ceph_lock);
+ fi->fmode |= CEPH_FILE_MODE_LAZY;
+ ci->i_nr_by_mode[ffs(CEPH_FILE_MODE_LAZY)]++;
+ __ceph_touch_fmode(ci, mdsc, fi->fmode);
+- spin_unlock(&ci->i_ceph_lock);
++ } else {
++ is_file_already_lazy = true;
++ }
++ spin_unlock(&ci->i_ceph_lock);
++
++ if (is_file_already_lazy) {
++ doutc(cl, "file %p %p %llx.%llx already lazy\n", file, inode,
++ ceph_vinop(inode));
++ } else {
+ doutc(cl, "file %p %p %llx.%llx marked lazy\n", file, inode,
+ ceph_vinop(inode));
+
+ ceph_check_caps(ci, 0);
+- } else {
+- doutc(cl, "file %p %p %llx.%llx already lazy\n", file, inode,
+- ceph_vinop(inode));
+ }
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c6e2e1f8577df4a55ad05338c6202a0d385fd8b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 12:20:57 -0700
+Subject: ceph: refactor wake_up_bit() pattern of calling
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit 53db6f25ee47cb1265141d31562604e56146919a ]
+
+The wake_up_bit() is called in ceph_async_unlink_cb(),
+wake_async_create_waiters(), and ceph_finish_async_create().
+It makes sense to switch on clear_bit() function, because
+it makes the code much cleaner and easier to understand.
+More important rework is the adding of smp_mb__after_atomic()
+memory barrier after the bit modification and before
+wake_up_bit() call. It can prevent potential race condition
+of accessing the modified bit in other threads. Luckily,
+clear_and_wake_up_bit() already implements the required
+functionality pattern:
+
+static inline void clear_and_wake_up_bit(int bit, unsigned long *word)
+{
+ clear_bit_unlock(bit, word);
+ /* See wake_up_bit() for which memory barrier you need to use. */
+ smp_mb__after_atomic();
+ wake_up_bit(word, bit);
+}
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/dir.c | 3 +--
+ fs/ceph/file.c | 6 ++----
+ 2 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 32973c62c1a23..d18c0eaef9b7e 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -1260,8 +1260,7 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc,
+ spin_unlock(&fsc->async_unlink_conflict_lock);
+
+ spin_lock(&dentry->d_lock);
+- di->flags &= ~CEPH_DENTRY_ASYNC_UNLINK;
+- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_UNLINK_BIT);
++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_UNLINK_BIT, &di->flags);
+ spin_unlock(&dentry->d_lock);
+
+ synchronize_rcu();
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 978acd3d4b329..d7b943feb9320 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -579,8 +579,7 @@ static void wake_async_create_waiters(struct inode *inode,
+
+ spin_lock(&ci->i_ceph_lock);
+ if (ci->i_ceph_flags & CEPH_I_ASYNC_CREATE) {
+- ci->i_ceph_flags &= ~CEPH_I_ASYNC_CREATE;
+- wake_up_bit(&ci->i_ceph_flags, CEPH_ASYNC_CREATE_BIT);
++ clear_and_wake_up_bit(CEPH_ASYNC_CREATE_BIT, &ci->i_ceph_flags);
+
+ if (ci->i_ceph_flags & CEPH_I_ASYNC_CHECK_CAPS) {
+ ci->i_ceph_flags &= ~CEPH_I_ASYNC_CHECK_CAPS;
+@@ -762,8 +761,7 @@ static int ceph_finish_async_create(struct inode *dir, struct inode *inode,
+ }
+
+ spin_lock(&dentry->d_lock);
+- di->flags &= ~CEPH_DENTRY_ASYNC_CREATE;
+- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_CREATE_BIT);
++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_CREATE_BIT, &di->flags);
+ spin_unlock(&dentry->d_lock);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From facbebb6e1420216c384564470ac0db9ba1f0e0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2024 17:47:17 +0200
+Subject: clk: at91: add ACR in all PLL settings
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit bfa2bddf6ffe0ac034d02cda20c74ef05571210e ]
+
+Add the ACR register to all PLL settings and provide the correct
+ACR value for each PLL used in different SoCs.
+
+Suggested-by: Mihai Sain <mihai.sain@microchip.com>
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+[nicolas.ferre@microchip.com: add sama7d65 and review commit message]
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/pmc.h | 1 +
+ drivers/clk/at91/sam9x60.c | 2 ++
+ drivers/clk/at91/sam9x7.c | 5 +++++
+ drivers/clk/at91/sama7d65.c | 4 ++++
+ drivers/clk/at91/sama7g5.c | 2 ++
+ 5 files changed, 14 insertions(+)
+
+diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h
+index 4fb29ca111f7d..5daa32c4cf254 100644
+--- a/drivers/clk/at91/pmc.h
++++ b/drivers/clk/at91/pmc.h
+@@ -80,6 +80,7 @@ struct clk_pll_characteristics {
+ u16 *icpll;
+ u8 *out;
+ u8 upll : 1;
++ u32 acr;
+ };
+
+ struct clk_programmable_layout {
+diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c
+index db6db9e2073eb..18baf4a256f47 100644
+--- a/drivers/clk/at91/sam9x60.c
++++ b/drivers/clk/at91/sam9x60.c
+@@ -36,6 +36,7 @@ static const struct clk_pll_characteristics plla_characteristics = {
+ .num_output = ARRAY_SIZE(plla_outputs),
+ .output = plla_outputs,
+ .core_output = core_outputs,
++ .acr = UL(0x00020010),
+ };
+
+ static const struct clk_range upll_outputs[] = {
+@@ -48,6 +49,7 @@ static const struct clk_pll_characteristics upll_characteristics = {
+ .output = upll_outputs,
+ .core_output = core_outputs,
+ .upll = true,
++ .acr = UL(0x12023010), /* fIN = [18 MHz, 32 MHz]*/
+ };
+
+ static const struct clk_pll_layout pll_frac_layout = {
+diff --git a/drivers/clk/at91/sam9x7.c b/drivers/clk/at91/sam9x7.c
+index ffab32b047a01..7322220418b45 100644
+--- a/drivers/clk/at91/sam9x7.c
++++ b/drivers/clk/at91/sam9x7.c
+@@ -107,6 +107,7 @@ static const struct clk_pll_characteristics plla_characteristics = {
+ .num_output = ARRAY_SIZE(plla_outputs),
+ .output = plla_outputs,
+ .core_output = plla_core_outputs,
++ .acr = UL(0x00020010), /* Old ACR_DEFAULT_PLLA value */
+ };
+
+ static const struct clk_pll_characteristics upll_characteristics = {
+@@ -115,6 +116,7 @@ static const struct clk_pll_characteristics upll_characteristics = {
+ .output = upll_outputs,
+ .core_output = upll_core_outputs,
+ .upll = true,
++ .acr = UL(0x12023010), /* fIN=[20 MHz, 32 MHz] */
+ };
+
+ static const struct clk_pll_characteristics lvdspll_characteristics = {
+@@ -122,6 +124,7 @@ static const struct clk_pll_characteristics lvdspll_characteristics = {
+ .num_output = ARRAY_SIZE(lvdspll_outputs),
+ .output = lvdspll_outputs,
+ .core_output = lvdspll_core_outputs,
++ .acr = UL(0x12023010), /* fIN=[20 MHz, 32 MHz] */
+ };
+
+ static const struct clk_pll_characteristics audiopll_characteristics = {
+@@ -129,6 +132,7 @@ static const struct clk_pll_characteristics audiopll_characteristics = {
+ .num_output = ARRAY_SIZE(audiopll_outputs),
+ .output = audiopll_outputs,
+ .core_output = audiopll_core_outputs,
++ .acr = UL(0x12023010), /* fIN=[20 MHz, 32 MHz] */
+ };
+
+ static const struct clk_pll_characteristics plladiv2_characteristics = {
+@@ -136,6 +140,7 @@ static const struct clk_pll_characteristics plladiv2_characteristics = {
+ .num_output = ARRAY_SIZE(plladiv2_outputs),
+ .output = plladiv2_outputs,
+ .core_output = plladiv2_core_outputs,
++ .acr = UL(0x00020010), /* Old ACR_DEFAULT_PLLA value */
+ };
+
+ /* Layout for fractional PLL ID PLLA. */
+diff --git a/drivers/clk/at91/sama7d65.c b/drivers/clk/at91/sama7d65.c
+index a5d40df8b2f27..7dee2b160ffb3 100644
+--- a/drivers/clk/at91/sama7d65.c
++++ b/drivers/clk/at91/sama7d65.c
+@@ -138,6 +138,7 @@ static const struct clk_pll_characteristics cpu_pll_characteristics = {
+ .num_output = ARRAY_SIZE(cpu_pll_outputs),
+ .output = cpu_pll_outputs,
+ .core_output = core_outputs,
++ .acr = UL(0x00070010),
+ };
+
+ /* PLL characteristics. */
+@@ -146,6 +147,7 @@ static const struct clk_pll_characteristics pll_characteristics = {
+ .num_output = ARRAY_SIZE(pll_outputs),
+ .output = pll_outputs,
+ .core_output = core_outputs,
++ .acr = UL(0x00070010),
+ };
+
+ static const struct clk_pll_characteristics lvdspll_characteristics = {
+@@ -153,6 +155,7 @@ static const struct clk_pll_characteristics lvdspll_characteristics = {
+ .num_output = ARRAY_SIZE(lvdspll_outputs),
+ .output = lvdspll_outputs,
+ .core_output = lvdspll_core_outputs,
++ .acr = UL(0x00070010),
+ };
+
+ static const struct clk_pll_characteristics upll_characteristics = {
+@@ -160,6 +163,7 @@ static const struct clk_pll_characteristics upll_characteristics = {
+ .num_output = ARRAY_SIZE(upll_outputs),
+ .output = upll_outputs,
+ .core_output = upll_core_outputs,
++ .acr = UL(0x12020010),
+ .upll = true,
+ };
+
+diff --git a/drivers/clk/at91/sama7g5.c b/drivers/clk/at91/sama7g5.c
+index 8385badc1c706..1340c2b006192 100644
+--- a/drivers/clk/at91/sama7g5.c
++++ b/drivers/clk/at91/sama7g5.c
+@@ -113,6 +113,7 @@ static const struct clk_pll_characteristics cpu_pll_characteristics = {
+ .num_output = ARRAY_SIZE(cpu_pll_outputs),
+ .output = cpu_pll_outputs,
+ .core_output = core_outputs,
++ .acr = UL(0x00070010),
+ };
+
+ /* PLL characteristics. */
+@@ -121,6 +122,7 @@ static const struct clk_pll_characteristics pll_characteristics = {
+ .num_output = ARRAY_SIZE(pll_outputs),
+ .output = pll_outputs,
+ .core_output = core_outputs,
++ .acr = UL(0x00070010),
+ };
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 33e888bab078071c138d0e2b7342c3aed3a1b3c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 13:07:17 -0700
+Subject: clk: at91: clk-master: Add check for divide by 3
+
+From: Ryan Wanner <Ryan.Wanner@microchip.com>
+
+[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ]
+
+A potential divider for the master clock is div/3. The register
+configuration for div/3 is MASTER_PRES_MAX. The current bit shifting
+method does not work for this case. Checking for MASTER_PRES_MAX will
+ensure the correct decimal value is stored in the system.
+
+Signed-off-by: Ryan Wanner <Ryan.Wanner@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-master.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
+index 7a544e429d34e..d5ea2069ec83a 100644
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -580,6 +580,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw,
+ {
+ struct clk_master *master = to_clk_master(hw);
+
++ if (master->div == MASTER_PRES_MAX)
++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3);
++
+ return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div));
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a0c2d76e9a64f7351fffe9fcd9a1a8855fc9541a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:08:10 +0200
+Subject: clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 ]
+
+This register is important for sequencing the commands to PLLs, so
+actually write the update bits with regmap_write_bits() instead of
+relying on a read/modify/write regmap command that could skip the actual
+hardware write if the value is identical to the one read.
+
+It's changed when modification is needed to the PLL, when
+read-only operation is done, we could keep the call to
+regmap_update_bits().
+
+Add a comment to the sam9x60_div_pll_set_div() function that uses this
+PLL_UPDT register so that it's used consistently, according to the
+product's datasheet.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Tested-by: Ryan Wanner <ryan.wanner@microchip.com> # on sama7d65 and sam9x75
+Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com
+[claudiu.beznea: fix "Alignment should match open parenthesis"
+ checkpatch.pl check]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-sam9x60-pll.c | 75 ++++++++++++++++--------------
+ 1 file changed, 39 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c
+index cefd9948e1039..a035dc15454b0 100644
+--- a/drivers/clk/at91/clk-sam9x60-pll.c
++++ b/drivers/clk/at91/clk-sam9x60-pll.c
+@@ -93,8 +93,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
+ cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
+ cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
+@@ -128,17 +128,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
+ udelay(10);
+ }
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -164,8 +164,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0);
+
+@@ -173,9 +173,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
+ regmap_update_bits(regmap, AT91_PMC_PLL_ACR,
+ AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ spin_unlock_irqrestore(core->lock, flags);
+ }
+@@ -262,8 +262,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+
+ spin_lock_irqsave(core->lock, irqflags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
+ cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
+ cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
+@@ -275,18 +275,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+ (frac->mul << core->layout->mul_shift) |
+ (frac->frac << core->layout->frac_shift));
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
+ AT91_PMC_PLL_CTRL0_ENLOCK |
+ AT91_PMC_PLL_CTRL0_ENPLL);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -338,7 +338,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = {
+ .restore_context = sam9x60_frac_pll_restore_context,
+ };
+
+-/* This function should be called with spinlock acquired. */
++/* This function should be called with spinlock acquired.
++ * Warning: this function must be called only if the same PLL ID was set in
++ * PLL_UPDT register previously.
++ */
+ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
+ bool enable)
+ {
+@@ -350,9 +353,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
+ core->layout->div_mask | ena_msk,
+ (div << core->layout->div_shift) | ena_val);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -366,8 +369,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core)
+ unsigned int val, cdiv;
+
+ spin_lock_irqsave(core->lock, flags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
+
+@@ -398,15 +401,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ core->layout->endiv_mask, 0);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ spin_unlock_irqrestore(core->lock, flags);
+ }
+@@ -518,8 +521,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+ div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1;
+
+ spin_lock_irqsave(core->lock, irqflags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
+
+@@ -574,8 +577,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier,
+ div->div = div->safe_div;
+
+ spin_lock_irqsave(core.lock, irqflags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core.id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core.id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core.layout->div_mask) >> core.layout->div_shift;
+
+--
+2.51.0
+
--- /dev/null
+From d86499862e80a6179c1c831f1adb05bd96767203 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:08:17 +0530
+Subject: clk: at91: sam9x7: Add peripheral clock id for pmecc
+
+From: Balamanikandan Gunasundar <balamanikandan.gunasundar@microchip.com>
+
+[ Upstream commit 94a1274100e397a27361ae53ace37be6da42a079 ]
+
+Add pmecc instance id in peripheral clock description.
+
+Signed-off-by: Balamanikandan Gunasundar <balamanikandan.gunasundar@microchip.com>
+Link: https://lore.kernel.org/r/20250909103817.49334-1-balamanikandan.gunasundar@microchip.com
+[claudiu.beznea@tuxon.dev: use tabs instead of spaces]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/sam9x7.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/at91/sam9x7.c b/drivers/clk/at91/sam9x7.c
+index 7322220418b45..89868a0aeaba9 100644
+--- a/drivers/clk/at91/sam9x7.c
++++ b/drivers/clk/at91/sam9x7.c
+@@ -408,6 +408,7 @@ static const struct {
+ { .n = "pioD_clk", .id = 44, },
+ { .n = "tcb1_clk", .id = 45, },
+ { .n = "dbgu_clk", .id = 47, },
++ { .n = "pmecc_clk", .id = 48, },
+ /*
+ * mpddr_clk feeds DDR controller and is enabled by bootloader thus we
+ * need to keep it enabled in case there is no Linux consumer for it.
+--
+2.51.0
+
--- /dev/null
+From 999022ab0502c6fdc7cf7419bfefb796a050b7ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 14:40:02 +0530
+Subject: clk: clocking-wizard: Fix output clock register offset for Versal
+ platforms
+
+From: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+
+[ Upstream commit 7c2e86f7b5af93d0e78c16e4359318fe7797671d ]
+
+The output clock register offset used in clk_wzrd_register_output_clocks
+was incorrectly referencing 0x3C instead of 0x38, which caused
+misconfiguration of output dividers on Versal platforms.
+
+Correcting the off-by-one error ensures proper configuration of output
+clocks.
+
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+index 0295a13a811cf..f209a02e82725 100644
+--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
++++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+@@ -1108,7 +1108,7 @@ static int clk_wzrd_register_output_clocks(struct device *dev, int nr_outputs)
+ (dev,
+ clkout_name, clk_name, 0,
+ clk_wzrd->base,
+- (WZRD_CLK_CFG_REG(is_versal, 3) + i * 8),
++ (WZRD_CLK_CFG_REG(is_versal, 2) + i * 8),
+ WZRD_CLKOUT_DIVIDE_SHIFT,
+ WZRD_CLKOUT_DIVIDE_WIDTH,
+ CLK_DIVIDER_ONE_BASED |
+--
+2.51.0
+
--- /dev/null
+From 411bed4e1ae37f0ded589cb6d506a80b705a6d43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 12:55:46 +0300
+Subject: clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marko Mäkelä <marko.makela@iki.fi>
+
+[ Upstream commit 2f7b168323c22faafb1fbf94ef93b7ce5efc15c6 ]
+
+Rework nss_port5 to use the new multiple configuration implementation
+and correctly fix the clocks for this port under some corner case.
+
+In OpenWrt, this patch avoids intermittent dmesg errors of the form
+nss_port5_rx_clk_src: rcg didn't update its configuration.
+
+This is a mechanical, straightforward port of
+commit e88f03230dc07aa3293b6aeb078bd27370bb2594
+("clk: qcom: gcc-ipq8074: rework nss_port5/6 clock to multiple conf")
+to gcc-ipq6018, with two conflicts resolved: different frequency of the
+P_XO clock source, and only 5 Ethernet ports.
+
+This was originally developed by JiaY-shi <shi05275@163.com>.
+
+Link: https://lore.kernel.org/all/20231220221724.3822-4-ansuelsmth@gmail.com/
+Signed-off-by: Marko Mäkelä <marko.makela@iki.fi>
+Tested-by: Marko Mäkelä <marko.makela@iki.fi>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250802095546.295448-1-marko.makela@iki.fi
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq6018.c | 60 +++++++++++++++++++++-------------
+ 1 file changed, 38 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
+index d861191b0c85c..d4fc491a18b22 100644
+--- a/drivers/clk/qcom/gcc-ipq6018.c
++++ b/drivers/clk/qcom/gcc-ipq6018.c
+@@ -511,15 +511,23 @@ static struct clk_rcg2 apss_ahb_clk_src = {
+ },
+ };
+
+-static const struct freq_tbl ftbl_nss_port5_rx_clk_src[] = {
+- F(24000000, P_XO, 1, 0, 0),
+- F(25000000, P_UNIPHY1_RX, 12.5, 0, 0),
+- F(25000000, P_UNIPHY0_RX, 5, 0, 0),
+- F(78125000, P_UNIPHY1_RX, 4, 0, 0),
+- F(125000000, P_UNIPHY1_RX, 2.5, 0, 0),
+- F(125000000, P_UNIPHY0_RX, 1, 0, 0),
+- F(156250000, P_UNIPHY1_RX, 2, 0, 0),
+- F(312500000, P_UNIPHY1_RX, 1, 0, 0),
++static const struct freq_conf ftbl_nss_port5_rx_clk_src_25[] = {
++ C(P_UNIPHY1_RX, 12.5, 0, 0),
++ C(P_UNIPHY0_RX, 5, 0, 0),
++};
++
++static const struct freq_conf ftbl_nss_port5_rx_clk_src_125[] = {
++ C(P_UNIPHY1_RX, 2.5, 0, 0),
++ C(P_UNIPHY0_RX, 1, 0, 0),
++};
++
++static const struct freq_multi_tbl ftbl_nss_port5_rx_clk_src[] = {
++ FMS(24000000, P_XO, 1, 0, 0),
++ FM(25000000, ftbl_nss_port5_rx_clk_src_25),
++ FMS(78125000, P_UNIPHY1_RX, 4, 0, 0),
++ FM(125000000, ftbl_nss_port5_rx_clk_src_125),
++ FMS(156250000, P_UNIPHY1_RX, 2, 0, 0),
++ FMS(312500000, P_UNIPHY1_RX, 1, 0, 0),
+ { }
+ };
+
+@@ -547,26 +555,34 @@ gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map[] = {
+
+ static struct clk_rcg2 nss_port5_rx_clk_src = {
+ .cmd_rcgr = 0x68060,
+- .freq_tbl = ftbl_nss_port5_rx_clk_src,
++ .freq_multi_tbl = ftbl_nss_port5_rx_clk_src,
+ .hid_width = 5,
+ .parent_map = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias_map,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "nss_port5_rx_clk_src",
+ .parent_data = gcc_xo_uniphy0_rx_tx_uniphy1_rx_tx_ubi32_bias,
+ .num_parents = 7,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_fm_ops,
+ },
+ };
+
+-static const struct freq_tbl ftbl_nss_port5_tx_clk_src[] = {
+- F(24000000, P_XO, 1, 0, 0),
+- F(25000000, P_UNIPHY1_TX, 12.5, 0, 0),
+- F(25000000, P_UNIPHY0_TX, 5, 0, 0),
+- F(78125000, P_UNIPHY1_TX, 4, 0, 0),
+- F(125000000, P_UNIPHY1_TX, 2.5, 0, 0),
+- F(125000000, P_UNIPHY0_TX, 1, 0, 0),
+- F(156250000, P_UNIPHY1_TX, 2, 0, 0),
+- F(312500000, P_UNIPHY1_TX, 1, 0, 0),
++static const struct freq_conf ftbl_nss_port5_tx_clk_src_25[] = {
++ C(P_UNIPHY1_TX, 12.5, 0, 0),
++ C(P_UNIPHY0_TX, 5, 0, 0),
++};
++
++static const struct freq_conf ftbl_nss_port5_tx_clk_src_125[] = {
++ C(P_UNIPHY1_TX, 2.5, 0, 0),
++ C(P_UNIPHY0_TX, 1, 0, 0),
++};
++
++static const struct freq_multi_tbl ftbl_nss_port5_tx_clk_src[] = {
++ FMS(24000000, P_XO, 1, 0, 0),
++ FM(25000000, ftbl_nss_port5_tx_clk_src_25),
++ FMS(78125000, P_UNIPHY1_TX, 4, 0, 0),
++ FM(125000000, ftbl_nss_port5_tx_clk_src_125),
++ FMS(156250000, P_UNIPHY1_TX, 2, 0, 0),
++ FMS(312500000, P_UNIPHY1_TX, 1, 0, 0),
+ { }
+ };
+
+@@ -594,14 +610,14 @@ gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map[] = {
+
+ static struct clk_rcg2 nss_port5_tx_clk_src = {
+ .cmd_rcgr = 0x68068,
+- .freq_tbl = ftbl_nss_port5_tx_clk_src,
++ .freq_multi_tbl = ftbl_nss_port5_tx_clk_src,
+ .hid_width = 5,
+ .parent_map = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias_map,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "nss_port5_tx_clk_src",
+ .parent_data = gcc_xo_uniphy0_tx_rx_uniphy1_tx_rx_ubi32_bias,
+ .num_parents = 7,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_fm_ops,
+ },
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 1169d9f7d2800ebdafbe279c345706864ad2f4af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:27:52 +0200
+Subject: clk: renesas: rzv2h: Re-assert reset on deassert timeout
+
+From: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
+
+[ Upstream commit f8c002165ca27d95d3d15e865dd0a47c0a1b14dd ]
+
+Prevent issues during reset deassertion by re-asserting the reset if a
+timeout occurs when trying to deassert. This ensures the reset line is in a
+known state and improves reliability for hardware that may not immediately
+clear the reset monitor bit.
+
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
+Link: https://lore.kernel.org/20250903082757.115778-4-tommaso.merciai.xr@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzv2h-cpg.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzv2h-cpg.c b/drivers/clk/renesas/rzv2h-cpg.c
+index f468afbb54e2d..5dfe660d13422 100644
+--- a/drivers/clk/renesas/rzv2h-cpg.c
++++ b/drivers/clk/renesas/rzv2h-cpg.c
+@@ -864,6 +864,7 @@ static int __rzv2h_cpg_assert(struct reset_controller_dev *rcdev,
+ u32 mask = BIT(priv->resets[id].reset_bit);
+ u8 monbit = priv->resets[id].mon_bit;
+ u32 value = mask << 16;
++ int ret;
+
+ dev_dbg(rcdev->dev, "%s id:%ld offset:0x%x\n",
+ assert ? "assert" : "deassert", id, reg);
+@@ -875,9 +876,15 @@ static int __rzv2h_cpg_assert(struct reset_controller_dev *rcdev,
+ reg = GET_RST_MON_OFFSET(priv->resets[id].mon_index);
+ mask = BIT(monbit);
+
+- return readl_poll_timeout_atomic(priv->base + reg, value,
+- assert ? (value & mask) : !(value & mask),
+- 10, 200);
++ ret = readl_poll_timeout_atomic(priv->base + reg, value,
++ assert ? (value & mask) : !(value & mask),
++ 10, 200);
++ if (ret && !assert) {
++ value = mask << 16;
++ writel(value, priv->base + GET_RST_OFFSET(priv->resets[id].reset_index));
++ }
++
++ return ret;
+ }
+
+ static int rzv2h_cpg_assert(struct reset_controller_dev *rcdev,
+--
+2.51.0
+
--- /dev/null
+From f88345c028a79304262b8550c5283b834ae19265 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:13:16 +0000
+Subject: clk: samsung: exynos990: Add missing USB clock registers to HSI0
+
+From: Denzeel Oliva <wachiturroxd150@gmail.com>
+
+[ Upstream commit f00a5dc81744250e7a3f843adfe12d7883282c56 ]
+
+These registers are required for proper USB operation and were omitted
+in the initial clock controller setup.
+
+Signed-off-by: Denzeel Oliva <wachiturroxd150@gmail.com>
+Link: https://lore.kernel.org/r/20250831-usb-v2-3-00b9c0559733@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos990.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos990.c b/drivers/clk/samsung/clk-exynos990.c
+index 8571c225d0907..7cf5932e914c2 100644
+--- a/drivers/clk/samsung/clk-exynos990.c
++++ b/drivers/clk/samsung/clk-exynos990.c
+@@ -1198,6 +1198,8 @@ static const unsigned long hsi0_clk_regs[] __initconst = {
+ CLK_CON_GAT_GOUT_BLK_HSI0_UID_SYSMMU_USB_IPCLKPORT_CLK_S2,
+ CLK_CON_GAT_GOUT_BLK_HSI0_UID_SYSREG_HSI0_IPCLKPORT_PCLK,
+ CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_ACLK_PHYCTRL,
++ CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_I_USB31DRD_REF_CLK_40,
++ CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_I_USBDPPHY_REF_SOC_PLL,
+ CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_I_USBDPPHY_SCL_APB_PCLK,
+ CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_I_USBPCS_APB_CLK,
+ CLK_CON_GAT_GOUT_BLK_HSI0_UID_USB31DRD_IPCLKPORT_BUS_CLK_EARLY,
+--
+2.51.0
+
--- /dev/null
+From 718368b8a0b84518ddba41bacb089912288c523b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:04:46 +0800
+Subject: clk: scmi: Add duty cycle ops only when duty cycle is supported
+
+From: Jacky Bai <ping.bai@nxp.com>
+
+[ Upstream commit 18db1ff2dea0f97dedaeadd18b0cb0a0d76154df ]
+
+For some of the SCMI based platforms, the oem extended config may be
+supported, but not for duty cycle purpose. Skip the duty cycle ops if
+err return when trying to get duty cycle info.
+
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-scmi.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c
+index d2408403283fc..c2f3ef4e58fe3 100644
+--- a/drivers/clk/clk-scmi.c
++++ b/drivers/clk/clk-scmi.c
+@@ -349,6 +349,8 @@ scmi_clk_ops_select(struct scmi_clk *sclk, bool atomic_capable,
+ unsigned int atomic_threshold_us,
+ const struct clk_ops **clk_ops_db, size_t db_size)
+ {
++ int ret;
++ u32 val;
+ const struct scmi_clock_info *ci = sclk->info;
+ unsigned int feats_key = 0;
+ const struct clk_ops *ops;
+@@ -370,8 +372,13 @@ scmi_clk_ops_select(struct scmi_clk *sclk, bool atomic_capable,
+ if (!ci->parent_ctrl_forbidden)
+ feats_key |= BIT(SCMI_CLK_PARENT_CTRL_SUPPORTED);
+
+- if (ci->extended_config)
+- feats_key |= BIT(SCMI_CLK_DUTY_CYCLE_SUPPORTED);
++ if (ci->extended_config) {
++ ret = scmi_proto_clk_ops->config_oem_get(sclk->ph, sclk->id,
++ SCMI_CLOCK_CFG_DUTY_CYCLE,
++ &val, NULL, false);
++ if (!ret)
++ feats_key |= BIT(SCMI_CLK_DUTY_CYCLE_SUPPORTED);
++ }
+
+ if (WARN_ON(feats_key >= db_size))
+ return NULL;
+--
+2.51.0
+
--- /dev/null
+From 05b641e708818297c08f71c7785f25d2a0b34007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 01:09:47 +0800
+Subject: clk: sunxi-ng: sun6i-rtc: Add A523 specifics
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ]
+
+The A523's RTC block is backward compatible with the R329's, but it also
+has a calibration function for its internal oscillator, which would
+allow it to provide a clock rate closer to the desired 32.768 KHz. This
+is useful on the Radxa Cubie A5E, which does not have an external 32.768
+KHz crystal.
+
+Add new compatible-specific data for it.
+
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
+index 0536e880b80fe..f6bfeba009e8e 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
++++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
+@@ -325,6 +325,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = {
+ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
+ };
+
++static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = {
++ .have_ext_osc32k = true,
++ .have_iosc_calibration = true,
++ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents,
++ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
++};
++
+ static const struct of_device_id sun6i_rtc_ccu_match[] = {
+ {
+ .compatible = "allwinner,sun50i-h616-rtc",
+@@ -334,6 +341,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = {
+ .compatible = "allwinner,sun50i-r329-rtc",
+ .data = &sun50i_r329_rtc_ccu_data,
+ },
++ {
++ .compatible = "allwinner,sun55i-a523-rtc",
++ .data = &sun55i_a523_rtc_ccu_data,
++ },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, sun6i_rtc_ccu_match);
+--
+2.51.0
+
--- /dev/null
+From aca627083aa4a62368013eda6cddd86b0ddf4436 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 17:11:13 +0800
+Subject: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL
+
+From: Icenowy Zheng <uwu@icenowy.me>
+
+[ Upstream commit c567bc5fc68c4388c00e11fc65fd14fe86b52070 ]
+
+The AXI crossbar of TH1520 has no proper timeout handling, which means
+gating AXI clocks can easily lead to bus timeout and thus system hang.
+
+Set all AXI clock gates to CLK_IS_CRITICAL. All these clock gates are
+ungated by default on system reset.
+
+In addition, convert all current CLK_IGNORE_UNUSED usage to
+CLK_IS_CRITICAL to prevent unwanted clock gating.
+
+Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
+Reviewed-by: Drew Fustini <fustini@kernel.org>
+Signed-off-by: Drew Fustini <fustini@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/thead/clk-th1520-ap.c | 44 +++++++++++++++----------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c
+index ec52726fbea95..6c1976aa1ae62 100644
+--- a/drivers/clk/thead/clk-th1520-ap.c
++++ b/drivers/clk/thead/clk-th1520-ap.c
+@@ -480,7 +480,7 @@ static struct ccu_div axi4_cpusys2_aclk = {
+ .hw.init = CLK_HW_INIT_PARENTS_HW("axi4-cpusys2-aclk",
+ gmac_pll_clk_parent,
+ &ccu_div_ops,
+- 0),
++ CLK_IS_CRITICAL),
+ },
+ };
+
+@@ -502,7 +502,7 @@ static struct ccu_div axi_aclk = {
+ .hw.init = CLK_HW_INIT_PARENTS_DATA("axi-aclk",
+ axi_parents,
+ &ccu_div_ops,
+- 0),
++ CLK_IS_CRITICAL),
+ },
+ };
+
+@@ -651,7 +651,7 @@ static struct ccu_div apb_pclk = {
+ .hw.init = CLK_HW_INIT_PARENTS_DATA("apb-pclk",
+ apb_parents,
+ &ccu_div_ops,
+- CLK_IGNORE_UNUSED),
++ CLK_IS_CRITICAL),
+ },
+ };
+
+@@ -682,7 +682,7 @@ static struct ccu_div vi_clk = {
+ .hw.init = CLK_HW_INIT_PARENTS_HW("vi",
+ video_pll_clk_parent,
+ &ccu_div_ops,
+- 0),
++ CLK_IS_CRITICAL),
+ },
+ };
+
+@@ -707,7 +707,7 @@ static struct ccu_div vo_axi_clk = {
+ .hw.init = CLK_HW_INIT_PARENTS_HW("vo-axi",
+ video_pll_clk_parent,
+ &ccu_div_ops,
+- 0),
++ CLK_IS_CRITICAL),
+ },
+ };
+
+@@ -732,7 +732,7 @@ static struct ccu_div vp_axi_clk = {
+ .hw.init = CLK_HW_INIT_PARENTS_HW("vp-axi",
+ video_pll_clk_parent,
+ &ccu_div_ops,
+- CLK_IGNORE_UNUSED),
++ CLK_IS_CRITICAL),
+ },
+ };
+
+@@ -791,27 +791,27 @@ static const struct clk_parent_data emmc_sdio_ref_clk_pd[] = {
+ static CCU_GATE(CLK_BROM, brom_clk, "brom", ahb2_cpusys_hclk_pd, 0x100, 4, 0);
+ static CCU_GATE(CLK_BMU, bmu_clk, "bmu", axi4_cpusys2_aclk_pd, 0x100, 5, 0);
+ static CCU_GATE(CLK_AON2CPU_A2X, aon2cpu_a2x_clk, "aon2cpu-a2x", axi4_cpusys2_aclk_pd,
+- 0x134, 8, 0);
++ 0x134, 8, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_X2X_CPUSYS, x2x_cpusys_clk, "x2x-cpusys", axi4_cpusys2_aclk_pd,
+- 0x134, 7, 0);
++ 0x134, 7, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_CPU2AON_X2H, cpu2aon_x2h_clk, "cpu2aon-x2h", axi_aclk_pd,
+- 0x138, 8, CLK_IGNORE_UNUSED);
++ 0x138, 8, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_CPU2PERI_X2H, cpu2peri_x2h_clk, "cpu2peri-x2h", axi4_cpusys2_aclk_pd,
+- 0x140, 9, CLK_IGNORE_UNUSED);
++ 0x140, 9, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_PERISYS_APB1_HCLK, perisys_apb1_hclk, "perisys-apb1-hclk", perisys_ahb_hclk_pd,
+- 0x150, 9, CLK_IGNORE_UNUSED);
++ 0x150, 9, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_PERISYS_APB2_HCLK, perisys_apb2_hclk, "perisys-apb2-hclk", perisys_ahb_hclk_pd,
+- 0x150, 10, CLK_IGNORE_UNUSED);
++ 0x150, 10, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", perisys_ahb_hclk_pd,
+- 0x150, 11, CLK_IGNORE_UNUSED);
++ 0x150, 11, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", perisys_ahb_hclk_pd,
+ 0x150, 12, 0);
+ static const struct clk_parent_data perisys_apb4_hclk_pd[] = {
+ { .hw = &perisys_apb4_hclk.gate.hw },
+ };
+
+-static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, 0);
+-static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, 0);
++static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, CLK_IS_CRITICAL);
++static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, 30, 0);
+ static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, 26, 0);
+ static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, 24, 0);
+@@ -855,11 +855,11 @@ static CCU_GATE(CLK_SRAM2, sram2_clk, "sram2", axi_aclk_pd, 0x20c, 2, 0);
+ static CCU_GATE(CLK_SRAM3, sram3_clk, "sram3", axi_aclk_pd, 0x20c, 1, 0);
+
+ static CCU_GATE(CLK_AXI4_VO_ACLK, axi4_vo_aclk, "axi4-vo-aclk",
+- video_pll_clk_pd, 0x0, 0, 0);
++ video_pll_clk_pd, 0x0, 0, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_GPU_CORE, gpu_core_clk, "gpu-core-clk", video_pll_clk_pd,
+ 0x0, 3, 0);
+ static CCU_GATE(CLK_GPU_CFG_ACLK, gpu_cfg_aclk, "gpu-cfg-aclk",
+- video_pll_clk_pd, 0x0, 4, 0);
++ video_pll_clk_pd, 0x0, 4, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_DPU_PIXELCLK0, dpu0_pixelclk, "dpu0-pixelclk",
+ dpu0_clk_pd, 0x0, 5, 0);
+ static CCU_GATE(CLK_DPU_PIXELCLK1, dpu1_pixelclk, "dpu1-pixelclk",
+@@ -891,9 +891,9 @@ static CCU_GATE(CLK_MIPI_DSI1_REFCLK, mipi_dsi1_refclk, "mipi-dsi1-refclk",
+ static CCU_GATE(CLK_HDMI_I2S, hdmi_i2s_clk, "hdmi-i2s-clk", video_pll_clk_pd,
+ 0x0, 19, 0);
+ static CCU_GATE(CLK_X2H_DPU1_ACLK, x2h_dpu1_aclk, "x2h-dpu1-aclk",
+- video_pll_clk_pd, 0x0, 20, 0);
++ video_pll_clk_pd, 0x0, 20, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_X2H_DPU_ACLK, x2h_dpu_aclk, "x2h-dpu-aclk",
+- video_pll_clk_pd, 0x0, 21, 0);
++ video_pll_clk_pd, 0x0, 21, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_AXI4_VO_PCLK, axi4_vo_pclk, "axi4-vo-pclk",
+ video_pll_clk_pd, 0x0, 22, 0);
+ static CCU_GATE(CLK_IOPMP_VOSYS_DPU_PCLK, iopmp_vosys_dpu_pclk,
+@@ -903,11 +903,11 @@ static CCU_GATE(CLK_IOPMP_VOSYS_DPU1_PCLK, iopmp_vosys_dpu1_pclk,
+ static CCU_GATE(CLK_IOPMP_VOSYS_GPU_PCLK, iopmp_vosys_gpu_pclk,
+ "iopmp-vosys-gpu-pclk", video_pll_clk_pd, 0x0, 25, 0);
+ static CCU_GATE(CLK_IOPMP_DPU1_ACLK, iopmp_dpu1_aclk, "iopmp-dpu1-aclk",
+- video_pll_clk_pd, 0x0, 27, 0);
++ video_pll_clk_pd, 0x0, 27, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_IOPMP_DPU_ACLK, iopmp_dpu_aclk, "iopmp-dpu-aclk",
+- video_pll_clk_pd, 0x0, 28, 0);
++ video_pll_clk_pd, 0x0, 28, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_IOPMP_GPU_ACLK, iopmp_gpu_aclk, "iopmp-gpu-aclk",
+- video_pll_clk_pd, 0x0, 29, 0);
++ video_pll_clk_pd, 0x0, 29, CLK_IS_CRITICAL);
+ static CCU_GATE(CLK_MIPIDSI0_PIXCLK, mipi_dsi0_pixclk, "mipi-dsi0-pixclk",
+ video_pll_clk_pd, 0x0, 30, 0);
+ static CCU_GATE(CLK_MIPIDSI1_PIXCLK, mipi_dsi1_pixclk, "mipi-dsi1-pixclk",
+--
+2.51.0
+
--- /dev/null
+From 4848d59d2beea598f34d0e7a6901eb1a8bd49fa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 16:08:11 +0200
+Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ]
+
+As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL
+can't be disabled - the clock module will just be stuck in transitioning
+state forever, resulting in the following warning message after the wait
+loop times out:
+
+ l3-aon-clkctrl:0000:0: failed to disable
+
+Just add the clock to enable_init_clks, so no attempt is made to disable
+it.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-33xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c
+index 85c50ea39e6da..9269e6a0db6a4 100644
+--- a/drivers/clk/ti/clk-33xx.c
++++ b/drivers/clk/ti/clk-33xx.c
+@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = {
+ "dpll_ddr_m2_ck",
+ "dpll_mpu_m2_ck",
+ "l3_gclk",
++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */
++ "l3-aon-clkctrl:0000:0",
+ /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */
+ "l3-clkctrl:00bc:0",
+ "l4hs_gclk",
+--
+2.51.0
+
--- /dev/null
+From b19eca3f89f34995584b9dee6d79f1fbf3bfcb31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 19:48:45 +0000
+Subject: clocksource: hyper-v: Skip unnecessary checks for the root partition
+
+From: Wei Liu <wei.liu@kernel.org>
+
+[ Upstream commit 47691ced158ab3a7ce2189b857b19c0c99a9aa80 ]
+
+The HV_ACCESS_TSC_INVARIANT bit is always zero when Linux runs as the
+root partition. The root partition will see directly what the hardware
+provides.
+
+The old logic in ms_hyperv_init_platform caused the native TSC clock
+source to be incorrectly marked as unstable on x86. Fix it.
+
+Skip the unnecessary checks in code for the root partition. Add one
+extra comment in code to clarify the behavior.
+
+Reviewed-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mshyperv.c | 11 ++++++++++-
+ drivers/clocksource/hyperv_timer.c | 10 +++++++++-
+ 2 files changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index c78f860419d69..25773af116bc4 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -565,6 +565,11 @@ static void __init ms_hyperv_init_platform(void)
+ machine_ops.crash_shutdown = hv_machine_crash_shutdown;
+ #endif
+ #endif
++ /*
++ * HV_ACCESS_TSC_INVARIANT is always zero for the root partition. Root
++ * partition doesn't need to write to synthetic MSR to enable invariant
++ * TSC feature. It sees what the hardware provides.
++ */
+ if (ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) {
+ /*
+ * Writing to synthetic MSR 0x40000118 updates/changes the
+@@ -636,8 +641,12 @@ static void __init ms_hyperv_init_platform(void)
+ * TSC should be marked as unstable only after Hyper-V
+ * clocksource has been initialized. This ensures that the
+ * stability of the sched_clock is not altered.
++ *
++ * HV_ACCESS_TSC_INVARIANT is always zero for the root partition. No
++ * need to check for it.
+ */
+- if (!(ms_hyperv.features & HV_ACCESS_TSC_INVARIANT))
++ if (!hv_root_partition() &&
++ !(ms_hyperv.features & HV_ACCESS_TSC_INVARIANT))
+ mark_tsc_unstable("running on Hyper-V");
+
+ hardlockup_detector_disable();
+diff --git a/drivers/clocksource/hyperv_timer.c b/drivers/clocksource/hyperv_timer.c
+index 2edc13ca184e0..10356d4ec55c3 100644
+--- a/drivers/clocksource/hyperv_timer.c
++++ b/drivers/clocksource/hyperv_timer.c
+@@ -549,14 +549,22 @@ static void __init hv_init_tsc_clocksource(void)
+ union hv_reference_tsc_msr tsc_msr;
+
+ /*
++ * When running as a guest partition:
++ *
+ * If Hyper-V offers TSC_INVARIANT, then the virtualized TSC correctly
+ * handles frequency and offset changes due to live migration,
+ * pause/resume, and other VM management operations. So lower the
+ * Hyper-V Reference TSC rating, causing the generic TSC to be used.
+ * TSC_INVARIANT is not offered on ARM64, so the Hyper-V Reference
+ * TSC will be preferred over the virtualized ARM64 arch counter.
++ *
++ * When running as the root partition:
++ *
++ * There is no HV_ACCESS_TSC_INVARIANT feature. Always lower the rating
++ * of the Hyper-V Reference TSC.
+ */
+- if (ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) {
++ if ((ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) ||
++ hv_root_partition()) {
+ hyperv_cs_tsc.rating = 250;
+ hyperv_cs_msr.rating = 245;
+ }
+--
+2.51.0
+
--- /dev/null
+From 28d274bd1026ac24302492350394a92ad321ea36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:13 -0500
+Subject: cpufreq: tegra186: Initialize all cores to max frequencies
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ]
+
+During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores
+are still at reset values and not reflecting the actual frequency. This
+causes get calls to fail. Set all cores to their respective max
+frequency during probe to initialize the registers to working values.
+
+Suggested-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index 6c394b429b618..bd94beebc4cc2 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -138,13 +138,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = {
+
+ static struct cpufreq_frequency_table *init_vhint_table(
+ struct platform_device *pdev, struct tegra_bpmp *bpmp,
+- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id)
++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id,
++ int *num_rates)
+ {
+ struct cpufreq_frequency_table *table;
+ struct mrq_cpu_vhint_request req;
+ struct tegra_bpmp_message msg;
+ struct cpu_vhint_data *data;
+- int err, i, j, num_rates = 0;
++ int err, i, j;
+ dma_addr_t phys;
+ void *virt;
+
+@@ -174,6 +175,7 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ goto free;
+ }
+
++ *num_rates = 0;
+ for (i = data->vfloor; i <= data->vceil; i++) {
+ u16 ndiv = data->ndiv[i];
+
+@@ -184,10 +186,10 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ if (i > 0 && ndiv == data->ndiv[i - 1])
+ continue;
+
+- num_rates++;
++ (*num_rates)++;
+ }
+
+- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table),
++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table),
+ GFP_KERNEL);
+ if (!table) {
+ table = ERR_PTR(-ENOMEM);
+@@ -229,7 +231,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ {
+ struct tegra186_cpufreq_data *data;
+ struct tegra_bpmp *bpmp;
+- unsigned int i = 0, err;
++ unsigned int i = 0, err, edvd_offset;
++ int num_rates = 0;
++ u32 edvd_val, cpu;
+
+ data = devm_kzalloc(&pdev->dev,
+ struct_size(data, clusters, TEGRA186_NUM_CLUSTERS),
+@@ -252,10 +256,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) {
+ struct tegra186_cpufreq_cluster *cluster = &data->clusters[i];
+
+- cluster->table = init_vhint_table(pdev, bpmp, cluster, i);
++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates);
+ if (IS_ERR(cluster->table)) {
+ err = PTR_ERR(cluster->table);
+ goto put_bpmp;
++ } else if (!num_rates) {
++ err = -EINVAL;
++ goto put_bpmp;
++ }
++
++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) {
++ if (data->cpus[cpu].bpmp_cluster_id == i) {
++ edvd_val = cluster->table[num_rates - 1].driver_data;
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d33ea2fd00fee90d06b5f4dd65ece6a6eee4588e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 10:39:03 +0530
+Subject: drm/amdgpu: Report individual reset error
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 2e97663760e5fb7ee14f399c68e57b894f01e505 ]
+
+If reinitialization of one of the GPUs fails after reset, it logs
+failure on all subsequent GPUs eventhough they have resumed
+successfully.
+
+A sample log where only device at 0000:95:00.0 had a failure -
+
+ amdgpu 0000:15:00.0: amdgpu: GPU reset(19) succeeded!
+ amdgpu 0000:65:00.0: amdgpu: GPU reset(19) succeeded!
+ amdgpu 0000:75:00.0: amdgpu: GPU reset(19) succeeded!
+ amdgpu 0000:85:00.0: amdgpu: GPU reset(19) succeeded!
+ amdgpu 0000:95:00.0: amdgpu: GPU reset(19) failed
+ amdgpu 0000:e5:00.0: amdgpu: GPU reset(19) failed
+ amdgpu 0000:f5:00.0: amdgpu: GPU reset(19) failed
+ amdgpu 0000:05:00.0: amdgpu: GPU reset(19) failed
+ amdgpu 0000:15:00.0: amdgpu: GPU reset end with ret = -5
+
+To avoid confusion, report the error for each device
+separately and return the first error as the overall result.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 25 +++++++++++++---------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 1115af343e013..ddd0e7ab82be7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -6337,23 +6337,28 @@ static int amdgpu_device_sched_resume(struct list_head *device_list,
+ if (!drm_drv_uses_atomic_modeset(adev_to_drm(tmp_adev)) && !job_signaled)
+ drm_helper_resume_force_mode(adev_to_drm(tmp_adev));
+
+- if (tmp_adev->asic_reset_res)
+- r = tmp_adev->asic_reset_res;
+-
+- tmp_adev->asic_reset_res = 0;
+-
+- if (r) {
++ if (tmp_adev->asic_reset_res) {
+ /* bad news, how to tell it to userspace ?
+ * for ras error, we should report GPU bad status instead of
+ * reset failure
+ */
+ if (reset_context->src != AMDGPU_RESET_SRC_RAS ||
+ !amdgpu_ras_eeprom_check_err_threshold(tmp_adev))
+- dev_info(tmp_adev->dev, "GPU reset(%d) failed\n",
+- atomic_read(&tmp_adev->gpu_reset_counter));
+- amdgpu_vf_error_put(tmp_adev, AMDGIM_ERROR_VF_GPU_RESET_FAIL, 0, r);
++ dev_info(
++ tmp_adev->dev,
++ "GPU reset(%d) failed with error %d \n",
++ atomic_read(
++ &tmp_adev->gpu_reset_counter),
++ tmp_adev->asic_reset_res);
++ amdgpu_vf_error_put(tmp_adev,
++ AMDGIM_ERROR_VF_GPU_RESET_FAIL, 0,
++ tmp_adev->asic_reset_res);
++ if (!r)
++ r = tmp_adev->asic_reset_res;
++ tmp_adev->asic_reset_res = 0;
+ } else {
+- dev_info(tmp_adev->dev, "GPU reset(%d) succeeded!\n", atomic_read(&tmp_adev->gpu_reset_counter));
++ dev_info(tmp_adev->dev, "GPU reset(%d) succeeded!\n",
++ atomic_read(&tmp_adev->gpu_reset_counter));
+ if (amdgpu_acpi_smart_shift_update(tmp_adev,
+ AMDGPU_SS_DEV_D0))
+ dev_warn(tmp_adev->dev,
+--
+2.51.0
+
--- /dev/null
+From e869e70c966c082d969f290643e5268fcf185327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 15:57:32 -0400
+Subject: drm/amdkfd: Fix mmap write lock not release
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 7574f30337e19045f03126b4c51f525b84e5049e ]
+
+If mmap write lock is taken while draining retry fault, mmap write lock
+is not released because svm_range_restore_pages calls mmap_read_unlock
+then returns. This causes deadlock and system hangs later because mmap
+read or write lock cannot be taken.
+
+Downgrade mmap write lock to read lock if draining retry fault fix this
+bug.
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index cecdbcea0bb90..827507cfed7aa 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -3046,6 +3046,8 @@ svm_range_restore_pages(struct amdgpu_device *adev, unsigned int pasid,
+ if (svms->checkpoint_ts[gpuidx] != 0) {
+ if (amdgpu_ih_ts_after_or_equal(ts, svms->checkpoint_ts[gpuidx])) {
+ pr_debug("draining retry fault, drop fault 0x%llx\n", addr);
++ if (write_locked)
++ mmap_write_downgrade(mm);
+ r = -EAGAIN;
+ goto out_unlock_svms;
+ } else {
+--
+2.51.0
+
--- /dev/null
+From 60d2987102395e5714d463bcf11539bdeeb4499e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 03:32:09 -0400
+Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
+
+From: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+
+[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
+
+Add bounds checking to prevent writes past framebuffer boundaries when
+rendering text near screen edges. Return early if the Y position is off-screen
+and clip image height to screen boundary. Break from the rendering loop if the
+X position is off-screen. When clipping image width to fit the screen, update
+the character count to match the clipped width to prevent buffer size
+mismatches.
+
+Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
+receive mismatched parameters where the buffer is allocated for the clipped
+width but cnt reflects the original larger count, causing out-of-bounds writes.
+
+Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
+Suggested-by: Helge Deller <deller@gmx.de>
+Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index 2e46c41a706a2..dc5ad3fcc7be4 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ image.height = vc->vc_font.height;
+ image.depth = 1;
+
++ if (image.dy >= info->var.yres)
++ return;
++
++ image.height = min(image.height, info->var.yres - image.dy);
++
+ if (attribute) {
+ buf = kmalloc(cellsize, GFP_ATOMIC);
+ if (!buf)
+@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ cnt = count;
+
+ image.width = vc->vc_font.width * cnt;
++
++ if (image.dx >= info->var.xres)
++ break;
++
++ if (image.dx + image.width > info->var.xres) {
++ image.width = info->var.xres - image.dx;
++ cnt = image.width / vc->vc_font.width;
++ if (cnt == 0)
++ break;
++ image.width = cnt * vc->vc_font.width;
++ }
++
+ pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
+ pitch &= ~scan_align;
+ size = pitch * image.height + buf_align;
+--
+2.51.0
+
--- /dev/null
+From 3c6a13ce76fa1c1fd02b90b7064b7372d1eae973 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 04:42:48 +0200
+Subject: fbdev: core: Fix ubsan warning in pixel_to_pat
+
+From: Zsolt Kajtar <soci@c64.rulez.org>
+
+[ Upstream commit aad1d99beaaf132e2024a52727c24894cdf9474a ]
+
+It could be triggered on 32 bit big endian machines at 32 bpp in the
+pattern realignment. In this case just return early as the result is
+an identity.
+
+Signed-off-by: Zsolt Kajtar <soci@c64.rulez.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/fb_fillrect.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/core/fb_fillrect.h b/drivers/video/fbdev/core/fb_fillrect.h
+index 66042e534de77..f366670a53af8 100644
+--- a/drivers/video/fbdev/core/fb_fillrect.h
++++ b/drivers/video/fbdev/core/fb_fillrect.h
+@@ -92,8 +92,7 @@ static unsigned long pixel_to_pat(int bpp, u32 color)
+ pattern = pattern | pattern << bpp;
+ break;
+ default:
+- pattern = color;
+- break;
++ return color;
+ }
+ #ifndef __LITTLE_ENDIAN
+ pattern <<= (BITS_PER_LONG % bpp);
+--
+2.51.0
+
--- /dev/null
+From fe3b2ff95854988edf5a3132582be5e019ffeba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 May 2025 20:44:34 -0500
+Subject: fs/hpfs: Fix error code for new_inode() failure in
+ mkdir/create/mknod/symlink
+
+From: Yikang Yue <yikangy2@illinois.edu>
+
+[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
+
+The function call new_inode() is a primitive for allocating an inode in memory,
+rather than planning disk space for it. Therefore, -ENOMEM should be returned
+as the error code rather than -ENOSPC.
+
+To be specific, new_inode()'s call path looks like this:
+new_inode
+ new_inode_pseudo
+ alloc_inode
+ ops->alloc_inode (hpfs_alloc_inode)
+ alloc_inode_sb
+ kmem_cache_alloc_lru
+
+Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM),
+not a lack of disk space. However, the current implementation of
+hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails.
+This patch fix this by set err to -ENOMEM before the goto statement.
+
+BTW, we also noticed that other nested calls within these four functions,
+like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure.
+But similarly, only -ENOSPC is returned. Addressing these will involve code
+modifications in other functions, and we plan to submit dedicated patches for these
+issues in the future. For this patch, we focus on new_inode().
+
+Signed-off-by: Yikang Yue <yikangy2@illinois.edu>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hpfs/namei.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index e3cdc421dfba7..353e13a615f56 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -52,8 +52,10 @@ static struct dentry *hpfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+ dee.fnode = cpu_to_le32(fno);
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail2;
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -153,9 +155,10 @@ static int hpfs_create(struct mnt_idmap *idmap, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ result->i_mode |= S_IFREG;
+@@ -239,9 +242,10 @@ static int hpfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -314,8 +318,10 @@ static int hpfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
++ }
+ result->i_ino = fno;
+ hpfs_init_inode(result);
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+--
+2.51.0
+
--- /dev/null
+From e59f02e310c930b221070999c83b6522c7f57253 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:20:57 -0700
+Subject: hyperv: Add missing field to hv_output_map_device_interrupt
+
+From: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+
+[ Upstream commit 4cd661c248b6671914ad59e16760bb6d908dfc61 ]
+
+This field is unused, but the correct structure size is needed
+when computing the amount of space for the output argument to
+reside, so that it does not cross a page boundary.
+
+Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/hyperv/hvhdk_mini.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/hyperv/hvhdk_mini.h b/include/hyperv/hvhdk_mini.h
+index 42e7876455b5b..858f6a3925b30 100644
+--- a/include/hyperv/hvhdk_mini.h
++++ b/include/hyperv/hvhdk_mini.h
+@@ -301,6 +301,7 @@ struct hv_input_map_device_interrupt {
+ /* HV_OUTPUT_MAP_DEVICE_INTERRUPT */
+ struct hv_output_map_device_interrupt {
+ struct hv_interrupt_entry interrupt_entry;
++ u64 ext_status_deprecated[5];
+ } __packed;
+
+ /* HV_INPUT_UNMAP_DEVICE_INTERRUPT */
+--
+2.51.0
+
--- /dev/null
+From 5b34ac16e3908ed3c50d055a7ffbc7117533a0b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 14:33:42 +0200
+Subject: kbuild: uapi: Strip comments before size type check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 66128f4287b04aef4d4db9bf5035985ab51487d5 ]
+
+On m68k, check_sizetypes in headers_check reports:
+
+ ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include <linux/types.h>
+
+This header file does not use any of the Linux-specific integer types,
+but merely refers to them from comments, so this is a false positive.
+As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes()
+warning to error"), this check was promoted to an error, breaking m68k
+all{mod,yes}config builds.
+
+Fix this by stripping simple comments before looking for Linux-specific
+integer types.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org
+[nathan: Adjust comment and remove unnecessary escaping from slashes in
+ regex]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ usr/include/headers_check.pl | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/usr/include/headers_check.pl b/usr/include/headers_check.pl
+index 2b70bfa5558e6..02767e8bf22d0 100755
+--- a/usr/include/headers_check.pl
++++ b/usr/include/headers_check.pl
+@@ -155,6 +155,8 @@ sub check_sizetypes
+ if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) {
+ check_include_typesh($included);
+ }
++ # strip single-line comments, as types may be referenced within them
++ $line =~ s@/\*.*?\*/@@;
+ if ($line =~ m/__[us](8|16|32|64)\b/) {
+ printf STDERR "$filename:$lineno: " .
+ "found __[us]{8,16,32,64} type " .
+--
+2.51.0
+
--- /dev/null
+From 6a3f635ea2b2588a4e76aebc01186ce97389c87f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 22:39:35 +0800
+Subject: LoongArch: Handle new atomic instructions for probes
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit db740f5689e61f2e75b73e5c8e7c985a3b4bc045 ]
+
+The atomic instructions sc.q, llacq.{w/d}, screl.{w/d} were newly added
+in the LoongArch Reference Manual v1.10, it is necessary to handle them
+in insns_not_supported() to avoid putting a breakpoint in the middle of
+a ll/sc atomic sequence, otherwise it will loop forever for kprobes and
+uprobes.
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/include/asm/inst.h | 5 +++++
+ arch/loongarch/kernel/inst.c | 12 ++++++++++++
+ 2 files changed, 17 insertions(+)
+
+diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h
+index 277d2140676b6..55e64a12a124a 100644
+--- a/arch/loongarch/include/asm/inst.h
++++ b/arch/loongarch/include/asm/inst.h
+@@ -77,6 +77,10 @@ enum reg2_op {
+ iocsrwrh_op = 0x19205,
+ iocsrwrw_op = 0x19206,
+ iocsrwrd_op = 0x19207,
++ llacqw_op = 0xe15e0,
++ screlw_op = 0xe15e1,
++ llacqd_op = 0xe15e2,
++ screld_op = 0xe15e3,
+ };
+
+ enum reg2i5_op {
+@@ -189,6 +193,7 @@ enum reg3_op {
+ fldxd_op = 0x7068,
+ fstxs_op = 0x7070,
+ fstxd_op = 0x7078,
++ scq_op = 0x70ae,
+ amswapw_op = 0x70c0,
+ amswapd_op = 0x70c1,
+ amaddw_op = 0x70c2,
+diff --git a/arch/loongarch/kernel/inst.c b/arch/loongarch/kernel/inst.c
+index 72ecfed29d55a..bf037f0c6b26c 100644
+--- a/arch/loongarch/kernel/inst.c
++++ b/arch/loongarch/kernel/inst.c
+@@ -141,6 +141,9 @@ bool insns_not_supported(union loongarch_instruction insn)
+ case amswapw_op ... ammindbdu_op:
+ pr_notice("atomic memory access instructions are not supported\n");
+ return true;
++ case scq_op:
++ pr_notice("sc.q instruction is not supported\n");
++ return true;
+ }
+
+ switch (insn.reg2i14_format.opcode) {
+@@ -152,6 +155,15 @@ bool insns_not_supported(union loongarch_instruction insn)
+ return true;
+ }
+
++ switch (insn.reg2_format.opcode) {
++ case llacqw_op:
++ case llacqd_op:
++ case screlw_op:
++ case screld_op:
++ pr_notice("llacq and screl instructions are not supported\n");
++ return true;
++ }
++
+ switch (insn.reg1i21_format.opcode) {
+ case bceqz_op:
+ pr_notice("bceqz and bcnez instructions are not supported\n");
+--
+2.51.0
+
--- /dev/null
+From bb8cb20603c805c53c0f524afae77bd5bbe80045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 10:48:41 +0800
+Subject: net: wwan: t7xx: add support for HP DRMR-H01
+
+From: Sammy Hsu <zelda3121@gmail.com>
+
+[ Upstream commit 370e98728bda92b1bdffb448d1acdcbe19dadb4c ]
+
+add support for HP DRMR-H01 (0x03f0, 0x09c8)
+
+Signed-off-by: Sammy Hsu <sammy.hsu@wnc.com.tw>
+Link: https://patch.msgid.link/20251002024841.5979-1-sammy.hsu@wnc.com.tw
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/t7xx/t7xx_pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wwan/t7xx/t7xx_pci.c b/drivers/net/wwan/t7xx/t7xx_pci.c
+index 8bf63f2dcbbfd..eb137e0784232 100644
+--- a/drivers/net/wwan/t7xx/t7xx_pci.c
++++ b/drivers/net/wwan/t7xx/t7xx_pci.c
+@@ -939,6 +939,7 @@ static void t7xx_pci_remove(struct pci_dev *pdev)
+
+ static const struct pci_device_id t7xx_pci_table[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x4d75) },
++ { PCI_DEVICE(0x03f0, 0x09c8) }, // HP DRMR-H01
+ { PCI_DEVICE(0x14c0, 0x4d75) }, // Dell DW5933e
+ { }
+ };
+--
+2.51.0
+
--- /dev/null
+From 94e33ee1d079c418331b0a0f303631744251ea19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 18:48:33 +0200
+Subject: NTB: epf: Allow arbitrary BAR mapping
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ]
+
+The NTB epf host driver assumes the BAR number associated with a memory
+window is just incremented from the BAR number associated with MW1. This
+seems to have been enough so far but this is not really how the endpoint
+side work and the two could easily become mis-aligned.
+
+ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window
+index + 2, which means the function only returns a proper result if BAR_2
+is associated with MW1.
+
+Instead, fully describe and allow arbitrary NTB BAR mapping.
+
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++++++++++++++++----------------
+ 1 file changed, 53 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
+index 00f0e78f685bf..2b51156e01b0f 100644
+--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
++++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
+@@ -49,6 +49,7 @@
+ #define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */
+
+ enum pci_barno {
++ NO_BAR = -1,
+ BAR_0,
+ BAR_1,
+ BAR_2,
+@@ -57,16 +58,26 @@ enum pci_barno {
+ BAR_5,
+ };
+
++enum epf_ntb_bar {
++ BAR_CONFIG,
++ BAR_PEER_SPAD,
++ BAR_DB,
++ BAR_MW1,
++ BAR_MW2,
++ BAR_MW3,
++ BAR_MW4,
++ NTB_BAR_NUM,
++};
++
++#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1)
++
+ struct ntb_epf_dev {
+ struct ntb_dev ntb;
+ struct device *dev;
+ /* Mutex to protect providing commands to NTB EPF */
+ struct mutex cmd_lock;
+
+- enum pci_barno ctrl_reg_bar;
+- enum pci_barno peer_spad_reg_bar;
+- enum pci_barno db_reg_bar;
+- enum pci_barno mw_bar;
++ const enum pci_barno *barno_map;
+
+ unsigned int mw_count;
+ unsigned int spad_count;
+@@ -85,17 +96,6 @@ struct ntb_epf_dev {
+
+ #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb)
+
+-struct ntb_epf_data {
+- /* BAR that contains both control region and self spad region */
+- enum pci_barno ctrl_reg_bar;
+- /* BAR that contains peer spad region */
+- enum pci_barno peer_spad_reg_bar;
+- /* BAR that contains Doorbell region and Memory window '1' */
+- enum pci_barno db_reg_bar;
+- /* BAR that contains memory windows*/
+- enum pci_barno mw_bar;
+-};
+-
+ static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command,
+ u32 argument)
+ {
+@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx)
+ return -EINVAL;
+ }
+
+- return idx + 2;
++ return ndev->barno_map[BAR_MW1 + idx];
+ }
+
+ static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx)
+@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx,
+ return -EINVAL;
+ }
+
+- bar = idx + ndev->mw_bar;
++ bar = ntb_epf_mw_to_bar(ndev, idx);
++ if (bar < 0)
++ return bar;
+
+ mw_size = pci_resource_len(ntb->pdev, bar);
+
+@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx,
+ if (idx == 0)
+ offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET);
+
+- bar = idx + ndev->mw_bar;
++ bar = ntb_epf_mw_to_bar(ndev, idx);
++ if (bar < 0)
++ return bar;
+
+ if (base)
+ *base = pci_resource_start(ndev->ntb.pdev, bar) + offset;
+@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev)
+ ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT);
+ ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT);
+
++ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) {
++ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count);
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
+@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
+ dev_warn(&pdev->dev, "Cannot DMA highmem\n");
+ }
+
+- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0);
++ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0);
+ if (!ndev->ctrl_reg) {
+ ret = -EIO;
+ goto err_pci_regions;
+ }
+
+- if (ndev->peer_spad_reg_bar) {
+- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0);
++ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) {
++ ndev->peer_spad_reg = pci_iomap(pdev,
++ ndev->barno_map[BAR_PEER_SPAD], 0);
+ if (!ndev->peer_spad_reg) {
+ ret = -EIO;
+ goto err_pci_regions;
+@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
+ ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz;
+ }
+
+- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0);
++ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0);
+ if (!ndev->db_reg) {
+ ret = -EIO;
+ goto err_pci_regions;
+@@ -659,12 +669,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev)
+ static int ntb_epf_pci_probe(struct pci_dev *pdev,
+ const struct pci_device_id *id)
+ {
+- enum pci_barno peer_spad_reg_bar = BAR_1;
+- enum pci_barno ctrl_reg_bar = BAR_0;
+- enum pci_barno db_reg_bar = BAR_2;
+- enum pci_barno mw_bar = BAR_2;
+ struct device *dev = &pdev->dev;
+- struct ntb_epf_data *data;
+ struct ntb_epf_dev *ndev;
+ int ret;
+
+@@ -675,18 +680,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev,
+ if (!ndev)
+ return -ENOMEM;
+
+- data = (struct ntb_epf_data *)id->driver_data;
+- if (data) {
+- peer_spad_reg_bar = data->peer_spad_reg_bar;
+- ctrl_reg_bar = data->ctrl_reg_bar;
+- db_reg_bar = data->db_reg_bar;
+- mw_bar = data->mw_bar;
+- }
++ ndev->barno_map = (const enum pci_barno *)id->driver_data;
++ if (!ndev->barno_map)
++ return -EINVAL;
+
+- ndev->peer_spad_reg_bar = peer_spad_reg_bar;
+- ndev->ctrl_reg_bar = ctrl_reg_bar;
+- ndev->db_reg_bar = db_reg_bar;
+- ndev->mw_bar = mw_bar;
+ ndev->dev = dev;
+
+ ntb_epf_init_struct(ndev, pdev);
+@@ -730,30 +727,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev)
+ ntb_epf_deinit_pci(ndev);
+ }
+
+-static const struct ntb_epf_data j721e_data = {
+- .ctrl_reg_bar = BAR_0,
+- .peer_spad_reg_bar = BAR_1,
+- .db_reg_bar = BAR_2,
+- .mw_bar = BAR_2,
++static const enum pci_barno j721e_map[NTB_BAR_NUM] = {
++ [BAR_CONFIG] = BAR_0,
++ [BAR_PEER_SPAD] = BAR_1,
++ [BAR_DB] = BAR_2,
++ [BAR_MW1] = BAR_2,
++ [BAR_MW2] = BAR_3,
++ [BAR_MW3] = BAR_4,
++ [BAR_MW4] = BAR_5
+ };
+
+-static const struct ntb_epf_data mx8_data = {
+- .ctrl_reg_bar = BAR_0,
+- .peer_spad_reg_bar = BAR_0,
+- .db_reg_bar = BAR_2,
+- .mw_bar = BAR_4,
++static const enum pci_barno mx8_map[NTB_BAR_NUM] = {
++ [BAR_CONFIG] = BAR_0,
++ [BAR_PEER_SPAD] = BAR_0,
++ [BAR_DB] = BAR_2,
++ [BAR_MW1] = BAR_4,
++ [BAR_MW2] = BAR_5,
++ [BAR_MW3] = NO_BAR,
++ [BAR_MW4] = NO_BAR
+ };
+
+ static const struct pci_device_id ntb_epf_pci_tbl[] = {
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E),
+ .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
+- .driver_data = (kernel_ulong_t)&j721e_data,
++ .driver_data = (kernel_ulong_t)j721e_map,
+ },
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809),
+ .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
+- .driver_data = (kernel_ulong_t)&mx8_data,
++ .driver_data = (kernel_ulong_t)mx8_map,
+ },
+ { },
+ };
+--
+2.51.0
+
--- /dev/null
+From 7ca0fb867546d53e121c1c5f2271ec6157011240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 19:54:09 +0200
+Subject: rtc: pcf2127: clear minute/second interrupt
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ]
+
+PCF2127 can generate interrupt every full second or minute configured
+from control and status register 1, bits MI (1) and SI (0).
+
+On interrupt control register 2 bit MSF (7) is set and must be cleared
+to continue normal operation.
+
+While the driver never enables this interrupt on its own, users or
+firmware may do so - e.g. as an easy way to test the interrupt.
+
+Add preprocessor definition for MSF bit and include it in the irq
+bitmask to ensure minute and second interrupts are cleared when fired.
+
+This fixes an issue where the rtc enters a test mode and becomes
+unresponsive after a second interrupt has fired and is not cleared in
+time. In this state register writes to control registers have no
+effect and the interrupt line is kept asserted [1]:
+
+[1] userspace commands to put rtc into unresponsive state:
+$ i2cget -f -y 2 0x51 0x00
+0x04
+$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI
+$ i2cget -f -y 2 0x51 0x00
+0x84 # bit 8 EXT_TEST set
+$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register
+$ i2cget -f -y 2 0x51 0x00
+0x84 # no change
+
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 2e1ac0c42e932..3ba1de30e89c2 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -42,6 +42,7 @@
+ #define PCF2127_BIT_CTRL2_AF BIT(4)
+ #define PCF2127_BIT_CTRL2_TSF2 BIT(5)
+ #define PCF2127_BIT_CTRL2_WDTF BIT(6)
++#define PCF2127_BIT_CTRL2_MSF BIT(7)
+ /* Control register 3 */
+ #define PCF2127_REG_CTRL3 0x02
+ #define PCF2127_BIT_CTRL3_BLIE BIT(0)
+@@ -96,7 +97,8 @@
+ #define PCF2127_CTRL2_IRQ_MASK ( \
+ PCF2127_BIT_CTRL2_AF | \
+ PCF2127_BIT_CTRL2_WDTF | \
+- PCF2127_BIT_CTRL2_TSF2)
++ PCF2127_BIT_CTRL2_TSF2 | \
++ PCF2127_BIT_CTRL2_MSF)
+
+ #define PCF2127_MAX_TS_SUPPORTED 4
+
+--
+2.51.0
+
--- /dev/null
+From 5fd2b60cd795ed2c468c1c820150508cdaf47d00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 20:22:35 +0200
+Subject: rtc: pcf2127: fix watchdog interrupt mask on pcf2131
+
+From: Bruno Thomsen <bruno.thomsen@gmail.com>
+
+[ Upstream commit 87064da2db7be537a7da20a25c18ba912c4db9e1 ]
+
+When using interrupt pin (INT A) as watchdog output all other
+interrupt sources need to be disabled to avoid additional
+resets. Resulting INT_A_MASK1 value is 55 (0x37).
+
+Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20250902182235.6825-1-bruno.thomsen@gmail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 3ba1de30e89c2..bb4fe81d3d62c 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -608,6 +608,21 @@ static int pcf2127_watchdog_init(struct device *dev, struct pcf2127 *pcf2127)
+ set_bit(WDOG_HW_RUNNING, &pcf2127->wdd.status);
+ }
+
++ /*
++ * When using interrupt pin (INT A) as watchdog output, only allow
++ * watchdog interrupt (PCF2131_BIT_INT_WD_CD) and disable (mask) all
++ * other interrupts.
++ */
++ if (pcf2127->cfg->type == PCF2131) {
++ ret = regmap_write(pcf2127->regmap,
++ PCF2131_REG_INT_A_MASK1,
++ PCF2131_BIT_INT_BLIE |
++ PCF2131_BIT_INT_BIE |
++ PCF2131_BIT_INT_AIE |
++ PCF2131_BIT_INT_SI |
++ PCF2131_BIT_INT_MI);
++ }
++
+ return devm_watchdog_register_device(dev, &pcf2127->wdd);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 697100d76960b648fd2cc40d167737cbfe5750ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 19:51:10 +0530
+Subject: rtc: zynqmp: Restore alarm functionality after kexec transition
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit e22f4d1321e0055065f274e20bf6d1dbf4b500f5 ]
+
+During kexec reboots, RTC alarms that are fired during the kernel
+transition experience delayed execution. The new kernel would eventually
+honor these alarms, but the interrupt handlers would only execute after
+the driver probe is completed rather than at the intended alarm time.
+
+This is because pending alarm interrupt status from the previous kernel
+is not properly cleared during driver initialization, causing timing
+discrepancies in alarm delivery.
+
+To ensure precise alarm timing across kexec transitions, enhance the
+probe function to:
+1. Clear any pending alarm interrupt status from previous boot.
+2. Detect existing valid alarms and preserve their state.
+3. Re-enable alarm interrupts for future alarms.
+
+Signed-off-by: Harini T <harini.t@amd.com>
+Link: https://lore.kernel.org/r/20250730142110.2354507-1-harini.t@amd.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-zynqmp.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c
+index f39102b66eac2..3baa2b481d9f2 100644
+--- a/drivers/rtc/rtc-zynqmp.c
++++ b/drivers/rtc/rtc-zynqmp.c
+@@ -277,6 +277,10 @@ static irqreturn_t xlnx_rtc_interrupt(int irq, void *id)
+ static int xlnx_rtc_probe(struct platform_device *pdev)
+ {
+ struct xlnx_rtc_dev *xrtcdev;
++ bool is_alarm_set = false;
++ u32 pending_alrm_irq;
++ u32 current_time;
++ u32 alarm_time;
+ int ret;
+
+ xrtcdev = devm_kzalloc(&pdev->dev, sizeof(*xrtcdev), GFP_KERNEL);
+@@ -296,6 +300,17 @@ static int xlnx_rtc_probe(struct platform_device *pdev)
+ if (IS_ERR(xrtcdev->reg_base))
+ return PTR_ERR(xrtcdev->reg_base);
+
++ /* Clear any pending alarm interrupts from previous kernel/boot */
++ pending_alrm_irq = readl(xrtcdev->reg_base + RTC_INT_STS) & RTC_INT_ALRM;
++ if (pending_alrm_irq)
++ writel(pending_alrm_irq, xrtcdev->reg_base + RTC_INT_STS);
++
++ /* Check if a valid alarm is already set from previous kernel/boot */
++ alarm_time = readl(xrtcdev->reg_base + RTC_ALRM);
++ current_time = readl(xrtcdev->reg_base + RTC_CUR_TM);
++ if (alarm_time > current_time && alarm_time != 0)
++ is_alarm_set = true;
++
+ xrtcdev->alarm_irq = platform_get_irq_byname(pdev, "alarm");
+ if (xrtcdev->alarm_irq < 0)
+ return xrtcdev->alarm_irq;
+@@ -337,6 +352,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev)
+
+ xlnx_init_rtc(xrtcdev);
+
++ /* Re-enable alarm interrupt if a valid alarm was found */
++ if (is_alarm_set)
++ writel(RTC_INT_ALRM, xrtcdev->reg_base + RTC_INT_EN);
++
+ device_init_wakeup(&pdev->dev, true);
+
+ return devm_rtc_register_device(xrtcdev->rtc);
+--
+2.51.0
+
--- /dev/null
+From 492ee5312ecf3685d671db6a2fee249c984a6a32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:14:28 +0900
+Subject: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
+
+From: Hoyoung Seo <hy50.seo@samsung.com>
+
+[ Upstream commit 558ae4579810fa0fef011944230c65a6f3087f85 ]
+
+When a UTP error occurs in isolation, UFS is not currently recoverable.
+This is because the UTP error is not considered fatal in the error
+handling code, leading to either an I/O timeout or an OCS error.
+
+Add the UTP error flag to INT_FATAL_ERRORS so the controller will be
+reset in this situation.
+
+ sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07
+ driverbyte=DRIVER_OK cmd_age=0s
+ sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00
+ I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg
+ 8 prio class 2
+ OCS error from controller = 9 for tag 39
+ pa_err[1] = 0x80000010 at 2667224756 us
+ pa_err: total cnt=2
+ dl_err[0] = 0x80000002 at 2667148060 us
+ dl_err[1] = 0x80002000 at 2667282844 us
+ No record of nl_err
+ No record of tl_err
+ No record of dme_err
+ No record of auto_hibern8_err
+ fatal_err[0] = 0x804 at 2667282836 us
+
+ ---------------------------------------------------
+ REGISTER
+ ---------------------------------------------------
+ NAME OFFSET VALUE
+ STD HCI SFR 0xfffffff0 0x0
+ AHIT 0x18 0x814
+ INTERRUPT STATUS 0x20 0x1000
+ INTERRUPT ENABLE 0x24 0x70ef5
+
+[mkp: commit desc]
+
+Signed-off-by: Hoyoung Seo <hy50.seo@samsung.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/ufs/ufshci.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h
+index 612500a7088f0..e64b701321010 100644
+--- a/include/ufs/ufshci.h
++++ b/include/ufs/ufshci.h
+@@ -180,6 +180,7 @@ static inline u32 ufshci_version(u32 major, u32 minor)
+ #define UTP_TASK_REQ_COMPL 0x200
+ #define UIC_COMMAND_COMPL 0x400
+ #define DEVICE_FATAL_ERROR 0x800
++#define UTP_ERROR 0x1000
+ #define CONTROLLER_FATAL_ERROR 0x10000
+ #define SYSTEM_BUS_FATAL_ERROR 0x20000
+ #define CRYPTO_ENGINE_FATAL_ERROR 0x40000
+@@ -199,7 +200,8 @@ static inline u32 ufshci_version(u32 major, u32 minor)
+ CONTROLLER_FATAL_ERROR |\
+ SYSTEM_BUS_FATAL_ERROR |\
+ CRYPTO_ENGINE_FATAL_ERROR |\
+- UIC_LINK_LOST)
++ UIC_LINK_LOST |\
++ UTP_ERROR)
+
+ /* HCS - Host Controller Status 30h */
+ #define DEVICE_PRESENT 0x1
+--
+2.51.0
+
rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch
btrfs-fix-memory-leak-of-qgroup_list-in-btrfs_add_qg.patch
btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch
+clk-qcom-gcc-ipq6018-rework-nss_port5-clock-to-multi.patch
+clk-thead-th1520-ap-set-all-axi-clocks-to-clk_is_cri.patch
+clk-renesas-rzv2h-re-assert-reset-on-deassert-timeou.patch
+clk-samsung-exynos990-add-missing-usb-clock-register.patch
+fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch
+clocksource-hyper-v-skip-unnecessary-checks-for-the-.patch
+hyperv-add-missing-field-to-hv_output_map_device_int.patch
+um-fix-help-message-for-ssl-non-raw.patch
+clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch
+rtc-pcf2127-clear-minute-second-interrupt.patch
+arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch
+clk-at91-add-acr-in-all-pll-settings.patch
+clk-at91-sam9x7-add-peripheral-clock-id-for-pmecc.patch
+clk-at91-clk-master-add-check-for-divide-by-3.patch
+clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch
+9p-trans_fd-p9_fd_request-kick-rx-thread-if-epollin.patch
+clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch
+clk-scmi-add-duty-cycle-ops-only-when-duty-cycle-is-.patch
+clk-clocking-wizard-fix-output-clock-register-offset.patch
+ntb-epf-allow-arbitrary-bar-mapping.patch
+9p-fix-sys-fs-9p-caches-overwriting-itself.patch
+cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch
+9p-sysfs_init-don-t-hardcode-error-to-enomem.patch
+scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch
+fbdev-core-fix-ubsan-warning-in-pixel_to_pat.patch
+acpi-property-return-present-device-nodes-only-on-fw.patch
+loongarch-handle-new-atomic-instructions-for-probes.patch
+tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch
+tools-lib-thermal-don-t-preserve-owner-in-install.patch
+tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch
+fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch
+alsa-hda-realtek-add-quirk-for-asus-rog-zephyrus-duo.patch
+rtc-zynqmp-restore-alarm-functionality-after-kexec-t.patch
+rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch
+net-wwan-t7xx-add-support-for-hp-drmr-h01.patch
+kbuild-uapi-strip-comments-before-size-type-check.patch
+asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch
+asoc-rt722-add-settings-for-rt722vb.patch
+drm-amdkfd-fix-mmap-write-lock-not-release.patch
+drm-amdgpu-report-individual-reset-error.patch
+ceph-add-checking-of-wait_for_completion_killable-re.patch
+ceph-fix-potential-race-condition-in-ceph_ioctl_lazy.patch
+ceph-refactor-wake_up_bit-pattern-of-calling.patch
+ceph-fix-multifs-mds-auth-caps-issue.patch
+x86-uaccess-don-t-use-runtime-const-rewriting-in-mod.patch
--- /dev/null
+From 8c3ca317840ad9d721eb5d6054e996409d1d5768 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:47:06 -0700
+Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
+
+small_const_nbits is defined in asm-generic/bitsperlong.h which
+bitmap.h uses but doesn't include causing build failures in some build
+systems. Add the missing #include.
+
+Note the bitmap.h in tools has diverged from that of the kernel, so no
+changes are made there.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Yury Norov <yury.norov@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: André Almeida <andrealmeid@igalia.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Ido Schimmel <idosch@nvidia.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Jason Xing <kerneljasonxing@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Maurice Lambert <mauricelambert434@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Petr Machata <petrm@nvidia.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yuyang Huang <yuyanghuang@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/bitmap.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
+index d4d300040d019..0d992245c600d 100644
+--- a/tools/include/linux/bitmap.h
++++ b/tools/include/linux/bitmap.h
+@@ -3,6 +3,7 @@
+ #define _TOOLS_LINUX_BITMAP_H
+
+ #include <string.h>
++#include <asm-generic/bitsperlong.h>
+ #include <linux/align.h>
+ #include <linux/bitops.h>
+ #include <linux/find.h>
+--
+2.51.0
+
--- /dev/null
+From 81830aa27d84aee82ba7bd70af35679b006d2994 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:40:56 +0200
+Subject: tools: lib: thermal: don't preserve owner in install
+
+From: Emil Dahl Juhl <juhl.emildahl@gmail.com>
+
+[ Upstream commit 1375152bb02ab2a8435e87ea27034482dbc95f57 ]
+
+Instead of preserving mode, timestamp, and owner, for the object files
+during installation, just preserve the mode and timestamp.
+
+When installing as root, the installed files should be owned by root.
+When installing as user, --preserve=ownership doesn't work anyway. This
+makes --preserve=ownership rather pointless.
+
+Signed-off-by: Emil Dahl Juhl <juhl.emildahl@gmail.com>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
+index a1f5e388644d3..ac918e98cd033 100644
+--- a/tools/lib/thermal/Makefile
++++ b/tools/lib/thermal/Makefile
+@@ -134,7 +134,7 @@ endef
+ install_lib: libs
+ $(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \
+ $(call do_install_mkdir,$(libdir_SQ)); \
+- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
++ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
+
+ install_headers:
+ $(call QUIET_INSTALL, headers) \
+--
+2.51.0
+
--- /dev/null
+From 6f06eee12bad566d25b3c0fb31afa4d2b8e8732c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:40:55 +0200
+Subject: tools: lib: thermal: use pkg-config to locate libnl3
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit b31f7f725cd932e2c2b41f3e4b66273653953687 ]
+
+To make libthermal more cross compile friendly use pkg-config to locate
+libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/Makefile | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
+index ac918e98cd033..41aa7a324ff4d 100644
+--- a/tools/lib/thermal/Makefile
++++ b/tools/lib/thermal/Makefile
+@@ -46,8 +46,12 @@ else
+ CFLAGS := -g -Wall
+ endif
+
++NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null)
++ifeq ($(NL3_CFLAGS),)
++NL3_CFLAGS = -I/usr/include/libnl3
++endif
++
+ INCLUDES = \
+--I/usr/include/libnl3 \
+ -I$(srctree)/tools/lib/thermal/include \
+ -I$(srctree)/tools/lib/ \
+ -I$(srctree)/tools/include \
+@@ -59,6 +63,7 @@ INCLUDES = \
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += -Werror -Wall
+ override CFLAGS += -fPIC
++override CFLAGS += $(NL3_CFLAGS)
+ override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFGLAS += -Wl,-L.
+--
+2.51.0
+
--- /dev/null
+From 98be43096261705042c3f0207152fdae903e4f21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 08:56:59 +0800
+Subject: um: Fix help message for ssl-non-raw
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ]
+
+Add the missing option name in the help message. Additionally,
+switch to __uml_help(), because this is a global option rather
+than a per-channel option.
+
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/ssl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
+index 277cea3d30eb5..8006a5bd578c2 100644
+--- a/arch/um/drivers/ssl.c
++++ b/arch/um/drivers/ssl.c
+@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str)
+ return 1;
+ }
+ __setup("ssl-non-raw", ssl_non_raw_setup);
+-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode");
++__uml_help(ssl_non_raw_setup,
++"ssl-non-raw\n"
++" Set serial lines to non-raw mode.\n\n"
++);
+--
+2.51.0
+
--- /dev/null
+From 8a10a91f0bc8cc23e6093d52014c06356e835e0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 15:25:20 +0900
+Subject: x86: uaccess: don't use runtime-const rewriting in modules
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 284922f4c563aa3a8558a00f2a05722133237fe8 ]
+
+The runtime-const infrastructure was never designed to handle the
+modular case, because the constant fixup is only done at boot time for
+core kernel code.
+
+But by the time I used it for the x86-64 user space limit handling in
+commit 86e6b1547b3d ("x86: fix user address masking non-canonical
+speculation issue"), I had completely repressed that fact.
+
+And it all happens to work because the only code that currently actually
+gets inlined by modules is for the access_ok() limit check, where the
+default constant value works even when not fixed up. Because at least I
+had intentionally made it be something that is in the non-canonical
+address space region.
+
+But it's technically very wrong, and it does mean that at least in
+theory, the use of 'access_ok()' + '__get_user()' can trigger the same
+speculation issue with non-canonical addresses that the original commit
+was all about.
+
+The pattern is unusual enough that this probably doesn't matter in
+practice, but very wrong is still very wrong. Also, let's fix it before
+the nice optimized scoped user accessor helpers that Thomas Gleixner is
+working on cause this pseudo-constant to then be more widely used.
+
+This all came up due to an unrelated discussion with Mateusz Guzik about
+using the runtime const infrastructure for names_cachep accesses too.
+There the modular case was much more obviously broken, and Mateusz noted
+it in his 'v2' of the patch series.
+
+That then made me notice how broken 'access_ok()' had been in modules
+all along. Mea culpa, mea maxima culpa.
+
+Fix it by simply not using the runtime-const code in modules, and just
+using the USER_PTR_MAX variable value instead. This is not
+performance-critical like the core user accessor functions (get_user()
+and friends) are.
+
+Also make sure this doesn't get forgotten the next time somebody wants
+to do runtime constant optimizations by having the x86 runtime-const.h
+header file error out if included by modules.
+
+Fixes: 86e6b1547b3d ("x86: fix user address masking non-canonical speculation issue")
+Acked-by: Borislav Petkov <bp@alien8.de>
+Acked-by: Sean Christopherson <seanjc@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Triggered-by: Mateusz Guzik <mjguzik@gmail.com>
+Link: https://lore.kernel.org/all/20251030105242.801528-1-mjguzik@gmail.com/
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/runtime-const.h | 4 ++++
+ arch/x86/include/asm/uaccess_64.h | 10 +++++-----
+ arch/x86/kernel/cpu/common.c | 6 +++++-
+ 3 files changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/include/asm/runtime-const.h b/arch/x86/include/asm/runtime-const.h
+index 8d983cfd06ea6..e5a13dc8816e2 100644
+--- a/arch/x86/include/asm/runtime-const.h
++++ b/arch/x86/include/asm/runtime-const.h
+@@ -2,6 +2,10 @@
+ #ifndef _ASM_RUNTIME_CONST_H
+ #define _ASM_RUNTIME_CONST_H
+
++#ifdef MODULE
++ #error "Cannot use runtime-const infrastructure from modules"
++#endif
++
+ #ifdef __ASSEMBLY__
+
+ .macro RUNTIME_CONST_PTR sym reg
+diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
+index c8a5ae35c8714..641f45c22f9da 100644
+--- a/arch/x86/include/asm/uaccess_64.h
++++ b/arch/x86/include/asm/uaccess_64.h
+@@ -12,12 +12,12 @@
+ #include <asm/cpufeatures.h>
+ #include <asm/page.h>
+ #include <asm/percpu.h>
+-#include <asm/runtime-const.h>
+
+-/*
+- * Virtual variable: there's no actual backing store for this,
+- * it can purely be used as 'runtime_const_ptr(USER_PTR_MAX)'
+- */
++#ifdef MODULE
++ #define runtime_const_ptr(sym) (sym)
++#else
++ #include <asm/runtime-const.h>
++#endif
+ extern unsigned long USER_PTR_MAX;
+
+ #ifdef CONFIG_ADDRESS_MASKING
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index f98ec9c7fc07f..c08fe6f6a186e 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -78,6 +78,10 @@
+ DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info);
+ EXPORT_PER_CPU_SYMBOL(cpu_info);
+
++/* Used for modules: built-in code uses runtime constants */
++unsigned long USER_PTR_MAX;
++EXPORT_SYMBOL(USER_PTR_MAX);
++
+ u32 elf_hwcap2 __read_mostly;
+
+ /* Number of siblings per CPU package */
+@@ -2578,7 +2582,7 @@ void __init arch_cpu_finalize_init(void)
+ alternative_instructions();
+
+ if (IS_ENABLED(CONFIG_X86_64)) {
+- unsigned long USER_PTR_MAX = TASK_SIZE_MAX;
++ USER_PTR_MAX = TASK_SIZE_MAX;
+
+ /*
+ * Enable this when LAM is gated on LASS support
+--
+2.51.0
+
--- /dev/null
+From 09a8f5293fdf6711c3ba823e0a5a4929d4912bb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:30 +0900
+Subject: 9p: fix /sys/fs/9p/caches overwriting itself
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
+
+caches_show() overwrote its buffer on each iteration,
+so only the last cache tag was visible in sysfs output.
+
+Properly append with snprintf(buf + count, …).
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index d525957594b6b..af1921454ce87 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -561,7 +561,7 @@ static ssize_t caches_show(struct kobject *kobj,
+ spin_lock(&v9fs_sessionlist_lock);
+ list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
+ if (v9ses->cachetag) {
+- n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
++ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag);
+ if (n < 0) {
+ count = n;
+ break;
+--
+2.51.0
+
--- /dev/null
+From 2c44c07fba8d7d50db5ec8fdf7906fa6cd31d9c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:27:31 +0900
+Subject: 9p: sysfs_init: don't hardcode error to ENOMEM
+
+From: Randall P. Embry <rpembry@gmail.com>
+
+[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
+
+v9fs_sysfs_init() always returned -ENOMEM on failure;
+return the actual sysfs_create_group() error instead.
+
+Signed-off-by: Randall P. Embry <rpembry@gmail.com>
+Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index af1921454ce87..be61810cb7798 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -597,13 +597,16 @@ static const struct attribute_group v9fs_attr_group = {
+
+ static int __init v9fs_sysfs_init(void)
+ {
++ int ret;
++
+ v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
+ if (!v9fs_kobj)
+ return -ENOMEM;
+
+- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) {
++ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group);
++ if (ret) {
+ kobject_put(v9fs_kobj);
+- return -ENOMEM;
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 790ba1c3b74be7b3039c42e90d951e2b651d1f07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:26:36 +0300
+Subject: ACPI: property: Return present device nodes only on fwnode interface
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
+
+fwnode_graph_get_next_subnode() may return fwnode backed by ACPI
+device nodes and there has been no check these devices are present
+in the system, unlike there has been on fwnode OF backend.
+
+In order to provide consistent behaviour towards callers,
+add a check for device presence by introducing
+a new function acpi_get_next_present_subnode(), used as the
+get_next_child_node() fwnode operation that also checks device
+node presence.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com
+[ rjw: Kerneldoc comment and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/property.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index 5898c3c8c2a7f..d02b332744e64 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -1286,6 +1286,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
+ return NULL;
+ }
+
++/*
++ * acpi_get_next_present_subnode - Return the next present child node handle
++ * @fwnode: Firmware node to find the next child node for.
++ * @child: Handle to one of the device's child nodes or a null handle.
++ *
++ * Like acpi_get_next_subnode(), but the device nodes returned by
++ * acpi_get_next_present_subnode() are guaranteed to be present.
++ *
++ * Returns: The fwnode handle of the next present sub-node.
++ */
++static struct fwnode_handle *
++acpi_get_next_present_subnode(const struct fwnode_handle *fwnode,
++ struct fwnode_handle *child)
++{
++ do {
++ child = acpi_get_next_subnode(fwnode, child);
++ } while (is_acpi_device_node(child) &&
++ !acpi_device_is_present(to_acpi_device_node(child)));
++
++ return child;
++}
++
+ /**
+ * acpi_node_get_parent - Return parent fwnode of this fwnode
+ * @fwnode: Firmware node whose parent to get
+@@ -1629,7 +1651,7 @@ static int acpi_fwnode_irq_get(const struct fwnode_handle *fwnode,
+ .property_read_string_array = \
+ acpi_fwnode_property_read_string_array, \
+ .get_parent = acpi_node_get_parent, \
+- .get_next_child_node = acpi_get_next_subnode, \
++ .get_next_child_node = acpi_get_next_present_subnode, \
+ .get_named_child_node = acpi_fwnode_get_named_child_node, \
+ .get_name = acpi_fwnode_get_name, \
+ .get_name_prefix = acpi_fwnode_get_name_prefix, \
+--
+2.51.0
+
--- /dev/null
+From cd26b25f99dadfa9d3f1dc35e309e6895c3ff452 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:27 +0200
+Subject: ARM: at91: pm: save and restore ACR during PLL disable/enable
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ]
+
+Add a new word in assembly to store ACR value during the calls
+to at91_plla_disable/at91_plla_enable macros and use it.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading]
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index 94dece1839af3..99aaf5cf89696 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -689,6 +689,10 @@ sr_dis_exit:
+ bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID
+ str tmp2, [pmc, #AT91_PMC_PLL_UPDT]
+
++ /* save acr */
++ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR]
++ str tmp2, .saved_acr
++
+ /* save div. */
+ mov tmp1, #0
+ ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0]
+@@ -758,7 +762,7 @@ sr_dis_exit:
+ str tmp1, [pmc, #AT91_PMC_PLL_UPDT]
+
+ /* step 2. */
+- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
++ ldr tmp1, .saved_acr
+ str tmp1, [pmc, #AT91_PMC_PLL_ACR]
+
+ /* step 3. */
+@@ -1134,6 +1138,8 @@ ENDPROC(at91_pm_suspend_in_sram)
+ .word 0
+ .saved_mckr:
+ .word 0
++.saved_acr:
++ .word 0
+ .saved_pllar:
+ .word 0
+ .saved_sam9_lpr:
+--
+2.51.0
+
--- /dev/null
+From f2c1ff797ab942552f203effa2ca2e996f6b8613 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 00:12:19 +0200
+Subject: ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
+
+From: Valerio Setti <vsetti@baylibre.com>
+
+[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ]
+
+According to I2S specs audio data is sampled on the rising edge of the
+clock and it can change on the falling one. When operating in normal mode
+this SoC behaves the opposite so a clock polarity inversion is required
+in this case.
+
+This was tested on an OdroidC2 (Amlogic S905 SoC) board.
+
+Signed-off-by: Valerio Setti <vsetti@baylibre.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Tested-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c
+index a0dd914c8ed13..3b4061508c180 100644
+--- a/sound/soc/meson/aiu-encoder-i2s.c
++++ b/sound/soc/meson/aiu-encoder-i2s.c
+@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ inv == SND_SOC_DAIFMT_IB_IF)
+ val |= AIU_CLK_CTRL_LRCLK_INVERT;
+
+- if (inv == SND_SOC_DAIFMT_IB_NF ||
+- inv == SND_SOC_DAIFMT_IB_IF)
++ /*
++ * The SoC changes data on the rising edge of the bitclock
++ * so an inversion of the bitclock is required in normal mode
++ */
++ if (inv == SND_SOC_DAIFMT_NB_NF ||
++ inv == SND_SOC_DAIFMT_NB_IF)
+ val |= AIU_CLK_CTRL_AOCLK_INVERT;
+
+ /* Signal skew */
+@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = {
+ .startup = aiu_encoder_i2s_startup,
+ .shutdown = aiu_encoder_i2s_shutdown,
+ };
+-
+--
+2.51.0
+
--- /dev/null
+From 2e395d8ff33296c1035448045d0403bf934bcf97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 12:04:32 -0700
+Subject: ceph: add checking of wait_for_completion_killable() return value
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
+
+The Coverity Scan service has detected the calling of
+wait_for_completion_killable() without checking the return
+value in ceph_lock_wait_for_completion() [1]. The CID 1636232
+defect contains explanation: "If the function returns an error
+value, the error value may be mistaken for a normal value.
+In ceph_lock_wait_for_completion(): Value returned from
+a function is not checked for errors before being used. (CWE-252)".
+
+The patch adds the checking of wait_for_completion_killable()
+return value and return the error code from
+ceph_lock_wait_for_completion().
+
+[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/locks.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index cb51c7e9c8e22..02f5fbe83aa46 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -219,7 +219,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,
+ if (err && err != -ERESTARTSYS)
+ return err;
+
+- wait_for_completion_killable(&req->r_safe_completion);
++ err = wait_for_completion_killable(&req->r_safe_completion);
++ if (err)
++ return err;
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a53e88947ee2cc9f2c36b8d7c35e8f6765eb07c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 12:20:57 -0700
+Subject: ceph: refactor wake_up_bit() pattern of calling
+
+From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+
+[ Upstream commit 53db6f25ee47cb1265141d31562604e56146919a ]
+
+The wake_up_bit() is called in ceph_async_unlink_cb(),
+wake_async_create_waiters(), and ceph_finish_async_create().
+It makes sense to switch on clear_bit() function, because
+it makes the code much cleaner and easier to understand.
+More important rework is the adding of smp_mb__after_atomic()
+memory barrier after the bit modification and before
+wake_up_bit() call. It can prevent potential race condition
+of accessing the modified bit in other threads. Luckily,
+clear_and_wake_up_bit() already implements the required
+functionality pattern:
+
+static inline void clear_and_wake_up_bit(int bit, unsigned long *word)
+{
+ clear_bit_unlock(bit, word);
+ /* See wake_up_bit() for which memory barrier you need to use. */
+ smp_mb__after_atomic();
+ wake_up_bit(word, bit);
+}
+
+Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Reviewed-by: Alex Markuze <amarkuze@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/dir.c | 3 +--
+ fs/ceph/file.c | 6 ++----
+ 2 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 1395b71df5ccc..529dd07fa459f 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -1213,8 +1213,7 @@ static void ceph_async_unlink_cb(struct ceph_mds_client *mdsc,
+ spin_unlock(&fsc->async_unlink_conflict_lock);
+
+ spin_lock(&dentry->d_lock);
+- di->flags &= ~CEPH_DENTRY_ASYNC_UNLINK;
+- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_UNLINK_BIT);
++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_UNLINK_BIT, &di->flags);
+ spin_unlock(&dentry->d_lock);
+
+ synchronize_rcu();
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index e12657b4c3e04..0ec78d87519ba 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -539,8 +539,7 @@ static void wake_async_create_waiters(struct inode *inode,
+
+ spin_lock(&ci->i_ceph_lock);
+ if (ci->i_ceph_flags & CEPH_I_ASYNC_CREATE) {
+- ci->i_ceph_flags &= ~CEPH_I_ASYNC_CREATE;
+- wake_up_bit(&ci->i_ceph_flags, CEPH_ASYNC_CREATE_BIT);
++ clear_and_wake_up_bit(CEPH_ASYNC_CREATE_BIT, &ci->i_ceph_flags);
+
+ if (ci->i_ceph_flags & CEPH_I_ASYNC_CHECK_CAPS) {
+ ci->i_ceph_flags &= ~CEPH_I_ASYNC_CHECK_CAPS;
+@@ -716,8 +715,7 @@ static int ceph_finish_async_create(struct inode *dir, struct inode *inode,
+ }
+
+ spin_lock(&dentry->d_lock);
+- di->flags &= ~CEPH_DENTRY_ASYNC_CREATE;
+- wake_up_bit(&di->flags, CEPH_DENTRY_ASYNC_CREATE_BIT);
++ clear_and_wake_up_bit(CEPH_DENTRY_ASYNC_CREATE_BIT, &di->flags);
+ spin_unlock(&dentry->d_lock);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From fe01e8bc6b6361de36e05905fdc1b7913c940195 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 13:07:17 -0700
+Subject: clk: at91: clk-master: Add check for divide by 3
+
+From: Ryan Wanner <Ryan.Wanner@microchip.com>
+
+[ Upstream commit e0237f5635727d64635ec6665e1de9f4cacce35c ]
+
+A potential divider for the master clock is div/3. The register
+configuration for div/3 is MASTER_PRES_MAX. The current bit shifting
+method does not work for this case. Checking for MASTER_PRES_MAX will
+ensure the correct decimal value is stored in the system.
+
+Signed-off-by: Ryan Wanner <Ryan.Wanner@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-master.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
+index 15c46489ba850..4c87a0f789de1 100644
+--- a/drivers/clk/at91/clk-master.c
++++ b/drivers/clk/at91/clk-master.c
+@@ -580,6 +580,9 @@ clk_sama7g5_master_recalc_rate(struct clk_hw *hw,
+ {
+ struct clk_master *master = to_clk_master(hw);
+
++ if (master->div == MASTER_PRES_MAX)
++ return DIV_ROUND_CLOSEST_ULL(parent_rate, 3);
++
+ return DIV_ROUND_CLOSEST_ULL(parent_rate, (1 << master->div));
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 82a78d137bfe7286ce4c44f88f30ff71af7ee3e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:08:10 +0200
+Subject: clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit af98caeaa7b6ad11eb7b7c8bfaddc769df2889f3 ]
+
+This register is important for sequencing the commands to PLLs, so
+actually write the update bits with regmap_write_bits() instead of
+relying on a read/modify/write regmap command that could skip the actual
+hardware write if the value is identical to the one read.
+
+It's changed when modification is needed to the PLL, when
+read-only operation is done, we could keep the call to
+regmap_update_bits().
+
+Add a comment to the sam9x60_div_pll_set_div() function that uses this
+PLL_UPDT register so that it's used consistently, according to the
+product's datasheet.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Tested-by: Ryan Wanner <ryan.wanner@microchip.com> # on sama7d65 and sam9x75
+Link: https://lore.kernel.org/r/20250827150811.82496-1-nicolas.ferre@microchip.com
+[claudiu.beznea: fix "Alignment should match open parenthesis"
+ checkpatch.pl check]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-sam9x60-pll.c | 75 ++++++++++++++++--------------
+ 1 file changed, 39 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c
+index ff65f7b916f07..57d7aef1ea865 100644
+--- a/drivers/clk/at91/clk-sam9x60-pll.c
++++ b/drivers/clk/at91/clk-sam9x60-pll.c
+@@ -90,8 +90,8 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
+ cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
+ cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
+@@ -125,17 +125,17 @@ static int sam9x60_frac_pll_set(struct sam9x60_pll_core *core)
+ udelay(10);
+ }
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -161,8 +161,8 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0, AT91_PMC_PLL_CTRL0_ENPLL, 0);
+
+@@ -170,9 +170,9 @@ static void sam9x60_frac_pll_unprepare(struct clk_hw *hw)
+ regmap_update_bits(regmap, AT91_PMC_PLL_ACR,
+ AT91_PMC_PLL_ACR_UTMIBG | AT91_PMC_PLL_ACR_UTMIVR, 0);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ spin_unlock_irqrestore(core->lock, flags);
+ }
+@@ -257,8 +257,8 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+
+ spin_lock_irqsave(core->lock, irqflags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL1, &val);
+ cmul = (val & core->layout->mul_mask) >> core->layout->mul_shift;
+ cfrac = (val & core->layout->frac_mask) >> core->layout->frac_shift;
+@@ -270,18 +270,18 @@ static int sam9x60_frac_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+ (frac->mul << core->layout->mul_shift) |
+ (frac->frac << core->layout->frac_shift));
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ AT91_PMC_PLL_CTRL0_ENLOCK | AT91_PMC_PLL_CTRL0_ENPLL,
+ AT91_PMC_PLL_CTRL0_ENLOCK |
+ AT91_PMC_PLL_CTRL0_ENPLL);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -333,7 +333,10 @@ static const struct clk_ops sam9x60_frac_pll_ops_chg = {
+ .restore_context = sam9x60_frac_pll_restore_context,
+ };
+
+-/* This function should be called with spinlock acquired. */
++/* This function should be called with spinlock acquired.
++ * Warning: this function must be called only if the same PLL ID was set in
++ * PLL_UPDT register previously.
++ */
+ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
+ bool enable)
+ {
+@@ -345,9 +348,9 @@ static void sam9x60_div_pll_set_div(struct sam9x60_pll_core *core, u32 div,
+ core->layout->div_mask | ena_msk,
+ (div << core->layout->div_shift) | ena_val);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ while (!sam9x60_pll_ready(regmap, core->id))
+ cpu_relax();
+@@ -361,8 +364,8 @@ static int sam9x60_div_pll_set(struct sam9x60_pll_core *core)
+ unsigned int val, cdiv;
+
+ spin_lock_irqsave(core->lock, flags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
+
+@@ -393,15 +396,15 @@ static void sam9x60_div_pll_unprepare(struct clk_hw *hw)
+
+ spin_lock_irqsave(core->lock, flags);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_ID_MSK, core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_ID_MSK, core->id);
+
+ regmap_update_bits(regmap, AT91_PMC_PLL_CTRL0,
+ core->layout->endiv_mask, 0);
+
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT,
+- AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
+- AT91_PMC_PLL_UPDT_UPDATE | core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT,
++ AT91_PMC_PLL_UPDT_UPDATE | AT91_PMC_PLL_UPDT_ID_MSK,
++ AT91_PMC_PLL_UPDT_UPDATE | core->id);
+
+ spin_unlock_irqrestore(core->lock, flags);
+ }
+@@ -507,8 +510,8 @@ static int sam9x60_div_pll_set_rate_chg(struct clk_hw *hw, unsigned long rate,
+ div->div = DIV_ROUND_CLOSEST(parent_rate, rate) - 1;
+
+ spin_lock_irqsave(core->lock, irqflags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core->id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core->id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core->layout->div_mask) >> core->layout->div_shift;
+
+@@ -563,8 +566,8 @@ static int sam9x60_div_pll_notifier_fn(struct notifier_block *notifier,
+ div->div = div->safe_div;
+
+ spin_lock_irqsave(core.lock, irqflags);
+- regmap_update_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
+- core.id);
++ regmap_write_bits(regmap, AT91_PMC_PLL_UPDT, AT91_PMC_PLL_UPDT_ID_MSK,
++ core.id);
+ regmap_read(regmap, AT91_PMC_PLL_CTRL0, &val);
+ cdiv = (val & core.layout->div_mask) >> core.layout->div_shift;
+
+--
+2.51.0
+
--- /dev/null
+From ab5291ea1d7daa4a0a26e86dd255e68440f260fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 01:09:47 +0800
+Subject: clk: sunxi-ng: sun6i-rtc: Add A523 specifics
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 7aa8781f379c32c31bd78f1408a31765b2297c43 ]
+
+The A523's RTC block is backward compatible with the R329's, but it also
+has a calibration function for its internal oscillator, which would
+allow it to provide a clock rate closer to the desired 32.768 KHz. This
+is useful on the Radxa Cubie A5E, which does not have an external 32.768
+KHz crystal.
+
+Add new compatible-specific data for it.
+
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250909170947.2221611-1-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun6i-rtc.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
+index fdc8ccc586c99..ec1717ddaf275 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
++++ b/drivers/clk/sunxi-ng/ccu-sun6i-rtc.c
+@@ -325,6 +325,13 @@ static const struct sun6i_rtc_match_data sun50i_r329_rtc_ccu_data = {
+ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
+ };
+
++static const struct sun6i_rtc_match_data sun55i_a523_rtc_ccu_data = {
++ .have_ext_osc32k = true,
++ .have_iosc_calibration = true,
++ .osc32k_fanout_parents = sun50i_r329_osc32k_fanout_parents,
++ .osc32k_fanout_nparents = ARRAY_SIZE(sun50i_r329_osc32k_fanout_parents),
++};
++
+ static const struct of_device_id sun6i_rtc_ccu_match[] = {
+ {
+ .compatible = "allwinner,sun50i-h616-rtc",
+@@ -334,6 +341,10 @@ static const struct of_device_id sun6i_rtc_ccu_match[] = {
+ .compatible = "allwinner,sun50i-r329-rtc",
+ .data = &sun50i_r329_rtc_ccu_data,
+ },
++ {
++ .compatible = "allwinner,sun55i-a523-rtc",
++ .data = &sun55i_a523_rtc_ccu_data,
++ },
+ {},
+ };
+
+--
+2.51.0
+
--- /dev/null
+From cc4b70d8c848ad608309101382ed1e3be5b087a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 16:08:11 +0200
+Subject: clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 1e0d75258bd09323cb452655549e03975992b29e ]
+
+As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL
+can't be disabled - the clock module will just be stuck in transitioning
+state forever, resulting in the following warning message after the wait
+loop times out:
+
+ l3-aon-clkctrl:0000:0: failed to disable
+
+Just add the clock to enable_init_clks, so no attempt is made to disable
+it.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-33xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c
+index 85c50ea39e6da..9269e6a0db6a4 100644
+--- a/drivers/clk/ti/clk-33xx.c
++++ b/drivers/clk/ti/clk-33xx.c
+@@ -258,6 +258,8 @@ static const char *enable_init_clks[] = {
+ "dpll_ddr_m2_ck",
+ "dpll_mpu_m2_ck",
+ "l3_gclk",
++ /* WKUP_DEBUGSS_CLKCTRL - disable fails, AM335x Errata Advisory 1.0.42 */
++ "l3-aon-clkctrl:0000:0",
+ /* AM3_L3_L3_MAIN_CLKCTRL, needed during suspend */
+ "l3-clkctrl:00bc:0",
+ "l4hs_gclk",
+--
+2.51.0
+
--- /dev/null
+From 3da1b7547eca4caa55b68a7ec848179577adfa9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:13 -0500
+Subject: cpufreq: tegra186: Initialize all cores to max frequencies
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit ba6018929165fc914c665f071f8e8cdbac844a49 ]
+
+During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores
+are still at reset values and not reflecting the actual frequency. This
+causes get calls to fail. Set all cores to their respective max
+frequency during probe to initialize the registers to working values.
+
+Suggested-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index 39186008afbfd..233c82a834086 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -132,13 +132,14 @@ static struct cpufreq_driver tegra186_cpufreq_driver = {
+
+ static struct cpufreq_frequency_table *init_vhint_table(
+ struct platform_device *pdev, struct tegra_bpmp *bpmp,
+- struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id)
++ struct tegra186_cpufreq_cluster *cluster, unsigned int cluster_id,
++ int *num_rates)
+ {
+ struct cpufreq_frequency_table *table;
+ struct mrq_cpu_vhint_request req;
+ struct tegra_bpmp_message msg;
+ struct cpu_vhint_data *data;
+- int err, i, j, num_rates = 0;
++ int err, i, j;
+ dma_addr_t phys;
+ void *virt;
+
+@@ -168,6 +169,7 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ goto free;
+ }
+
++ *num_rates = 0;
+ for (i = data->vfloor; i <= data->vceil; i++) {
+ u16 ndiv = data->ndiv[i];
+
+@@ -178,10 +180,10 @@ static struct cpufreq_frequency_table *init_vhint_table(
+ if (i > 0 && ndiv == data->ndiv[i - 1])
+ continue;
+
+- num_rates++;
++ (*num_rates)++;
+ }
+
+- table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table),
++ table = devm_kcalloc(&pdev->dev, *num_rates + 1, sizeof(*table),
+ GFP_KERNEL);
+ if (!table) {
+ table = ERR_PTR(-ENOMEM);
+@@ -223,7 +225,9 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ {
+ struct tegra186_cpufreq_data *data;
+ struct tegra_bpmp *bpmp;
+- unsigned int i = 0, err;
++ unsigned int i = 0, err, edvd_offset;
++ int num_rates = 0;
++ u32 edvd_val, cpu;
+
+ data = devm_kzalloc(&pdev->dev,
+ struct_size(data, clusters, TEGRA186_NUM_CLUSTERS),
+@@ -246,10 +250,21 @@ static int tegra186_cpufreq_probe(struct platform_device *pdev)
+ for (i = 0; i < TEGRA186_NUM_CLUSTERS; i++) {
+ struct tegra186_cpufreq_cluster *cluster = &data->clusters[i];
+
+- cluster->table = init_vhint_table(pdev, bpmp, cluster, i);
++ cluster->table = init_vhint_table(pdev, bpmp, cluster, i, &num_rates);
+ if (IS_ERR(cluster->table)) {
+ err = PTR_ERR(cluster->table);
+ goto put_bpmp;
++ } else if (!num_rates) {
++ err = -EINVAL;
++ goto put_bpmp;
++ }
++
++ for (cpu = 0; cpu < ARRAY_SIZE(tegra186_cpus); cpu++) {
++ if (data->cpus[cpu].bpmp_cluster_id == i) {
++ edvd_val = cluster->table[num_rates - 1].driver_data;
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1e22afcf5d8eb387a89f16144ee9a46c04552684 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 03:32:09 -0400
+Subject: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
+
+From: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+
+[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
+
+Add bounds checking to prevent writes past framebuffer boundaries when
+rendering text near screen edges. Return early if the Y position is off-screen
+and clip image height to screen boundary. Break from the rendering loop if the
+X position is off-screen. When clipping image width to fit the screen, update
+the character count to match the clipped width to prevent buffer size
+mismatches.
+
+Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
+receive mismatched parameters where the buffer is allocated for the clipped
+width but cnt reflects the original larger count, causing out-of-bounds writes.
+
+Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
+Suggested-by: Helge Deller <deller@gmx.de>
+Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
+Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index a4b4e1ec702e5..8563264d11fac 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ image.height = vc->vc_font.height;
+ image.depth = 1;
+
++ if (image.dy >= info->var.yres)
++ return;
++
++ image.height = min(image.height, info->var.yres - image.dy);
++
+ if (attribute) {
+ buf = kmalloc(cellsize, GFP_ATOMIC);
+ if (!buf)
+@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ cnt = count;
+
+ image.width = vc->vc_font.width * cnt;
++
++ if (image.dx >= info->var.xres)
++ break;
++
++ if (image.dx + image.width > info->var.xres) {
++ image.width = info->var.xres - image.dx;
++ cnt = image.width / vc->vc_font.width;
++ if (cnt == 0)
++ break;
++ image.width = cnt * vc->vc_font.width;
++ }
++
+ pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
+ pitch &= ~scan_align;
+ size = pitch * image.height + buf_align;
+--
+2.51.0
+
--- /dev/null
+From ff83b707f16c2d901188f3e7e8e0d1a06c50676a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 May 2025 20:44:34 -0500
+Subject: fs/hpfs: Fix error code for new_inode() failure in
+ mkdir/create/mknod/symlink
+
+From: Yikang Yue <yikangy2@illinois.edu>
+
+[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
+
+The function call new_inode() is a primitive for allocating an inode in memory,
+rather than planning disk space for it. Therefore, -ENOMEM should be returned
+as the error code rather than -ENOSPC.
+
+To be specific, new_inode()'s call path looks like this:
+new_inode
+ new_inode_pseudo
+ alloc_inode
+ ops->alloc_inode (hpfs_alloc_inode)
+ alloc_inode_sb
+ kmem_cache_alloc_lru
+
+Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM),
+not a lack of disk space. However, the current implementation of
+hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails.
+This patch fix this by set err to -ENOMEM before the goto statement.
+
+BTW, we also noticed that other nested calls within these four functions,
+like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure.
+But similarly, only -ENOSPC is returned. Addressing these will involve code
+modifications in other functions, and we plan to submit dedicated patches for these
+issues in the future. For this patch, we focus on new_inode().
+
+Signed-off-by: Yikang Yue <yikangy2@illinois.edu>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hpfs/namei.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index f4eb8d6f59894..6cf17fe239c9a 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+ dee.fnode = cpu_to_le32(fno);
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail2;
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -153,9 +155,10 @@ static int hpfs_create(struct mnt_idmap *idmap, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ result->i_mode |= S_IFREG;
+@@ -239,9 +242,10 @@ static int hpfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
+-
++ }
+ hpfs_init_inode(result);
+ result->i_ino = fno;
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+@@ -314,8 +318,10 @@ static int hpfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
+ dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
+
+ result = new_inode(dir->i_sb);
+- if (!result)
++ if (!result) {
++ err = -ENOMEM;
+ goto bail1;
++ }
+ result->i_ino = fno;
+ hpfs_init_inode(result);
+ hpfs_i(result)->i_parent_dir = dir->i_ino;
+--
+2.51.0
+
--- /dev/null
+From ca49a2521e793856f13d2d5350ac47a9dc09abea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 14:33:42 +0200
+Subject: kbuild: uapi: Strip comments before size type check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 66128f4287b04aef4d4db9bf5035985ab51487d5 ]
+
+On m68k, check_sizetypes in headers_check reports:
+
+ ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include <linux/types.h>
+
+This header file does not use any of the Linux-specific integer types,
+but merely refers to them from comments, so this is a false positive.
+As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes()
+warning to error"), this check was promoted to an error, breaking m68k
+all{mod,yes}config builds.
+
+Fix this by stripping simple comments before looking for Linux-specific
+integer types.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org
+[nathan: Adjust comment and remove unnecessary escaping from slashes in
+ regex]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ usr/include/headers_check.pl | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/usr/include/headers_check.pl b/usr/include/headers_check.pl
+index b6aec5e4365f9..682980781eb37 100755
+--- a/usr/include/headers_check.pl
++++ b/usr/include/headers_check.pl
+@@ -160,6 +160,8 @@ sub check_sizetypes
+ if (my $included = ($line =~ /^\s*#\s*include\s+[<"](\S+)[>"]/)[0]) {
+ check_include_typesh($included);
+ }
++ # strip single-line comments, as types may be referenced within them
++ $line =~ s@/\*.*?\*/@@;
+ if ($line =~ m/__[us](8|16|32|64)\b/) {
+ printf STDERR "$filename:$lineno: " .
+ "found __[us]{8,16,32,64} type " .
+--
+2.51.0
+
--- /dev/null
+From 98241f439f89a46df9d86d1b04716dd6a6d30cc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 18:48:33 +0200
+Subject: NTB: epf: Allow arbitrary BAR mapping
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ]
+
+The NTB epf host driver assumes the BAR number associated with a memory
+window is just incremented from the BAR number associated with MW1. This
+seems to have been enough so far but this is not really how the endpoint
+side work and the two could easily become mis-aligned.
+
+ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window
+index + 2, which means the function only returns a proper result if BAR_2
+is associated with MW1.
+
+Instead, fully describe and allow arbitrary NTB BAR mapping.
+
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/epf/ntb_hw_epf.c | 103 ++++++++++++++++----------------
+ 1 file changed, 53 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
+index b640aa0bf45e6..5e79cfce8649c 100644
+--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
++++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
+@@ -49,6 +49,7 @@
+ #define NTB_EPF_COMMAND_TIMEOUT 1000 /* 1 Sec */
+
+ enum pci_barno {
++ NO_BAR = -1,
+ BAR_0,
+ BAR_1,
+ BAR_2,
+@@ -57,16 +58,26 @@ enum pci_barno {
+ BAR_5,
+ };
+
++enum epf_ntb_bar {
++ BAR_CONFIG,
++ BAR_PEER_SPAD,
++ BAR_DB,
++ BAR_MW1,
++ BAR_MW2,
++ BAR_MW3,
++ BAR_MW4,
++ NTB_BAR_NUM,
++};
++
++#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1)
++
+ struct ntb_epf_dev {
+ struct ntb_dev ntb;
+ struct device *dev;
+ /* Mutex to protect providing commands to NTB EPF */
+ struct mutex cmd_lock;
+
+- enum pci_barno ctrl_reg_bar;
+- enum pci_barno peer_spad_reg_bar;
+- enum pci_barno db_reg_bar;
+- enum pci_barno mw_bar;
++ const enum pci_barno *barno_map;
+
+ unsigned int mw_count;
+ unsigned int spad_count;
+@@ -85,17 +96,6 @@ struct ntb_epf_dev {
+
+ #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb)
+
+-struct ntb_epf_data {
+- /* BAR that contains both control region and self spad region */
+- enum pci_barno ctrl_reg_bar;
+- /* BAR that contains peer spad region */
+- enum pci_barno peer_spad_reg_bar;
+- /* BAR that contains Doorbell region and Memory window '1' */
+- enum pci_barno db_reg_bar;
+- /* BAR that contains memory windows*/
+- enum pci_barno mw_bar;
+-};
+-
+ static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command,
+ u32 argument)
+ {
+@@ -144,7 +144,7 @@ static int ntb_epf_mw_to_bar(struct ntb_epf_dev *ndev, int idx)
+ return -EINVAL;
+ }
+
+- return idx + 2;
++ return ndev->barno_map[BAR_MW1 + idx];
+ }
+
+ static int ntb_epf_mw_count(struct ntb_dev *ntb, int pidx)
+@@ -413,7 +413,9 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx,
+ return -EINVAL;
+ }
+
+- bar = idx + ndev->mw_bar;
++ bar = ntb_epf_mw_to_bar(ndev, idx);
++ if (bar < 0)
++ return bar;
+
+ mw_size = pci_resource_len(ntb->pdev, bar);
+
+@@ -455,7 +457,9 @@ static int ntb_epf_peer_mw_get_addr(struct ntb_dev *ntb, int idx,
+ if (idx == 0)
+ offset = readl(ndev->ctrl_reg + NTB_EPF_MW1_OFFSET);
+
+- bar = idx + ndev->mw_bar;
++ bar = ntb_epf_mw_to_bar(ndev, idx);
++ if (bar < 0)
++ return bar;
+
+ if (base)
+ *base = pci_resource_start(ndev->ntb.pdev, bar) + offset;
+@@ -560,6 +564,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev)
+ ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT);
+ ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT);
+
++ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) {
++ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count);
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
+@@ -596,14 +605,15 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
+ dev_warn(&pdev->dev, "Cannot DMA highmem\n");
+ }
+
+- ndev->ctrl_reg = pci_iomap(pdev, ndev->ctrl_reg_bar, 0);
++ ndev->ctrl_reg = pci_iomap(pdev, ndev->barno_map[BAR_CONFIG], 0);
+ if (!ndev->ctrl_reg) {
+ ret = -EIO;
+ goto err_pci_regions;
+ }
+
+- if (ndev->peer_spad_reg_bar) {
+- ndev->peer_spad_reg = pci_iomap(pdev, ndev->peer_spad_reg_bar, 0);
++ if (ndev->barno_map[BAR_PEER_SPAD] != ndev->barno_map[BAR_CONFIG]) {
++ ndev->peer_spad_reg = pci_iomap(pdev,
++ ndev->barno_map[BAR_PEER_SPAD], 0);
+ if (!ndev->peer_spad_reg) {
+ ret = -EIO;
+ goto err_pci_regions;
+@@ -614,7 +624,7 @@ static int ntb_epf_init_pci(struct ntb_epf_dev *ndev,
+ ndev->peer_spad_reg = ndev->ctrl_reg + spad_off + spad_sz;
+ }
+
+- ndev->db_reg = pci_iomap(pdev, ndev->db_reg_bar, 0);
++ ndev->db_reg = pci_iomap(pdev, ndev->barno_map[BAR_DB], 0);
+ if (!ndev->db_reg) {
+ ret = -EIO;
+ goto err_pci_regions;
+@@ -659,12 +669,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev)
+ static int ntb_epf_pci_probe(struct pci_dev *pdev,
+ const struct pci_device_id *id)
+ {
+- enum pci_barno peer_spad_reg_bar = BAR_1;
+- enum pci_barno ctrl_reg_bar = BAR_0;
+- enum pci_barno db_reg_bar = BAR_2;
+- enum pci_barno mw_bar = BAR_2;
+ struct device *dev = &pdev->dev;
+- struct ntb_epf_data *data;
+ struct ntb_epf_dev *ndev;
+ int ret;
+
+@@ -675,18 +680,10 @@ static int ntb_epf_pci_probe(struct pci_dev *pdev,
+ if (!ndev)
+ return -ENOMEM;
+
+- data = (struct ntb_epf_data *)id->driver_data;
+- if (data) {
+- peer_spad_reg_bar = data->peer_spad_reg_bar;
+- ctrl_reg_bar = data->ctrl_reg_bar;
+- db_reg_bar = data->db_reg_bar;
+- mw_bar = data->mw_bar;
+- }
++ ndev->barno_map = (const enum pci_barno *)id->driver_data;
++ if (!ndev->barno_map)
++ return -EINVAL;
+
+- ndev->peer_spad_reg_bar = peer_spad_reg_bar;
+- ndev->ctrl_reg_bar = ctrl_reg_bar;
+- ndev->db_reg_bar = db_reg_bar;
+- ndev->mw_bar = mw_bar;
+ ndev->dev = dev;
+
+ ntb_epf_init_struct(ndev, pdev);
+@@ -730,30 +727,36 @@ static void ntb_epf_pci_remove(struct pci_dev *pdev)
+ ntb_epf_deinit_pci(ndev);
+ }
+
+-static const struct ntb_epf_data j721e_data = {
+- .ctrl_reg_bar = BAR_0,
+- .peer_spad_reg_bar = BAR_1,
+- .db_reg_bar = BAR_2,
+- .mw_bar = BAR_2,
++static const enum pci_barno j721e_map[NTB_BAR_NUM] = {
++ [BAR_CONFIG] = BAR_0,
++ [BAR_PEER_SPAD] = BAR_1,
++ [BAR_DB] = BAR_2,
++ [BAR_MW1] = BAR_2,
++ [BAR_MW2] = BAR_3,
++ [BAR_MW3] = BAR_4,
++ [BAR_MW4] = BAR_5
+ };
+
+-static const struct ntb_epf_data mx8_data = {
+- .ctrl_reg_bar = BAR_0,
+- .peer_spad_reg_bar = BAR_0,
+- .db_reg_bar = BAR_2,
+- .mw_bar = BAR_4,
++static const enum pci_barno mx8_map[NTB_BAR_NUM] = {
++ [BAR_CONFIG] = BAR_0,
++ [BAR_PEER_SPAD] = BAR_0,
++ [BAR_DB] = BAR_2,
++ [BAR_MW1] = BAR_4,
++ [BAR_MW2] = BAR_5,
++ [BAR_MW3] = NO_BAR,
++ [BAR_MW4] = NO_BAR
+ };
+
+ static const struct pci_device_id ntb_epf_pci_tbl[] = {
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E),
+ .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
+- .driver_data = (kernel_ulong_t)&j721e_data,
++ .driver_data = (kernel_ulong_t)j721e_map,
+ },
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x0809),
+ .class = PCI_CLASS_MEMORY_RAM << 8, .class_mask = 0xffff00,
+- .driver_data = (kernel_ulong_t)&mx8_data,
++ .driver_data = (kernel_ulong_t)mx8_map,
+ },
+ { },
+ };
+--
+2.51.0
+
--- /dev/null
+From 592edabbfcff23df29cd441b983a21f9bb58457b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 19:54:09 +0200
+Subject: rtc: pcf2127: clear minute/second interrupt
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit a6f1a4f05970664004a9370459c6799c1b2f2dcf ]
+
+PCF2127 can generate interrupt every full second or minute configured
+from control and status register 1, bits MI (1) and SI (0).
+
+On interrupt control register 2 bit MSF (7) is set and must be cleared
+to continue normal operation.
+
+While the driver never enables this interrupt on its own, users or
+firmware may do so - e.g. as an easy way to test the interrupt.
+
+Add preprocessor definition for MSF bit and include it in the irq
+bitmask to ensure minute and second interrupts are cleared when fired.
+
+This fixes an issue where the rtc enters a test mode and becomes
+unresponsive after a second interrupt has fired and is not cleared in
+time. In this state register writes to control registers have no
+effect and the interrupt line is kept asserted [1]:
+
+[1] userspace commands to put rtc into unresponsive state:
+$ i2cget -f -y 2 0x51 0x00
+0x04
+$ i2cset -f -y 2 0x51 0x00 0x05 # set bit 0 SI
+$ i2cget -f -y 2 0x51 0x00
+0x84 # bit 8 EXT_TEST set
+$ i2cset -f -y 2 0x51 0x00 0x05 # try overwrite control register
+$ i2cget -f -y 2 0x51 0x00
+0x84 # no change
+
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20250825-rtc-irq-v1-1-0133319406a7@solid-run.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 502571f0c203f..e793c019fb9d7 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -41,6 +41,7 @@
+ #define PCF2127_BIT_CTRL2_AF BIT(4)
+ #define PCF2127_BIT_CTRL2_TSF2 BIT(5)
+ #define PCF2127_BIT_CTRL2_WDTF BIT(6)
++#define PCF2127_BIT_CTRL2_MSF BIT(7)
+ /* Control register 3 */
+ #define PCF2127_REG_CTRL3 0x02
+ #define PCF2127_BIT_CTRL3_BLIE BIT(0)
+@@ -94,7 +95,8 @@
+ #define PCF2127_CTRL2_IRQ_MASK ( \
+ PCF2127_BIT_CTRL2_AF | \
+ PCF2127_BIT_CTRL2_WDTF | \
+- PCF2127_BIT_CTRL2_TSF2)
++ PCF2127_BIT_CTRL2_TSF2 | \
++ PCF2127_BIT_CTRL2_MSF)
+
+ #define PCF2127_MAX_TS_SUPPORTED 4
+
+--
+2.51.0
+
--- /dev/null
+From d688e21d195ca8e543124e016cf4067b5ac09d7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 20:22:35 +0200
+Subject: rtc: pcf2127: fix watchdog interrupt mask on pcf2131
+
+From: Bruno Thomsen <bruno.thomsen@gmail.com>
+
+[ Upstream commit 87064da2db7be537a7da20a25c18ba912c4db9e1 ]
+
+When using interrupt pin (INT A) as watchdog output all other
+interrupt sources need to be disabled to avoid additional
+resets. Resulting INT_A_MASK1 value is 55 (0x37).
+
+Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20250902182235.6825-1-bruno.thomsen@gmail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index e793c019fb9d7..05a54f4d4d9a6 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -528,6 +528,21 @@ static int pcf2127_watchdog_init(struct device *dev, struct pcf2127 *pcf2127)
+ set_bit(WDOG_HW_RUNNING, &pcf2127->wdd.status);
+ }
+
++ /*
++ * When using interrupt pin (INT A) as watchdog output, only allow
++ * watchdog interrupt (PCF2131_BIT_INT_WD_CD) and disable (mask) all
++ * other interrupts.
++ */
++ if (pcf2127->cfg->type == PCF2131) {
++ ret = regmap_write(pcf2127->regmap,
++ PCF2131_REG_INT_A_MASK1,
++ PCF2131_BIT_INT_BLIE |
++ PCF2131_BIT_INT_BIE |
++ PCF2131_BIT_INT_AIE |
++ PCF2131_BIT_INT_SI |
++ PCF2131_BIT_INT_MI);
++ }
++
+ return devm_watchdog_register_device(dev, &pcf2127->wdd);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b8cb0c828d7e07e2865638218ac6b0365f260e97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:14:28 +0900
+Subject: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
+
+From: Hoyoung Seo <hy50.seo@samsung.com>
+
+[ Upstream commit 558ae4579810fa0fef011944230c65a6f3087f85 ]
+
+When a UTP error occurs in isolation, UFS is not currently recoverable.
+This is because the UTP error is not considered fatal in the error
+handling code, leading to either an I/O timeout or an OCS error.
+
+Add the UTP error flag to INT_FATAL_ERRORS so the controller will be
+reset in this situation.
+
+ sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07
+ driverbyte=DRIVER_OK cmd_age=0s
+ sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00
+ I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg
+ 8 prio class 2
+ OCS error from controller = 9 for tag 39
+ pa_err[1] = 0x80000010 at 2667224756 us
+ pa_err: total cnt=2
+ dl_err[0] = 0x80000002 at 2667148060 us
+ dl_err[1] = 0x80002000 at 2667282844 us
+ No record of nl_err
+ No record of tl_err
+ No record of dme_err
+ No record of auto_hibern8_err
+ fatal_err[0] = 0x804 at 2667282836 us
+
+ ---------------------------------------------------
+ REGISTER
+ ---------------------------------------------------
+ NAME OFFSET VALUE
+ STD HCI SFR 0xfffffff0 0x0
+ AHIT 0x18 0x814
+ INTERRUPT STATUS 0x20 0x1000
+ INTERRUPT ENABLE 0x24 0x70ef5
+
+[mkp: commit desc]
+
+Signed-off-by: Hoyoung Seo <hy50.seo@samsung.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/ufs/ufshci.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/ufs/ufshci.h b/include/ufs/ufshci.h
+index ae93b30d25893..725437f02b1fa 100644
+--- a/include/ufs/ufshci.h
++++ b/include/ufs/ufshci.h
+@@ -182,6 +182,7 @@ static inline u32 ufshci_version(u32 major, u32 minor)
+ #define UTP_TASK_REQ_COMPL 0x200
+ #define UIC_COMMAND_COMPL 0x400
+ #define DEVICE_FATAL_ERROR 0x800
++#define UTP_ERROR 0x1000
+ #define CONTROLLER_FATAL_ERROR 0x10000
+ #define SYSTEM_BUS_FATAL_ERROR 0x20000
+ #define CRYPTO_ENGINE_FATAL_ERROR 0x40000
+@@ -201,7 +202,8 @@ static inline u32 ufshci_version(u32 major, u32 minor)
+ CONTROLLER_FATAL_ERROR |\
+ SYSTEM_BUS_FATAL_ERROR |\
+ CRYPTO_ENGINE_FATAL_ERROR |\
+- UIC_LINK_LOST)
++ UIC_LINK_LOST |\
++ UTP_ERROR)
+
+ /* HCS - Host Controller Status 30h */
+ #define DEVICE_PRESENT 0x1
+--
+2.51.0
+
rdma-hns-fix-the-modification-of-max_send_sge.patch
rdma-hns-fix-wrong-wqe-data-when-qp-wraps-around.patch
btrfs-mark-dirty-extent-range-for-out-of-bound-preal.patch
+fs-hpfs-fix-error-code-for-new_inode-failure-in-mkdi.patch
+um-fix-help-message-for-ssl-non-raw.patch
+clk-sunxi-ng-sun6i-rtc-add-a523-specifics.patch
+rtc-pcf2127-clear-minute-second-interrupt.patch
+arm-at91-pm-save-and-restore-acr-during-pll-disable-.patch
+clk-at91-clk-master-add-check-for-divide-by-3.patch
+clk-at91-clk-sam9x60-pll-force-write-to-pll_updt-reg.patch
+clk-ti-am33xx-keep-wkup_debugss_clkctrl-enabled.patch
+ntb-epf-allow-arbitrary-bar-mapping.patch
+9p-fix-sys-fs-9p-caches-overwriting-itself.patch
+cpufreq-tegra186-initialize-all-cores-to-max-frequen.patch
+9p-sysfs_init-don-t-hardcode-error-to-enomem.patch
+scsi-ufs-core-include-utp-error-in-int_fatal_errors.patch
+acpi-property-return-present-device-nodes-only-on-fw.patch
+tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch
+tools-lib-thermal-don-t-preserve-owner-in-install.patch
+tools-lib-thermal-use-pkg-config-to-locate-libnl3.patch
+fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch
+rtc-pcf2127-fix-watchdog-interrupt-mask-on-pcf2131.patch
+kbuild-uapi-strip-comments-before-size-type-check.patch
+asoc-meson-aiu-encoder-i2s-fix-bit-clock-polarity.patch
+ceph-add-checking-of-wait_for_completion_killable-re.patch
+ceph-refactor-wake_up_bit-pattern-of-calling.patch
--- /dev/null
+From acfc8b70d8a0b72c6f569a73862e410072fdeace Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:47:06 -0700
+Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
+
+small_const_nbits is defined in asm-generic/bitsperlong.h which
+bitmap.h uses but doesn't include causing build failures in some build
+systems. Add the missing #include.
+
+Note the bitmap.h in tools has diverged from that of the kernel, so no
+changes are made there.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Yury Norov <yury.norov@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: André Almeida <andrealmeid@igalia.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Ido Schimmel <idosch@nvidia.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Jason Xing <kerneljasonxing@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Maurice Lambert <mauricelambert434@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Petr Machata <petrm@nvidia.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yuyang Huang <yuyanghuang@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/bitmap.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
+index 210c13b1b8570..926f3117d8e4f 100644
+--- a/tools/include/linux/bitmap.h
++++ b/tools/include/linux/bitmap.h
+@@ -3,6 +3,7 @@
+ #define _TOOLS_LINUX_BITMAP_H
+
+ #include <string.h>
++#include <asm-generic/bitsperlong.h>
+ #include <linux/align.h>
+ #include <linux/bitops.h>
+ #include <linux/find.h>
+--
+2.51.0
+
--- /dev/null
+From 63c0d237ada4355700b6d4217f878558c88cb413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:40:56 +0200
+Subject: tools: lib: thermal: don't preserve owner in install
+
+From: Emil Dahl Juhl <juhl.emildahl@gmail.com>
+
+[ Upstream commit 1375152bb02ab2a8435e87ea27034482dbc95f57 ]
+
+Instead of preserving mode, timestamp, and owner, for the object files
+during installation, just preserve the mode and timestamp.
+
+When installing as root, the installed files should be owned by root.
+When installing as user, --preserve=ownership doesn't work anyway. This
+makes --preserve=ownership rather pointless.
+
+Signed-off-by: Emil Dahl Juhl <juhl.emildahl@gmail.com>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
+index 8890fd57b110c..1694889847caf 100644
+--- a/tools/lib/thermal/Makefile
++++ b/tools/lib/thermal/Makefile
+@@ -147,7 +147,7 @@ endef
+ install_lib: libs
+ $(call QUIET_INSTALL, $(LIBTHERMAL_ALL)) \
+ $(call do_install_mkdir,$(libdir_SQ)); \
+- cp -fpR $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
++ cp -fR --preserve=mode,timestamp $(LIBTHERMAL_ALL) $(DESTDIR)$(libdir_SQ)
+
+ install_headers:
+ $(call QUIET_INSTALL, headers) \
+--
+2.51.0
+
--- /dev/null
+From 6ec5597c90b732401168f56227f4f6968466bb77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 13:40:55 +0200
+Subject: tools: lib: thermal: use pkg-config to locate libnl3
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit b31f7f725cd932e2c2b41f3e4b66273653953687 ]
+
+To make libthermal more cross compile friendly use pkg-config to locate
+libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/Makefile | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/thermal/Makefile b/tools/lib/thermal/Makefile
+index 1694889847caf..8d21ea1950a31 100644
+--- a/tools/lib/thermal/Makefile
++++ b/tools/lib/thermal/Makefile
+@@ -59,8 +59,12 @@ else
+ CFLAGS := -g -Wall
+ endif
+
++NL3_CFLAGS = $(shell pkg-config --cflags libnl-3.0 2>/dev/null)
++ifeq ($(NL3_CFLAGS),)
++NL3_CFLAGS = -I/usr/include/libnl3
++endif
++
+ INCLUDES = \
+--I/usr/include/libnl3 \
+ -I$(srctree)/tools/lib/thermal/include \
+ -I$(srctree)/tools/lib/ \
+ -I$(srctree)/tools/include \
+@@ -72,6 +76,7 @@ INCLUDES = \
+ override CFLAGS += $(EXTRA_WARNINGS)
+ override CFLAGS += -Werror -Wall
+ override CFLAGS += -fPIC
++override CFLAGS += $(NL3_CFLAGS)
+ override CFLAGS += $(INCLUDES)
+ override CFLAGS += -fvisibility=hidden
+ override CFGLAS += -Wl,-L.
+--
+2.51.0
+
--- /dev/null
+From ca9d8e4cc179a367b435cf264c86b45c51d3b7e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 08:56:59 +0800
+Subject: um: Fix help message for ssl-non-raw
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ]
+
+Add the missing option name in the help message. Additionally,
+switch to __uml_help(), because this is a global option rather
+than a per-channel option.
+
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/ssl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
+index 277cea3d30eb5..8006a5bd578c2 100644
+--- a/arch/um/drivers/ssl.c
++++ b/arch/um/drivers/ssl.c
+@@ -199,4 +199,7 @@ static int ssl_non_raw_setup(char *str)
+ return 1;
+ }
+ __setup("ssl-non-raw", ssl_non_raw_setup);
+-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode");
++__uml_help(ssl_non_raw_setup,
++"ssl-non-raw\n"
++" Set serial lines to non-raw mode.\n\n"
++);
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
